2

I am failing to get filtering by program or facility working in FreeBSD syslogd.

I added

local6.debug            /var/log/test.log
!testd
*.debug                 /var/log/test.log

to my /etc/syslog.conf and restarted the syslog daemon.

I then wrote a little Go program testd that sends a "debug" message to syslogd (facility "user") and then sent an additional message using logger -p local6.debug "msg". The first message was only logged to /var/log/messages (according to the default rules), but not to /var/log/test.log, the second one was not logged at all.

It seems the rules are being ignored?

snøreven
  • 165
  • 1
  • 9
  • Did you have a look at /var/log/debug.log ? Can you paste entire /etc/syslog.conf ? Have you tried reproducing the issue with default syslog.conf (the one available at http://svnweb.freebsd.org/base/head/etc/syslog.conf?revision=252481&view=markup) –  Aug 22 '13 at 11:15
  • Thanks for the answer! Forgot about debug.log: the logger message is indeed there. I am using the default syslog.conf plus the three lines I pasted above the "!ppp" line/block. – snøreven Aug 22 '13 at 11:58

2 Answers2

1

It seems that your log messages are sent to /var/log/debug.log because of this line : *.=debug /var/log/debug.log

You can either :

  • Use another priority for your tests (eg notice instead of debug)
  • Change the order so that your lines are before the one referring to debug.log
  • Unfortunately that does not work. I already tried putting "local6.debug" as line #1 - doesn't change anything. – snøreven Aug 22 '13 at 13:39
  • 1
    Did you try "# touch /var/log/test.log and chmod it to mode 600 before it will work"? –  Aug 22 '13 at 13:43
  • 1
    Aaah, that works for facility. I tried that before but I guess I forgot to restart syslog after creating the file. Filter by program name still does not work, but I think that's related to the syslog library I'm using. Please edit your answer so I can accept. – snøreven Aug 22 '13 at 14:31
0

The file you want to log to must exist and have the right permissions. Run the following commands as root to create the file, update its permissions and reload the syslog configuration:

touch /var/log/test.log
chmod 600 /var/log/test.log
killall -HUP syslogd

Tested on FreeBSD 10.3, 11.1 and 12.0.

Note: Credit goes to user130370 who mentioned this in the comments. However, he/she didn't return to update their answer with this information. I feel this should be posted as an answer since it solved the OP's problem.

simlev
  • 1,105
  • 3
  • 14
  • 22