The invention discloses an operation method for a log system, which comprises the steps of: inspecting the configuration of the log system and initializing network; judging whether syslog warning is sent or not; if so, connecting the syslog warning to a remote server; if not, judging whether archive and backup are necessary or not; if so, mounting archive and backup of handle and starting queue processing thread; if not, obtaining the serial number of log files; judging whether log file backup is necessary or not; if so, joining the backup information in a queue; if not, drawing back log monitoring thread, starting the thread of an acceptor of a transmission control protocol/datagram protocol and saving the physical address and a data member of an object in a shared memory. By adopting the technical proposal of the invention, the monitoring is convenient, faults are timely discovered, calling method is convenient and flexible, and the method of the invention is easy to use and beneficial to maintenance and has complete and practical functions.