Want only specific syslog severity levels directed to a file

[Michael Lampi]

In Linux it is possible to configure syslog.conf to direct messages sent to syslog that have specific severity levels (e.g., debug, error, warning, etc.) to separate places.

In HP-UX it appears that there is no way to do this. If one specifies *.warning, then everything at warning level and above get captured and directed to where the syslog.conf entry places them.

Is this true?

Is there some wat one can specify that only messages at warning level can be directed to a specific place?

Thanks.

Michael Lampi

[Dennis Handly]

Have you looked at syslogd(1M)?
http://docs.hp.com/en/B2355-60130/syslogd.1M.html

[Michael Lampi]

Yes, I have read the syslog man pages.

As I said, in HP-UX it appears that you can't select a specific severity level to direct to a file, e-mail message, etc. The only mechanisms appear to be "severity level and above".

I was just hoping that there was something I was missing from reading the man pages.

[Rita C Workman]

You mention that Linux does...specific severity levels (e.g., debug, error, warning, etc.) to separate places.

HPUX does similar, depending on how you set things up. One way is to set up your syslog.conf file to send different levels of alerts to where you want/how you want.

For example:

*.alert /var/adm/syslog/syslog.log
root
@server9
*.emerg *
*.warn /var/adm/syslog/syslog.log
*.lbolt @server9

OK...above sends all alerts to the syslog file, a message to root and sends it to server.
In our case, that is the mgmt server that watches for specific info the syslog file on that box and emails the appropriate folks.
We centralize messaging this way.

.emerg sends to everyone
.warn just send a msg to syslog.log on the local box
.lbolt sends the msg over to server9
Again for it to check and email the right folks.

You can get the info on severity levels from man syslog 3c.

Hope this helps.
Rgrds,
Rita

[Michael Lampi]

Hi Rita,

What you are suggesting is not what I had in mind, either. I am aware of being able to specify different locations and methods of delivery.

There is a way in Linux to say that ONLY messages with the warning severity shall go to , and messages with error or info or anything else simply do not go to that place.

This is the behavior what I want.

Unfortunately, however, in HP-UX so far as I can tell, you can only specify the lowest severity level of the messages that will go to that place. Higher severity levels than the one you explicitly define will also go to that place.

[Dennis Handly]

>in HP-UX so far as I can tell, you can only specify the lowest severity level of the messages that will go to that place. Higher severity levels than the one you explicitly define will also go to that place.

IF HP-UX does the processing in order, you can use C++ STL tricks to implement operator== by only operator<.

*.err default?
*.warning where you want it special ...

So if errors and above to somewhere, then warnings will only go to that line.

[Michael Lampi]

No, HP-UX syslog doesn't do it that way.

[Michael Lampi]

HP just doesn't do this. I'll have to solve the problem another way.