5

I am looking at bunch of syslog messages written by dhcpd. I want to write a quick parser that can deconstruct the message into its component parts, but I don't know what the various parts mean. I assume this is documented somewhere, but my simple queries (like dhcpd syslog message format) on Google have failed to turn up any useful documentation.

Improve this question
5
  • If you can't find anything else, the definitive place to look would be the source code (isc.org/downloadables/12).
    – Zoredache
    Jan 27, 2010 at 22:29
  • Yeah, I am hoping it doesn't come to that.
    – Chas. Owens
    Jan 27, 2010 at 22:47
  • also... don't forget that the message format may change between the releases/updates
    – rytis
    Jan 28, 2010 at 8:30
  • @pulegium Not necessarily. The messages might have a fixed format. That is why I want to see docs rather than just examine the code. The docs will state whether or not the format will change. If the format is not documented, then yes, I can't trust the source to be accurate for anything but that release.
    – Chas. Owens
    Jan 28, 2010 at 14:12
  • yes i see what you mean.. my rule of thumb though is never trust arbitrary messages (read: syslog :) )
    – rytis
    Jan 28, 2010 at 20:15

3 Answers 3

Reset to default
1

Why parse the log files? What you really want to read is the leases file. That's where all the useful information is, and its format is very machine-readable.

Improve this answer
1
  • Leases largely tells you about what went right. The log file may indicate certain errors that may be occurring, such as addresses being consistently declined, clients that flood discovers without accepting offers, etc. Note that certain information in the log file is client-generated, such as remote station name; be sure that any parsing you do takes this into consideration.
    – medina
    Jun 12, 2010 at 13:52
1

I experienced the same agony just like you. I seached on Google for several hours but no result. Finally, I found in the "man in.dhcpd", at the part of "-l syslog_local_facility", there is a format description for the log file.

Improve this answer
0

dhcpd is pretty sparsely documented in general - I've never seen docs on the logging format.

I think the source is your best hope.

Improve this answer
1
  • Yeah, when I didn't get pointed in the right direction in a few hours I went ahead and started reading the code. I have a better, if fuzzy, understanding of the specific message types I want. I am going to answer my own question with detailed info later when I am certain I know what the values are.
    – Chas. Owens
    Jan 28, 2010 at 20:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .