Syslog is a standard logging facility. It collects messages of various programs and services including the kernel, and stores them, depending on setup, in a bunch of log files typically under /var/log
. In some datacenter setups there are hundreds of devices each with its own log; syslog comes in handy here too. One just sets up a dedicated syslog server which collects all the individual device logs over the network. Syslog can also save logs to databases, and other clients.
According to my /etc/syslog.conf
, default /var/log/kern.log
captures only the kernel's messages of any loglevel; i.e. the output of dmesg
.
/var/log/messages
instead aims at storing valuable, non-debug and non-critical messages. This log should be considered the "general system activity" log.
/var/log/syslog
in turn logs everything, except auth related messages.
Other insteresting standard logs managed by syslog are /var/log/auth.log
, /var/log/mail.log
.
2020 update
You may still stumble upon syslog; but the defaults have changed.
journald
has replaced syslog, in quite a big portion of systems, including Ubuntu.
This is relevant because you won't be finding /var/log/messages
that often anymore. journald
doesn't write plaintext logs — it uses its own, compressed and partially authenticated format.
Search online for e.g. journalctl cheatsheet, or just study man 8 systemd-journald
, man 1 journalctl
yourself.
Syslog and journald are, to a degree, cross-compatible; you can transport logs between them in either direction. However, you won't get plaintext logs a-la /var/log/messages
with journald; and you won't get structured (journalctl -o json-pretty
) and authenticated logging with syslog.
I noticed that my system freeze happened every time I had Firefox open - totally weird, I know. FF was at 4.x level.
But then, I was desperate to get a resolution for the system freeze problem; couldn't possibly work in the gnome-safe mode forever.
I noticed that my update-manager did not complete installation of a set of updates, and that it always stopped at the "ubufox" update.
ubufox - Ubuntu Firefox specific configuration defaults and apt support
Went into synaptic, removed ubufox, and noticed that Firefox then updated itself to 5.0. Also, a whole load of other updates happened: http://pastebin.ubuntu.com/640006/.
So, as it stands now, my machine has been functioning ok, in the regular gnome-session. Still not sure what was causing the problem, because I didn't come across some conclusive evidence.
Closing this thread, by marking this as the answer.
Best Answer
That is the default traditional format.
To output log levels in messages (technically known as priorities), you should change the default template used by
rsyslog
:open with admin privileges the file
/etc/rsyslog.conf
and add the following linesafter the line
restart the daemon, with the command:
Now you should see lines like the following:
where the first two numbers (6 and 5) represent respectively the priority and the facility, where the priority is given by
and the facilities can be seen in the
syslog(3)
man page.