<div dir="auto"><div>Hi,<div dir="auto"><br></div><div dir="auto">There's no facility code for named, basically the list of facility codes have been frozen for 30 years, so really not up to the task.</div><div dir="auto"><br></div><div dir="auto">That syslog-ng.conf file could be simplified a lot, if you don't require so many log files, I'd recommend something simple like this:</div><div dir="auto"><br></div><div dir="auto">```</div><div dir="auto"><br></div><div dir="auto">@version: 3.17</div><div dir="auto"><br></div><div dir="auto">source s_local {</div><div dir="auto"> system();</div><div dir="auto">};</div><div dir="auto"><br></div><div dir="auto">log {</div><div dir="auto"> source(s_local);</div><div dir="auto"> destination { file("/var/log/syslog"); };</div><div dir="auto">};</div><div dir="auto"><br></div>```</div><div dir="auto"><br></div><div dir="auto">And start adding your custom rules from here.</div><div dir="auto"><br></div><div dir="auto">The named process can be matched easily with this filter expression:</div><div dir="auto"><br></div><div dir="auto">```</div><div dir="auto">filter f_named { program("named"); };</div><div dir="auto">```</div><div dir="auto"><br></div><div dir="auto">No need to use facility codes, the program name is enough.<br><br><div class="gmail_quote" dir="auto"><div dir="ltr">On Fri, Oct 5, 2018, 06:46 Ruben Safir <<a href="mailto:ruben@mrbrklyn.com">ruben@mrbrklyn.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello<br>
<br>
I am trying to log named to syslog_ng and it is not set up by default on<br>
arch or artex.<br>
<br>
I set up named for logging, I think<br>
<br>
<br>
logging {<br>
category default { log_syslog; };<br>
channel log_syslog { syslog; };<br>
};<br>
<br>
<br>
in the config file for syslog_ng I had added<br>
<br>
<br>
destination d_mail { file("/var/log/mail.log"); };<br>
destination d_named { file("/var/log/named.log"); };<br>
destination d_news { file("/var/log/news.log"); };<br>
<br>
I am looking at filters and have no idea what to do<br>
<br>
filter f_auth { facility(auth); };<br>
filter f_authpriv { facility(auth, authpriv); };<br>
filter f_syslog { program(syslog-ng); };<br>
filter f_cron { facility(cron); };<br>
filter f_daemon { facility(daemon); };<br>
filter f_kernel { facility(kern) and not filter(f_iptables); };<br>
filter f_lpr { facility(lpr); };<br>
filter f_mail { facility(mail); };<br>
filter f_news { facility(news); };<br>
filter f_user { facility(user); };<br>
filter f_uucp { facility(uucp); };<br>
filter f_ppp { facility(local2); };<br>
filter f_debug { not facility(auth, authpriv, news, mail); };<br>
filter f_messages { level(info..warn) and not facility(auth, authpriv,<br>
mail, news, cron) and not program(syslog-ng) and not filter(f_iptables); };<br>
filter f_everything { level(debug..emerg) and not facility(auth,<br>
authpriv); };<br>
filter f_emergency { level(emerg); };<br>
filter f_info { level(info); };<br>
filter f_notice { level(notice); };<br>
filter f_warn { level(warn); };<br>
filter f_crit { level(crit); };<br>
filter f_err { level(err); };<br>
filter f_iptables { match("IN=" value("MESSAGE")) and match("OUT="<br>
value("MESSAGE")); };<br>
filter f_acpid { program("acpid"); };<br>
<br>
<br>
I don't know if there is a built in facilty for named. The docs for the<br>
server and very detailed and rich, and overwhelming.<br>
<br>
Ruben<br>
<br>
<br>
-- <br>
So many immigrant groups have swept through our town<br>
that Brooklyn, like Atlantis, reaches mythological<br>
proportions in the mind of the world - RI Safir 1998<br>
<a href="http://www.mrbrklyn.com" rel="noreferrer noreferrer" target="_blank">http://www.mrbrklyn.com</a><br>
DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002<br>
<br>
<a href="http://www.nylxs.com" rel="noreferrer noreferrer" target="_blank">http://www.nylxs.com</a> - Leadership Development in Free Software<br>
<a href="http://www.brooklyn-living.com" rel="noreferrer noreferrer" target="_blank">http://www.brooklyn-living.com</a><br>
<br>
Being so tracked is for FARM ANIMALS and and extermination camps,<br>
but incompatible with living as a free human being. -RI Safir 2013<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div></div></div>