/var/log/messages filling up with DHCPDISCOVER messages

[Mel]

On Monday 08 October 2007 16:24:22 Jeff Royle wrote:
> Stephen Allen wrote:
> > /usr/local/etc/dhcpd.conf is configured with
> >
> >      "log-facility local7;"
> >
> > and /etc/syslog.conf is also configured with
> >
> >      "local7.*  /var/log/dhcpd.log"
> >
> > However, /var/log/messages is filling up with "DHCPDISCOVER / no free
> > leases" messages for those clients that are unknown to the DHCP server
> > (eg. on a different subnet).  I suspect that these messages are being
> > caught by "*.notice" which is why they end up in /var/log/messages.
> >
> > Is there a way to prevent this happening?
>
> You could try filtering them out of syslog like so (in your syslogd.conf):
>
> "local7.!=notice  /var/log/dhcpd.log"
>
> Which should log everything for local7 except notice. See man
> syslog.conf(5)

Almost correct but he doesn't want /var/log/messages filling up, so add 
local7.none to the line that points to /var/log/messages, ie:
--- /etc/syslog.conf    2007-09-20 09:22:55.000000000 -0800
+++ /etc/syslog.conf.dhcpd      2007-10-09 14:32:18.000000000 -0800
@@ -6,7 +6,7 @@
 #      may want to use only tabs as field separators here.
 #      Consult the syslog.conf(5) manpage.
 *.err;kern.warning;auth.notice;mail.crit               /dev/console
-*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err  /var/log/messages
+*.notice;local7.none;authpriv.none;kern.debug;lpr.info;mail.crit;news.err      /var/log/messages
 security.*                                     /var/log/security
 auth.info;authpriv.info                                /var/log/auth.log
 mail.info                                      /var/log/maillog


-- 
Mel