Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there any way to determine which daemons are logging to a specific syslog facility? (spec. rsyslog)

What I am specifically looking for is who logs to the auth.* severities.

A 2001 audit for netbsd syslog.

atrun(8)    cron.err pid        fatal errors

chat(8)     local2.err pid ndelay   fatal errors
            local2.info     -v output

comsat(8)   daemon.err pid      fatal errors
            daemon.info     log biffs (-l)
            daemon.debug        debug notices (if debug != 0)
            auth.notice     / in tty name (might be incorrect code)

cron(8)     cron.info pid       commands executed
share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

There's no way to determine this a priori. That is, you can't usefully inspect a binary and figure out which facility it's going to use.

You only real option is to analyze the logs and see which processes are logging to which facility. You can make this easier by having rsyslogd either (a) log each facility to a separate file or (b) include the facility name in log messages (I think rsyslog will let you do this).

share|improve this answer
    
rsyslogd (in fact every syslog I've ever used) does let you separate by facility and priority level if you set up syslog.conf to do so. If you're looking for something to replace standard syslog though I'd suggest syslog-ng -- Vastly superior in nearly every way IMHO. –  voretaq7 Jun 23 '11 at 18:57
    
The caveat was for (b), not (a). Even stock syslog will let you separate messages by facility and level. I've worked extensively with syslog-ng, which allows you to specify the format of log messages (so, for example, you can include the facility and level name in the message). I don't know off the top of my head if rsyslog can do this or not. –  larsks Jun 23 '11 at 18:59
    
ah, that I know rsyslogd can do (Its message formats are almost as customizable as syslog-ng, you just can't do the cool stuff like launching scripts by regex match (AFAIK). –  voretaq7 Jun 23 '11 at 19:04
    
thanks for the wistful recollection of studying Kant! –  mikewaters Jun 23 '11 at 20:48
add comment

"Not Really" -- Any daemon can send messages to any log facility (if syslog is listening on a network socket you can usually add "from any host" to that as well). Config files for various daemons is your best bet.

Most daemons are good about putting their name in their logs -- You may be able to do this by process of elimination if yours is one of the ones that doesn't. auth.* is also usually authentication-related stuff (logins/passwords), so you may be able to narrow the field further...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.