LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
LinkBack Search this Thread
Old 03-10-2009, 01:35 PM   #1
simplified
Member
 
Registered: May 2007
Location: London, UK
Distribution: Kubuntu 9.04 x64 / Ubuntu Server 9.04 x64
Posts: 50

Rep: Reputation: 15
Logging syslog messages from a particular IP to individual file


Hi All

I'm looking for a way to be able to log messages generated by a network host onto my CentOS 5.2 box into an individual file.

Now setting up syslog (I'm using the default sysklogd for CentOS) is the easy part; I've ensured that the following line is present in my /etc/sysconfig/syslog file:

Code:
SYSLOGD_OPTIONS="-m 0 -r"
This works a treat... the only issue is that the network host creates the following types of messages (i.e. Facilities and Priorities):

Code:
local7.warn
auth.warn
kern.warn
auth.info
... the problem that I have is that these get put into the same file as anything else using these matching facilities (local7 being a good example as this logs by default to /var/log/boot.log). What I'd like to do is be able to filter the incoming messages by IP address as well. So for example, I'd like to say "if the syslog message is coming from 192.168.1.11 and has local7.warn as the facility & priority log it to /var/log/192.168.1.11.log"

I've done a lot of looking around but have had no joy... can anyone tell me to RTFM in the right direction?

Thanks for reading! Simp.

Last edited by simplified; 03-10-2009 at 01:48 PM.
 
Old 03-10-2009, 02:06 PM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,344

Rep: Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945
*cough* syslog-ng *cough*

The rpm will function exactly the same as the standard syslogd and klogd configs with centos, and then it's really quite nice to add extra config to do what you want, in a much nicer way that syslogd.conf allows.
 
Old 03-10-2009, 02:07 PM   #3
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,344

Rep: Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945
http://www.silfreed.net/download/rep...ges/syslog-ng/
 
Old 03-10-2009, 03:48 PM   #4
simplified
Member
 
Registered: May 2007
Location: London, UK
Distribution: Kubuntu 9.04 x64 / Ubuntu Server 9.04 x64
Posts: 50

Original Poster
Rep: Reputation: 15
Cool! Thanks all... I'll check it out and let you know how I get on.
 
Old 03-11-2009, 02:48 AM   #5
simplified
Member
 
Registered: May 2007
Location: London, UK
Distribution: Kubuntu 9.04 x64 / Ubuntu Server 9.04 x64
Posts: 50

Original Poster
Rep: Reputation: 15
Perfecto!

Hi Guys

Many thanks for the pointer - this is exactly what I was after!

Simp.
 
Old 03-11-2009, 04:10 AM   #6
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,344

Rep: Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945
syslog-ng is pretty great. Many people don't like the alternative syntax on principle, when there are other syslogd replacements like rsyslog which keep the same basic syntax. But ng is great and very flexible without being necessarily complicated.
 
Old 03-12-2009, 10:26 AM   #7
simplified
Member
 
Registered: May 2007
Location: London, UK
Distribution: Kubuntu 9.04 x64 / Ubuntu Server 9.04 x64
Posts: 50

Original Poster
Rep: Reputation: 15
Hi Chris

Thanks for that - do you have any recommendation on documentation for the free version, there seem to be two available.

Don't worry if you don't just thought I'd ask the question

OL
 
Old 03-12-2009, 02:03 PM   #8
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,344

Rep: Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945Reputation: 1945
http://www.campin.net/syslog-ng/faq.html this is a great page, lots of clever hangups dealt with there.
 
  


Reply

Tags
network, sysklogd, syslog


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
getting syslog to write to other file than /var/log/messages c_mitulescu Linux - Enterprise 6 04-02-2008 10:17 AM
Logging - Text File to Syslog humbletech99 Linux - Security 3 01-29-2008 06:47 AM
strange broadcast logging in messages file PennyroyalFrog Linux - Newbie 1 10-12-2004 09:37 PM
Can you send syslog messages to different file plythgam Linux - Networking 1 07-01-2004 06:21 PM
syslog and firestarter - log messages to another file than messages mule Linux - Newbie 0 08-07-2003 03:35 AM


All times are GMT -5. The time now is 11:31 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration