syslogd facility

[Andy Farkas]

On Fri, 2 May 2003, Antoine Jacoutot wrote:

> I am trying to log the accesses to my webmail system.
> It works nice except that I get logs twice: ionce in /var/log/horde.log, which
> is OK and one in /var/log/messages which I don't want.
>
> My syslog.conf contains this lines:
>
> *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages
> [...]
> !HORDE
> *.*	/var/log/horde.log
>
> So I though I wouls tweak the line concerning /var/log/messages, which I did:
> *.notice;kern.debug;lpr.info;mail.crit;news.err;HORDE.none /var/log/messages
>
> >From now, it does not log to /var/log/messages anymore, but when I kill -HUP
> syslogd, I get this message:
> syslogd: unknown facility name "HORDE"
>
> ... well, indeed, syslogd is right.
>
> So does anyone know how I could do what I want ?
> Meaning logging accesses to my webmail --> /var/log/horde.log only
>
> Thanks in advance?
>
> Antoine

I can suggest two things. 1/ run syslogd with -vv flags. This will show
what level/facility messages have. 2/ log everything to /var/log/all.log
by uncommenting the line in /etc/syslog.conf. Now you can tail -f and
watch what gets logged.

Also, read "man syslog.conf" very carefully.

Hope that helps.

--

 :{ andyf at speednet.com.au

        Andy Farkas
    System Administrator
   Speednet Communications
 http://www.speednet.com.au/