Okay, I give up. I prefer to have separate NFS logs. I notice the nfs-utils package created a /var/log/nfsd directory but there are no logs stored there. I would like that to happen. Surfing revealed little (the Solaris version seems to have a nfslogd that nobody else has). Anybody know some simple tricks to route all NFS related logs to /var/log/nfsd?

Thanks again.

Are you getting no logging at all or is it just not going where you want?

If it is the latter you can easily redirect it by modifying syslogd.conf.

Yup, plenty of logs just nothing going to /var/log/nfsd.

Please explain!

Actually it's syslog.conf not syslogd.conf as I mispoke. This is used by the syslogd daemon to determine what to log and where.

Format is fairly simple and the one you have probably has good examples. It should be /etc/syslog.conf.

Basically you have service and level of message.

If all the messages you're seeing in /var/log/messages (I'm assuming that's where you're seeing them) go say "nfsd" in them then likely simply adding:
nfsd.* /var/log/nfsd
Then bounce the syslogd daemon to reread syslog.conf.

That line tells it to send all nfsd generated messages, (info, warn, critical etc...) to /var/log/nfsd.

I tried the following:

nfsd.* -/var/log/nfsd/mountd
nfs.* -/var/log/nfsd/mountd
mountd.* -/var/log/nfsd/mountd
mount.* -/var/log/nfsd/mountd

When restarting the syslog service, all entries resulted in the error message:

unknown facility name

Further surfing and reading the syslog man page revealed none of the above options are valid. The only facility option that comes close is the daemon option or one of the local options.

The primary clutter point is mountd. I would prefer those log entries go into a separate log rather than clutter the normal logs.

I tried daemon.*. That works but then all daemon log output is duplicated to the new associated log, as well as cluttering /var/log/messages. So that accomplishes nothing.

Funny thing, there is a /var/log/nfsd/mountd file being created when I reboot. I deleted the file but something recreated the file. The file size is zero and then nothing is ever entered into the file.

My bad. After doing a lot of research I can't see how to do this for rpc.mountd or nfsd. I see many people have asked the question but no one ever seems to have gotten a good response.

The facilities are defined in /usr/include/sys/syslog.h and don't include nfs or rpc stuff. It's possible that someone better at C than I am could figure out how to add rpc.mountd as a facility there though I suspect it isn't that simple - probably requires modifying the rpc.mountd to be more specific about about where it logs. Documentation for rpc simply says it sends its information to syslog(3).

Indeed there is no nfs facilities in syslog.h, there are user facilities like LOG_LOCAL0 to LOG_LOCAL7 but nfs module would have to be reprogrammed to include one of those facilities

I guess the best way is to program a parser that will extract nfs logs lines

I suspected as much after reading the syslog man page. These are the little things that sometimes annoy me about some free software tools. Usability features often are lacking.