[Techtalk] syslog question

[John Clarke]

On Wed, Jan 09, 2008 at 11:56:14 +0000, Conor Daly wrote:
> On Wed, Jan 09, 2008 at 12:47:01PM -0800 or so it is rumoured hereabouts, 
> Maria McKinley thought:
> > For some reason I am having difficulty finding the answer to this simple 
> > question. Where is it set which local in syslog belongs to which process?
> 
> This is pretty much wild speculation but I think it's the case that the
> _process_ registers localx with the kernel or with syslog rather than
> syslog assigning localx to the process.  Within syslog.conf, you can then
> tell syslog what to do with localx output.

That's correct.  A program opens syslog like this:

        openlog("tsld", LOG_PID | LOG_NOWAIT, LOG_DAEMON);

then writes to it like this:

        syslog(LOG_DAEMON | LOG_NOTICE, "daemon started\n");

The facility specified in the openlog() call is the default to use if
none is given in subsequent syslog() calls (i.e. if LOG_DAEMON wasn't
included).

As a user, you can only control where the various facility messages are
logged via syslog.conf.  Some programs may give you the ability to change
the facility they use to log messages, but many (most?) don't.

> I'm not sure if more than one process can register localx or does each

The various facilities are available to all programs, and there's no
limit to the number of programs that can use each one.  It wouldn't
be much use if there was a limit; there are only a limited number
available and there's no limit to the number of programs that might
want to use syslog.

> Conor (guessing wildly...)

And accurately :-)


Cheers,

John
-- 
I am, too. I think that Windows "File and Printer Sharing" more properly
should be called "Bend Over, Here It Comes Again".
            -- Mike Andrews