Diagnosing syslogd configuration problems

You must install and activate the AF_UNIX domain before starting syslogd in normal or local-only mode. To determine whether AF_UNIX was successfully started, check for a message in the console log similar to the following message:

BPXF203I DOMAIN AF_UNIX WAS SUCCESSFULLY ACTIVATED.

syslogd supports a debug mode, which is selected using the -d command-line option. If you run syslogd from the UNIX shell using this debug mode, syslogd writes debug messages to STDOUT. These messages can be used to diagnose problems in the syslogd configuration or to collect documentation when reporting a syslogd problem to IBM® support.

You can use the SYSLOGD_DEBUG_LEVEL environment variable to limit the amount of debug messages. You can specify the following debug levels:

Value
Level
1
Base debugging information.
2
Configuration file processing.
4
Message handling information for messages being logged by syslogd.
8
Automatic archive processing.
16
Operator command processing.
32
Thread-specific processing.
64
Mutex lock processing. Locks that are specific to threads are logged only if the debug level includes 32.

You can add these values together in any combination to select the type of debug messages to be written. For example, SYSLOGD_DEBUG_LEVEL=91 includes all debugging information except for message handling and thread-specific processing (including locks). The default debug level is 127, which includes all debug information.

Rule: Do not use the -d option for normal operations.

If you are running syslogd in batch with -d, debug output is written to SYSPRINT, SYSTERM, or SYSERR, whichever is found first. The sample syslogd procedure SEZAINST(syslogd) defines SYSPRINT so that debug messages are stored in the job output. The following example shows how to change the SYSPRINT DD statement to write debug output to a file.

SYSPRINT DD PATH='/var/syslog/syserr',PATHOPTS=(OWRONLY,OCREAT)

Use caution using -d when syslogd is started from /etc/rc. If -d is used in this way, the shell background character (&) must be used to run syslogd in the background. Otherwise, /etc/rc does not end and UNIX System Services initialization does not complete.

If you are using the automatic archive function of syslogd, it is possible that an archive of a particular file fails. A failure can occur for many reasons, including dynamic allocation errors for the target data set, or read/write errors for the UNIX file or target data set. If a failure occurs, syslogd attempts to archive the file again when the next archive trigger event occurs, but it is possible that all archive attempts continue to fail. If all attempts fail, the original UNIX file to be archived still exists in the UNIX file system, renamed with a suffix of the form Dyymmdd.Thhmmss, and the target data set might also exist and contain partial data. You should examine the error messages in the syslogd destination output file for the daemon facility to determine which files have failed, and manually recover or delete such files and the associated partial archive data sets.