Sign up ×

Relevant part:

anisha@linux-trra~> sudo cat /var/log/messages
Aug 29 13:04:22 linux kernel: imklog 5.6.3, log source = /proc/kmsg started.
Aug 29 13:04:22 linux rsyslogd: [origin software="rsyslogd" swVersion="5.6.3" x-pid="1879" x-info=""] start
Aug 29 13:04:22 linux kernel: [7.585951] type=1400 audit(1346225659.436:4): apparmor="STATUS" operation="profile_load" name="/sbin/syslog-ng" pid=807 comm="apparmor_parser" Aug 29 13:04:22 linux kernel: [7.667712] type=1400 audit(1346225659.518:5): apparmor="STATUS" operation="profile_load" name="/sbin/syslogd" pid=830 comm="apparmor_parser"

I couldn't find these PIDs on my system through ps -el.

  • How do the programs automatically know that they have to send messages to RSyslog?

  • Is it that all programs dump their messages at one place, and RSyslog picks up the relevant ones?

  • Man page of Syslog says that Syslog reads its messages from a socket in /dev. So, how does it correlate with the above two points?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

By default all syslog daemons read incoming messages from: /dev/log

Additionally syslog can bind to UDP socket on port 514. See /etc/services::

$ cat /etc/services | grep syslog
syslog          514/udp

Second is mostly used for passing logs between syslog daemons. I.e. one logging server per cluster.

As a programmer you don't directly write to /dev/log but instead you call a posix function syslog::

#include <syslog.h>

void closelog(void);

In fact all higher level languages give you an abstraction layer on top of these functions.

share|improve this answer

Your Answer


