On Wednesday, November 17, 2010, Lars Ellenberg wrote:
> On Wed, Nov 17, 2010 at 01:05:52PM +0100, Andrew Beekhof wrote:
> > >> fwiw, syslog_facility works the way Bernd proposed
> > >
> > > It does not, at least not if you don't have it exclusively.
> >
> > Pretty sure it does, I recall adding the code since there was no other
> > way to turn syslog logging off from ha.cf.
> > Has it changed since?
>
> Um, the point being: if you have logd log to facility local7,
> and you have something else logging to local7 as well,
> filtering on local7 gives you more than you want.
>
> So, yes, you should configure one of the things to log to local3
> instead.
>
> In most deployments, there should be one of the eight local facilities
> available for exclusive use by logd.
>
> So I'm fine with that.
>
> Apparently Bernd thinks this is not good enough, though.
>
> Or I misunderstood ;-)
My point is here, we want a simple rule to blacklist everything from the
overly verbose HA daemons from the main systems logs. Those logs have simply
far too many logs line and then it is easy to miss something important in the
logs. Now, if we rely on localX *only*, we also might blacklist something
else, that is also important. So the rule should be
local7 and match("logd:")
Right now I have to match on at least 7 daemons and have no chance to write a
generic rule for *all* RAs.
Also, there is no global config file for localX usage. Each and every daemon
can take it whenever it wants and I simply do not have much influence on that.
And unless I write some syslog rules, I even won't notice. So yes, filtering
on localX is a good idea, as it is a fast numerical filter, but it is simply
not enough, if you want to make absolutely sure.
Thanks,
Bernd
_______________________________________________________
Linux-HA-Dev: Linux-HA-Dev@lists.linux-ha.org
http://lists.linux-ha.org/mailman/listinfo/linux-ha-dev
Home Page: http://linux-ha.org/
