topic Re: syslog.conf - How to negate a facility in Operating System - HP-UX

syslog.conf - How to negate a facility

Mauro Gatti — Tue, 30 Oct 2007 05:46:14 GMT

Hi all,
Does it exist a way to negate a facility in syslog.conf?
for example: if I write
auth.info /alpha
*.info /beta
system logs auth.info both in /alpha and in /beta
I would like that system logs auht.info only in /alpha without rewrite syslog.conf putting all facility but auth in 2nd line:
auht.info /alpha
facility1,facility2,..,facilityN.info /beta

Thank You

Best Regards

Mauro

Re: syslog.conf - How to negate a facility

Fat Scrape — Tue, 30 Oct 2007 06:16:12 GMT

Mauro,

I use syslog-ng it's better and easy to use than syslogd.

You can download it from:

http://hpux.connect.org.uk/hppd/hpux/Networking/Admin/syslog_ng-1.6.12/

Fat

Re: syslog.conf - How to negate a facility

Mauro Gatti — Tue, 30 Oct 2007 06:26:48 GMT

It seems it's already installed but classic syslogd is now running.
I have to better look into

Re: syslog.conf - How to negate a facility

Fat Scrape — Tue, 30 Oct 2007 06:32:18 GMT

Mauro,

I think that into syslogd is no possible create the filters to deny some facilities.

see this:

http://www.dia.unisa.it/~ads/corso-security/www/CORSO-0304/Syslog/index.html

Fat

Re: syslog.conf - How to negate a facility

Fat Scrape — Tue, 30 Oct 2007 06:53:10 GMT

Mauro,

However you could write:

auth.info /alpha
*.info;auth.none /beta

none:
Do not send messages from the indicated facility to the selected file. For example, specifying:
*.debug;mail.none
sends all messages except mail messages to the selected file

Fat

Re: syslog.conf - How to negate a facility

Mauro Gatti — Tue, 30 Oct 2007 07:43:39 GMT

Thank You Fat!