Re: tlug: syslog messages...?

[Scott Stone <sstone@example.com>]

On Wed, 7 Oct 1998, Rex Walters wrote:

> >>>>> Scott Stone writes:  (on 07 Oct 98)
> 
> > 
> > What the heck is this:
> > 
> > Oct  7 19:44:15 porcupine -- MARK --
> > 
> > I have tons of these -- MARK -- things in /var/log/messages.
> > /var/log/messages is set up to receive:
> > 
> > *.info;mail.none;authpriv.none
> 
> Interesting.  Assuming that above line is from /etc/syslog.conf on host
> porcupine (and that it is the only applicable line in the file) it
> appears that "*" now matches the "mark" facility in syslog.  It used to
> be that "*" matched everything *except* mark.
> 
> Probably more than you wanted to know, but I've a long association with
> syslog:
> 
> "Facilities" in syslog are like channels on your TV.  Messages are
> logged to syslog over "facilities" with a given "priority".  In
> /etc/syslog.conf you specify what actions to take when a message at a
> given priority or higher arrives over a given "facility" (channel).
> 
> If /etc/syslog.conf on porcupine contains *ONLY* the line:
> 
>     *.info; mail.none; authpriv.none	/var/log/messages
> 
> (unclear from your post) then it means that:
> 
>     1) Any message over any (*) channel at priority "info" or higher is
>        sent to /var/log/messages (on porcupine).  (i.e. only messages
>        with a priority of "debug" are ignored; in order, the priorities
>        are debug, info, notice, warning, error, crit, alert, panic).
> 
>     2) Except messages over the "mail" facility, which are ignored.  
>        ("none" is a special "priority" meaning nothing should match.)
> 
>     3) Except messages over the "authpriv" facility, which are ignored..

Actually, the conf has (minus comment lines):

kern.*	/var/log/kernmsg
*.info;mail.none;authpriv.none	/var/log/messages
authpriv.*	/var/log/secure
mail.*		/var/log/maillog
*.emerg		*
uucp,news.crit	/var/log/spooler


Also, I have 'daemontools', but I usually use the standard syslogd/klogd
instead..

--------------------------------------------------
Scott M. Stone <sstone@example.com, sstone@example.com>
               <sstone@example.com>
Head of TurboLinux Development/Systems Administrator
Pacific HiTech, Inc (USA) / Pacific HiTech, KK (Japan)
http://www.pht.com		http://armadillo.pht.co.jp
http://www.pht.co.jp	        http://www.turbolinux.com


---------------------------------------------------------------
Next Meeting: 10 October, 12:30 Tokyo Station Yaesu central gate
Featuring the IMASY Eng. Team on "IPv6 - The Next Generation IP"
Next Nomikai: 20 November, 19:30  Tengu TokyoEkiMae 03-3275-3691
---------------------------------------------------------------
Sponsor: PHT, makers of TurboLinux http://www.pht.co.jp