LinuxSA Mailing list archives

  From: Daryl Tester <Daryl.Tester@IOCANE.com.au>
  To  : Matthew Western <mwestern@affairs.net.au>
        linuxsa@linuxsa.org.au <linuxsa@linuxsa.org.au>
  Date: Thu, 30 May 2002 13:13:46 +0930

RE: Syslog.conf Question

Matthew Western wrote:

> the man page of syslog.conf says that i can't just filter any old
> thing out to various /var/log/logfiles but i have to stick to
> only certain words.
> ie  auth, authpriv, cron, daemon, kern, lpr, mail, mark, news,
> security (same as  auth), syslog,  user,  uucp and local0
> through local7.

That's not how syslog works.  A "process" (can be kernel) logs to
a facility (auth, authpriv, etc ...), and that in turn is directed
to a particular file/whatever by syslogd.  It is not "grepping" for
a keyword - particular processes use particular facilities, but the
mapping is pretty arbitrary, and the facilities themselves are fixed.

I think syslog-ng has RE matching, but I've not used it.


Regards,
  Daryl Tester

-- 
LinuxSA WWW: http://www.linuxsa.org.au/  IRC: #linuxsa on irc.linux.org.au
To unsubscribe from the LinuxSA list:
  mail linuxsa-request@linuxsa.org.au with "unsubscribe" as the subject