The target locations for the syslog message files are defined within the /etc/syslog.conf file. You must restart the syslogd daemon whenever you make any changes to this file.

The following excerpt from the /etc/syslog.conf file shows how various events are logged by the system.

1. *.err;kern.notice;auth.notice /dev/sysmsg
2. *.err;kern.debug;daemon.notice;mail.crit /var/adm/messages
3. *.alert;kern.err;daemon.err operator
4. *.alert root
5. *.emerg *

Note: Within the /etc/syslog.conf file, use a selector level of err to indicate that all events of priority error (and higher) are logged to the target defined in the action field.

In Line 1, every error event (*.err) and all kernel and authorization facility events of level notice, which are not error conditions but might require special handling, will write a message to the /dev/sysmsg file.

In Line 2, every error event (*.err), all kernel facility events of level debug, all daemon facility events of level notice, and all critical level mail events will record a message in the /var/adm/messages file. Therefore, errors are logged to both files.

Line 3 indicates that all alert level events, including the kernel error level and daemon error level events, are sent to the user operator if this user is logged in.

Line 4 indicates that all alert level events are sent to the root user if the root user is logged in.

Line 5 indicates that any event that the system interprets as an emergency will be logged to the terminal of every logged-in user.

To alter the event logging mechanism, edit the /etc/syslog.conf file, and restart the syslogd daemon.

The syslogd daemon can be started automatically during boot or manually from the command line.

Starting the syslogd Daemon During Boot Operation

The /lib/svc/method/system-log file starts the syslogd process during each system boot.

The /etc/syslog.conf configuration file is read each time the syslogd daemon starts.

Manually Stopping and Starting the syslogd Daemon

If the configuration file has been modified, you can manually stop or start the syslogd daemon, or send it a refresh command, which causes the daemon to reread the /etc/syslog.conf file.

To stop the syslogd daemon, perform the command:

# svcadm disable svc:/system/system-log:default

To start the syslogd daemon, perform the command:

# svcadm enable svc:/system/system-log:default

To send a refresh to the syslogd daemon, perform the command:

# svcadm refresh svc:/system/system-log:default

Keywords: Event logging