I have these lines in my syslog.conf: *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages !ipmon *.* /var/log/ipflog
The first line says send *.notice, kern.debug...etc to messages. The second line starts a block specifically referring to the program name "ipmon". The third line says send all errors from ipmon to ipflog. I'm getting duplicate logging for ipf in both messages and ipflog. It's because ipmon sends the syslog messages at the LOG_NOTICE level. Is there any way to say in the first line "send *.notice except where programname=ipmon to /var/log/messages"? I read through the syslog.conf man page, but there doesn't seem to be any way to do this. I was just curious if anyone else has configured something like this in syslog? Michael Grant To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-questions" in the body of the message