Subject: Re: Getting to grips with syslog and localn.*
To: Jeremy C. Reed <reed@reedmedia.net>
From: Amadeus Stevenson <amadeus.stevenson@gmail.com>
List: netbsd-help
Date: 04/29/2006 20:14:09
Hello and thanks for the help.

Following pavel's tip and '"cvs up -dP -rHEAD" in
src/usr.sbin/syslogd' I'm running the latest syslogd on my 2.0 system.

I have successfully filtered the required hostname and daemon bits,
but I'm still getting a duplicate of the entries in /var/log/messages
as well as in the separate log files I specified.

I suspect I've left something in the old syslog.conf file which is
saying this, although I can't see it, perhaps the *.info bit?

#       $NetBSD: syslog.conf,v 1.8 2003/04/02 14:38:26 perry Exp $

!named
*.*                                                     /var/log/named.log

!dhclient
*.*                                                     /var/log/dhclient.l=
og

!*

+xxx.xxx.xxx.234,xxx.xxx.xxx.230,xxx.xxx.xxx.231,xxx.xxx.xxx.232,xxx.xxx.xx=
x.233,xxx.xxx.xxx.235
*.*                                                     /var/log/wifi.log

+*

*.err;kern.*;auth.notice;authpriv.none;mail.crit        /dev/console
*.info;auth,authpriv,cron,ftp,kern,lpr,local7.none,mail.none  =20
/var/log/messages
kern.debug                                              /var/log/messages

# The authpriv log file should be restricted access; these
# messages shouldn't go to terminals or publically-readable
# files.
auth,authpriv.info                                      /var/log/authlog

cron.info                                               /var/log/cron
ftp.info                                                /var/log/xferlog
lpr.info                                                /var/log/lpd-errs
mail.info                                               /var/log/maillog
#uucp.info                                              /var/spool/uucp/ERR=
ORS

*.emerg                                                 *
*.notice                                                root

local7.*                                                /var/log/dhcpd.log

I wonder how to stop this duplication?

Many thanks,

Amadeus

On 4/29/06, Jeremy C. Reed <reed@reedmedia.net> wrote:
> > I managed some time ago to separate out dhcpd logs (although how I
> > knew it was local7 is a mystery).
>
> dhcpd(8) man page says LOG_DAEMON. You probably based your configuration
> on the example which has:
>
> # Use this to send dhcp log messages to a different log file (you also
> # have to hack syslog.conf to complete the redirection).
> log-facility local7;
>
> > I'd like to do the same for dhclient logs as well, but don't know how t=
o
> > divert the dhclient log messages into a file eg. /var/log/dhclient.log.
> > The same goes for named logs (bind9).
>
> Some implementations of syslogd can do this for specific processes (and
> even hostnames). I have used this a lot of FreeBSD.
>
> It is not available in NetBSD 2.x. But now I see it is in NetBSD 3. The
> cvs commit says "Extend the syntax of syslog.conf to allow selections of
> log destinations by comma-separated lists of program name (including
> kernel-generated messages) and originating host name." (and more).
>
> Here is an untested example to put at very bottom of your syslog.conf:
>
> !dhclient
> *.*             /var/log/dhclient.log
> !*
>
> The last line above is not needed if you don't have any later rules.
>
> > How do I "find out" what facility corresponds to my access point
> > messages, named and dhclient?
>
> NetBSD 3 has that too. This is an untested example:
>
> +host1
> *.*     /var/log/host1.logs
> +host2
> *.*     /var/log/host2.logs
> +*
>
> (Last line not needed if at end.)
>
> More details in NetBSD 3 (or later) syslog.conf manual page.
>
> Have fun!
>
>  Jeremy C. Reed
>
> p.s. Thank you thorpej for adding all these features!
>