remote syslog to specific file

[David Robillard]

> Hello,
>
>
> I am trying to log my sonicwall FW log to a specific file…
>
> For the moment all logs are sent to /var/log/messages
>
> I would like them to go to /var/log/sonic.log
>
>
> I have tried couple of things which does not seem to work, among them :
>
> > +fw.xxx.yyy
> > local0.*		/var/log/sonic.log
> > +@
> --> not working
>
> > local0.*		/var/log/sonic.log
> --> not working either
>
>
> In /var/log/messages my log are of that format :
>
> > Dec 14 14:50:49 fw id=firewall sn=0006Bxxx4D6C time="2006-12-14
> > 14:50:45" fw=80.98.206.97 pri=5 c=64 m=36 msg="TCP connection
> > dropped" n=183 src=80.97.99.70:3763:WAN:89-90-99-70.pde.norby.ee
> > dst=192.168.2.3:135:LAN:newmail.rmm.fr proto=tcp/135
>
>
>
> Any help would be welcome.

Try installing those two lines in your syslog.conf(5) file and make
sure you use TAB instead of spaces.

!fw
*.*                         /var/log/sonic.log

Then issue a `sudo touch /var/log/sonic.log` as the file must exist
before syslogd(8) can write to it (i.e. syslogd(8) does not create
files).

After this run `sudo /etc/rc.d/syslogd restart` to instruct syslogd(8)
of the changes you've made to syslog.conf(5).

Finally, make sure you edit newsyslog.conf(5) with something like this
to keep your /var file system from filling up.

/var/log/sonic.log        www:wheel 640  7     100  *   J

man newsyslog.conf for more on newsyslog.conf(5)'s syntax.

Cheers,

David
-- 
David Robillard
UNIX systems administrator & Oracle DBA
CISSP, RHCE & Sun Certified Security Administrator
Montreal: +1 514 966 0122