"If /etc/syslog.conf does not exist the syslogd daemon will output all log messages of priority info or higher to the console and to the file /etc/messages"
This does not appear to be wholey accurate though. By default it seems that audit messages generated by the local7 facility will also be logged but to /etc/logs/audit file also. Is this correct? Also, are these defaults overridden by the syslogd.comf file. For example, by default we are logging *.info to /etc/messages. If I add a line to the .confg file of
Does this override the default and enable logging of only kernel message at critical level to the messages log?
Local auditlog logging is not handled by syslog. auditlog is recorded even when syslog.conf has no corresponding entry. Whereas, you can configure remote logging of auditlog by adding special facility in syslog.conf.
🙂 Thanks for that. So it's a different daemon that handles the audit logging but it reads some config from the syslog.conf file. A little confusing but makes sense based on the tests I have been performing. In terms of the message loggin to console/file though, is the following correct:
if there is an entry relating to message loggin to messages log/console it will override the default of *.info
> if there is an entry relating to message loggin to messages log/console it will override the default of *.info
Well, it is a bit dirrerent. If you create custom syslog.conf file, syslogd works like that on other UNIX/Linux OS. No line of /dev/console destination in syslog.conf, log output of console is completely disabled. Or, if /dev/console output is defined with other facility, syslog follows as it is.
"Note: Audit log messages are more verbose than syslog messages. A typical syslog entry is a single line. A typical audit log entry is as follows: date [method of access] :START:command incoming hostname date [method of access] :IN:command "input" command being sent to filer date [method of access] :OUT: output from command (may be multiple lines) date [method of access] :END:command"
Is that the only difference between these configs?