Each message is one line. A message can contain a priority code, marked by a digit in angle braces at the beginning of the line. Priorities are defined in < syslog.h >, as follows:
It is expected that the kernel will not log anything below LOG_ERR priority.
The configuration file is in two sections separated by a blank line. The first section defines files that syslog will log into. Each line contains a single digit which defines the lowest priority (highest numbered priority) that this file will receive, an optional asterisk which guarantees that something gets output at least every 20 minutes, and a pathname. The second part of the file contains a list of users that will be informed on SALERT level messages. For example, the configuration file:
5*/dev/console 8/usr/spool/adm/syslog 3/usr/adm/critical eric kridle kalashlogs all messages of priority 5 or higher onto the system console, including timing marks every 20 minutes; all messages of priority 8 or higher into the file /usr/spool/adm/syslog; and all messages of priority 3 or higher into /usr/adm/critical. The users ``eric'', ``kridle'', and ``kalash'' will be informed on any subalert messages.
The flags are:
0.5i -m Set the mark interval to N (default 20 minutes).
-f Specify an alternate configuration file.
-d Turn on debugging (if compiled in).
To bring syslog down, it should be sent a terminate signal. It logs that it is going down and then waits approximately 30 seconds for any additional messages to come in.
There are some special messages that cause control functions. ``<*>N'' sets the default message priority to N. ``<$>'' causes syslog to reconfigure (equivalent to a hangup signal). This can be used in a shell file run automatically early in the morning to truncate the log.
Syslog creates the file
/etc/syslog.pid
if possible
containing a single line
with its process id.
This can be used to kill or reconfigure
syslog. .PP
.I Syslog
can also be compiled to use
.IR mpx (2)
files instead of datagrams
if you are running V7.
In this case it creates and reads the file
/dev/log.
/etc/syslog.pid - the process id
.br
/dev/log - under V7, the mpx file
Actually, syslog is not clever enough to deal with kernel error messages in the current implementation.