Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is sample output of my syslog messages in /var/log/syslog:

Nov 15 20:20:48 ubuntu winbindd[915]: [2011/11/15 20:20:48.940063,  0] winbindd/idmap_tdb.c:287(idmap_tdb_open_db)
Nov 15 20:20:48 ubuntu winbindd[915]:   Upgrade of IDMAP_VERSION from -1 to 2 is not possible with incomplete configuration

How do I see what was the level of message, like info, warn, error etc.?

I am using Ubuntu 10.04 LTS with rsyslog package version 5.8.1-1ubuntu2.

share|improve this question
up vote 9 down vote accepted

That is the default traditional format.

To output log levels in messages (technically known as priorities), you should change the default template used by rsyslog:

  1. open with admin privileges the file /etc/rsyslog.conf and add the following lines

    $template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%,%syslogtag%,%msg%\n"
    $ActionFileDefaultTemplate precise

    after the line

    $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
  2. restart the daemon, with the command:

    sudo service rsyslog restart

Now you should see lines like the following:

6,5,Nov 18 10:17:02,acer,rsyslogd:, [origin software="rsyslogd" swVersion="5.8.1" x-pid="7064" x-info=""] exiting on signal 15.

where the first two numbers (6 and 5) represent respectively the priority and the facility, where the priority is given by

7 - debug
6 - info
5 - notice
4 - warning, warn
3 - err, error
2 - crit, 
1 - alert, 
0 - emerg, panic

and the facilities can be seen in the syslog(3) man page.

share|improve this answer
More about formats in rsyslog docs: and – Taha Jahangir Jan 4 '14 at 16:16

Make sure you have uncommented out the rsyslog.conf entries for imudp, imtcp and UDPServerRun, TCPServerRun. Example:

\# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514
\# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

Restart the rsyslog daemon and check to see that port 514 is running with netstat -tunlp. Finally verify your logs are indicating that rsyslog is started. A tail /var/log/messages will reveal the following.

Mar  5 03:13:45 hostname rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="14890" x-info=""] (re)start
Mar  5 03:13:45 hostname rsyslogd: rsyslogd's groupid changed to 103
Mar  5 03:13:45 hostname rsyslogd: rsyslogd's userid changed to 101
share|improve this answer
Turning on UDP/TCP log reception is not related to the question! – Taha Jahangir Jan 4 '14 at 16:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.