From owner-freebsd-questions  Mon Feb 22 11:49:27 1999
Delivered-To: freebsd-questions@freebsd.org
Received: from procyon.meridian-enviro.com (thunder.meridian-enviro.com [207.109.234.227])
	by hub.freebsd.org (Postfix) with ESMTP id C627111052
	for <freebsd-questions@FreeBSD.ORG>; Mon, 22 Feb 1999 11:49:00 -0800 (PST)
	(envelope-from rand@meridian-enviro.com)
Received: from deneb.meridian-enviro.com (deneb.meridian-enviro.com [10.10.10.32])
	by procyon.meridian-enviro.com (8.9.2/8.9.2) with ESMTP id NAA28004;
	Mon, 22 Feb 1999 13:48:46 -0600 (CST)
Received: (from rand@localhost)
	by deneb.meridian-enviro.com (8.9.2/8.9.2) id NAA07759;
	Mon, 22 Feb 1999 13:48:53 -0600 (CST)
From: "Douglas K. Rand" <rand@meridian-enviro.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <14033.46245.609338.992333@deneb.meridian-enviro.com>
Date: Mon, 22 Feb 1999 13:48:53 -0600 (CST)
To: Patrick Seal <patseal@hyperhost.net>
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: syslog.conf
In-Reply-To: <Pine.BSF.4.05.9902211554000.37743-100000@foobar.hyperhost.net>
References: <Pine.BSF.4.05.9902211554000.37743-100000@foobar.hyperhost.net>
X-Mailer: VM 6.47 under 20.4 "Emerald" XEmacs  Lucid
X-Face: $L%T~#'9fAQ])o]A][d7EH`V;"_;2K;TEPQB=v]rDf_2s%<d5}=?&`PeE)<@]
        fT6ejN-VVK,Fej'k6570?"R$}bLKm84G-S?"!F8vaZ*8h}mM;@Xs%\I@8p8Rc
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

Patrick> I'm trying to restrict the messeges that fill up my messeges
Patrick> log file into a sudo log. This is what I have so far:

Patrick> *.notice;kern.debug;mail.crit        /var/log/messages
Patrick> !sudo
Patrick> *.*				      /var/log/sudo

Patrick> But sudo stuff still goes into messeges as well as sudo.  How
Patrick> can I restrict sudo stuff from the messeges file? I've tried
Patrick> sudo.none but that doesn't seem to help, and the man page
Patrick> isn't much help either.

I don't think you can do this, even with all the extensions to syslog
on FreeBSD.  If you want to throwaway your syslogd and get a new one
(http://www.aero.und.edu/~rand/syslogd) you'll be able to accomplish
what you want. (This is probably more work than you'll want to do
though.) 

Here is an extract from my syslogd.conf:

	facility auth {
		program "su" {
			file "/var/log/su";
			break;
		}
		file "/var/log/auth";
	};




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message