Date: Wed, 19 Feb 1997 15:21:38 +0100 (MET) From: Andre Albsmeier <Andre.Albsmeier@mchp.siemens.de> To: msmith@atrad.adelaide.edu.au (Michael Smith) Cc: hackers@FreeBSD.ORG Subject: Re: License to kill annoying syslog feature? Message-ID: <199702191421.PAA07927@server.us.tld> In-Reply-To: <199702190339.OAA09285@genesis.atrad.adelaide.edu.au> from Michael Smith at "Feb 19, 97 02:09:33 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
> > If I have a syslog.conf fragment like : > > ! > *.notice /var/log/messages > !zog > * /var/log/zog.log > > And the 'zog' programs logs something at *.notice, the log message ends up > in both places. > > This is a _spectacular_ pain in the ass with things like socks, which > are odiously verbose. (And some of our own software, but I have a > brick waiting for the pleb responsible for that problem, so we can > ignore it here.) > > I'd like to know what people think about a couple of possibilities : > > 1) Only log stuff to the 'wildcard' file entry if it hasn't matched another > rule already. > > or > > 2) Add another meta-config entry like !, say %, which implies that > log messages from the named program will _only_ be processed according > to the following rule(s). > > Of the two, 1) is likely to have the traditionalists unhappy but introduces > fewer platform incompatabilities. I am very happy with the IRIX 5.3 syslog. It supports the syntax *.debug;kern.none;user.none |/var/syslog/log-filter /var/syslog/all which pipes all messages through /var/syslog/log-filter and this script decides what to do with them. So I get my squid, socks, slip, etc. logs all in different files and can for example ignore some messages with the same level and priority depending on the process that sends them. This is the only reason why I still have my old SGI 4D25 running on my networks... as loghost. This would also be an option which IMHO allows most flexiblity and is compatible to the old syslog.conf file because the | defines the presence of a filter. -Andre
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199702191421.PAA07927>