Re: question about NetBSD syslog

cheusovtut.by (Aleksey Cheusov) writes:

>I think the following scheme

>func do_syslog (line)
>{
>   if (match1(line)){
>      action1(line)
>   }elif if (match2(line)){
>      action2(line)
>   }elif ...
>   ...
>}

>scheme is a reasonable alternative.

This just drops a valuable feature: logging events to
multiple destinations independently.

The thing that you cannot do with syslog now is to
log only low priority events but skip high priority
events. I.e.:

user.info	only-info.log

will result in only-info.log to get all events with
priority info or higher.

With your scheme you could do

user.notice	/dev/null
user.info	only-info.log

and divert the higher priority events to /dev/null
(or some other log file).

A better way of doing things is to distinguish these
events not by priority but by facility. But sometimes
you have no control over this.

Of course you could also use sysutils/syslog-ng which
has a rich set of filters.

-- 
-- 
                                Michael van Elst
Internet: mlelstvserpens.de
                                "A potential Snark may
lurk in every tree."

On Thu, 24 May 2007, Michael van Elst wrote:

> This just drops a valuable feature: logging events to
> multiple destinations independently.

That could be just an option. (Coding seems very simple. See
my other 
email.)

> The thing that you cannot do with syslog now is to
> log only low priority events but skip high priority
> events. I.e.:
> 
> user.info	only-info.log
> 
> will result in only-info.log to get all events with
> priority info or higher.

Use the "=" (equal) comparison flag. See the
syslog.conf(5) man page.

user.=info	only-info.log

Or use the syslogd -U switch. See the syslogd(8) man page.


  Jeremy C. Reed