Logging Messages with the Syslog Service

This chapter describes the Syslog service. It contains the following sections:

• "Overview"

• "Using Message Classes"

• "Specifying Message Log Files"

For information about starting and stopping the Syslog service, setting basic options, and controlling access to Syslog, see Chapter 2, "Configuring Services with the Cisco Service Manager."

Overview

The Syslog service receives messages from applications on the local host or from remote hosts (for example, a router or a printer) that have been configured to forward messages. Syslog directs messages to a log file. To each message that Syslog handles, it adds a timestamp, the message type keyword at the beginning of the message, and a newline at the end of the message.

---

Note The Syslog service is provided primarily for troubleshooting services of the CDDM. It does not need to be running to log messages from services included with the CDDM. Start the Syslog service only if you want to log messages from other applications or hosts on the network. The Syslog service does not implement the /dev/log interface provided by many operating systems' native Syslog servers, therefore many native services cannot log messages via the Cisco Syslog service.

---

The default message log for informational messages from the services is:

• MultiNet\log\info.log under Windows NT

• CSCOcddm/log/info.log under UNIX

The log file is found in the directory into which you installed the CDDM or the Cisco Server Suite 1000.

Caution If you use Cisco's Syslog service, messages from your operating system utilities that attempt to use the native Syslog routines are not logged. Therefore, you may not be notified about problems with your system.

Using Message Classes

Syslog forwards messages based on message class. The message class is a combination of the facility that issues the message and the priority. Table 10-1 lists the facilities and the keyword associated with each facility. Keywords local0 through local7 are for other, user-defined services. Although some of these keywords are pre-assigned to facilities, you may use them if you are not running those facilities.

Table 10-1: Syslog Message Classes

Facility	Keyword
Authorization messages	auth or security
BootP messages	bootp
Daemon (background processes) messages	daemon
Domain Name System messages	domainname
GATED (gateway messages)	gated
Kernel messages	kern
Mail utility messages	mail
Network Time Protocol (NTP) messages	ntp
User-defined service	local0
User-defined service	local1 (also used by BootP)
User-defined service	local2 (also used by BIND)
User-defined service	local3 (also used by GATED)
User-defined service	local4
User-defined service	local5 (also used by NTP)
User-defined service	local6
User-defined service	local7

Message priorities follow, listed from most severe to least severe:

• panic

• emerg

• alert

• crit

• err

• error

• warn

• warning

• notice

• info

• debug

• * (indicates all priority levels)

• none (explicitly does not log messages of the listed class)

The message class is in the form message type.priority level. You can specify multiple message classes for the same log file by separating them with a semicolon. Some examples of message classes are listed in Table 10-2.

Table  10-2: Message Class Examples

Example	Description
ntp.info	NTP messages with priority of info (informational messages).
gated.warn	GATED messages with priority of warn (warning messages).
*.debug	All messages with debug priority.
domainname.*	Domain Name Service messages of all priorities.
security.*	Authorization and security services messages of all priorities.
auth.panic;auth.emerg	Authorization and security services messages of panic and emergency priorities.
*.debug;bootp.none	All messages with debug priority, except for bootp messages.

Specifying Message Log Files

Syslog forwards system messages to different log files based on message class. To specify the log files for the different message classes:

Step 1 Start the CSM.

Step 2 Choose Syslog from the Available Services list.

Step 3 Select the Config

tab.

Step 4 Enter the message class in the format message type.priority level in the Class field.

Step 5 Enter the absolute path and file name of the log file in the Log File field. The default log files are shown in the screen for each service.

To forward messages to a log file on a different host, enter @hostname in the Log File field,

where hostname is the host where messages should be logged.

The other host must be running a Syslog daemon.

To forward system messages to a destination other than a file, in the Log File field, enter one of the parameters listed in Table 10-3.

Table 10-3: System Message Forwarding Parameters

Parameter	Destination
$DISCARD$	Causes matching messages to be thrown away.
$FILE$:filename	Designates filename as a file (for clarity).
$DBWIN$	Sends matching messages to the NT debug window (Windows NT only).
$MESSAGEBOX$	Causes matching messages to display in a pop-up message box (Windows NT only).
$EVENTLOG$	Forwards matching messages to the event log (Windows NT only).

Step 6 Click Add.

Step 7 Repeat Steps 4 through 6 until you have added all of your message classes and log files.

Step 8 Choose Save Configuration from the File menu.

Your changes take effect after you restart the Syslog service.