What is syslog and how can I tackle problems by using it?

Question

Browsing through many Linux forums, I found that many Ubuntu geeks solve issue using syslog. They analyze it, and post the answer.

What is this syslog, and how can it help me solve problems with my system?

Answer 1

There are many software packages that can provide system logging. Ubuntu is using the package rsyslog. Its configuration files are located in /etc/rsyslog.conf and /etc/rsyslog.d/*. The configuration files define which system messages to log, which directories to store messages, and which files to record different portions of system messages. As with the majority of Unix and Linux, the system log files are recorded in the files located in the directory, /var/log/.

By examining these files, we can learn what is happening with the software on the system. For example, auth.log records user authentication events, boot.log records boot events, syslog records all messages except authentication events (in the default configuration).

To examine a log file in real time: tail -f /var/log/syslog

To find cron-related messages: grep cron /var/log/syslog

To learn more about system logging from the command line:

apropos syslog

This command, apropos, will try to return relevant manual pages for the term syslog.

It will return a reference for rsyslogd and its configuration files.

There is also a good Wikipedia article on the topic.