SYSLOG_TO_SVCLOG(8)

💅 NAME 💅

ok so: syslog_to_svclog — it logs your syslog messages into servicelog. that's the whole vibe. welcome to the <pink>ppc64-diag</pink> diagnostic tools corner of the man pages, bestie, it's cozy here 🎀

---

✨ SYNOPSIS ✨

syslog_to_svclog [ -b begin_time ] [ -e end_time | -F ]
[ -m message_file | -M ] [ -C catalog_dir ] [ -h ] [ -d ]

eyebrow raise at all those brackets? don't worry, we're going through every single one 🫶

---

🌸 DESCRIPTION 🌸

okay so the tea: syslog_to_svclog reads the message file you give it (and if you don't give it one, it defaults to stdin). that file should be in the format that the syslogd daemon produces. for each line that matches a message documented in the message catalog, syslog_to_svclog logs an event to the servicelog database, as appropriate. ✨

typically, syslog_to_svclog logs only warning and error messages to servicelog — not debug or informational messages. she's picky like that and honestly? valid. 💅

---

when /var/log/messages or /var/log/syslog is the message file, syslog_to_svclog maintains a little "last-message" file. iconic little guy. it contains a copy of the last line read from /var/log/messages or /var/log/syslog that matched a message from the message catalog. 🎀

so when a subsequent instance of syslog_to_svclog begins reading from /var/log/messages or /var/log/syslog, and no -b option is specified, syslog_to_svclog begins with the next message after the one in the "last message" file. the intent is to avoid logging the same event to servicelog multiple times. no duplicate spam in the group chat, periodt. 🔥

---

👑 OPTIONS 👑

• -b begin_time — ignore messages with timestamps prior to begin_time. see "Timestamps." (yes, the quotes are her idea, she's fancy) ⭐
• -C catalog_dir — use the message catalog in catalog_dir. the default is /etc/ppc64-diag/message_catalog. 🦋
• -d — print debugging output on stderr. loud and proud about it, love that for her 💜
• -e end_time — ignore messages with timestamps after end_time. see "Timestamps." 💖
• -F — do not terminate upon reaching the end of the message file. continue watching for, and processing, new messages as they arrive, as with tail -F. to terminate syslog_to_svclog, send it a termination signal, as with CTRL+C. she's a "no thoughts head empty just vibing and watching" girlie 🌈
• -h — print help text and exit. the polite one. 🫶
• -m message_file — read syslog messages from the specified file instead of stdin. 🍓
• -M — read syslog messages from system default location /var/log/messages or /var/log/syslog. -M implies -F. noted! 💅

---

⏰ TIMESTAMPS ⏰

the following timestamp formats are recognized by syslog_to_svclog:

month day [ year ] [hh:mm[:ss]] — e.g., Feb 12 2010 14:30
month day hh:mm[:ss] [ year ]
day month [ year ] [hh:mm[:ss]] — e.g., 12 Feb 14:30
day month hh:mm[:ss] [ year ]
year-month-day [hh:mm[:ss]] — e.g., 2010-2-12 14:30:00

if no year is specified, syslog_to_svclog assumes that the timestamp is from the prior 12 months. if no hh:mm is specified, syslog_to_svclog assumes 00:00:00. she fills in the blanks herself, main character energy, iykyk 😭

---

🧚 AUTHOR 🧚

written by Jim Keniston (jkenisto@us.ibm.com). conversion of format strings to regular expressions (for matching syslog messages to catalog entries) written by Jesse Larrew (jlarrew@us.ibm.com). two legends, one man page, we stan 👑

---

🎀 FILES 🎀

• /etc/ppc64-diag/message_catalog/* — message catalog
• /var/log/ppc64-diag/last_syslog_event — last message matched from /var/log/messages

---

💀 SEE ALSO 💀

explain_syslog(8), servicelog(8), syslog(3) — go read those too, bestie, it's giving "expanded universe" 🌸

---

lowkey warning from your girl: -F literally means she will not stop. do not expect her to wander off on her own. send a termination signal, as with CTRL+C, or she's staying forever. 🙈

---

k that's the whole page, no cap. this one's on the Linux tip, dated <purple>March 2010</purple>, and it's SYSLOG_TO_SVCLOG(8) in the ppc64-diag universe from back in the day. slay, go log some events responsibly 💖✨🌷