oh, and I forgot to mention that you will run into serious trouble with those non-standard facility IDs if you ever intend to use it with the upcoming syslog-sign standard (for end-to-end message verfification). They simply won't play together.
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Rainer Gerhards > Sent: Tuesday, December 01, 2009 6:07 PM > To: rsyslog-users > Subject: Re: [rsyslog] using arbitrary facility id > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of Sayan Chowdhury > > Sent: Monday, November 30, 2009 5:52 PM > > To: rsyslog-users > > Subject: Re: [rsyslog] using arbitrary facility id > > > > Hello Rainer, > > Thanks... Yes I agree what I am doing is invalid. > > I was just trying it out, my idea was if I can use numbers greater > > than 23, > > then I can maybe use it as my own customized logging system, and I > > would use > > numbers greater than 23 for my application and use different ids > (>23) > > for > > different kind of application level log messages. I would try to look > > into > > the code as well, is this something you thing may be useful in > general? > > Regards, > > Sayan > > > You can definitely modify rsyslogd to support this, but you must be > very > careful that you catch all the loose ends. Be especially careful with > the > lookup table e.g. in msg.c. > > I think the overall usefulness is limited, as no well-behaved sender > would > emit such facility IDs (please read my other mail from a minute ago as > well). > > Rainer > > > > > > > On Mon, Nov 30, 2009 at 11:40 AM, Rainer Gerhards > > <[email protected]>wrote: > > > > > You can use facilities other than local0..local7, but you cannot > use > > a > > > facility with a numerical value greater than 23, because the > relevant > > > standards do not permit this (see RFC5424, Table 1). > > > > > > It may be that rsyslog does not properly prevent this, maybe it > uses > > modulo > > > 24 in this case. Will check that. But it is invalid in any case > (not > > only > > > with rsyslog but with any syslogd). > > > > > > Rainer > > > > > > > -----Original Message----- > > > > From: [email protected] [mailto:rsyslog- > > > > [email protected]] On Behalf Of Sayan Chowdhury > > > > Sent: Monday, November 30, 2009 5:20 PM > > > > To: rsyslog-users > > > > Subject: [rsyslog] using arbitrary facility id > > > > > > > > Hello All, > > > > Is it possible to use a facility id other than local0-local7? > > > > I was using a facility id of 50 in some of the messages , and I > had > > > > written > > > > a selector line in my rsyslog file as well to log messages with > > > > facility id > > > > of 50 into a seperate file. > > > > However, I see that sometimes the messages are being written into > > all > > > > the > > > > files(/var/log/messages, boot.log,/var/log/secure etc) instead of > > the > > > > one I > > > > specified in the rsyslog.conf. If I restart rsyslog the problem > > goes > > > > away. > > > > I am using rsyslog version 4.2.0. > > > > > > > > Here is the selector line in my config > > > > > > > > > > > > if $fromhost-ip == '127.0.0.1' and $syslogfacility == '50' and > > > > $syslogseverity <= '6' then $log_rotation_50 > > > > > > > > where $log_rotation_50 is an outchannel which is configured to > > rotate > > > > the > > > > file when it reaches the size of 2MB. > > > > Regards, > > > > Sayan > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
