AIX系统日志学习笔记之二
来源：岁月联盟
时间：2012-02-18
还有一个/etc/syslog.pid文件与syslog.conf配合，syslog.pid只有一行内容，syslogd守护进程的进程ID，可以用来终止或者配置日志守护进程。
我们可以定制/etc/syslog.conf文件，可以定义系统信息的目的地，反映机制等
#cat /etc/syslog.conf
# @(#)34 1.11.2.1 src/bos/etc/syslog/syslog.conf, cmdnet,bos61N, n2011_13B1 2/21/11 04:02:04
#IBM_PROLOG_BEGIN_TAG
# This is anautomatically generated prolog.
#
# bos61Nsrc/bos/etc/syslog/syslog.conf 1.11.2.1
#
# LicensedMaterials - Property of IBM
#
# COPYRIGHTInternational Business Machines Corp. 1988,1989
# All RightsReserved
#
# US GovernmentUsers Restricted Rights - Use, duplication or
# disclosurerestricted by GSA ADP Schedule Contract with IBM Corp.
#
#IBM_PROLOG_END_TAG
#
#COMPONENT_NAME: (CMDNET) Network commands.
#
# FUNCTIONS:
#
# ORIGINS: 27
#
# (C) COPYRIGHTInternational Business Machines Corp. 1988, 1989
# All RightsReserved
# LicensedMaterials - Property of IBM
#
# US GovernmentUsers Restricted Rights - Use, duplication or
# disclosurerestricted by GSA ADP Schedule Contract with IBM Corp.
#
#/etc/syslog.conf - control output of syslogd
#
#
# Each line mustconsist of two parts:-
#
# 1) A selectorto determine the message priorities to which the
# line applies
# 2) An action.
#
# Each line cancontain an optional part:-
#
# 3) Rotation.
#
# The fieldsmust be separated by one or more tabs or spaces.
#
# format:
#
#<msg_src_list> <destination> [rotate [size <size> k|m] [files<files>] [time <time> h|d|w|m|y] [compress] [archive<archive>]]
#
# where<msg_src_list> is a semicolon separated list of<facility>.<priority>
# where:
#
#<facility> is:
# * - all (except mark)
# mark - time marks
功能可选项
# kern,user,mail,daemon, auth,... (seesyslogd(AIX Commands Reference))
#
#<priority> is one of (from high to low):
错误优先级
# emerg/panic,alert,crit,err(or),warn(ing),notice,info,debug
# (meaning all messages of this priority orhigher)
#
#<destination> is:
# /filename - log to this file
# username[,username2...] - write touser(s)
# @hostname - send to syslogd on thismachine
# * - send to all logged in users
#
# [rotate [size<size> k|m] [files <files>] [time <time> h|d|w|m|y][compress] [archive <archive>]] is:
# If <destination> is a regular fileand the word "rotate" is
# specified, then the <destination>is limited by either
# <size> or <time>, or both<size> and <time>. The <size> causes
# the <destination> to be limited to<size>, with <files> files
# kept in the rotation. The <time>causes the <destination> to be rotated after
# <time>. If both <time> and<size> are specified then logfiles
# will be rotated once the the logfilesize exceeds the <size>
# or after <time>, whichever isearlier. The rotated filenames
# are created by appending a period and anumber to <destination>,
# starting with ".0".
#
# If compress option is specified then thelogfile names will be
# generated with a ".Z"extension. The files keyword will be applicable
# to the logfiles which are currentlyunder rotation. For example
# if we specify the compress option thenonly fileis with ".Z" extension
# will be under rotation and number ofsuch files will be limited by
# <files> files. Any logfiles withan extension other than ".Z"
# will not be under the rotation schemeand thus will not be within
# the limit of <files> files.Similarly if we remove the compress
# option then the files which have beengenerated with ".Z" extension
# will no longer be the part of rotationscheme and will not be limited
# by the <files> files.
#
# The minimum size that can be specifiedis 10k, the minimum
# number of files that can be specified is2. The default
# size is 1m (meg) and the default for<files> is unlimited.
# Therefore, if only "rotate" isspecified, the log will be
# rotated with <size> = 1m.
# The compress option means that rotatedlog files that are not
# in use will be compressed.
# The archive option will save rotated logfiles that are not
# in use to <archive>.
# The default is not to rotate log files.
#
# example:
# "mailmessages, at debug or higher, go to Log file. File must exist."
# "allfacilities, at debug and higher, go to console"
# "allfacilities, at crit or higher, go to all users"
# mail.debug /usr/spool/mqueue/syslog
# *.debug /dev/console
# *.crit *
# *.debug /var/log/syslog.out rotate size 100k files 4
# *.crit /var/log/syslog.out rotate time 1d
*.info /var/adm/ras/syslog.caarotate size 1m files 10
/etc/syslog.conf可以定制系统日志的产生和输出，编辑之后需要重启syslogd,才能生效。
下面是一些基本启动和关闭的命令：
#
# lssrc -s syslogd
Subsystem Group PID Status
syslogd ras 5177376 active
# cat /etc/syslog.pid
5177376
# ps -ef | grep syslogd
root 5177376 2162834 0 Feb 01 - 0:04 /usr/sbin/syslogd
root 5898452 5767218 0 10:49:35 pts/1 0:00 grep syslogd
# stopsrc -s syslogd
0513-044 Thesyslogd Subsystem was requested to stop.
# ps -ef | grep syslogd
root 5898454 5767218 0 10:50:01 pts/1 0:00 grep syslogd
# startsrc -s syslogd
0513-059 Thesyslogd Subsystem has been started. Subsystem PID is 5898456.
# ps -ef | grep syslogd
root 5898456 2162834 0 10:50:09 - 0:00 /usr/sbin/syslogd
root 7209178 5767218 0 10:50:20 pts/1 0:00 grep syslogd
#
定制实例：www.2cto.com
1 、将调试级或以上的所有邮件功能消息记录到文件/tmp/mailsyslog，可以输入以下命令：
mail.debug /tmp/mailsyslog
其中：
mail 是功能。
debug 是优先级。
/tmp/mailsyslog 是目标。
2、将除来自邮件功能以外的所有系统消息发送到名为rigil 的主机（此处可以直接使用IP地址），可以输入以下命令：
*.debug;mail.none @rigil
其中：
* 和mail 是功能。
debug 和none 是优先级。
@rigil 是目标。
3、将来自所有功能的emerg 优先级的消息和来自邮件及守护进程的crit 及以上优先级的消息发送到用户nick 和jam，可以输入以下命令：
*.emerg;mail,daemon.crit nick, jam
其中：
*、mail 和daemon 是功能。
emerg 和crit 是优先级。
nick 和jam 是目标。
4、将所有邮件功能消息发送到所有用户的终端屏幕，可以输入以下命令：
mail.debug *
其中：
mail 是功能。
debug 是优先级。
* 是目标。
摘自 wolf
上一篇：AIX系统日志学习笔记之一
下一篇：AIX系统日志学习笔记之三
