Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In /etc/syslog.conf

#ident  "@(#)syslog.conf        1.5     98/12/14 SMI"   /* SunOS 5.0 */
# Copyright (c) 1991-1998 by Sun Microsystems, Inc.
# All rights reserved.
# syslog configuration file.
# This file is processed by m4 so be careful to quote (`') names
# that match m4 reserved words.  Also, within ifdef's, arguments
# containing commas must be quoted.
*.err;kern.notice;auth.notice                   /dev/sysmsg
*.err;kern.debug;daemon.notice;mail.crit        /var/adm/messages

*.alert;kern.err;daemon.err                     operator
*.alert                                         root

*.emerg                                         *

# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice                    ifdef(`LOGHOST', /var/log/authlog, @loghost)

mail.debug                      ifdef(`LOGHOST', /var/log/syslog, @loghost)

# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
ifdef(`LOGHOST', ,
user.err                                        /dev/sysmsg
user.err                                        /var/adm/messages
user.alert                                      `root, operator'
user.emerg                                      *

I googled some and it seems that root and operator mean email to root and to operator. Is this correct?

share|improve this question
up vote 2 down vote accepted

A couple additions to lain's answer. You won't see the root messages if you su to root. The tty actually has to be owned by root which you can check like this:

ls -l `tty`

The "operator" isn't an actual user but sends the log messages to the console. You can't always see the console these days because the GUI runs on top of it. You can open a console window by running this as root:

xterm -C

A lot of this stuff is historic now when we commonly had serial consoles on the servers monitored by operators. You can see the things logged are to show kernel errors probably caused by failing hardware and server process failures.

share|improve this answer
Thank you for that clarification. Were any of those serial consoles printed with a typewriter machine? :) – George Bailey Dec 29 '10 at 0:03
It's funny you should ask because we did have one that went to a printer. That way someone would have to actually break into the computer room to get rid of the logs. – JOTN Jan 4 '11 at 14:29

The user.alert messages will be sent to terminals on which the root user and the operator user are logged in to. Here is the syslog.conf man page

bash-3.00# logger -p user.alert "Test"
Dec 28 22:40:26 solbase root: [ID 702911 user.alert] Test
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.