SysLogHandler not writing to syslog with Python logging

1 January 2008

Logging to syslog in Python

I was trying to use the standard Python logging module to write messages to syslog. The logging module has a SysLogHandler class which can log to a local or remote syslog daemon.

With no host specified, SysLogHandler uses localhost which is what I wanted. I tried to use SysLogHandler, but it just wouldn’t work. There was no error when I called the logging methods, but my messages didn’t show up in /var/log/syslog.

syslog module works

Python also has a standard syslog module. I tried it and it worked fine; my messages were written to the syslog file.

For example:

import syslog

syslogd isn’t listening

After running Wireshark I found the SysLogHandler was correctly sending a UDP packet to localhost on port 514. I could also see there was an ICMP response indicating the UDP packet was not received on that port. syslog wasn’t listening!

Use /dev/log

Instead of sending to localhost, I wanted SysLogHandler to pass the message to syslog on the local machine in the same way the syslog Python module was doing.

The solution is to pass /dev/log as the address parameter to SysLogHandler. It’s not well documented, but it works.

For example:

import logging
from logging.handlers import SysLogHandler

logger = logging.getLogger()
syslog = SysLogHandler(address='/dev/log')
formatter = logging.Formatter('%(name)s: %(levelname)s %(message)s')

Easy when you know how.

Filed under: Python — Scott @ 11:21 pm


  1. Thanks, that fixed my problem.

    Comment by John — 15 January 2008 @ 8:02 pm

  2. Does somebody know how to apply that to a logger configuration file?

    Comment by Manuel — 13 August 2008 @ 12:45 pm

  3. For a configuration file, change the (host,port) tuple in the args of the handler to “/dev/log”
    For example:

    formatter: form01

    Change args to:

    Comment by Eric — 19 August 2008 @ 5:49 pm

  4. How to properly log exceptions to syslog? I’ve configured syslog-ng to log python messages to separate file and unfortunately only first line of traceback is logged to it (other are routed to /var/log/messages).

    Comment by Max — 9 July 2009 @ 7:54 am

  5. Found this page via google. You don’t have to use /dev/log if you make the syslog server accept remote logging requests (ie, listen on UDP 514). At least on Ubuntu, just add “-r” to /etc/default/syslogd.

    This option is introduced in version 1.3 of the sysklogd package.
    Please note that the default behavior is the opposite of how older
    versions behave, so you might have to turn this on.

    Comment by Jamshid — 13 July 2010 @ 5:31 pm

  6. Thanks a lot for this post, it solves my problem.

    By the way, the default behaviour is a bit stupid …

    Comment by GĂ©rald — 24 February 2012 @ 5:27 pm

RSS feed for comments on this post.

Leave a comment