How to Check Syslog in Bash on Linux

How to check syslog in Bash on Linux?

How about less /var/log/syslog?

How to view syslog in ubuntu?

Looks like you are trying to read syslog from Java, not from an interactive terminal. The text looks like a correct output, but with smashed formatting.

tail -f is good for interactive terminals.

Try cat /var/log/syslog, or just open /var/log/syslog as a file (if your process has enough permissions).

Where does linux store my syslog?

On my Ubuntu machine, I can see the output at /var/log/syslog.

On a RHEL/CentOS machine, the output is found in /var/log/messages.

This is controlled by the rsyslog service, so if this is disabled for some reason you may need to start it with systemctl start rsyslog.

As noted by others, your syslog() output would be logged by the /var/log/syslog file.

You can see system, user, and other logs at /var/log.

For more details: here's an interesting link.

What is the best way to identify which syslog daemon is running on Linux?

To the best of my knowledge, syslog-ng and rsyslog (the default) are the only ones available on RHEL. You could either probe the process space, see which process currently holds /var/log/syslog open or simply check which syslog daemon is installed (though, it's possible to have them both installed at the same time).

$ lsof /var/log/messages /var/log/syslog 2>&1 | grep syslog
$ rpm -q rsyslog syslog-ng
$ pgrep -u root syslog | xargs ps -p

How to test that a message has been sent to syslog

Probably the best method is to interpose a shared library (using LD_PRELOAD) in which you provide your own verifiable implementations of the syslog functions for the purpose of your unit tests. You don't have to let the messages go to the installed syslog daemon at all (unless you want to).

Howto: Using syslog for user created shell script

You want the logger(1) utility, available in the bsdutils package.

From the man page:

     logger - a shell command interface to the syslog(3) system log module

There's nothing that's essential to configure, just pass the switches you want. E.g.

logger -p local3.info -t myprogram "What's up, doc?"

You can now inspect wherever local3.info messages go and you will see something like this:

Jul 11 12:46:35 hostname myprogram: What's up, doc?

You only need to worry about logrotate if you need something fancier than this.

As for what log facility to use, I would use daemon for daemon messages and local for most other things. You should consult syslog(3) for the purposes of the different facilities.

How to view syslog entries since last time I looked

Linux has a wc command which can count the number of lines within a file, for example

wc -l /var/log/syslog. The bash script below stores the output of the wc -l command in a file called ./prevlinecount. Whenever you want just the new lines in a file it gets the value in ./prevlinecount and subtracts this value from a new instance of wc -l /var/log/syslog called newlinecount. Then it tails (newlinecount - prevlinecount).

#!/bin/bash
prevlinecount=`cat ./prevlinecount`
if [ -z $prevlinecount ]; then
        echo `wc -l $1 | awk '{ print $1 }' > ./prevlinecount`
        tail -n +1 $1
else
        newlinecount=`wc -l $1 | awk '{print $1}'`
        tail -n `expr $newlinecount - $prevlinecount` $1
        echo $newlinecount > ./prevlinecount
fi

beware
this is a very rudimentary script which can only keep track of one file. If you would like to extend this script to multiple files, look into associative arrays. With associative arrays you could keep track of multiple files by having the key as the filename and value being the previous line count.

beware too that over time syslog files can be archived after the file reaches a predetermined size (maybe 10MB) and this script does not account for the archival process.

how to check syslog for ubuntu docker

There is no rsyslogd installed by default, nor in this image you are using.

If you wish to utilize rsyslogd in your docker container, you should install/configure it by your self via Dockerfile first.

RUN apt-get -y install rsyslog

You will probably need supervisord as well to have all your processes started in container.

understanding syslog logs format

This is specified in the Syslog RFC:

https://www.rfc-editor.org/rfc/rfc5424#section-6.2.1

Some years ago I wrote a Shell script to calculate the numbers:

https://gist.github.com/ceving/b32d4986f43d66f252ef

---

Related Topics