Re: Avoiding duplicate syslog messages
At 17:12:57.03 on 23-APR-2011 in message , Stuart Henderson wrote: >On 2011-04-23, Michael T. Davis wrote: >> Say you have some number of syslog messages directed to the console: >> >> auth,authpriv,daemon,kern,user,local0.* /dev/console >> >> Now we want local0 messages that come from "myapp" to also be sent to anyone >> who's logged into the system: >> >> !myapp >> local0.* * >> >> For the purposes of this discussion, these two sections may be considered >> the entirety of the (current) syslog.conf file in the order presented. Is >> there a way to formulate syslog.conf so that if someone is using the > console, >> only a single stream of messages from myapp is displayed? FWIW, we don't >> care about local0 messages from anything other than myapp. >> >> Thanks, >> Mike > >!!myapp >*.** >!* > >auth,authpriv,daemon,kern,user,local0.*/dev/console > > >This is sort-of in the manpage but IMO the phrase "cancelling the effect >of a !prog or !!prog" is not exactly crystal-clear when it comes to !!, >it might be better replaced with something like "ending a !prog or !!prog >block". Though I know opinions vary on this :) > ...And/Or, perhaps the description of "!!" could be better written: Old !!prog causes the subsequent block to abort evaluation when a message matches, ensuring that only a single set of actions is taken. New !!prog causes any subsequent block(s) that would normally match to be ignored, ensuring that only the single set of actions in the !!prog block is taken. At any rate, thanks for the clarification. Would you (or anyone) happen to know if there's a way to achieve this behavior under a syslog that doesn't grok "!!" (a la BSD)? Thanks, Mike -- | Manager for Networking, Admin. Michael T. Davis (Mike) | & Research Computing: CBE/MSE http://www.ecr6.ohio-state.edu/~davism/ | The Ohio State University | 197 Watts, (614) 292-6928 ** E-mail is the best way to contact me **
Re: Avoiding duplicate syslog messages
On 2011-04-23, Michael T. Davis wrote: > Say you have some number of syslog messages directed to the console: > > auth,authpriv,daemon,kern,user,local0.* /dev/console > > Now we want local0 messages that come from "myapp" to also be sent to anyone > who's logged into the system: > > !myapp > local0.* * > > For the purposes of this discussion, these two sections may be considered > the entirety of the (current) syslog.conf file in the order presented. Is > there a way to formulate syslog.conf so that if someone is using the console, > only a single stream of messages from myapp is displayed? FWIW, we don't > care about local0 messages from anything other than myapp. > > Thanks, > Mike !!myapp *.* * !* auth,authpriv,daemon,kern,user,local0.* /dev/console This is sort-of in the manpage but IMO the phrase "cancelling the effect of a !prog or !!prog" is not exactly crystal-clear when it comes to !!, it might be better replaced with something like "ending a !prog or !!prog block". Though I know opinions vary on this :)
Avoiding duplicate syslog messages
Say you have some number of syslog messages directed to the console: auth,authpriv,daemon,kern,user,local0.* /dev/console Now we want local0 messages that come from "myapp" to also be sent to anyone who's logged into the system: !myapp local0.** For the purposes of this discussion, these two sections may be considered the entirety of the (current) syslog.conf file in the order presented. Is there a way to formulate syslog.conf so that if someone is using the console, only a single stream of messages from myapp is displayed? FWIW, we don't care about local0 messages from anything other than myapp. Thanks, Mike -- | Manager for Networking, Admin. Michael T. Davis (Mike) | & Research Computing: CBE/MSE http://www.ecr6.ohio-state.edu/~davism/ | The Ohio State University | 197 Watts, (614) 292-6928 ** E-mail is the best way to contact me **
