Hi,

On Wed, May 17, 2006 at 11:43:54PM -0500, Tim & Alethea Larson wrote:
<snip>
> >
> >The key line would be something like:
> >
> >*.err;kern.*;auth.notice;authpriv.none;mail.crit        /dev/console
> 
> What exactly is syslog.conf doing?  I understand this line must be 
> making certain types of things output to /dev/console, but I don't 
> understand what/why/how.
> 
> >Change that /dev/console to something else, say /var/log/messages.
> 
> So it's possible to make it output to a file rather than /dev/console? 
> That would be great...I could capture the errors for posterity (if 
> necessary) that way!  Do I need to restart for this to take effect?

The syslog call looks like:

syslog(int priority, const char *message, ...);

where priority is a constant like:

LOG_ERR

When you opened the syslog you gave an id, like say mail or kern.

These messages are passed to the syslogd daemon which, when 
started, reads syslogd.conf.

If you kill -HUP it the config file is reread.

What syslog does is that any message that from anyone (mail, kern, sshd, etc)
that is sent with the priority of err is shipped the the file specified, 
in this case /dev/console.  Ditto for anymessage send from the auth facility
with the priority of notice, etc.

Without thinking too hard I think that

auth.notice;authpriv.none        /var/log/authlog
*.err;kern.*;mail.crit        /dev/console

would stop the annoying su and failed login messages to the console and put
them (possibly duplicated) in /var/log/authlog.  The kernel messages and anything
sent with err will still mess up the x display.  OTOH, you probably want those
anyway since that might be your only way of deciding what fubared and caused
the system to crash.

I'd personally move mail.crit to /var/log/messages but I'm not a big mail person.

If you feel like reading man pages and playing syslog can send the messages
off to another system, and that system can write them to it's disk which
is pretty cool.

cheers

bruce



-- 
edoneel@sdf.lonestar.org
SDF Public Access UNIX System - http://sdf.lonestar.org