LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
 
Search this Thread
Old 10-11-2010, 11:03 PM   #1
digger86
LQ Newbie
 
Registered: Jun 2009
Location: Oregon
Distribution: SLES, HPUX, SOLARIS
Posts: 24

Rep: Reputation: 0
syslog-ng redirect "martian source"


Nothing worse than finding old docs:
http://www.novell.com/support/viewCo...3798&sliceId=1

I would like to redirect "martian source"

I have added:
Code:
filter f_martian    { facility(kern) and match('^martian source'); };
filter f_console    { level(warn) and facility(kern) and not filter(f_iptables)
                      or level(err) and not facility(authpriv)
                      and not filter(f_martian); };
destination martian { file("/var/log/martian"); };
log { source(src); filter(f_martian); destination(martian); };
I than run:
Code:
kill -HUP `cat /var/run/syslog-ng.pid'
/var/log/messages shows:
Code:
Oct 11 18:03:50 node1 syslog-ng[2153]: Configuration reload request received, reloading configuration;
Oct 11 18:03:50 node1 syslog-ng[2153]: New configuration initialized;
my /etc/syslog-ng/syslog-ng.conf:
Code:
# egrep -v '^#|^$' syslog-ng.conf
options { long_hostnames(off); sync(0); perm(0640); stats(3600); };
source src {
	#
	# include internal syslog-ng messages
	# note: the internal() soure is required!
	#
	internal();
	#
	# the default log socket for local logging:
	#
	unix-dgram("/dev/log");
	#
	# uncomment to process log messages from network:
	#
	#udp(ip("0.0.0.0") port(514));
};
filter f_iptables   { facility(kern) and match("IN=") and match("OUT="); };
filter f_martian    { facility(kern) and match('^martian source'); };
filter f_console    { level(warn) and facility(kern) and not filter(f_iptables)
                      or level(err) and not facility(authpriv)
                      and not filter(f_martian); };
filter f_newsnotice { level(notice) and facility(news); };
filter f_newscrit   { level(crit)   and facility(news); };
filter f_newserr    { level(err)    and facility(news); };
filter f_news       { facility(news); };
filter f_mailinfo   { level(info)      and facility(mail); };
filter f_mailwarn   { level(warn)      and facility(mail); };
filter f_mailerr    { level(err, crit) and facility(mail); };
filter f_mail       { facility(mail); };
filter f_cron       { facility(cron); };
filter f_local      { facility(local0, local1, local2, local3,
                               local4, local5, local6, local7); };
filter f_acpid_full { match('^acpid:'); };
filter f_acpid      { level(emerg..notice) and match('^acpid:'); };
filter f_acpid_old  { match('^\[acpid\]:'); };
filter f_netmgm     { match('^NetworkManager:'); };
filter f_messages   { not facility(news, mail) and not filter(f_iptables); };
filter f_warn       { level(warn, err, crit) and not filter(f_iptables); };
filter f_alert      { level(alert); };
destination console  { pipe("/dev/tty10"    owner(-1) group(-1) perm(-1)); };
log { source(src); filter(f_console); destination(console); };
destination xconsole { pipe("/dev/xconsole" owner(-1) group(-1) perm(-1)); };
log { source(src); filter(f_console); destination(xconsole); };
destination newscrit   { file("/var/log/news/news.crit"
                              owner(news) group(news)); };
log { source(src); filter(f_newscrit); destination(newscrit); };
destination newserr    { file("/var/log/news/news.err"
                              owner(news) group(news)); };
log { source(src); filter(f_newserr); destination(newserr); };
destination newsnotice { file("/var/log/news/news.notice"
                              owner(news) group(news)); };
log { source(src); filter(f_newsnotice); destination(newsnotice); };
destination mailinfo { file("/var/log/mail.info"); };
log { source(src); filter(f_mailinfo); destination(mailinfo); };
destination mailwarn { file("/var/log/mail.warn"); };
log { source(src); filter(f_mailwarn); destination(mailwarn); };
destination mailerr  { file("/var/log/mail.err" fsync(yes)); };
log { source(src); filter(f_mailerr);  destination(mailerr); };
destination mail { file("/var/log/mail"); };
log { source(src); filter(f_mail); destination(mail); };
 
destination acpid { file("/var/log/acpid"); };
destination null { };
log { source(src); filter(f_acpid); destination(acpid); flags(final); };
log { source(src); filter(f_acpid_full); destination(null); flags(final); };
log { source(src); filter(f_acpid_old); destination(acpid); flags(final); };
destination netmgm { file("/var/log/NetworkManager"); };
log { source(src); filter(f_netmgm); destination(netmgm); flags(final); };
destination localmessages { file("/var/log/localmessages"); };
log { source(src); filter(f_local); destination(localmessages); };
destination messages { file("/var/log/messages"); };
log { source(src); filter(f_messages); destination(messages); };
destination firewall { file("/var/log/firewall"); };
log { source(src); filter(f_iptables); destination(firewall); };
destination martian { file("/var/log/martian"); };
log { source(src); filter(f_martian); destination(martian); };
destination warn { file("/var/log/warn" fsync(yes)); };
log { source(src); filter(f_warn); destination(warn); };
 
Old 10-12-2010, 01:45 AM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,415

Rep: Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970
OK, glad to hear it.... did you have a question or is this advice for others?
 
Old 10-12-2010, 09:45 AM   #3
digger86
LQ Newbie
 
Registered: Jun 2009
Location: Oregon
Distribution: SLES, HPUX, SOLARIS
Posts: 24

Original Poster
Rep: Reputation: 0
DOH! :x you are right I forgot the question.

The above is not working.

How do I do this?

Thanks
 
Old 10-12-2010, 02:59 PM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,415

Rep: Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970Reputation: 1970
Well what's not working about it? are you seeing errors? failures? Just a lack of output? What are the messages you are seeing that should be filtered?
 
Old 10-12-2010, 08:39 PM   #5
digger86
LQ Newbie
 
Registered: Jun 2009
Location: Oregon
Distribution: SLES, HPUX, SOLARIS
Posts: 24

Original Poster
Rep: Reputation: 0
I cannot get it to stop sending messages to /var/log/messages. But it is sending "martian source" messages to /var/log/martian. So the messages are being duplicated.

I changed:
Code:
filter f_martian    { facility(kern) and match('^martian source'); };
to
Code:
filter f_martian    { facility(kern) and match("martian source"); };
 
Old 10-12-2010, 09:20 PM   #6
digger86
LQ Newbie
 
Registered: Jun 2009
Location: Oregon
Distribution: SLES, HPUX, SOLARIS
Posts: 24

Original Poster
Rep: Reputation: 0
Got it. There is a commented line:
Code:
# this is for the old acpid < 1.0.6
my version:
Code:
# acpi -v
acpi 0.09

Copyright (C) 2001 Grahame Bowland.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
That was where I had to put the:
Code:
and not filter(f_martian)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Router sends "martian address" when acting as DHCP server ixhabbaba Linux - Software 1 09-16-2008 03:35 PM
LXer: Merging "Open Source" and "Free Software" LXer Syndicated Linux News 2 08-08-2007 04:27 AM
What does "Directory "/usr/src/linux" doesn't appear to contain kernel source." mean? jtp51 Linux - General 4 06-11-2007 12:22 AM
Strange "martian source" messages in my linux gateway log files Dr3am3r Linux - Networking 2 12-09-2006 08:57 AM
Can you explain the difference between "Free Software (GNU)" and "Open Source"? vharishankar General 5 03-03-2005 09:40 AM


All times are GMT -5. The time now is 02:09 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration