> Source: [sk34680](https://support.checkpoint.com/results/sk/sk34680)

# sk34680 - How to configure syslog daemon on SecurePlatform OS

| Property | Value |
|----------|-------|
| Solution ID | sk34680 |
| Date Created | 2008-03-24 |
| Last Modified | 2017-07-12 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server |
| Versions | R82.10, R82, R81.20, R82.10, R82, R81.20 |

## Solution

The `syslog` daemon, running on SecurePlatform OS (and most Linux based OS's) handles most of the Operating System logging. This daemon uses the `/etc/syslog.conf` file for configuration and handles all messages sent to it on UDP 0.0.0.0:514

Based on `syslog` message facility and priority, the `syslog.conf` file defines how each `syslog` message is handled, then determines where this message is written locally or to what remote IP address it should be sent.

|------------------|--------------------------------------------------------------------------------------------------------|
| **Name**         | **Facility**                                                                                           |
| kern             | Kernel                                                                                                 |
| user             | Regular user processes                                                                                 |
| mail             | Mail system                                                                                            |
| lpr              | Line printer system                                                                                    |
| auth (authpriv)  | Authorization system, or programs that ask for user names and passwords (login, su, getty, ftpd, etc.) |
| daemon           | Other system daemons                                                                                   |
| news             | News subsystem                                                                                         |
| uucp             | UUCP subsystem                                                                                         |
| local0... local7 | Reserved for site-specific use                                                                         |

|--------------|---------------------------------------------------------------------------------------|
| **Priority** | **Meaning**                                                                           |
| emerg        | Emergency condition, such as an imminent system crash, usually broadcast to all users |
| alert        | Condition that should be corrected immediately, such as a corrupted system database   |
| crit         | Critical condition, such as a hardware error                                          |
| err          | Ordinary error                                                                        |
| warning      | Warning                                                                               |
| notice       | Condition that is not an error, but possibly should be handled in a special way       |
| info         | Informational message                                                                 |
| debug        | Messages that are used when debugging programs                                        |
| none         | Do not send messages from the indicated facility to the selected file.                |

**Example 1**:

`authpriv.* <TAB> /var/log/secure`   

"`authpriv`" is the facility.   
"." - delimits the facility from the priority.   
"\*" - means all priorities.   
There must be a \<TAB\> between the selector section (facility.priority) and the action section on each line.   
"`/var/log/secure`" is the file that the messages are written to.

**Example 2**:

`*.info;authpriv.none;cron.none;local5.none <TAB> @10.0.0.1`   

The selector section states, all facilities (except `authpriv, cron` and `local5`) with a priority of at least info or higher.   
Send them via UDP:514 to IP address 10.0.0.1.   

If you want to send syslogs to multiple servers, repeat the command from Example 2 to a different server.  

<br />

**Note** :   
When defining the priority, it will include the defined level and anything higher. Number of lines does not matter, each message is processed by each line separately.   
Any time a change is made to the `/etc/syslog.conf` file, the `syslog` daemon should be restarted. To do so, run the `service syslog restart` command.   
A Security rule to allow a `syslog` traffic to pass to/from the server may be required.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content