why I can't get syslog message?

konvalo · October 30, 2008, 12:58am

I read Unix network programming by richard,in chap12.3,it say if call syslog() by using parameter LOG_USER,it should write a message in /var/adm/messages in Solaris,such as "connected from 10.1.1.2",example file inet/daytimetcpsrv2.c.I want to know which syslog file in FreeBSD7.0?I look for /var/log/messages,I don't find my message "connected from 10.1.1.2" in this file. Why?

My syslog.conf is follows:

# $FreeBSD: src/etc/syslog.conf,v 1.28 2005/03/12 12:31:16 glebius Exp $
#
# Spaces ARE valid field separators in this file. However,
# other nix-like systems still insist on using tabs as field
# separators. If you are sharing this file between systems, you
# may want to use only tabs as field separators here.
# Consult the syslog.conf(5) manpage.
.err;kern.warning;auth.notice;mail.crit /dev/console
.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages
security. /var/log/security
auth.info;authpriv.info /var/log/auth.log
mail.info /var/log/maillog
lpr.info /var/log/lpd-errs
ftp.info /var/log/xferlog
cron. /var/log/cron
.=debug /var/log/debug.log
.emerg *
# uncomment this to log all writes to /dev/console to /var/log/console.log
#console.info /var/log/console.log
# uncomment this to enable logging of all log messages to /var/log/all.log
# touch /var/log/all.log and chmod it to mode 600 before it will work
#*. /var/log/all.log
# uncomment this to enable logging to a remote loghost named loghost
#*. @loghost
# uncomment these if you're running inn
# news.crit /var/log/news/news.crit
# news.err /var/log/news/news.err
# news.notice /var/log/news/news.notice
!startslip
*. /var/log/slip.log
!ppp
*.* /var/log/ppp.log

Annihilannic · October 30, 2008, 9:42pm

Read the man syslog page to get a better understanding. You should log messages with both a facility (such as LOG_USER) and a level (such as LOG_NOTICE), which you provide as logical OR in the first parameter of the syslog() call. If you do not provide a level the message is ignored and discarded.

You can easily test whether syslogd is functioning properly using the logger command, e.g. logger -p user.notice "Fatal kernel error, the system's going to crash!! (Just kidding)", then check your messages file.