Troubleshooting System Administration Issues in Oracle^® Solaris 11.4

Extended System Logging With the rsyslogd Command

This Oracle Solaris release includes the option of installing and using the rsyslogd package for managing system logging. rsyslogd is derived from the syslogd daemon implementation, with a modular design that supports several features such as filtering, TCP, encryption, and high-precision time stamps, as well as output control.

The syslog SMF service, svc:/system/system-log:default, continues to be the default logging service. To use the rsyslog service, you need to install the rsyslog package and enable the rsyslogd service.

How to Install and Enable rsyslog

1. Check whether the rsyslog package is installed on your system.

   root@pcclone: ~$ pkg info rsyslog
   
   pkg: info: no packages matching the following patterns you specified are
   installed on the system.  Try specifying -r to query remotely:
   
      rsyslog

2. Install the package.

   root@pcclone:~$ pkg install rsyslog
              Packages to install:  3
               Services to change:  1
          Create boot environment: No
   Create backup boot environment: No
   
   DOWNLOAD                                PKGS         FILES    XFER (MB)   SPEED
   Completed                                3/3         68/68      1.7/1.7  354k/s
   
   PHASE                                          ITEMS
   Installing new actions                       147/147
   Updating package state database                 Done
   Updating package cache                           0/0
   Updating image state                            Done
   Creating fast lookup database                   Done

3. Confirm that the rsyslog service is instantiated.

   root@pcclone:~$ svcs -a | grep "system-log"
   disabled       18:27:16 svc:/system/system-log:rsyslog
   online         18:27:21 svc:/system/system-log:default
   

   This output confirms that the rsyslog instance exists but disabled.

4. Switch to the rsyslog service.

   root@pcclone:~$ svcadm disable svc:/system/system-log:default
   root@pcclone:~$ svcadm enable svc:/system/system-log:rsyslog
   root@pcclone:~$ svcs -xv

   These commands disable the default service, enable rsyslog, and report on status.

   ---

   Note - You must disable the default service first, otherwise rsyslog will not start.

   ---

Next Steps

After rsyslog is installed and enabled, you can configure syslog in the /etc/rsyslog.conf file. For more information, see the rsyslogd(8) man page.