什麼是syslogd
syslogd可以負責記錄系統運作中，kernel或套用程式產生的各種訊息。這些訊息被寫入到系統的紀錄檔中，讓管理人員，進行故障排除、追蹤嘗試非法入侵的使用者、進行使用者的分析等等。運作方式
kernel
kernel產生的訊息交由klogd處理，klogd再交由syslogd處理。套用程式
套用程式產生的訊息，可以在套用程式的設定檔中，改變設定參數，以決定要將套用程式產生的訊息交由syslogd處理，或是由套用程式自行處理。syslogd運作方式的設定
有二個設定檔/etc/sysconfig/syslog
# Options to syslogd
# -m 0 disables 'MARK' messages.
# -r enables logging from remote machines
# -x disables DNS lookups on messages recieved with -r
# See syslogd(8) for more details
SYSLOGD_OPTIONS="-m 0"
# Options to klogd
# -2 prints all kernel oops messages twice; once for klogd to decode, and
# once for processing with 'ksymoops'
# -x disables all klogd processing of oops messages entirely
# See klogd(8) for more details
KLOGD_OPTIONS ="-x"
#
SYSLOG_UMASK=077
# set this to a umask value to use for all log files as in umask(1).
# By default, all permissions are removed for "group" and "other".
/etc/syslog.conf
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
/etc/syslog.conf的設定檔格式
套用程式類型.記錄等級 儲存位置套用程式類型
auth
authpriv
cron
daemon
kern
lpr
mark
news
security(即auth)
syslog
user
uucp
local0~local7(使用者自訂類型)
*(所有的類型)
記錄等級(緊急程度，往下遞增，愈往下，記錄的資訊愈少)
debug
info
notice
warning
warn(即warning)
err
error(即err)
crit
alert
emerg
panic(即emerg)
none(全不記錄)
儲存位置
