Applications can log in two ways: according to their autonomous logic or via the system's log daemon: syslog
The syslog daemon has /etc/syslog.conf
configuration file: analyze it in order to know where logs are stored.
Usually the directory /var/log/
is used for the system logs.
Many distributions provide tools to manage and analyze the system logs.
Logrotate is a well known log rotation tool which usually is configured in the /etc/logrotate.conf
file and may have additional package-defined configurations in the /etc/logrotate.d/
directory
In order to understand what's happening on the system a brief analysys of /etc/syslog.conf is mandatory for checking the main logs positions.
Here is the basic logic used in the main Linux distro:
FEDORA logs the most relevant system messages in /var/log/messages
, the mail messages in /var/log/maillog
, the authentication attempts in /var/log/secure
.
It uses by default LogRotate and provides the useful LogWatch to monitor and analyze system logs.
The command system-logviewer
(Menu: System Tools - System Logs) is an handly graphical interface to check various logs.
MANDRAKE logs system messages in /var/log/syslog
and /var/log/messages
, mail messgaes in the directory /var/log/mail/
with different files for different logging levels, kernel messages in /var/log/kernel/
, messages from varios daemons in the directory /var/log/daemons/
, Mandrake's own configuration tools messages in /var/log/explanations
, every kind of message on the tty12 virtual console, authentication data in /var/log/auth.log
.
Interesting security related reports, not generated by syslog, but by Mandrake's own cronjob: /etc/cron.daily/msec
are placed in /var/log/security/
.
Logrotate is installed by default and supported by most of the packages.
SLACKWARE provides quite standard logging positions, with system messages in /var/log/messages
and /var/log/syslog
, mail messages in /var/log/maillog
, authentication attempts in /var/log/secure
. Logrotate is installed by default and supported by most of the packages.