Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

syslog customization

Posted on 2010-11-30
7
Medium Priority
?
389 Views
Last Modified: 2012-08-13
I am trying to customize syslog server and would like to know if its possible to dedicated logfile per device. lets say facility local7is reserved for network devices how can i split this up to per device ? without switching to another facility (sticking with local7 for all devices.)
0
Comment
Question by:shadow2007
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 35

Expert Comment

by:Duncan Roe
ID: 34242944
local7 is local7. You can't split it further, not with standard syslog facilities anyway.
0
 

Author Comment

by:shadow2007
ID: 34248627
what abt with rules ? (using syslogd 1.4.1 with cent os 5)
0
 
LVL 35

Expert Comment

by:Duncan Roe
ID: 34252507
Not with syslogd rules, no. You would have to re-build the entire logging system to introduce more categories
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 35

Expert Comment

by:Duncan Roe
ID: 34272513
This is an article about how to configure a network syslogd server to store entries from multiple systems. You can store entries from different systems into different directories if you want.
I don't think it helps with your requirements. You can't run multiple syslogd servers on your system pretending to be on different systems - is that what you had in mind?
0
 

Author Comment

by:shadow2007
ID: 34285032
my requirement =  store entries from different systems into different files
can this be done ? if so how ?
0
 
LVL 35

Accepted Solution

by:
Duncan Roe earned 2000 total points
ID: 34287657
If by store entries from different systems you mean different computer systems, then rsyslog is what you want, as per your penultimate post. But that's not what you asked in the Q, so I'll go back to your original question.
You have all devices logging to local7. You have configured syslog so that there is a dedicated log file for all messages in category local7, any priority. Let's say this file is /var/log/local7
If you look at this log file, can you tell which device each message came from?
I'm going to assume you can.
Can you write a grep command which will filter out all and only the lines of interest for a particular device? I'm going to assume you can do that as well. Btw, if you are generating these messages, you can fix them yourself to make the task easier if need be.
Given the above, bow run the required number of scripts of the form:

tail --follow=name /var/log/local7 | grep your_grep_expression_for_device > device/log

The output file naming is up to you - I gave an example of a separate directory per device.
We do something like this at work for a system that generates masses of log entries when in debug mode - syslog is configured to limit he files to a couple of MB and we run logrotate every minute. The tail argument --follow=name means tail keeps reading the latest file (see man tail) but the output log file itself doesn't rotate well because the script doesn't ever close it.
0

Featured Post

What Is Blockchain Technology?

Blockchain is a technology that underpins the success of Bitcoin and other digital currencies, but it has uses far beyond finance. Learn how blockchain works and why it is proving disruptive to other areas of IT.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Suggested Courses

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question