/var/log/messages filling up with DHCPDISCOVER messages

[sdafreebsduk at rowyerboat.com]

Thanks to both of you... I'd already sussed out and used what Mel 
suggested, but I've learnt for the future, from Jeff's suggestion.  It 
all makes sense going back through the man pages, when you get a couple 
of examples explained to you.

Many thanks,
Steve ;)
-- 

Mel wrote:
> On Monday 08 October 2007 16:24:22 Jeff Royle wrote:
>> Stephen Allen wrote:
>>> /usr/local/etc/dhcpd.conf is configured with
>>>
>>>      "log-facility local7;"
>>>
>>> and /etc/syslog.conf is also configured with
>>>
>>>      "local7.*  /var/log/dhcpd.log"
>>>
>>> However, /var/log/messages is filling up with "DHCPDISCOVER / no free
>>> leases" messages for those clients that are unknown to the DHCP server
>>> (eg. on a different subnet).  I suspect that these messages are being
>>> caught by "*.notice" which is why they end up in /var/log/messages.
>>>
>>> Is there a way to prevent this happening?
>> You could try filtering them out of syslog like so (in your syslogd.conf):
>>
>> "local7.!=notice  /var/log/dhcpd.log"
>>
>> Which should log everything for local7 except notice. See man
>> syslog.conf(5)
> 
> Almost correct but he doesn't want /var/log/messages filling up, so add 
> local7.none to the line that points to /var/log/messages, ie:
> --- /etc/syslog.conf    2007-09-20 09:22:55.000000000 -0800
> +++ /etc/syslog.conf.dhcpd      2007-10-09 14:32:18.000000000 -0800
> @@ -6,7 +6,7 @@
>  #      may want to use only tabs as field separators here.
>  #      Consult the syslog.conf(5) manpage.
>  *.err;kern.warning;auth.notice;mail.crit               /dev/console
> -*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err  /var/log/messages
> +*.notice;local7.none;authpriv.none;kern.debug;lpr.info;mail.crit;news.err      /var/log/messages
>  security.*                                     /var/log/security
>  auth.info;authpriv.info                                /var/log/auth.log
>  mail.info                                      /var/log/maillog
> 
>