Bug 62368

--On Wednesday, February 04, 2004 17:24:17 -0800 Erik Kline <kline@netapp.com> wrote:

>> Number:         62368
>> Category:       conf
>> Synopsis:       5.2-RELEASE syslog.conf appears to be malformed
>
>> Description:
> /etc/syslog.conf contains the following lines at the tail end of the file:
>
> !startslip
> *.*                                             /var/log/slip.log
> !ppp
> *.*                                             /var/log/ppp.log
>
> These don't appear to be syntactically valid. Any entries appended
> after these aren't parsed and processed. CVSup today (04 Feb 2004)
> shows that /usr/src/etc/syslog.conf remains malformed.

man syslog.conf:

     Each block of lines is separated from the previous block by a program or
     hostname specification.  A block will only log messages corresponding to
     the most recent program and hostname specifications given.  Thus, with a
     block which selects `ppp' as the program, directly followed by a block
     that selects messages from the hostname `dialhost', the second block will
     only log messages from the ppp(8) program on dialhost.

     A program specification is a line beginning with `#!prog' or `!prog' (the
     former is for compatibility with the previous syslogd, if one is sharing
     syslog.conf files, for example) and the following blocks will be associ-
     ated with calls to syslog(3) from that specific program.  A program spec-
     ification for `foo' will also match any message logged by the kernel with
     the prefix `foo: '.  The `#!+prog' or `!+prog' specification works just
     like the previous one, and the `#!-prog' or `!-prog' specification will
     match any message but the ones from that program.  A hostname specifica-
     tion of the form `#+hostname' or `+hostname' means the following blocks
     will be applied to messages received from the specified hostname.  Alter-
     natively, the hostname specification `#-hostname' or `-hostname' causes
     the following blocks to be applied to messages from any host but the one
     specified.  If the hostname is given as `@', the local hostname will be
     used.  A program or hostname specification may be reset by giving the
     program or hostname as `*'.

The reason that lines added after that point don't appear to be
parsed or processed is that they apply only to messages from programs
named 'ppp'.



-Pat

so when writing scripts that make custom mods to syslog.conf I need to
cat >> /etc/syslog.conf something like:

!*
local2.info		@some.log.host

Is this correct? Thanks for pointing out the section of the man page I
didn't quite get down to!

On Wed, 4 Feb 2004, Pat Lashley wrote:

> --On Wednesday, February 04, 2004 17:24:17 -0800 Erik Kline <kline@netapp.com> wrote:
>
> >> Number:         62368
> >> Category:       conf
> >> Synopsis:       5.2-RELEASE syslog.conf appears to be malformed
> >
> >> Description:
> > /etc/syslog.conf contains the following lines at the tail end of the file:
> >
> > !startslip
> > *.*                                             /var/log/slip.log
> > !ppp
> > *.*                                             /var/log/ppp.log
> >
> > These don't appear to be syntactically valid. Any entries appended
> > after these aren't parsed and processed. CVSup today (04 Feb 2004)
> > shows that /usr/src/etc/syslog.conf remains malformed.
>
> man syslog.conf:
>
>      Each block of lines is separated from the previous block by a program or
>      hostname specification.  A block will only log messages corresponding to
>      the most recent program and hostname specifications given.  Thus, with a
>      block which selects `ppp' as the program, directly followed by a block
>      that selects messages from the hostname `dialhost', the second block will
>      only log messages from the ppp(8) program on dialhost.
>
>      A program specification is a line beginning with `#!prog' or `!prog' (the
>      former is for compatibility with the previous syslogd, if one is sharing
>      syslog.conf files, for example) and the following blocks will be associ-
>      ated with calls to syslog(3) from that specific program.  A program spec-
>      ification for `foo' will also match any message logged by the kernel with
>      the prefix `foo: '.  The `#!+prog' or `!+prog' specification works just
>      like the previous one, and the `#!-prog' or `!-prog' specification will
>      match any message but the ones from that program.  A hostname specifica-
>      tion of the form `#+hostname' or `+hostname' means the following blocks
>      will be applied to messages received from the specified hostname.  Alter-
>      natively, the hostname specification `#-hostname' or `-hostname' causes
>      the following blocks to be applied to messages from any host but the one
>      specified.  If the hostname is given as `@', the local hostname will be
>      used.  A program or hostname specification may be reset by giving the
>      program or hostname as `*'.
>
> The reason that lines added after that point don't appear to be
> parsed or processed is that they apply only to messages from programs
> named 'ppp'.
>
>
>
> -Pat

>

Comment 3 dwmalone 2004-02-09 08:17:50 UTC

State Changed
From-To: open->closed

Seems to have been a misunderstanding of program based filtering.