How To

Summary

This article explains the purpose of "mark" messages, how to enable the "mark" module, and how to collect its messages.

Objective

We will cover:

What the "mark" module in rsyslog is and its uses.
How to enable the "mark" module.
How to direct "mark" messages to a file.

Environment

This article applies to AIX 7.2 and later.

Steps

By default, AIX includes the syslog service, which is primarily used to receive messages from any application or daemon configured to use this service. If you are not familiar with syslog and how to set up /etc/syslog.conf, please refer to the available AIX documentation to understand the basics.

An alternative to syslog is rsyslog, which offers enhanced functionalities. You can switch to rsyslog as explained in this Technote: IBM AIX: How to Download, Install and Use rsyslog In Place of the Native syslog Logging Service.

Rsyslog works with additional modules, each providing specific functionalities. The "mark" module sends heartbeat messages to ensure rsyslog is active and that the receiver, if a remote server, can receive rsyslog messages.

To enable the "mark" module and set the frequency of mark messages, add the following lines to /etc/rsyslog.conf:

# Load mark message module

$ModLoad immark

# Set interval for mark messages (in seconds)

$MarkMessagePeriod 60

To collect "mark" messages in a dedicated file, add these lines to /etc/rsyslog.conf:

if $msg contains "-- MARK --" then {
        action (type="omfile" file="/var/adm/syslog/mark.log")
        stop
        }

Be certain to restart the rsyslog service by executing the following commands after you've made changes to /etc/rsyslog:

stopsrc -s syslogd
startsrc -s syslogd

Please remember, these commands stop and then start the syslogd service respectively.

Additional Information

For additional information on rsyslog "mark" messages, see:

immark: Mark Message Input Module

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB08","label":"Cognitive Systems"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG10","label":"AIX"},"ARM Category":[{"code":"a8m0z000000cvxuAAA","label":"Communication Applications-\u003ESYSLOG\/RSYSLOG"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Was this topic helpful?

Document Information

More support for:
AIX

Component:
Communication Applications->SYSLOG/RSYSLOG

Software version:
All Versions

Document number:
7231621

Modified date:
23 April 2025

UID

ibm17231621

IBM Support

Tips

How can I enable and configure the "mark" module in rsyslog to gather "mark" messages, and what function does this module serve?