Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am failing to get filtering by program or facility working in FreeBSD syslogd.

I added

local6.debug            /var/log/test.log
!testd
*.debug                 /var/log/test.log

to my /etc/syslog.conf and restarted the syslog daemon.

I then wrote a little Go program testd that sends a "debug" message to syslogd (facility "user") and then sent an additional message using logger -p local6.debug "msg". The first message was only logged to /var/log/messages (according to the default rules), but not to /var/log/test.log, the second one was not logged at all.

It seems the rules are being ignored?

share|improve this question
    
Did you have a look at /var/log/debug.log ? Can you paste entire /etc/syslog.conf ? Have you tried reproducing the issue with default syslog.conf (the one available at svnweb.freebsd.org/base/head/etc/…) –  coincoin Aug 22 '13 at 11:15
    
Thanks for the answer! Forgot about debug.log: the logger message is indeed there. I am using the default syslog.conf plus the three lines I pasted above the "!ppp" line/block. –  snøreven Aug 22 '13 at 11:58

1 Answer 1

It seems that your log messages are sent to /var/log/debug.log because of this line : *.=debug /var/log/debug.log

You can either :

  • Use another priority for your tests (eg notice instead of debug)
  • Change the order so that your lines are before the one referring to debug.log
share|improve this answer
    
Unfortunately that does not work. I already tried putting "local6.debug" as line #1 - doesn't change anything. –  snøreven Aug 22 '13 at 13:39
    
Did you try "# touch /var/log/test.log and chmod it to mode 600 before it will work"? –  coincoin Aug 22 '13 at 13:43
    
Aaah, that works for facility. I tried that before but I guess I forgot to restart syslog after creating the file. Filter by program name still does not work, but I think that's related to the syslog library I'm using. Please edit your answer so I can accept. –  snøreven Aug 22 '13 at 14:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.