Re: Avoiding duplicate syslog messages
At 17:12:57.03 on 23-APR-2011 in message slrn3vfsir6fv7.pk7@naiad.spacehopper.org, Stuart Henderson s...@spacehopper.org wrote: On 2011-04-23, Michael T. Davis dav...@ecr6.ohio-state.edu wrote: Say you have some number of syslog messages directed to the console: auth,authpriv,daemon,kern,user,local0.* /dev/console Now we want local0 messages that come from myapp to also be sent to anyone who's logged into the system: !myapp local0.* * For the purposes of this discussion, these two sections may be considered the entirety of the (current) syslog.conf file in the order presented. Is there a way to formulate syslog.conf so that if someone is using the console, only a single stream of messages from myapp is displayed? FWIW, we don't care about local0 messages from anything other than myapp. Thanks, Mike !!myapp *.** !* auth,authpriv,daemon,kern,user,local0.*/dev/console This is sort-of in the manpage but IMO the phrase cancelling the effect of a !prog or !!prog is not exactly crystal-clear when it comes to !!, it might be better replaced with something like ending a !prog or !!prog block. Though I know opinions vary on this :) ...And/Or, perhaps the description of !! could be better written: Old !!prog causes the subsequent block to abort evaluation when a message matches, ensuring that only a single set of actions is taken. New !!prog causes any subsequent block(s) that would normally match to be ignored, ensuring that only the single set of actions in the !!prog block is taken. At any rate, thanks for the clarification. Would you (or anyone) happen to know if there's a way to achieve this behavior under a syslog that doesn't grok !! (a la Free|NetBSD)? Thanks, Mike -- | Manager for Networking, Admin. Michael T. Davis (Mike) | Research Computing: CBE/MSE http://www.ecr6.ohio-state.edu/~davism/ | The Ohio State University | 197 Watts, (614) 292-6928 ** E-mail is the best way to contact me **
Avoiding duplicate syslog messages
Say you have some number of syslog messages directed to the console: auth,authpriv,daemon,kern,user,local0.* /dev/console Now we want local0 messages that come from myapp to also be sent to anyone who's logged into the system: !myapp local0.** For the purposes of this discussion, these two sections may be considered the entirety of the (current) syslog.conf file in the order presented. Is there a way to formulate syslog.conf so that if someone is using the console, only a single stream of messages from myapp is displayed? FWIW, we don't care about local0 messages from anything other than myapp. Thanks, Mike -- | Manager for Networking, Admin. Michael T. Davis (Mike) | Research Computing: CBE/MSE http://www.ecr6.ohio-state.edu/~davism/ | The Ohio State University | 197 Watts, (614) 292-6928 ** E-mail is the best way to contact me **
Re: Avoiding duplicate syslog messages
On 2011-04-23, Michael T. Davis dav...@ecr6.ohio-state.edu wrote: Say you have some number of syslog messages directed to the console: auth,authpriv,daemon,kern,user,local0.* /dev/console Now we want local0 messages that come from myapp to also be sent to anyone who's logged into the system: !myapp local0.* * For the purposes of this discussion, these two sections may be considered the entirety of the (current) syslog.conf file in the order presented. Is there a way to formulate syslog.conf so that if someone is using the console, only a single stream of messages from myapp is displayed? FWIW, we don't care about local0 messages from anything other than myapp. Thanks, Mike !!myapp *.* * !* auth,authpriv,daemon,kern,user,local0.* /dev/console This is sort-of in the manpage but IMO the phrase cancelling the effect of a !prog or !!prog is not exactly crystal-clear when it comes to !!, it might be better replaced with something like ending a !prog or !!prog block. Though I know opinions vary on this :)
