Linux with Operating System Concepts

source
.
priority
action
A 
source
is the type of software that might generate an activity to be logged. For instance, 
mail represents the system mailer, cron is the crontab service, and authpriv represents any 
authentication software. You can also assign specific application software to logging rules 
using the reserved sources of local0, local1, local2, …, local7. An * can be used in place of 
the source indicating any source. For instance, 
*.
priority
would indicate any event of 
the given 
priority
level as generated by any system software.
The 
priority
dictates which type of event should be logged. There are nine levels of prior-
ity: none, debug, info, notice, warning, err, crit, alert, and emerg. The meanings of these 

---

476
◾
Linux with Operating System Concepts
priorities is given in Table 11.5. Each level is progressively more urgent. Using an * for 
priority indicates that any message sent by the source no matter what level the priority is 
to be logged.
The 
action
is the location of where the log event should be sent. This is typically a file. 
The log files are text files and in most cases, they will be stored under /var/log. You can 
replace the log file with /dev/console to direct log messages to the main console window. 
Alternatively, the use of * for action causes the messages to be redirected to all open ter-
minal windows. This might be useful if you want a specific type of message to be viewed 
by all users.
The initial entries in the rsyslog.conf/syslog.conf may look like the following list.
#kern.* 
/dev/console
*.info;mail.none;authpriv.none;cron.none
/var/log/messages
authpriv.* 
/var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg 
*
uucp,news.crit
/var/log/spooler
local7.* 
/var/log/boot.log
These rules work like a nested if-then-else statement. If any message is informational 
or if mail, authpriv, or cron have a message whose priority is “none,” log those messages 
to /var/log/messages. Otherwise, if any authpriv message (other than “none”) is gener-
ated, log those messages to /var/log/secure, and so forth. The hyphen appearing before the 
log location for mail.* indicates that writing to this file does not need to be synchronized 
(messages are not necessarily written to the file in the order that they are received). In most 
cases, we want file access to be synchronized but in the case of this log file, removing the 
necessity for syncing the file may improve performance. This is an issue only because the 
maillog may be a very large file. The * used as an action for any emergency message is sent 
to all users. You should be able to interpret the rest of the rules.
TABLE 11.5 
Priority Levels for syslog.conf/rsyslog.conf