The Syslog channel allows the logging server to log events to a specific syslog facility on any syslog host or to a remote syslog daemon.
It is also capable of creating localized logs. If the logging applications have localized log schema files and if those files are added to their respective Application objects, the Syslog channel can write the log files in the language designated in the Syslog Channel object.
The log schema catalogs the events that can be logged for a given application. It can also provide event descriptions and labels for the event fields. For more information, see Log Schema Files.
The logging server can use the Syslog channel to write the central data store or to create filtered log files.
IMPORTANT: On the SUSE® SLES platform, the syslog daemon must be restarted with the -r option before it can accept log events, even when logging locally.
At startup, the Syslog driver, lgdsyslg, loads each application's log schema. If a logging application has multiple language versions of its log schema, the Syslog channel loads the schema for the language designated in the Syslog Channel object.
Novell® Audit stores log schema files as attributes in their respective Application objects. For further information, see Log Schema Files.
NOTE: If the File and Syslog Channel objects reference the same language, the drivers independently load the log schema in their own memory. The only time the log schema is shared is between multiple instances of the same driver. For example, if you have two Syslog channels configured to write log files in English, the English log schema for each application is loaded only once.
When it writes events to the syslog facility, the Syslog driver uses the Event ID to look up each event in the corresponding application's log schema and then it writes the event description to the data store. If the log schema isn't available, or if there isn't a descriptive entry for the current event, the Syslog channel defaults to the following format:
$DC $TC,$SO,$NI,$NL,$NG,$N1,$N2,$SS,$ST\n
(Client Date and Time Stamp, Component, EventID, Log Level, Group ID, Value1, Value2, Text1, Text2.) See Event Variables for an explanation of each field and format variable.
Because it uses the log schema to log events, the Syslog driver is also capable of creating localized logs. If a logging application has localized log schema files and if those files are added to the Application object, the Syslog driver uses the log schema for the language designated in the Syslog Channel object to write the event descriptions.
For more information on the Syslog channel's language attribute, see Syslog Channel Configuration. For information on localized log schema files, see Log Schema Files.
A trademark symbol (®, , etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party trademark. For information on trademarks, see Legal Notices.