How to supress specific message in syslogd 1.4.1

Question

Is there any way to suppress specific message in syslogd? I have couple of Linux Oracle 5.10 servers with syslogd 1.4.1 As all my servers are production servers - I can't upgrade syslogd to rsyslogd (where filtering messages is possible). Any idea how to achieve it?

Answer 1

As you've already found, the old syslogd does not have that kind of filtering abilities in itself. This means that if you want to filter those messages out, you'll need to use some external program to filter for you.

If you're in any kind of large environment, I'd start by recommending that you set up a separate syslog server, and redirect logs to that one. On that server, you can use a more modern syslog application which has filtering functions.

However, if you want or need to keep the kernel logs on the local machine, you can get around this by a bit of trickiness.

The easiest way is to have syslog write the log to a non-standard log file, e.g.

kern.err          /var/tmp/kernel-unfiltered

Then you can simply have a script to watch /var/tmp/kernel-unfiltered, and for any line that does not match the thing you want to filter, re-inject it with logger but with another facility or loglevel, or simply writing directly to the logfile you do want.

Another method would be using a pipe. Syslogd can't write directly to a program (otherwise piping to grep -v THEMESSAGE > /var/log/kernel.log would be the obvious solution), but it can log to a named pipe - and then you can have a separate program read from that pipe and filter out the messages you want, and either re-inject the message or write it directly to a logfile. You would create the pipe using e.g.

mkfifo /var/tmp/logfifo

and config would be

kern.err          |/var/tmp/logfifo

The advantage here would be less risk of filling up the file system with junk, compared to using an actual file.

Both these solutions will probably cause a lot of headaches to any new person taking over these systems, unless well documented.