LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 06-03-2008, 01:32 PM   #1
lp449
Member
 
Registered: Oct 2004
Location: Olsztyn, Poland
Distribution: Debian Squeeze / CentOS 6
Posts: 60

Rep: Reputation: 15
Separating WPA logs from /var/log/messages using syslog-ng


Hello everyone

I was wondering maybe some of you would provide me some more complex help on the following topic... I use WPA TKIP (wpa_supplicant) to authenticate access to my wireless network and what I noticed recently is that my /var/log/messages get pretty messy because of that fact. It gets filled up with encrypt/decrypt info so that it is hard to find out anything else than that in that logfile.

I use syslog-ng as a system logger and was wondering what to add to a config file on order to make the messages of WPA separated from /var/log/messages and place that information in a different log file such as /var/log/wpa or something like that ... I think I should use some rexgrep but don't actually have an idea how to do so.

Any help would be greatly appreciated.
 
Old 06-04-2008, 06:12 AM   #2
stress_junkie
Senior Member
 
Registered: Dec 2005
Location: Massachusetts, USA
Distribution: Ubuntu 10.04 and CentOS 5.5
Posts: 3,873

Rep: Reputation: 332Reputation: 332Reputation: 332Reputation: 332
I've been using UNIX and Linux for a long time and this issue took me a long time to figure out. In my defense I had other issues to study before this got to the top of my priority list. Other people may have a more accurate understanding of this. I will be watching this thread to see if I can learn more about this from other people's posts.

It looks to me that the syslog configuration is two level. The /etc/syslog.conf file is only good for managing groups of messages. These groups are expressed as name.severity such as kernel.critical. The second level comes from the configuration of the individual applications that create log messages. This is where you want to look to accomplish your goal. I have found that the configuration files for software that creates log messages will often contain a line or two saying how messages are to be handled. In general there is an option to send the messages to syslog with a label saying what group the messages belong to, and then there is another line saying what application specific file should be used for messages.

In your case you would want to find the configuration file for the WPA software and change its logging settings. You would want to stop sending messages to syslog and have the software maintain its own log file with whatever name you select.

I don't know the name of the configuration file that you need to change. I don't use wireless very much.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
getting syslog to write to other file than /var/log/messages c_mitulescu Linux - Enterprise 6 04-02-2008 10:17 AM
/var/log/syslog messages. gbowden Slackware 2 02-25-2006 05:00 PM
my /var/log/syslog only logs the last 12 hours or so ALInux Linux - General 4 02-11-2006 10:53 AM
No output to /var/log/messages or ~syslog eelriver Slackware 5 07-18-2004 05:13 AM
strange logs in /var/log/messages dominant Linux - Security 1 04-21-2004 12:12 PM


All times are GMT -5. The time now is 06:28 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration