Re: [loganalysis] determining faciliy.level (was Logging standards and such)

From: Andrew Stribblehill (a.d.stribblehillat_private)
Date: Fri Aug 17 2001 - 01:57:56 PDT

  • Next message: Matthew Collins: "Re: [loganalysis] Re: Central syslog server best practices?" 

    Quoting Marget, Chris <Chris.Margetat_private>:
> 
> this is a detail that's long bugged me.  is there a way (with vanilla
> syslog) to determine the facility and level with which a message was logged?
> the best i've been able to do is breaking up syslog's output files, and
> [strace|truss]ing the applications or syslog.  not very pretty.

Apparently there is with FreeBSD (use the -v flag) but not in
general. I chose to run syslog-ng on my central logging box, with the
output set to:

destination d_splitboth {
        file("/acctscratch/log/$FACILITY.$PRIORITY"); 
};

To save the other admins on the logging box (which also does the
accounts) from heartache, syslog-ng only takes its logs from UDP
whilst the native Solaris syslogd has been told NOT to listen to UDP
packets.

-- 
Andrew Stribblehill
Systems programmer, IT Service, University of Durham, England

---------------------------------------------------------------------
To unsubscribe, e-mail: loganalysis-unsubscribeat_private
For additional commands, e-mail: loganalysis-helpat_private

    This archive was generated by hypermail 2b30 : Fri Aug 17 2001 - 08:34:26 PDT