On Wed, Dec 16, 2020, 06:04 Dan Egli <dan@newideatest.site> wrote:
Help me understand this, please? I have ISC dhcpd configured to log to
syslog.local7 (since I don't see an option to force it into it's own log
file).
Hmm syslog.local7 doesn't seem to be a facility.severity pair.
Both syslog and localX are facility codes, so either syslog or localX.
Syslog is normally reserved for the syslog subsystem, so I wouldn't use that for dhcpd.
Also, logging and filtering based on facility codes alone is not really flexible, as facility codes were not kept up with changes of the underlying system. There are dedicated codes for legacy stuff like "news" which people rarely use, but lack newer stuff like kafka or docker.
So in most cases, I see people use the PROGRAM field, or even the IP address of devices to classify log messages.
Still, in your use case the current set of facility codes could be just fine.
So I went into my syslog-ng file and created two filters, just
like on the example page of syslog-ng.com:
filter dhcpmsgs { facility(23) );
This would filter on facility code 23, each facility is mapped to a numeric code, I can't remember what is 23, but you can check rfc3164 for the exact assignment.
filter non_dhcp { NOT filter(dhcpmsgs) );
Negation should be lower case, e.g. "not"
The closing paren should be a closing brace (e.g. "}")