Good Day,

A few days ago, I put freebsd on a Netra X1 to serve as our primary log host for our network devices, primarily to log for our CISCO ASA firewall.

Once I configured syslog to capture remotely, I realized that syslog by default logs local information to /var/log/messages via: *.err *.info amongst others, causing duplicate firewall logs in /var/log/messages and in /var/log/firewall/logs

My syslog:

From what I understand, in syslog.conf I can specify a process id (or string? (e.g. ftpd) and give it an action? Thus, redirect messages sent to the wrong facility and logged in the proper place, as in my example given below:

ftpd.err  /var/log/ftp/1.log /var/log/ftp/2.log

I fired up tcpdump and saw the following:

09:47:28.413584 IP > SYSLOG, length: 154 09:47:28.413596 IP > SYSLOG, length: 155 09:47:28.415157 IP > SYSLOG, length: 134 09:47:28.415166 IP > SYSLOG, length: 178

So the big question is, what best method can I employ to stop syslog from duplicating these messages?

Can I use SYSLOG as a string?
local7.err  /var/log/firewall/log /var/log/firewall/1.log

local7.err  /var/log/firewall/log /var/log/firewall/1.log

Lastly, I quickly reviewed syslog-ng, but I really want to keep this as simple as possible so no.

Thanks much for your help!

This message was sent using IMP, the Internet Messaging Program.

_______________________________________________ mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to