configure and use system log
   the behavior of syslog is controlled by its configuration file./etc/syslog.conf.this text file contains lines indicating what is to be logged and where.each line contains directories in this form:
   facility.level action
   the directories are defined as follow:
   facility this represents the creator of the message(that is,the kernel or process) and is one of the following:auth,authpriv,cron,daemon,kern,lpr,mail,mark,news,syslog,user,or local0 through local7.the use of these facility designator allows you to control the destination of message based on their origin.facilities local0 through local7 are for any use may wish to assign to them in your own programs and scripts.
   level specifies a severity(严格,激烈,严重) threshold(门槛,入口,开端) beyond which message are logged,and is one of the following (from lowest to highest severity):debug, info, notice, warning, err,crit, alert, or emerg.there is also a special level called none that will disable a facillity.the level defines the amount of detail recorded in the log file.a single period separates the facility from the level,and together they comprise the message selector.the asterisk(*) can be used to describe all facilities or all levels.
   action the derective is arguably misnamed.it represents the destination for message that correspond to a given selector(facility.level).the action by the @ sign,or a comma-separated list of users or asterisk(this means all loged-in users will be included), the action is to send the message to the specified destination.
   for example,if you wanted to create a separate log file for activity reported by the scripts you write,you might include a line like this in /etc/syslog.conf:
   #define a new log file for the local5 facility
   local5.*            /var/log/local5
  you could then use the logger utility to write message to the facility from your shell script:
  $logger -p local5.info "script terminated normally"
  the message "script terminated normally" would be placed into /var/log/local5,along with a timestamp and hostname that sent the message.
  
log file rotation(/etc/logrotate.conf)
  to prevet any of log file from growing unattended to extreme sizes,a log file rotation scheme should be installed as well.the cron system issues commands on a regural basis (usually once per day) to establish new log files.the old files fare renamed with numeric suffixes.with this kind of rotation,yesterday's /var/log/message file becomes today's messages.1
  the utility that establishes the rotation is ligrotate. this privileged command is configured using ong or more files.which are specfied as arguments to the logrotate command.these configuration files can contain directorives to include other files as well. the default configuration file is /etc/logrotate.conf.

examing log files
  syslog store the message it creates with the following information,separated by (but also including) spaces
  date/time
  origin hostname
  message sender(such as kernel,sendmail,or a username)
  message text
  typical messages will look this:
  Dec 28 01:39:19 localhost syslogd 1.4.1: restart.