0

Is there a way to find the syslog priority or severity of log entries using a standard unix tool?

For example I could grep for the word error in a log. But not all logs will state the word "error" should an error occur. It would be nice to find all the entries in a log that were logged at the err severity.

Obviously syslog knows these attributes but I'm not sure if this related meta data is simpled dropped once the message is written to disk, so this may not be possible.

2 Answers 2

1

Traditional syslog behavior is indeed as you say, the priority is part of the header of the syslog message and is used internally and only the timestamp, hostname and content of the message get written to disk.

That message may or may not include a textual description of the severity and there's no way to retrieve it after it is written to disk.

If you switch to a more feature rich alternative, like for instance rsyslog you get more configuration options, including templates where you could configure exactly how the events get stored, allowing you to include the priority.

1
  • Should have mentioned I was using rsyslog. Thanks for confirming the extra data is dropped unless I add it to my templates.
    – user92227
    Jan 28, 2014 at 12:19
0

By default the information is not written to disk. -- Check your syslogd documentation how to change that.

{Free,Net}BSD's syslogd takes a -v or -vv parameter to add facility and priority.

rsyslog and syslog-ng let you configure custom message templates. For example in rsyslog:

$template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%,%syslogtag%,%msg%\n"

You must log in to answer this question.