[syslog-ng] weird problems logging kern.notice with syslog-ng

[Brad Arlt]

On Thu, Jun 08, 2000 at 11:20:15AM -0700, Robert Coli wrote:
> --
> [happy] /var/adm # logger -p auth.notice AUTH NOTICE TEST #5
> [happy] /var/adm # logger -p kern.notice KERN NOTICE TEST #5
> [happy] /var/adm # tail messages
> Jun  8 11:19:32 system@w4 root: AUTH NOTICE TEST #5
> --
> 
> Anyone have any idea why syslog-ng is picking up auth notice just fine
> and not picking up kern notice?

I had problems with this earlier too.. if you read syslog(3), it says
something to the effect the LOG_KERN messages can only come from the
kernel.  You are not the kernel (not even if you are root).

The kern.notice is turned into user.notice.  The same goes for the whole
kern facility...

To confirm this isn't a syslog-ng quirk (it isn't), run syslogd at the
same time (you can do this if you are using the syslog IPC door).
Syslogd also will log your kernel syslog message using the user
facility.

To convince yourself that kernel messages get logged at all you can
reboot the machine(kern.info), or fill a drive up(kern.???).
----------------------------------------------------------------------------
   __o		Bradley Arlt	  Email: arlt@cpsc.ucalgary.ca         o__
 _ \<_				    WWW: www.acs.ucalgary.ca/~bdarlt   _>/ _
(_)/(_)  -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)