Troubleshooting System Administration Issues in Oracle^® Solaris 11.3

Extended System Logging With the rsyslogd Command

This Oracle Solaris release includes the option of installing and using the rsyslogd package for managing system logging. rsyslogd is derived from the syslogd daemon implementation, with a modular design that supports several features such as filtering, TCP, encryption, and high-precision time-stamps, as well as output control.

The syslog SMF service, svc:/system/system-log:default, continues to be the default logging service. To use the rsyslog service, you need to install the rsyslog package and enable the rsyslogd service.

How to Install and Enable rsyslog

1. Check whether the rsyslog package is already installed on your system by trying to enable the service as follows:

   root@pcclone: ~# svcadm enable svc:/system/system-log:rsyslog

   If the rsyslog package is not installed, the following message displays:

   svcadm: Pattern 'svc:/system/system-log:rsyslog' doesn't match any instance.

2. If the rsyslog package is not installed, install it.

   root@pcclone:~# pkg install rsyslog
              Packages to install:  3
               Services to change:  1
          Create boot environment: No
   Create backup boot environment: No
   
   DOWNLOAD                                PKGS         FILES    XFER (MB)   SPEED
   Completed                                3/3         68/68      1.7/1.7  354k/s
   
   PHASE                                          ITEMS
   Installing new actions                       147/147
   Updating package state database                 Done
   Updating package cache                           0/0
   Updating image state                            Done
   Creating fast lookup database                   Done
   

3. Confirm the rsyslog instance.

   root@pcclone:~# svcs -a | grep "system-log"
   disabled       18:27:16 svc:/system/system-log:rsyslog
   online         18:27:21 svc:/system/system-log:default
   

   This output confirms that the rsyslog instance exists, though it is disabled.

4. Switch to the rsyslog service.

   root@pcclone:~# svcadm disable svc:/system/system-log:default
   root@pcclone:~# svcadm enable svc:/system/system-log:rsyslog
   root@pcclone:~# svcs -xv
   

   These commands disable the default service, enable rsyslog, and report on status.

Next Steps

After rsyslog is installed and enabled, you can configure syslog in the /etc/rsyslog.conf file. For more information, see rsyslogd(1m).