From owner-freebsd-hackers Thu Feb 20 09:00:16 1997 Return-Path: Received: (from root@localhost) by freefall.freebsd.org (8.8.5/8.8.5) id JAA22873 for hackers-outgoing; Thu, 20 Feb 1997 09:00:16 -0800 (PST) Received: from mole.mole.org (marmot.mole.org [204.216.57.191]) by freefall.freebsd.org (8.8.5/8.8.5) with SMTP id JAA22868 for ; Thu, 20 Feb 1997 09:00:13 -0800 (PST) Received: (from mail@localhost) by mole.mole.org (8.6.12/8.6.12) id RAA03415; Thu, 20 Feb 1997 17:01:11 GMT Received: from meerkat.mole.org(206.197.192.110) by mole.mole.org via smap (V1.3) id sma003413; Thu Feb 20 17:00:56 1997 Received: (from mrm@localhost) by meerkat.mole.org (8.6.11/8.6.9) id IAA06173; Thu, 20 Feb 1997 08:59:54 -0800 Date: Thu, 20 Feb 1997 08:59:54 -0800 From: "M.R.Murphy" Message-Id: <199702201659.IAA06173@meerkat.mole.org> To: Andre.Albsmeier@mchp.siemens.de, syssgm@devetir.qld.gov.au Subject: Re: License to kill annoying syslog feature? Cc: freebsd-hackers@freebsd.org Sender: owner-hackers@freebsd.org X-Loop: FreeBSD.org Precedence: bulk > > >I am very happy with the IRIX 5.3 syslog. It supports the syntax > > > >*.debug;kern.none;user.none |/var/syslog/log-filter /var/syslog/all > > > >which pipes all messages through /var/syslog/log-filter and this script > >decides what to do with them. So I get my squid, socks, slip, etc. logs > >all in different files and can for example ignore some messages with > >the same level and priority depending on the process that sends them. > > Shouldn't we add better log filtering to syslogd instead? Its function > should be to accept messages, discard unnecessary ones, and log the required > ones to the appropriate log files. If it is not up to this task, and we > add a shell filter escape, isn't that the same thing as saying that syslogd > is bogus and useless? > > Add some new syntax supporting arbitrary regular expressions. That should > be enough for everyone. > I'd like to, once again, be a curmudgeon and disagree. I'd prefer syslogd to just do _one thing_ well: reliably log the messages I configure it to log. If I want them filtered, well, that's what awk, sed, grep, perl, ..., the tools of a toolset-oriented system are for. Please don't build the electric coffee pot controller into the FPU. (for the humor-impaired of us, me being one from time to time, that means don't get creeping featurism). Keep it small and simple. BTW, on a system that logs a reasonable amount of messages and supports 4000+ users, $ du -k -s /var/log 11348 /var/log That's a weeks worth of compressed logs. -- Mike Murphy mrm@Mole.ORG +1 619 598 5874 Better is the enemy of Good