Hi,
I have discovered the syslog-ng template macro, so I have some
more documentation that this is indeed a syslog-ng problem,
May 19 19:36:44 l1 local2.debug pppd[9420]: Script /etc/ppp/ip-down
started (pid 13581)
May 19 19:36:44 l1 local2.debug pppd[9420]: sent [LCP TermReq id=0x2
"User re quest"]
May 19 19:36:44 l1 local2.debug pppd[9420]: rcvd [LCP TermAck id=0x3
May 19 19:36:45 l1 local2.debug pppd[9420]: Script /etc/ppp/ip-down
finished (pid 13581), status = 0x0
The above was produced by adding this destination,
destination df_debug_eslc {
file("/home/jsroot/temp/syslog-ng"
template("$DATE $HOST $FACILITY.$LEVEL $MSG\n")
template_escape(no)
);
};
to this log statement,
# all the sysadmin users
log {
source(s_all);
filter(f_sysadmin);
destination(du_root);
destination(du_jsroot);
destination(du_jeff);
destination(du_jss);
};
Notice the coincidence, that the pppd filter, immediately follows
the sysadmin filter, which should not be accepting message with
debug priority,
filter f_sysadmin {
( level(crit..alert)
and not
( filter(f_genpowerd)
or
filter(f_iptables)
or
filter(f_smartmontools)
)
);
};
# pppd logs to facility local2
filter f_ppp { facility(local2); };
Another anomaly, is that *all* of the pppd messages are sent to
the syslog with local2.debug, however, only *some* of them are being
misdirected by syslog-ng.
Thanks,
--
Jeffrey Sheinberg
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
