5.10 Logging

F-PROT Antivirus looks for the variable *_LOGLEVEL in /etc/f-prot.conf to determine the amount of information to write to the system logs, where * is the prefix for the subsystem in question (FPSCAND for the F-PROT Antivirus Daemon Scanner, FPMON for the F-PROT Filesystem Monitor, FP_SO for the F-PROT Antivirus Preloadable Library Call Wrapper etc.). The legal *_LOGLEVEL values correspond to the kernel syslog()'s loglevels, and are passed as-is to the system logger.

As with any other system log messages, all of F-PROT Antivirus log messages marked with lower or equal loglevel then *_LOGLEVEL will be put in the system logs, while messages marked with a higher level are discarded. This applies to all relevant F-PROT Antivirus components, i.e. those that write to system logs (fpscand, fpmon, fp.so etc.).

The default loglevel is 4, which logs all warnings and errors, but the system administrator can increase or decrease the loglevel if he/she so wishes by changing the value of the *_LOGLEVEL variable.

The valid loglevels are listed below:

FPROT_LOGLEVEL | Semantic name | Description
0 | LOG_EMERG | Fatal condition
1 | LOG_ALERT | Action must be taken immediately
2 | LOG_CRIT | Critical conditions
3 | LOG_ERR | Error conditions
4 | LOG_WARNING | Warning conditions
5 | LOG_NOTICE | Normal, but significant, condition
6 | LOG_INFO | Informational message
7 | LOG_DEBUG | Debugging information

By default, fpscand, fpmon and fp.so log to the 'daemon' facility and the mail server plugins log to the 'mail' facility. By changing the *_LOGFACILITY variable in /etc/f-prot.conf you can direct the logs from fpscand, fpmon and fp.so to another facility. See the syslog man pages (sections 3 and 7) for your system and /etc/f-prot.conf for details.

Back to Index

Copyright © 2007 FRISK Software International. All rights reserved