Thanks Stuart, thinking about it some more, this is the only explanation
that makes sense - otherwise !* would be unnesesary.
From the syslog.conf(5):
!!prog causes the subsequent block to abort evaluation when a message
matches, ensuring that only a single set of actions is taken. !* can
be
used to ensure that any ensuing blocks are further evaluated (i.e.
can-
celling the effect of a !prog or !!prog).
However to me, the 2nd sentence reads that !* causes evaluation of
subsequent blocks even if a match is found within a !!prog block. Is
that
just my addled brain?
Perhaps the wording of that 2nd sentence could be something like:
!* is the 'any' tag and can be used to end a !prog or !!prog tag,
allowing
evaluation to continue as though no tag had been specified. Or
something.
paulm
On 15/03/2011, at 3:12 AM, Stuart Henderson wrote:
One more try and you probably would have had it :)
As demonstrated in the EXAMPLES section in syslog.conf(5), first use
!!myprog, then !*, then the standard ones.
On 2011-03-14, Paul M <l...@no-tek.com> wrote:
I have a program who's output I want to log exclusively to it's own
file.
Which is to say I dont want any of it's output appearing in the system
logs.
Reading the syslog man pages this doesn't seem possible:
If I put
!!myprog
*.* /path/to/logfile
after the initial block (which has no !prog tag), then when the
initial
block is evaluated and matching entries (based on wildcards) will send
output from my program to the system logs.
If I put my program tag before the initial block, then the initial
block becomes part of the block tagged by !!myprog, so will no longer
work as desired.
If I put a !* tag after my program block to sepparate the initial
block
from !!myprog, that undoes the exclusive nature of !!myprog.
Perhaps I could do this by using one of the 'local' levels. This would
probably work, but would break if some other program used the same
local level as me.
I see there is syslog-ng which may be more flexible, but I'd rather
stick with simply configuring the built in syslogd. If I cant get that
to work, I could write my own dedicated logger to only handle my
program's output (which would bring other benefits).
Is there a way to do this with syslogd?
paulm
