[syslog-ng] facility(kern) not working? Syslog-ng 2.0.7

[Geller, Sandor (IT)]

Hi,

It's not logger but glibc:

static int      LogFacility = LOG_USER; /* default facility code */

...

        /* Set default facility if none specified. */
        if ((pri & LOG_FACMASK) == 0)
                pri |= LogFacility;

As LOG_KERN is 0 the above code sets the facility to LOG_USER.

Regards,

Sandor

> Just wanted to record the outcome of this for posterity.
>
> You can't use logger to generate messages with a facility of
> kern (zero) for test purposes.
> It will accept "kern" as a facility name on its command line
> but the messages will actually
> get logged with a facility of "user".
>
> Joe.
>
> -----Original Message-----
> From: syslog-ng-bounces at lists.balabit.hu
> [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Fegan, Joe
> Sent: 17 November 2008 14:01
> To: Syslog-ng users' and developers' mailing list
> Subject: Re: [syslog-ng] facility(kern) not working? Syslog-ng 2.0.7
>
> OK thanks, I see that. 14 = 16 octal = facility 1 (user)
> severity 6 (info).
>
> So even though I specify kern.info on the command line, the
> message comes through as user.info
>
> [root at node1 ~]# logger -i -p kern.info "hello world"
> [root at node1 ~]# tail -1 /var/log/messages
> Nov 17 13:39:17 node1 14 info root[7402]: hello world
> [root at node1 ~]#
>
> -----Original Message-----
> From: syslog-ng-bounces at lists.balabit.hu
> [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of
> Geller, Sandor (IT)
> Sent: 17 November 2008 13:02
> To: 'Syslog-ng users' and developers' mailing list'
> Subject: Re: [syslog-ng] facility(kern) not working? Syslog-ng 2.0.7
>
> Hi,
>
> > I am using 2.0.7 and it seems that facility(kern) does not
> > match messages from "logger -p kern.info". I am trying to
> > filter kernel messages into a file but nothing goes there.
>
> [ cut ]
>
> > Nov 17 12:40:45 dizzyfive1 189 notice syslog-ng: syslog-ng
> > startup succeeded
> > Nov 17 12:41:40 dizzyfive1 14 info root[19336]: hello from kern
>
> $PRI being 14 indicates user.info, not kern.info
>
> Regards,
>
> Sandor
> --------------------------------------------------------
>
> NOTICE: If received in error, please destroy and notify
> sender. Sender does not intend to waive confidentiality or
> privilege. Use of this email is prohibited when received in error.
> ______________________________________________________________
> ________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
> ______________________________________________________________
> ________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
> ______________________________________________________________
> ________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
--------------------------------------------------------

NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.