RE: [syslog-ng]config questions
AF> yep, there is a predefined filter named "DEFAULT" which should do AF> what you're after.
Ah, you're quite right. Though
destination default { file("/var/log/default-$YEAR$MONTH$DAY"); }; log { source(src); filter(DEFAULT); destination(default); };
doesn't seem to work, no file is created. Any ideas?
Are any messages from source(src) making it to the default filter? If not, no file will ever be created. Find a situation your other rules dont cater for (an unusual facility, for instance), and use 'logger' to create log messages to see if the problem is syslog-ng or simply you dont have any 'extra' messages which need catching by a default rule. -- afort
"AF" == Andrew Fort <afort@staff.webcentral.com.au> writes:
MV> destination default { file("/var/log/default-$YEAR$MONTH$DAY"); }; MV> log { source(src); filter(DEFAULT); destination(default); }; MV> doesn't seem to work, no file is created. Any ideas? AF> Are any messages from source(src) making it to the default filter? AF> If not, no file will ever be created. AF> Find a situation your other rules dont cater for (an unusual AF> facility, for instance), and use 'logger' to create log messages AF> to see if the problem is syslog-ng or simply you dont have any AF> 'extra' messages which need catching by a default rule. I think it's syslog-ng, f ex I have filter f_lpr { facility(lpr) and not level(debug..info); }; and logging to lpr.debug does not end up anywhere (and there's no other filter that takes care of *.debug or anything). Strange, -- ___ . . . . . + . . o _|___|_ + . + . + . . Per Olofsson, konstnär o-o . . . o + MagerValp@cling.gu.se - + + . http://www.cling.gu.se/~cl3polof/
participants (2)
-
Andrew Fort
-
MagerValp