Normalizing syslogs from FreeBSD and Solaris machines
Hello I can't seem to get syslog outputs from Postfix running on Solaris and FreeBSD servers to look the same. FreeBSD - Aug 5 11:14:43 69.67.254.17 postfix/smtp[80999]: 9FAA9EB760: to=<adams4@usadatanet.net>, relay=127.0.0.1[127.0.0.1], delay=1, status=sent (250 2.6.0 Ok, id=81995-01, from MTA: 250 Ok: queued as E16ECEB7CD) This corresponds to $DATE $HOST $MESSAGE, yes the postfix/smtp[80999] which would be $PROGRAM is actually part of the $MESSAGE. Solaris - Aug 5 11:16:06 69.67.254.10 postfix/smtp[10111]: [ID 197553 mail.info] B3391B26D: to=<taptoes@usadatanet.net>, relay=127.0.0.1[127.0.0.1], delay=2, status=sent (250 2.6.0 Ok, id=11585-10, from MTA: 250 Ok: queued as 9190DAE91) This corresponds to $DATE $PROGRAM $MESSAGE. Which is closer to what I would expect. My main problem is that Solaris stuffs the ID and facility.priority into the message itself. I've tried logging with defined message formats and that doesn't seem to help. So how can I gracefully removed the [ID xxxxxx Facility.Priority] from the message in the Solaris log lines? Thanks Ken McKittrick ISP Engineer USADatanet
Ken McKittrick <klmac@usadatanet.net> - Thu, Aug 05, 2004:
So how can I gracefully removed the [ID xxxxxx Facility.Priority] from the message in the Solaris log lines?
I don't recall exactly if that will completely solve your problem, but part of the solution might be to configure the /kernel/drv/log.conf file with something like: name="log" parent="pseudo" instance=0 msgid=0; HTH, -- Loïc Minier <lool@dooz.org>
Loic That was the clue I needed. Those are called Message ID's and they were a "feature" that was added in Solaris 8. You can turn them off in /kern/drv/log/conf. Only problem is that the change requires a reboot. We don't like reboots. Thanks Ken McKittrick On Aug 5, 2004, at 11:59 AM, Loic Minier wrote:
Ken McKittrick <klmac@usadatanet.net> - Thu, Aug 05, 2004:
So how can I gracefully removed the [ID xxxxxx Facility.Priority] from the message in the Solaris log lines?
I don't recall exactly if that will completely solve your problem, but part of the solution might be to configure the /kernel/drv/log.conf file with something like: name="log" parent="pseudo" instance=0 msgid=0;
HTH,
-- Loïc Minier <lool@dooz.org> _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Ken McKittrick <klmac@usadatanet.net> - Thu, Aug 05, 2004:
That was the clue I needed. Those are called Message ID's and they were a "feature" that was added in Solaris 8. You can turn them off in /kern/drv/log/conf. Only problem is that the change requires a reboot. We don't like reboots.
Well try to: # echo log_msgid/W0 | adb -kw No guarantee though... :) (PS: this is really dangerous) -- Loïc Minier <lool@dooz.org>
participants (2)
-
Ken McKittrick
-
Loic Minier