From owner-freebsd-questions Tue Aug 6 12:37:05 1996 Return-Path: owner-questions Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id MAA14732 for questions-outgoing; Tue, 6 Aug 1996 12:37:05 -0700 (PDT) Received: from mole.mole.org (marmot.mole.org [204.216.57.191]) by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id MAA14724 for ; Tue, 6 Aug 1996 12:37:01 -0700 (PDT) Received: (from mail@localhost) by mole.mole.org (8.6.12/8.6.12) id TAA05369; Tue, 6 Aug 1996 19:36:54 GMT Received: from meerkat.mole.org(206.197.192.110) by mole.mole.org via smap (V1.3) id sma005366; Tue Aug 6 19:36:43 1996 Received: (from mrm@localhost) by meerkat.mole.org (8.6.11/8.6.9) id MAA26847; Tue, 6 Aug 1996 12:36:43 -0700 Date: Tue, 6 Aug 1996 12:36:43 -0700 From: "M.R.Murphy" Message-Id: <199608061936.MAA26847@meerkat.mole.org> To: jc@netview.net Subject: Re: discriminating system messages from multiple hosts Cc: questions@FreeBSD.org Sender: owner-questions@FreeBSD.org X-Loop: FreeBSD.org Precedence: bulk > From owner-freebsd-questions@freefall.freebsd.org Tue Aug 6 12:05:26 1996 > Date: Tue, 6 Aug 1996 13:24:58 -0500 (EST) > To: questions@FreeBSD.org > From: John Clark > Subject: discriminating system messages from multiple hosts > > Hello, > > I have just recently started logging messages from one server to another > (using a line in /etc/syslog.conf). The first thing that immediately > strikes me is the need to log each server to its own set of log files. Can > someone tell me if this is possible, and how to do it? > Each server will have its messages identified by server in the single log file. Use awk to extract the information by server from the log file. This makes logfile rotation easier. It's not hard to do the awk. As an example, for the following snippet of log file (/var/log/messages) Aug 6 12:27:50 mouse syslog: UU.SCF SUCCESSFUL meerkat R(0) Aug 6 12:27:50 mouse syslog: UU.SCS mole 9999 Aug 6 12:27:50 mouse syslog: UU.SCF SUCCESSFUL mole R(0) Aug 6 12:27:50 mouse syslog: UU.SCE end Aug 6 12:27:50 mouse syslog: UU.HRE scheduling complete Aug 6 12:30:11 meerkat popper[26839]: Stats: kjm 0 0 0 0 Aug 6 19:30:44 mole /kernel: sio1: 45 more interrupt-level buffer overflows (total 757) Aug 6 12:30:02 mouse syslog: CR.RHB begin root.hh Aug 6 12:30:02 mouse syslog: CR.RST time reset (2181230.01, 2181230.01) Aug 6 12:30:02 mouse syslog: CR.RHE end root.hh awk '$4 == "meerkat" {print}' /var/log/messages will print Aug 6 12:30:11 meerkat popper[26839]: Stats: kjm 0 0 0 0 Regards, Mike -- Mike Murphy mrm@Mole.ORG +1 619 598 5874 Better is the enemy of Good