logger

send a message to syslog system

linux

Text in this font/color apply to the xxxx version

logger [ -isdhV ] [-p pri | facility.level] [-n server] [-P port] [-t tag] [-u socket] [-f file] [--] [message]

Send messages to the syslog subsystem to be processed by syslogd daemon as per /etc/syslog.conf, frequently writting them to /var/log.

Without message or -f, standard input is logged. With no stdinno message is sent.

-p
--priority facility.level | 0:7
Example: -p local3.info logs the message as informational in the local3 facility.
-p 9 uses emerg Default: user.notice.
facilities: cron, ftp, lpr, kern, mail, news, syslog, uucp,
auth, authpriv (for security information of a sensitive nature),security(deprecated synonym for auth),
daemon, user, local0, 1 … 6, local7
levels: emerg, panic, alert, crit, err, error, warning, warn, notice, info, debug

-f
--file file
Log the contents of file
-e
--skip-empty
Ignore empty lines when processing files. (A line consisting only of whitespace is NOT considered empty).
-i include logger's PID in the message (probally not helpful)
--id[=id] id is used for the PID in the message if permitted.

use --id=$$ (PPID)

--journald[=file] systemd journal entry from file. Default:standard input.
Each line must begin with a field that is accepted by journald; see systemd.journal-fields, use MESSAGE_ID to make finding entries easy. Examples:
 logger --journald <<+++
          MESSAGE_ID=67feb6ffbaf24c5cbec13c008dd72309
          MESSAGE="The dogs bark, but the caravan goes on."
          DOGS=bark
          CARAVAN=goes on
          +++

 logger --journald=entry.txt 
Ignores values of other options, such as priority. If priority is needed it must be within input, and use PRIORITY field.
journalctl displays date, time, host, subsystem, PID and message.
-- Logs begin at Fri 2023-05-26 12:29:56 EDT, end at Fri 2023-05-26 17:36:23 EDT. --
May 26 12:29:56 dapi2 kernel: Booting Linux on physical CPU 0x0
May 26 12:29:56 dapi2 kernel: Linux version 5.10.103+ (dom@buildbot) 
            (arm-linux-gnueabihf-gcc-8 (Ubuntu/Linaro 8.4.0-3ubuntu1) 8.4.0, GNU ld 
Use journalctl --output json-pretty to see all fields in JSON format.

> journalctl --output json-pretty 
{
        "_BOOT_ID" : "a7e86dd305c44ddfa2f4c3e6c4c7da7b",
        "MESSAGE" : "Booting Linux on physical CPU 0x0",
        "__REALTIME_TIMESTAMP" : "1685118596405396",
        "SYSLOG_FACILITY" : "0",
        "SYSLOG_IDENTIFIER" : "kernel",
        "_MACHINE_ID" : "441e2a1e206a466b85d885e373ab55cb",
        "_TRANSPORT" : "kernel",
        "_SOURCE_MONOTONIC_TIMESTAMP" : "0",
        "__MONOTONIC_TIMESTAMP" : "9505538",
        "PRIORITY" : "6",
        "__CURSOR" : "s=1db414a2fe154f858805d0aa7e43f5e5;i=1;b=a7e86dd305c44ddfa2f4c3e6c4c7da7b;
                      m=910b02;t=5fc9b3f57d894;x=79e2e00fcd03cde9"
        "_HOSTNAME" : "dapi2"
}
{
        "_MACHINE_ID" : "441e2a1e206a466b85d885e373ab55cb",
        "_HOSTNAME" : "dapi2",
        "__MONOTONIC_TIMESTAMP" : "9506773",
        "__REALTIME_TIMESTAMP" : "1685118596406636",
        "PRIORITY" : "5",
        "_BOOT_ID" : "a7e86dd305c44ddfa2f4c3e6c4c7da7b",
        "__CURSOR" : "s=1db414a2fe154f858805d0aa7e43f5e5;i=2;b=a7e86dd305c44ddfa2f4c3e6c4c7da7b;
                      m=910fd5;t=5fc9b3f57dd6c;x=661f690cc998e5cc"
        "SYSLOG_IDENTIFIER" : "kernel",
        "SYSLOG_FACILITY" : "0",
        "_TRANSPORT" : "kernel",
        "_SOURCE_MONOTONIC_TIMESTAMP" : "0",
        "MESSAGE" : "Linux version 5.10.103+ (dom@buildbot) (arm-linux-gnueabihf-gcc-8 (Ubuntu/Linaro 8.4.0-3ubuntu1) 
                     8.4.0, GNU ld (GNU Bin
}/small>
--msgid msgid RFC5424 MSGID field. space is not permitted in msgid.
-n
--server server
Write to the remote syslog server instead of system log socket.
Use UDP with failover to TCP unless --udp or --tcp is specified,
--no-act no writing to system log, and removing the connection or the journal.
Used with --stderr for testing purposes.
--octet-count Use the RFC 6587 octet counting framing method for sending messages.
Default is no framing on UDP, and RFC6587 non-transparent framing (also known as octet stuffing) on TCP.
-P
--port port
defaults to syslog for UDP and to syslog-conn for TCP , often 514 .
-d
--udp
use UDP only. Default port from /etc/services, often 514 .
--prio-prefix Process lines in standard input that contain a decimal number within angle brackets encoding facility and level using facility * 8 + level.
facility defaults to specified by -p

Example: local0.info: facility 16 and level 6, 16*8+6 becomes <134>.

Does not affect a command-line message.
With --prio-prefix, lines without characters after prefix is ignored.

--rfc3164 <f*8+l> Mmm dd hh:mm:ss HOSTNAME pgm content BSD to submit messages to a remote server.
--rfc5424[notq|,notime,|nohost] submit messages to a remote server.
notq time-quality data is ommitted which shows whether the local clock was synchronized and the maximum number of microseconds the timestamp might be off.
The time quality is suppressed with --sd-id timeQuality .
notime implies notq) suppresses the timestamp
nohostsuppress gethostname(2) information from the message header.
The RFC 5424 protocol is the default >
-s
--stderr
stderr also receives message
--sd-id name[@digits] structured data element ID for an RFC 5424 message header. Must be before --sd-param to introduce a new element.
The ID (name plus possibly @digits) is case-sensitive and uniquely identifies the type and purpose of the element.
The same ID must not exist more than once in a message.
The @digits is required for user-defined non-standardized IDs.

logger generates the timeQuality standardized element only.
RFC 5424 describes the elements origin (with parameters ip, enterpriseId, software and swVersion) and meta (with parameters sequenceId, sysUpTime and language). These element IDs may be specified without the @digits suffix.

--sd-param name="value" Structured Data element parameter.
Example:
 logger --rfc5424 --sd-id zoo@123     --sd-param tiger=\"hungry\"   --sd-param zebra=\"running\"  \
                  --sd-id manager@123 --sd-param onMeeting=\"yes\"   "African area status" 
produces:
 <13>1 2015-10-01T14:07:59.168662+02:00 ws kzak - - 
            [timeQuality tzKnown="1" isSynced="1" syncAccuracy="218616"]
            [zoo@123 tiger="hungry" zebra="running"]
            [manager@123 onMeeting="yes"] African area status
--size maxsize maximum permitted message size including the header. Default 1KiB RFC 5424 receivers can process 4KiB.
--socket-errors[=on|off|auto] Print errors about Unix socket connections.
auto logger will detect if the init process is systemd, and if so assumption is made /dev/log can be used early at boot.
Other init systems lack of /dev/log will not cause errors that is identical with messaging using openlog(3) system call.
default auto.
When errors are not enabled lost messages are not communicated and will result in success return value
-T
--tcp
TCP is used only. Default the connection is tried to the syslog-conn port defined in /etc/services, often 601.
-t
--tag tag
Mark every line with tag. Default name of the user
-u
--socket socket
instead of to the system log socket.
-- End the argument list. This allows the message to start with a hyphen (-).
-V
--version
 
-h
--help
 

Return value

exits 0 on success, and >0 if an error occurs.

FACILITIES AND LEVELS

Valid facility names(numbers) :

              auth
              authpriv   for security information of a sensitive nature
              cron(9,15)
              daemon(3)
              ftp(11)
              kern (0)      cannot be generated from userspace process, automatically converted to user
              lpr(6)
              log audit(13), log alert(14)
              mail(2) 
              news(7)
              ntp(12)
              syslog(5)
              user(1)
              uucp(8)
              local0 (16)
                …
              local7(23)
              security (4)  deprecated synonym for auth

Valid level names(numbers) :

 emerg(0), alert(1), crit(2), err(3), warning(4), notice(5), info(6), debug(7) 
depricated: error, warn and panic
For the priority order and intended purposes of these facilities and levels, see syslog(3).

Examples

       logger System rebooted
       logger --priority local0.notice -t HOSTIDM -f /dev/idmc
       logger --server loghost.example.com System rebooted

See

journalctl, syslog(3), systemd.journal-fields(7)

Example:

  1. Run myUpdater.sh
  2. Send a syslog notice that it ran containing the last line of the stdout
  3. Send the log file to the syslog with a priority of info
  4. If there return code indicated a problem,
    send the stderr to syslog with priority of error
    myUpdater.sh 1> /tmp/myUpdater.log 2> /tmp/myupdater.err
    rc=$?
     tail -n1 /tmp/myUpdater.log | logger -p local3.notice 
     logger -p local3.info -f /tmp/myUpdater.log
    if [ $rc != 0 ]; then  logger -p local3.err  -f /tmp/myUpdater.err -s 
     fi 

    -d
    --udp
    Use UDP datagram. Default TCP.
    -n
    --server
    not builtin syslod
    -i process id of the logger process
    -s Log the message to standard error, as well as the system log.
    -f file Enter the contents of file into the log.
    -p pri Enter the message with the specified priority.
    -p facility.level The priority may be specified numerically or as a
    facility.level pair.
    -p local3.info level in the local3 facility.
    The default is user.notice.
    -t tag tag line .
    -u socket Write to socket instead of builtin syslog routines. (port 514)
    -d Use a datagram instead of a stream connection to this socket.
    -- End of options, (allows message to start with a hyphen (-)).
    if no message is specified standard input is logged
    exits 0 on success, and >0 if an error occurs.

    logger System rebooted

    logger --priority local0.notice --tag HOSTIDM --file rootStatNotes

    For the priority order and intended purposes of these levels, See syslog(BSDactually Mac OSX ; darwin), syslogd(8)

    syslog(3), syslogd(8)

    Best Practices by Dan Gunter, Lawrence Berkeley National Laboratory

    Some implementations only include -i -s -f -p -t -u!

    Testing

    Generate user.log entries : telnet logserver-host 514
    message to be logged
    another

    enter ^] to enter command mode.

    echo '173 <165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ' \
    ' ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"] An application event log entry...' |\
    nc 127.0.0.1 6514

    See syslog

    Made true HTML and terse by Dennis German