The syslog system is one of the most delightful things about Unix. Unlike some operating systems that force you to use the limited range of logs that they condescend to provide, Unix allows you to log almost anything, at almost any level of detail. While system logging hooks are provided for the most common Unix resources, administrators can choose a logging configuration that meets their needs. My networks usually have a single logging host that handles not only the FreeBSD boxes, but Cisco routers, switches, and any other syslog -speaking systems. The system logger is actually fairly straightforward.
Programs send log entries to the system logging daemon, syslogd .
When it finds a matching entry, it processes the log entry in the manner described. The first is the system providing the information to be logged. The second is the action to be taken when a log message matches. The most confusing part is understanding exactly how to specify a logging information source. The standard method of specifying a logging source is by facility and level.