[syslog-ng] facility(kern) not working? Syslog-ng 2.0.7

Geller, Sandor (IT) Sandor.Geller at morganstanley.com
Thu Nov 20 15:12:47 CET 2008


Hi,

It's not logger but glibc:

static int      LogFacility = LOG_USER; /* default facility code */

...

        /* Set default facility if none specified. */
        if ((pri & LOG_FACMASK) == 0)
                pri |= LogFacility;

As LOG_KERN is 0 the above code sets the facility to LOG_USER.

Regards,

Sandor

> Just wanted to record the outcome of this for posterity.
>
> You can't use logger to generate messages with a facility of
> kern (zero) for test purposes.
> It will accept "kern" as a facility name on its command line
> but the messages will actually
> get logged with a facility of "user".
>
> Joe.
>
> -----Original Message-----
> From: syslog-ng-bounces at lists.balabit.hu
> [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Fegan, Joe
> Sent: 17 November 2008 14:01
> To: Syslog-ng users' and developers' mailing list
> Subject: Re: [syslog-ng] facility(kern) not working? Syslog-ng 2.0.7
>
> OK thanks, I see that. 14 = 16 octal = facility 1 (user)
> severity 6 (info).
>
> So even though I specify kern.info on the command line, the
> message comes through as user.info
>
> [root at node1 ~]# logger -i -p kern.info "hello world"
> [root at node1 ~]# tail -1 /var/log/messages
> Nov 17 13:39:17 node1 14 info root[7402]: hello world
> [root at node1 ~]#
>
> -----Original Message-----
> From: syslog-ng-bounces at lists.balabit.hu
> [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of
> Geller, Sandor (IT)
> Sent: 17 November 2008 13:02
> To: 'Syslog-ng users' and developers' mailing list'
> Subject: Re: [syslog-ng] facility(kern) not working? Syslog-ng 2.0.7
>
> Hi,
>
> > I am using 2.0.7 and it seems that facility(kern) does not
> > match messages from "logger -p kern.info". I am trying to
> > filter kernel messages into a file but nothing goes there.
>
> [ cut ]
>
> > Nov 17 12:40:45 dizzyfive1 189 notice syslog-ng: syslog-ng
> > startup succeeded
> > Nov 17 12:41:40 dizzyfive1 14 info root[19336]: hello from kern
>
> $PRI being 14 indicates user.info, not kern.info
>
> Regards,
>
> Sandor
> --------------------------------------------------------
>
> NOTICE: If received in error, please destroy and notify
> sender. Sender does not intend to waive confidentiality or
> privilege. Use of this email is prohibited when received in error.
> ______________________________________________________________
> ________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
> ______________________________________________________________
> ________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
> ______________________________________________________________
> ________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
--------------------------------------------------------

NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.


More information about the syslog-ng mailing list