How to exclude logging duplication from certain programs? I have a standard /etc/syslog.conf and create an additional file in /etc/syslog.d/ with the following contents: !ovpn1 *.* /var/log/ovpn/ovpn1.log !-ovpn1 !ovpn2 *.* /var/log/ovpn/ovpn2.log !-ovpn2 !ovpn3 *.* /var/log/ovpn/ovpn3.log !-ovpn3 !ovpn4 *.* /var/log/ovpn/ovpn4.log !-ovpn4 . . . cut here . . . !ovpn158 *.* /var/log/ovpn/ovpn158.log !-ovpn158 Unfortunately, the output from the programs goes to /var/log/messages and to /var/log/daemon.log all the same, exactly like the assigned files in the additional config file (/var/log/ovpn/ovpn1.log ... /var/log/ovpn/ovpn158.log)
Experimenting with different options from Google, I found a temporary solution to the problem. But it is not so logical. FreeBSD designers must do something about it! We modify the standard configuration file /etc/syslog.conf: $FreeBSD$ # # Spaces ARE valid field separators in this file. However, # other *nix-like systems still insist on using tabs as field # separators. If you are sharing this file between systems, you # may want to use only tabs as field separators here. # Consult the syslog.conf(5) manpage. # openvpn: /%regex 'ovpn[1-9]'/ !-ovpn1,ovpn2,ovpn3,ovpn4, . . . cut here (very! long string) . . . ,ovpn158 *.err;kern.warning;auth.notice;mail.crit /dev/console *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages security.* /var/log/security auth.info;authpriv.info /var/log/auth.log mail.info /var/log/maillog cron.* /var/log/cron !-devd *.=debug /var/log/debug.log *.emerg * daemon.info /var/log/daemon.log # uncomment this to log all writes to /dev/console to /var/log/console.log # touch /var/log/console.log and chmod it to mode 600 before it will work #console.info /var/log/console.log # uncomment this to enable logging of all log messages to /var/log/all.log # touch /var/log/all.log and chmod it to mode 600 before it will work #*.* /var/log/all.log # uncomment this to enable logging to a remote loghost named loghost #*.* @loghost # uncomment these if you're running inn # news.crit /var/log/news/news.crit # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice # Uncomment this if you wish to see messages produced by devd # !devd # *.>=notice /var/log/devd.log !* include /etc/syslog.d include /usr/local/etc/syslog.d