2

At my office I recently wondered aloud to all, "Why shouldn't these logs be redirected to /dev/null instead of /dev/lognull?" I was told that there is (or was) a reason, but no one could remember it. I was told that the reasons is in the syslog-ng documentation somewhere, but so far I haven't been able to find it. Does anybody know the reason?

1
  • 1
    Watching this one because I've never heard of lognull.
    – phoebus
    Dec 3, 2009 at 2:38

3 Answers 3

4

I was just emailed this from my boss:

Well, we named it lognull, but that was just our choice. I found the reason again. Syslog-ng wants to change the permissions on the file it uses for logging, including /dev/null. Lots of other things in the system (incl. things not running as root) depend on /dev/null being readable and writable. That's why you're supposed to use a separate device file:

odin ~ # ls -ld /dev/null crw------- 1 root root 1, 3 Sep 30 15:48 /dev/null

Maybe the easiest thing would be for the init script for syslog-ng to create something like /dev/lognull so it's always available for the system. I think the problem is that it goes away after a reboot because of the dynamic nature of devices now. That wasn't the case when we ran all this on older versions of Linux or on Solaris. Does this make sense?

And I also found this thread on the syslog-ng list about the issue. So far I've followed the advice about an empty destination.

1
  • Please mark this as the correct answer to the question.
    – pauska
    Dec 3, 2009 at 15:25
2

I have never heard of /dev/lognull.

What does this return?

ls -l /dev/null /dev/lognull

I suppose it's possible syslog-ng is creating that device node, but man, seems very strange.

I have to admit I'd find it pretty entertaining if /dev/lognull were a large regular file. :)

2
  • See that's the problem, when I last remember looking I would swear lognull was a device file, but when I looked more recently it was an enormous regular file and it was causing problems. Dec 3, 2009 at 3:48
  • 3
    I have no idea what it would do that is different than /dev/null, and searching for /dev/lognull through various engines returns only this question. I think perhaps you need more or less coffee. :) Dec 3, 2009 at 8:28
1

Simply define a log statement with a source but no destination: https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.21/administration-guide/55#TOPIC-1180579

To skip the processing of a message without sending it to a destination, create a log statement with the appropriate filters, but do not include any destination in the statement, and use the final flag.

2
  • 2
    This does not answer the question.
    – womble
    May 17, 2019 at 0:15
  • 1
    @womble: The question is based on the mistaken assumption that all messages processed by syslog-ng need to have a defined destination. As indicated by this answer, if you want syslog-ng to discard some messages, the correct solution has two parts: to not define a destination for them, and use the final flag to stop further processing of logging rules. This way you don't have to create any non-standard /dev/lognull devices or anything like that.
    – telcoM
    May 17, 2019 at 6:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .