Syslog

man_linux · 12-12-2006, 05:07 AM

How to configure syslog daemon to store logs in different files depending on application, I want to store Snort logs in a different file away from normal system logs.

Thanks

chort · 12-12-2006, 01:34 PM

You can specify that certain programs get logged to different locations with !program.

example:

Code:

*.err;kern.debug;auth.notice;authpriv.none;mail.crit    /dev/console
*.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none /var/log/messages
kern.debug;user.info;syslog.info                        /var/log/messages
auth.info                                               /var/log/authlog
authpriv.debug                                          /var/log/secure
cron.info                                               /var/cron/log
daemon.info                                             /var/log/daemon
ftp.info                                                /var/log/xferlog
lpr.debug                                               /var/log/lpd-errs
mail.info                                               /var/log/maillog
#uucp.info                                              /var/log/uucp

*.err                                                   root
*.notice;auth.debug                                     root
*.alert                                                 root
*.emerg                                                 *
!snort
*.*                                                    /var/log/snort

unSpawn · 12-12-2006, 02:34 PM

IIRC at compile-time you can choose to tell Snort to log to syslog.
If you do you will use one of the "local.*" facility slots.
Then set that facility in syslog.

lostjohnny · 03-06-2007, 07:23 AM

Quote:

Originally Posted by chort

You can specify that certain programs get logged to different locations with !program.

example:

Code:

*.err;kern.debug;auth.notice;authpriv.none;mail.crit    /dev/console
*.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none /var/log/messages
kern.debug;user.info;syslog.info                        /var/log/messages
auth.info                                               /var/log/authlog
authpriv.debug                                          /var/log/secure
cron.info                                               /var/cron/log
daemon.info                                             /var/log/daemon
ftp.info                                                /var/log/xferlog
lpr.debug                                               /var/log/lpd-errs
mail.info                                               /var/log/maillog
#uucp.info                                              /var/log/uucp

*.err                                                   root
*.notice;auth.debug                                     root
*.alert                                                 root
*.emerg                                                 *
!snort
*.*                                                    /var/log/snort

I tried this - customised to my requirements.

In my program I call openlog thus:
openlog("gse", LOG_NDELAY, LOG_USER);

then make calls to syslog such as:
syslog(LOG_INFO, "gse started");

I appended to the end of syslog.conf:

Code:

!gse
*.info        /var/log/gse.log
*.=debug      /var/log/gse.debug

and created the two log files with
cp /dev/null /var/log/gse.log
cp /dev/null /var/log/gse.debug

The result is as if the !gse line isn't there. All the messages from my program appear in both /var/log/messages and gse.log. And all messages from everything (it seems - I don't know if it's literally everything) appear in gse.log.

My executable is called "gse" as well as being identified as "gse" in the call to openlog.

Is there something I've missed?

TIA
Lost Johnny