Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to send some log messages out to a remote log server, and change the facility on them to a configured value so the log server can tell more easily that they came from my hardware. That is, all logs coming out of my machine are, say, local3, regardless of their original facility.

Can I do this with vanilla syslogd on FreeBSD, or using some other implementation?

share|improve this question

3 Answers 3

I think you trying to do something strange. You can easily sort messages in syslog depending on hostname they came from.

See man syslog.conf:

 A hostname specification of the form #+hostname or +hostname means
 the following blocks will be applied to messages received from the speci-
 fied hostname.  Alternatively, the hostname specification #-hostname or
 -hostname causes the following blocks to be applied to messages from
 any host but the one specified.  If the hostname is given as @, the
 local hostname will be used.  As for program specifications, multiple
 comma-separated values may be specified for hostname specifications.
share|improve this answer
    
Yes, it is strange as it turns out, but it has nothing to do with incoming logs; I want to modify the ones going out. –  Andrew Fleenor Jul 25 '11 at 2:14
up vote 1 down vote accepted

Apparently it is not possible to do this with FreeBSD syslog. I've scoured the man page for any clue and found nothing.

According to this web page you can do it with syslog-ng, but we're not in a position to switch.

share|improve this answer

As Andrew itself found out, syslog-ng would be the best option.

But I think there might be a kludgish way to do the trick even with vanilla FreeBSD syslogd. It seems to be possible to pipe log entries to an external program: you can then pipe the messages to logger and set the wanted facility & priority with it and ask logger to send the log entry to your log server.

logger probably adds its own timestamps etc to every log entry, so you might want to sed or whatever the original timestamps away.

Yes, I know, this approach would be ugly as hell and belongs to Don't Try This Anywhere category, but still it might work.

share|improve this answer
    
That's pretty close to what I did, and it was indeed ugly. But I had problems getting remote servers to accept messages from logger using the -h option. It sends the messages from any old UDP port, and my rsyslog server apparently didn't like that. –  Andrew Fleenor Jul 27 '11 at 4:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.