- syslog-ng - lists.balabit.hu

solaris 8 x86 errors
by Nate Campi 26 Oct '01

26 Oct '01

I'm running syslog-ng 1.4.14 on a solaris 8 x86 box, logging over TCP to another syslog-ng loghost. I'm getting this error sporadically: pkt_buffer::do_flush(): Error flushing data Is this anything to worry about? All I see on this is a patch from 1999: http://lists.balabit.hu/pipermail/syslog-ng/1999-December/000376.html -- Nate Campi <nate(a)campin.net> www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 A mathematician is an engine for converting coffee into theorems.

2 2

RE: [syslog-ng]deleting log files - syslog-ng]
by Christian Hammers 26 Oct '01

26 Oct '01

Hello On Fri, Oct 26, 2001 at 12:11:48PM +0200, Thomas Kaehn wrote: > cp /some/where/file.log /some/where/old/file.log.old > cp /dev/null /some/where/file.log > This way, file still exists and file descriptos are not closed. > However, this is not atomic, one might lose logged lines before > file is truncated. Better idea: mv logfile logfile.old kill -WHATEVER syslog-ng This way it would continue writing into the moved file until I restart it which would flush buffers, close the file and then crate a new one. But a fstat() call at each write would be a more elegant solutuion if it doesn't slow down writing too much. > -MNi bye, -christian- -- Christian Hammers WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 ch(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

4 3

deleting log files - syslog-ng
by Thomas Kaehn 26 Oct '01

26 Oct '01

Hello, is it possible that I have to restart syslog-ng, when deleting a log file? I log from different hosts to different files using $HOST in the config-file. If I delete one file of them it is not created until restarting syslog-ng. Is it possible to change this behaviour. Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

3 2

syslog-ng 1.5.12 and use_time_recvd()
by Jon Bidinger 26 Oct '01

26 Oct '01

I'm using syslog-ng as a syslogd replacement for a centralized log server. I'm also monitoring the logs using swatch. One of the options for swatch is to throttle messages that are repeating over a period of time. The problem I'm having is that I have servers over many different timezones logging to the log server. This seems to confuse swatch since it can't tell which machine is in which timezone. After reading the docs for syslog-ng, use_time_recvd()seemed like the perfect option. However, after putting it in my options, the output doesn't change. Am I doing something wrong or is there a problem with this feature? from my /etc/syslog-ng/syslog-ng.conf options { sync(0); time_reopen(10); log_fifo_size(100); use_time_recvd(yes); }; Thanks, - Jon =============================================================== Jon Bidinger Email: jpb(a)fairisaac.com

3 2

syslog-ng crash
by Thomas Kaehn 26 Oct '01

26 Oct '01

Hello, syslog-ng crashes several times per hour. I get the following error message: ol_object_check: Type error! What is the possible cause of this problem? Is there a possibility to fix it? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

2 2

Fw: [syslog-ng]logger, locales and syslog-ng
by todd glassey 26 Oct '01

26 Oct '01

----- Original Message ----- From: "Gregor Binder" <gb(a)rootnexus.net> Sent: Thursday, October 25, 2001 6:56 AM Subject: Re: [syslog-ng]logger, locales and syslog-ng > Thomas Kaehn on Thu, Oct 25, 2001 at 03:04:04PM +0200: > > > Is it possible to configure syslog-ng that it does > > not look at the date of the incoming log packet? > > use_time_recvd(yes) .. see documentation. Bazsi - Can we create a timestamp_recvd(yes) parameter that digitally timestamps, hashes and signs the timestamps with MD5 and SHA-1/2 routines? Todd > > -- > ____ ____ > / _/| - > Gregor Binder <gb(a)(rootnexus.net|sysfive.com)> > | / || _\ \ > \__ Id: 0xE2F31C4B Fp: 8B8A 5CE3 B79B FBF1 5518 8871 0EFB AFA3 E2F3 1C4B > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

5 6

logger, locales and syslog-ng
by Thomas Kaehn 25 Oct '01

25 Oct '01

Hi, when trying to log to different files, by using the following configuration entry, syslog-ng does not handle all date information correctly. destination syslog { file("/var/log/syslog-$YEAR-$MONTH-$DAY" owner("root") group("adm") perm(0640)); }; If the environment-variable LC_ALL is set to de_DE logger produces a german-language output and syslog-ng logs the message to /var/log/syslog-2000-12-31. Is it possible to configure syslog-ng that it does not look at the date of the incoming log packet? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

2 2

RE: [syslog-ng]Syslog-ng overflow issue
by Clausing, James A (Jim), SOBUS 23 Oct '01

23 Oct '01

I've just noticed this problem when there is a \n embedded in the message, too (in 1.5.10). The stock Solaris syslog, keeps the \n and following string in the same log entry, syslog-ng is splitting it into a new entry and then concatenating the next message onto it. ---Jim Solaris syslogd: ---------------- Oct 23 13:28:41 altiga1 32467 10/23/2001 13:28:43.020 SEV=4 IKE/119 RPT=859 a.b.c.d Group [employee] User [e002808]\nPHASE 1 COMPLETED syslog-ng: ---------- Oct 23 12:29:04 altiga2 4851 10/23/2001 12:29:03.800 SEV=4 IKE/119 RPT=90 e.f.g.h Group [employee] User [e008694] Oct 23 12:29:04 altiga2 PHASE1 COMPLETED<149>4853 10/32/2001 12:29:03.800 SEV=5 IKE/25 RPT=262 e.f.g.h Group [employee] User [e008694] Received remote Proxy Host data in ID Payload: Address 192.168.0.191, Protocol 0, Port 0 -----Original Message----- From: todd glassey [mailto:todd.glassey@worldnet.att.net] Sent: Monday, October 15, 2001 6:42 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Syslog-ng overflow issue Or replicate the previous header and open a new line for this message content - which seems like it would be a whole lot more useful... T. ----- Original Message ----- From: "Mike Kelland" <MKelland(a)jetnet.ca> To: <syslog-ng(a)lists.balabit.hu> Sent: Monday, October 15, 2001 1:11 PM Subject: [syslog-ng]Syslog-ng overflow issue > I'm having a problem where if a syslog message is sent to syslog-ng which > exceeds a certain length, the piece of the message which was truncated off > the end is appended to the beginning of the next message sent. Is there a > way to cause syslog-ng to instead simply loose this truncated piece? > > Thanks, > Mike Kelland > > > <<...OLE_Obj...>> > Michael Kelland > Internetworking Applications Engineer > 333 Preston Street, 3rd Floor, > Ottawa, Ontario. K1S 5N4 > Ph. (613) 237-5995, ext 248 > Fax(613) 237-9002 > www.JETNET.ca > mkelland(a)JETNET.ca > > This communication contains confidential information intended solely for the > use of the individual/s and/or entity or entities to whom it was intended to > be addressed. If you are not the intended recipient, be aware that any > disclosure, copying, distribution or use of the contents of this > transmission is prohibited. If you have received this communication in > error, please contact the sender immediately, delete the communication from > your system and do not disclose its contents to any third party or use its > contents. Any opinions expressed are soley those of the author and do not > necessariy represent those of JETNET Internetworking Services Inc. unless > otherwise specifically stated. > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

type error fix
by Balazs Scheidler 23 Oct '01

23 Oct '01

Hi, The patch below hopefully fixes the "Type Error" problems reported in 1.5.12. I'd appreciate feedback whether it really fixes the bug. (if it does, expect a new version shortly) Thanks for the cooperation for those who helped me to track this issue. diff -urN syslog-ng-1.5.12/src/affile.c syslog-ng-1.5.12-fixed/src/affile.c --- syslog-ng-1.5.12/src/affile.c Sat Oct 20 15:03:59 2001 +++ syslog-ng-1.5.12-fixed/src/affile.c Mon Oct 22 21:22:18 2001 @@ -118,7 +118,7 @@ struct resource_node *res; lseek(fd, 0, SEEK_END); - self->src = io_read(make_io_fd(cfg->backend, fd, self->name), + self->src = io_read(make_io_fd(cfg->backend, fd, ol_string_use(self->name)), make_log_reader(0, c), NULL); res = REMEMBER_RESOURCE(cfg->resources, &self->src->super.super); @@ -218,7 +219,7 @@ self->owner->flags & AFFILE_CREATE_DIRS, &fd)) { self->dest = - io_write(make_io_fd(cfg->backend, fd, self->expanded_fname), + io_write(make_io_fd(cfg->backend, fd, ol_string_use(self->expanded_fname)), make_pkt_buffer_ext(self->owner->sync_freq, MAX(self->owner->super.log_fifo_size + 1, self->owner->sync_freq)), -- Bazsi

2 1

asyncronous logging
by Allen Bettilyon 22 Oct '01

22 Oct '01

Hello, I was wondering if syslog-ng supported asyncronous logging. Much like the "-" option of standard syslog: mail.* -/var/log/maillog -- Allen Bettilyon

2 3

Problem after HANGUP signal
by Jerome Poggi 21 Oct '01

21 Oct '01

I use Syslog-NG 1.5.11 on Linux 2.4.10 and when I send HANGUP signal to syslog-ng, I never seen the stats info more. For having it more long time, I must kill and restart syslog-ng. Is it a bug ? Jerome.

3 4

syslog-ng 1.5.12
by Balazs Scheidler 21 Oct '01

21 Oct '01

Hi, I've released syslog-ng 1.5.12 fixing a couple of bugs. Here's the NEWS entry: News for the 1.5.12 release Sun, 21 Oct 2001 13:03:53 +0200 Couple of bug fixes: * a bug in libol causing problems on PPC was found * fixed pipe chmod() problems * fixed problem with losing log sources during SIGHUP I don't plan to add any new features to this branch of syslog-ng, and plan to release 1.6 as soon as this branch stabilizes. I received reports that there's a crash bug in syslog-ng 1.5.11 (the type error problem) I was unable to reproduce it, but one of the fixes might affect it, so those who encountered this bug, _please_ try this release, and if the bug occurs, send me a syslog-ng -dv output (with --with-debug configure option for both libol and syslog-ng) Thanks. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

syslog-ng 1.5.11
by Balazs Scheidler 21 Oct '01

21 Oct '01

Hi, I released syslog-ng 1.5.11, which hopefully fixes the SIGKILL problem you might have encountered earlier. No further changes for now. The tarball is available at the usual places: http://www.balabit.hu/en/products/syslog-ng (I also updated 1.4.x related links, the webpage is being reorganized and that's why we didn't update the pages for so long. But since the new version is not yet ready I now updated the old pages) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 4

syslogd to syslog-ng
by Dustin H 19 Oct '01

19 Oct '01

in normal syslog i use *.=info;*.=notice;*.=debug;*.warn /dev/tty12 to have it dump to tty12 how can i do that in syslog-ng ?

2 1

Question on match() expression
by Antai Ning 19 Oct '01

19 Oct '01

Hi there, I know I shouid search the archive first before I ask. So I did that and here is the question that I haven't found an answer... I want to create a filter to capture certain messages from syslog. The message I want to match is something like this: "[out-proxy]: tcp from 192.168.10.28-3933 to 216.191.40.60-80 established". I tried 1. match("\[out-proxy\]: .*tcp from .* to .*-80 established"); 2. match("\[out-proxy]: .*tcp from .* to .*-80 established"); 3. match("[out-proxy]: .*tcp from .* to .*-80 established"); 4. match(".*out-proxy.*: .*tcp from .* to .*-80 established"); Only #4 works. It seems that it doesn't understand "[" and "]" and esc"\". I want a exact match for "[out-proxy]" anyway. So how to do that? Thanks in advance! Andy Internetworking Applications Engineer JETNET InternetWorking Services Inc. Email : aning(a)jetnet.ca Web : http://www.jetnet.ca Phone : (613) 237-5995 x 369 Fax : (613) 271-6229

1 0

syslog-ng 1.4.14 released
by Balazs Scheidler 19 Oct '01

19 Oct '01

Hi, I've released syslog-ng 1.4.14 which fixes a quite important problem with regard to local messages. NEWS entry follows: News for the 1.4.14 release Fri, 19 Oct 2001 14:45:12 +0200 Fixed a problem causing opened unix domain sessions to drop during SIGHUP. This new version can be found at: http://www.balabit.hu/en/products/syslog-ng -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]fully qualified hostname help
by Dawson, Kevin 18 Oct '01

18 Oct '01

Ugh...no. Can't it use DNS to resolve? I had use_dns(yes) set but it didn't work either. The number of hosts I'd have to add to /etc/hosts would be significant as we are relaying from *a bunch* of boxes to a central collection point. Kevin. -----Original Message----- From: Allen Bettilyon [mailto:allen@about-inc.com] Sent: Thursday, October 18, 2001 3:20 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]fully qualified hostname help Do you have the hosts listed in /etc/hosts? -- Allen "Dawson, Kevin" wrote: > I'm sure this has been asked a thousand times before (although I couldn't > find it in the archives), but here it goes. My options line reads: > > options { sync(0); time_reopen(10); log_fifo_size(100); long_hostnames(yes); > chain_hostnames(yes); }; > > I'm running version 1.4.12 on Solaris and the problem is my messages are > still listing the short hostname. Any thoughts on this? > > Best Regards, > Kevin. > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

RE: [syslog-ng]fully qualified hostname help
by Dawson, Kevin 18 Oct '01

18 Oct '01

Allen- Thanks a ton for the help. This fixes the problem - or more specifically my lack of knowledge. Now it's off to update all the hosts...where's the coffee! Best Regards, Kevin. -----Original Message----- From: Allen Bettilyon [mailto:allen@about-inc.com] Sent: Thursday, October 18, 2001 3:51 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]fully qualified hostname help Yes, it can use dns. I was just asking if you ALSO had the hosts listed in your /etc/hosts file. If you did, than it would ask that first. I actually relay about 80 boxes to my loghost, and I prefer having them all listed in /etc/hosts. This way, if dns falls down, my logs still retain hostnames. I think the option your looking for is: use_fqdn (yes); -- Allen "Dawson, Kevin" wrote: > Ugh...no. Can't it use DNS to resolve? I had use_dns(yes) set but itss > didn't work either. The number of hosts I'd have to add to /etc/hosts would > be significant as we are relaying from *a bunch* of boxes to a central > collection point. > > Kevin. > > -----Original Message----- > From: Allen Bettilyon [mailto:allen@about-inc.com] > Sent: Thursday, October 18, 2001 3:20 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]fully qualified hostname help > > Do you have the hosts listed in /etc/hosts? > > -- Allen > > "Dawson, Kevin" wrote: > > > I'm sure this has been asked a thousand times before (although I couldn't > > find it in the archives), but here it goes. My options line reads: > > > > options { sync(0); time_reopen(10); log_fifo_size(100); > long_hostnames(yes); > > chain_hostnames(yes); }; > > > > I'm running version 1.4.12 on Solaris and the problem is my messages are > > still listing the short hostname. Any thoughts on this? > > > > Best Regards, > > Kevin. > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]fully qualified hostname help
by Dawson, Kevin 18 Oct '01

18 Oct '01

Actually both - the remote hosts are running syslog-ng as well with the exception of the routers which simply spit out messages w/o a syslog daemon. BTW, the syslogd daemon was able to resolve the full hostname without any entries in the /etc/hosts file. I changed to syslog-ng...no full hostnames. -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Thursday, October 18, 2001 2:45 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]fully qualified hostname help Also, are you referring to locally generated syslog messages or ones from remote hosts? The difference is important. On Thu, Oct 18, 2001 at 03:19:47PM -0700, Allen Bettilyon wrote: > Do you have the hosts listed in /etc/hosts? > > -- Allen > > "Dawson, Kevin" wrote: > > > I'm sure this has been asked a thousand times before (although I couldn't > > find it in the archives), but here it goes. My options line reads: > > > > options { sync(0); time_reopen(10); log_fifo_size(100); long_hostnames(yes); > > chain_hostnames(yes); }; > > > > I'm running version 1.4.12 on Solaris and the problem is my messages are > > still listing the short hostname. Any thoughts on this? -- Nate Campi <nate(a)campin.net> GnuPG key: 0xC17AEF79 http://www.campin.net But, for my own part, it was Greek to me. -- William Shakespeare, "Julius Caesar" _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

fully qualified hostname help
by Dawson, Kevin 18 Oct '01

18 Oct '01

I'm sure this has been asked a thousand times before (although I couldn't find it in the archives), but here it goes. My options line reads: options { sync(0); time_reopen(10); log_fifo_size(100); long_hostnames(yes); chain_hostnames(yes); }; I'm running version 1.4.12 on Solaris and the problem is my messages are still listing the short hostname. Any thoughts on this? Best Regards, Kevin.

3 2

How to use Macros in file() ?
by Denis Doublet 17 Oct '01

17 Oct '01

Hello, Currently using syslog-ng 1.5.9 on Solaris, I would to see in the generated logs, the Facility and criticity of each line. Could you give me an example of the usage of macros in filename? The documentation is quite light about this subject. Thanks for your help. Denis

1 0

Syslog-ng overflow issue
by Mike Kelland 15 Oct '01

15 Oct '01

I'm having a problem where if a syslog message is sent to syslog-ng which exceeds a certain length, the piece of the message which was truncated off the end is appended to the beginning of the next message sent. Is there a way to cause syslog-ng to instead simply loose this truncated piece? Thanks, Mike Kelland <<...OLE_Obj...>> Michael Kelland Internetworking Applications Engineer 333 Preston Street, 3rd Floor, Ottawa, Ontario. K1S 5N4 Ph. (613) 237-5995, ext 248 Fax(613) 237-9002 www.JETNET.ca mkelland(a)JETNET.ca This communication contains confidential information intended solely for the use of the individual/s and/or entity or entities to whom it was intended to be addressed. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this transmission is prohibited. If you have received this communication in error, please contact the sender immediately, delete the communication from your system and do not disclose its contents to any third party or use its contents. Any opinions expressed are soley those of the author and do not necessariy represent those of JETNET Internetworking Services Inc. unless otherwise specifically stated.

2 1

problems with receiving messages from other host
by Michael Wahlbrink 15 Oct '01

15 Oct '01

hi, I'm trying to install a linux loghost (running syslog-ng) which should collect the log-messages of the other linuxboxes in our dmz. The problem is that if on the other pcs also the syslog-ng is running the loghost seems not to receive any messages fom the other pcs. On one box I've tried to install the 'original' syslog and I received the messages .......... So here are the important Parts of my config files: the loghost: options { long_hostnames(on); sync(0); create_dirs(yes); }; ##################################################################### # Direct all local messages to the source s_local ##################################################################### source s_local { unix-stream("/dev/log"); internal(); }; ##################################################################### # Accept all messages from dmz.testlan.propack-data.de # and direct them to the source s_net_dmz.bw ##################################################################### source s_net_dmz.testlan { udp(ip(123.45.67.89) port(514)); }; ##################################################################### # Print all messages from swan (local) on tty10 ##################################################################### destination d_console10 { file("/dev/tty10"); }; log { source(s_local); destination(d_console10); }; ##################################################################### # Log all messages to /var/log/messages ##################################################################### destination messages { file("/var/log/messages" owner(root) group(root) perm(0640) dir_perm(0755)); }; log { source(s_local); source(s_net_dmz.testlan); destination(messages); }; the other host: ##################################################################### # define options for syslog ##################################################################### options { long_hostnames(on); sync(0); }; ##################################################################### # define the source pipe for all local messages ##################################################################### source src { unix-stream("/dev/log"); internal(); }; ##################################################################### # print all messages on tty10 ##################################################################### destination console { file("/dev/tty10"); }; log { source(src); destination(console); }; ##################################################################### # send all messages to the loghost loghost.testlan.propack-data.de ##################################################################### destination loghost { udp("123.45.67.89" port(514)); }; log { source(src); destination(loghost); }; I hope you can help me with my problem ;-) and sorry for my bad english thanx micha

1 0

Outputting UTC time strings?
by Rory Toma 13 Oct '01

13 Oct '01

For the life of me, I can't seem to find out where msg->date gets set. I changed destinations.c to only use "%s" in strftime, but it only affects the startup syslog message, not the other messages. Where do I make the change to use UTC time instead of the time string that it currently uses? -- Rory Toma rory(a)colinburns.com Game Master http://www.colinburns.com Colin Burns Games

1 0

filter problem: level()
by Michael D. (Mick) Bauer 11 Oct '01

11 Oct '01

Hi, all. I've got a puzzling problem (to me ;-) with the level() function in my syslog-ng.conf file. I'm using a filter whose sole criterion is level(debug .. alert); as a sort of "catch-all" filter. But if I send syslog-ng eight messages, each with a different priority (i.e., one of each level), only the ones with levels "crit," "alert," and "emerg" get logged. But wait! Those "emerg" messages shouldn't be making it past the filter! What *on earth* is going on here? (Could it be some sort of weirdness between logger & syslog-ng?) Here's my config file, etc.: # begin syslog-ng.conf options { long_hostnames(off); sync(0); }; source src { unix-dgram("/dev/log"); internal(); }; destination d_local { file("/var/log/messages"); }; filter f_mick { level(debug .. alert); }; log { source(src); filter(f_mick); destination(d_local); }; # end syslog-ng.conf # begin bash-commands (logger) to test above config curious-george:/etc/init.d# for i in {debug,info,notice,warning,err,crit,alert, emerg} >do >logger -p auth.$i "Priority level $i" >echo "Priority level $i" >done Priority level debug Priority level info Priority level notice Priority level warning Priority level err Priority level crit Priority level alert Priority level emerg # end bash-commands & output # begin excerpt from /var/log/messages Sep 5 00:13:04 curious-george darthelm: Priority level crit Sep 5 00:13:04 curious-george darthelm: Priority level alert Sep 5 00:13:04 curious-george darthelm: Priority level emerg # end excerpt TIA, Mick /=============================\ | Michael D.(Mick) Bauer | | Network Security Consultant | | St. Paul, Minnesota (USA) | | mick<at>visi.com | \=============================/

2 2