I propose the following fixes for the current syslog integration:

• Eliminate setlogmask() call, since every message is checked for its level anyway in the log method. Otherwise some messages can get cut that should get through.
• Properly map zabbix log levels to syslog log levels.

• • • ./src/libs/zbxlog/log.c.orig Mon Dec 7 20:43:56 2009
    • ./src/libs/zbxlog/log.c Tue Jan 26 17:23:52 2010
      ***************
    • 111,118 ****
      zbx_free(wevent_source);
      #else /* not _WINDOWS */

! openlog("zabbix_suckerd", LOG_PID, LOG_USER);
! setlogmask(LOG_UPTO(LOG_WARNING));

#endif /* _WINDOWS */
}
— 111,117 ----
zbx_free(wevent_source);
#else /* not _WINDOWS */

! openlog("zabbix", LOG_PID, LOG_DAEMON);

#endif /* _WINDOWS */
}
***************

• • • 244,249 ****
    • 234,241 ----
      struct timeval current_time;
      #endif /* _WINDOWS */

+ int syslog_level;
+
if( (level != LOG_LEVEL_INFORMATION) && ((level > log_level) || (LOG_LEVEL_EMPTY == level)) )

{ return; *************** *** 362,368 **** #else /* not _WINDOWS */ ! syslog(LOG_DEBUG, "%s", message); #endif /* _WINDOWS */ }

— 354,372 ----

#else /* not _WINDOWS */

! switch(level)
!

{ ! case LOG_LEVEL_CRIT: ! syslog_level = LOG_CRIT; ! case LOG_LEVEL_ERR: ! syslog_level = LOG_ERR; ! case LOG_LEVEL_WARNING: ! syslog_level = LOG_WARNING; ! default: ! syslog_level = LOG_DEBUG; ! }

!
! syslog(syslog_level, "%s", message);

#endif /* _WINDOWS */
}

Furthermore I suggest that for better syslog integration the following things should be addressed:

• Set proper facilities (e.g. daemon for agentd, but user for zabbix_sender)
• Open the log with a different ident for each program, so messages can be matched to the exact zabbix program/daemon
• Enhance clarity of how to configure syslog method in config files, currently it's done by not specifying a log file

Just some ideas I had,
Thanks