[comp.unix.questions] syslog.conf question

eric@brolga.cc.uq.oz.au (Eric Halil) (06/05/91)

We're running SunOS 4.1 and I've had problems with the syslog.conf file.

When I have the following line in my syslog.conf

    local6.info;local6.err;local6.warning			/some/file

and I try logging to LOG_INFO it doesn't write to /some/file though
both LOG_WARNING and LOG_ERR get logged to /some/file ok.

But, if I have

    local6.err;local6.warning;local6.info			/some/file

they ALL get logged properly to /some/file.

Is this a problem with my conf file configuration, or a bug in syslogd or ...
BTW, I kill -HUP syslogd after making changes to syslog.conf

Thanks,
Eric.
--
Eric Halil                           |Internet/CSnet:         eric@cc.uq.oz.au
Prentice Computer Centre             |Bitnet:    eric%cc.uq.oz.au@uunet.uu.net
University of Queensland    4072     |UUCP:        uunet!munnari!cc.uq.oz!eric
AUSTRALIA --   Phone: +61 7 365 3610 |JANET:        eric%cc.uq.oz.au@uk.ac.ukc

Tom Christiansen <tchrist@convex.COM> (06/05/91)

From the keyboard of eric@brolga.cc.uq.oz.au (Eric Halil):
:We're running SunOS 4.1 and I've had problems with the syslog.conf file.
:
:When I have the following line in my syslog.conf
:
:    local6.info;local6.err;local6.warning			/some/file
:
:and I try logging to LOG_INFO it doesn't write to /some/file though
:both LOG_WARNING and LOG_ERR get logged to /some/file ok.
:
:But, if I have
:
:    local6.err;local6.warning;local6.info			/some/file
:
:they ALL get logged properly to /some/file.
:
:Is this a problem with my conf file configuration, or a bug in syslogd or ...

Only specify the *highest* syslog priority you are concerned about.
The conf file means log UP TO that level.  Mixing them on the same
line will confuse things, as will having *.foo entries except at
the front of the line.  syslogd -d, or source code, can help you
figure this out.

--tom
--
Tom Christiansen		tchrist@convex.com	convex!tchrist
	    "Perl is to sed as C is to assembly language."  -me

armhold@porthos.rutgers.edu (George Armhold) (06/05/91)

tchrist@convex.COM (Tom Christiansen) writes:
>Only specify the *highest* syslog priority you are concerned about.
>The conf file means log UP TO that level.  Mixing them on the same
>line will confuse things, as will having *.foo entries except at
>the front of the line.  syslogd -d, or source code, can help you
>figure this out.

Perhaps I am reading you wrong, but what syslogd actually does is log
messages from the specified level up FROM that level, not TO it .  ie
if you specify a level of "crit", you will get crit, alert, and emerg
all logged.  Here is an excerpt from the man page:

EXAMPLE
     With the following configuration file:
         *.notice;mail.info     /var/log/notice
         *.crit                 /var/log/critical
         kern,mark.debug        /dev/console
         kern.err               @server
         *.emerg                *
         *.alert                root,operator
         *.alert;auth.warning   /var/log/auth

     syslogd will log all mail system messages except debug  mes-
     sages  and all notice (or higher) messages into a file named
     /var/log/notice.   It  logs  all  critical   messages   into
     /var/log/critical,  and  all  kernel  messages and 20-minute
     marks onto the system console.

Another problem might be that he isn't creating the log files before
he does a kill -HUP on syslogd- syslogd won't write to files that
don't yet exist.  You need to touch the logfile first.

-George

-- 
		 Internet: armhold@aramis.rutgers.edu
	 UUCP: {backbone}!rutgers!aramis.rutgers.edu!armhold
		    BITNET: armhold@PISCES.BITNET

tchrist@convex.COM (Tom Christiansen) (06/06/91)

From the keyboard of armhold@porthos.rutgers.edu (George Armhold):
:Perhaps I am reading you wrong, but what syslogd actually does is log
:messages from the specified level up FROM that level, not TO it .  ie
:if you specify a level of "crit", you will get crit, alert, and emerg
:all logged.  

Right -- I was standing on my head when I wrote that. :-)  I had the
up-down stuff reversed in my brain.

--tom
--
Tom Christiansen		tchrist@convex.com	convex!tchrist
		"So much mail, so little time."