send a message to syslog system


Text in this font/color apply to the xxxx version

logger [ -isdhV ] [-p pri | facility.level] [-n server] [-P port] [-f file] [-t tag] [-u socket]
[--] [message]

Command interface to send messages to the syslog daemon which deals with them as per /etc/syslog.conf frequently to /var/log.

Without message and -f, standard input is logged.

--priority facility.level | 0:7
Example: -p local3.info logs the message as informational in the local3 facility.
-p 9 uses emerg Default: user.notice.
facilities: cron, ftp, lpr, kern, mail, news, syslog, uucp,
auth, authpriv (for security information of a sensitive nature),security(deprecated synonym for auth),
daemon, user, local0, 1 … 6, local7
levels: emerg, panic, alert, crit, err, error, warning, warn, notice, info, debug

--file file
Log the contents of file
Ignore empty lines when processing files. (A line consisting only of whitespace is NOT considered empty).
-i include logger's PID in the message (probally not helpful)
--id[=id] id is used for the PID in the message if permitted.

use --id=$$ (PPID)

--journald[=file] systemd journal entry from file. Default:standard input.
Each line must begin with a field that is accepted by journald; see systemd.journal-fields, use MESSAGE_ID to make finding entries easy. Examples:
 logger --journald <<+++
          MESSAGE="The dogs bark, but the caravan goes on."
          CARAVAN=goes on

 logger --journald=entry.txt 
--journald ignores values of other options, such as priority. If priority is needed it must be within input, and use PRIORITY field. The simple execution of journalctl will display MESSAGE field.
Use journalctl --output json-pretty to see rest of the fields.
--msgid msgid RFC5424 MSGID field. space is not permitted in msgid.
--server server
Write to the remote syslog server instead of system log socket.
Use UDP with failover to TCP unless --udp or --tcp is specified,
--no-act no writing to system log, and removing the connection or the journal.
Used with --stderr for testing purposes.
--octet-count Use the RFC 6587 octet counting framing method for sending messages.
Default is no framing on UDP, and RFC6587 non-transparent framing (also known as octet stuffing) on TCP.
--port port
defaults to syslog for UDP and to syslog-conn for TCP , often 514 .
use UDP only. Default port from /etc/services, often 514 .
--prio-prefix Process lines in standard input that contain a decimal number within angle brackets encoding facility and level using facility * 8 + level.
facility defaults to specified by -p

Example: local0.info: facility 16 and level 6, 16*8+6 becomes <134>.

Does not affect a command-line message.
With --prio-prefix, lines without characters after prefix is ignored.

--rfc3164 <f*8+l> Mmm dd hh:mm:ss HOSTNAME pgm content BSD to submit messages to a remote server.
--rfc5424[notq|,notime,|nohost] submit messages to a remote server.
notq time-quality data is ommitted which shows whether the local clock was synchronized and the maximum number of microseconds the timestamp might be off.
The time quality is suppressed with --sd-id timeQuality .
notime implies notq) suppresses the timestamp
nohostsuppress gethostname(2) information from the message header.
The RFC 5424 protocol is the default >
stderr recives message also
--sd-id name[@digits] structured data element ID for an RFC 5424 message header. Must be before --sd-param to introduce a new element.
The number of structured data elements is unlimited.
The ID (name plus possibly @digits) is case-sensitive and uniquely identifies the type and purpose of the element.
The same ID must not exist more than once in a message.
The @digits is required for user-defined non-standardized IDs.

logger generates the timeQuality standardized element only.
RFC 5424 describes the elements origin (with parameters ip, enterpriseId, software and swVersion) and meta (with parameters sequenceId, sysUpTime and language). These element IDs may be specified without the @digits suffix.

--sd-param name="value" Structured Data element parameter, a name=value pair.
Must be after --sd-id and may be specified more than once for the same element.

      logger --rfc5424 --sd-id zoo@123               \
                       --sd-param tiger=\"hungry\"   \
                       --sd-param zebra=\"running\"  \
                       --sd-id manager@123           \
                       --sd-param onMeeting=\"yes\"  \
                       "African area status"

<13>1 2015-10-01T14:07:59.168662+02:00 ws kzak - - 
            [timeQuality tzKnown="1" isSynced="1" syncAccuracy="218616"]
            [zoo@123 tiger="hungry" zebra="running"]
            [manager@123 onMeeting="yes"] African area status

--size maxsize maximum permitted message size including the header. Default 1KiB RFC 5424 receivers can process 4KiB.
--socket-errors[=on|off|auto] Print errors about Unix socket connections.
auto logger will detect if the init process is systemd, and if so assumption is made /dev/log can be used early at boot.
Other init systems lack of /dev/log will not cause errors that is identical with messaging using openlog(3) system call.
default auto.
When errors are not enabled lost messages are not communicated and will result in success return value
TCP is used only. Default the connection is tried to the syslog-conn port defined in /etc/services, often 601.
--tag tag
Mark every line with tag. Default name of the user
--socket socket
instead of to the system log socket.
-- End the argument list. This allows the message to start with a hyphen (-).

Return value

exits 0 on success, and >0 if an error occurs.


Valid facility names(numbers) :

              authpriv   for security information of a sensitive nature
              kern (0)      cannot be generated from userspace process, automatically converted to user
              log audit(13), log alert(14)
              local0 (16)
              security (4)  deprecated synonym for auth

Valid level names(numbers) :

 emerg(0), alert(1), crit(2), err(3), warning(4), notice(5), info(6), debug(7) 
depricated: error, warn and panic
For the priority order and intended purposes of these facilities and levels, see syslog(3).


       logger System rebooted
       logger --priority local0.notice -t HOSTIDM -f /dev/idmc
       logger --server loghost.example.com System rebooted


journalctl, syslog(3), systemd.journal-fields(7)


  1. Run myUpdater.sh
  2. Send a syslog notice that it ran containing the last line of the stdout
  3. Send the log file to the syslog with a priority of info
  4. If there return code indicated a problem,
    send the stderr to syslog with priority of error
    myUpdater.sh 1> /tmp/myUpdater.log 2> /tmp/myupdater.err
     tail -n1 /tmp/myUpdater.log | logger -p local3.notice 
     logger -p local3.info -f /tmp/myUpdater.log
    if [ $rc != 0 ]; then  logger -p local3.err  -f /tmp/myUpdater.err -s 

    Use UDP datagram. Default TCP.
    not builtin syslod
    -i process id of the logger process
    -s Log the message to standard error, as well as the system log.
    -f file Enter the contents of file into the log.
    -p pri Enter the message with the specified priority.
    -p facility.level The priority may be specified numerically or as a
    facility.level pair.
    -p local3.info level in the local3 facility.
    The default is user.notice.
    -t tag tag line .
    -u socket Write to socket instead of builtin syslog routines. (port 514)
    -d Use a datagram instead of a stream connection to this socket.
    -- End of options, (allows message to start with a hyphen (-)).
    if no message is specified standard input is logged
    exits 0 on success, and >0 if an error occurs.

    logger System rebooted

    logger --priority local0.notice --tag HOSTIDM --file rootStatNotes

    For the priority order and intended purposes of these levels, See syslog(BSDactually Mac OSX ; darwin), syslogd(8)

    syslog(3), syslogd(8)

    Best Practices by Dan Gunter, Lawrence Berkeley National Laboratory

    Some implementations only include -i -s -f -p -t -u!


    Generate user.log entries : telnet logserver-host 514
    message to be logged

    enter ^] to enter command mode.

    echo '173 <165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"] An application event log entry...' | nc 6514

    Made true HTML and terse by Dennis German