1

Is there any way to determine which daemons are logging to a specific syslog facility? (spec. rsyslog)

What I am specifically looking for is who logs to the auth.* severities.

A 2001 audit for netbsd syslog.

atrun(8)    cron.err pid        fatal errors

chat(8)     local2.err pid ndelay   fatal errors
            local2.info     -v output

comsat(8)   daemon.err pid      fatal errors
            daemon.info     log biffs (-l)
            daemon.debug        debug notices (if debug != 0)
            auth.notice     / in tty name (might be incorrect code)

cron(8)     cron.info pid       commands executed
voretaq7
  • 80,391
mikewaters
  • 1,215
  • 1
  • 15
  • 27

2 Answers2

2

There's no way to determine this a priori. That is, you can't usefully inspect a binary and figure out which facility it's going to use.

You only real option is to analyze the logs and see which processes are logging to which facility. You can make this easier by having rsyslogd either (a) log each facility to a separate file or (b) include the facility name in log messages (I think rsyslog will let you do this).

larsks
  • 44,886
  • 15
  • 124
  • 183
  • rsyslogd (in fact every syslog I've ever used) does let you separate by facility and priority level if you set up syslog.conf to do so. If you're looking for something to replace standard syslog though I'd suggest syslog-ng -- Vastly superior in nearly every way IMHO. – voretaq7 Jun 23 '11 at 18:57
  • The caveat was for (b), not (a). Even stock syslog will let you separate messages by facility and level. I've worked extensively with syslog-ng, which allows you to specify the format of log messages (so, for example, you can include the facility and level name in the message). I don't know off the top of my head if rsyslog can do this or not. – larsks Jun 23 '11 at 18:59
  • ah, that I know rsyslogd can do (Its message formats are almost as customizable as syslog-ng, you just can't do the cool stuff like launching scripts by regex match (AFAIK). – voretaq7 Jun 23 '11 at 19:04
1

"Not Really" -- Any daemon can send messages to any log facility (if syslog is listening on a network socket you can usually add "from any host" to that as well). Config files for various daemons is your best bet.

Most daemons are good about putting their name in their logs -- You may be able to do this by process of elimination if yours is one of the ones that doesn't. auth.* is also usually authentication-related stuff (logins/passwords), so you may be able to narrow the field further...

voretaq7
  • 80,391