Last updated March 5, 2014. Created by ChrisKennedy on October 23, 2007.
Edited by batigolix, osopolar, Russell James, rooby. Log in to edit this page.


The Syslog module logs events by sending messages to the logging facility of your web server's operating system. Syslog is an operating system administrative logging tool that provides valuable information for use in system management and security auditing. Most suited to medium and large sites, Syslog provides filtering tools that allow messages to be routed by type and severity.

It is not suitable for shared hosting environments.

It might not be as user friendly as Database Logging but will allow you to see logs and troubleshoot if your site is not accessible. Because the Database loggin module write logs to the database it can slow down the website. By using Syslog you can improve the performance of the site.

syslog or rsyslog

Recent versions of Debian and CentOS use rsyslog instead of syslog.

Using Syslog

Here is a four-step guide to switching from Drupal's default database. It is for Linux systems only.

1. Install & configure the Syslog module

  • Enable the module Syslog on the:
    • Extend page at admin/modules (Drupal 8) or
    • Modules page at admin/modules (Drupal 7)
    • Modules page at admin/build/modules (Drupal 6)
  • Configure the module on the:
    • Logging and errors configuration page at admin/config/development/logging (Drupal 7 & 8) or
    • Syslog settings page at /admin/settings/logging/syslog (Drupal 6)
  • Select which Syslog facility to attach to the log messages. Choose one that is not in use by Syslog.
  • Set the syslog identity (a string that will be prepended to every message logged to Syslog), for example drupal_www_example_com.

2. Configure Syslog to log to a separate file (optional)

You can write the log messages to a separate file (If you dont the messages will most likely end up in /var/log/messages)

Edit the syslog configuration file at:


Add the following line at the bottom of the file:

local0.* /var/log/drupal.log
Where local0 is the Syslog facility that you chose in the Syslog configuration (see Step 1)

Restart Syslog:

service syslog restart
service rsyslog restart

Restart syslog on MacOSx

Check that you are seeing messages in the syslog:

tail /var/log/drupal.log

This shows the bottom of the log file. To see the complete log file use:
less /var/log/drupal.log

To see new log messages appearing in the log file use:
tail -f /var/log/drupal.log

Exit using ctrl+c

3. Disable the Database Logging (formerly, Watchdog) module (optional)

If you have the the Database logging (dblog) enabled, disable it at on the Modules page (Extend page in Drupal 8) /admin/build/modules.

4. Configure Syslog to log to a separate file for each domain

You can use separate log files for each website.

Edit the syslog configuration file at:


and add:

if $programname == 'drupal_www_example_com' then /var/log/drupal/drupal_www_example_com.log
& ~
local0.* /var/log/drupal/others.log
& ~

$progname drupal_www_example_com is the Sylog identity that you have set in the Logging and errors configuration page, (admin/config/development/logging), see step 1.

With the last line you are sure to put all Drupal log (if you choose facility local0) in one file.

The "strange" lines, & ~, omit to put the log record in other files (for example /var/log/syslog)

Note If you use rsyslog with a /etc/rsyslog.d/ folder, you can create a new file there, with the same content (preferred method).

More information

Four-step guide to switching from Drupal's default database logging to Syslog.

Write drupal logs to rsysloginstead of to dblog

See also the PHP's documentation pages for the openlog and syslog functions.

On syslog facilities, severity levels, and how to setup a syslog.conf file, see UNIX/Linux syslog.conf.


On Windows Server 2003R2, syslog doesn't write successfully to the Event Log. Instead, an Application Warning appears (Source: PHP-5.2.0) which starts with: "The description for Event ID ( 3 ) in Source ( PHP-5.2.9 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer". According to , the default IUSR_ needs to be added to the Users group

Looking for support? Visit the forums, or join #drupal-support in IRC.


Users not familiar with linux may not know how to find this information. Is it possible to specify this in a link?