General
cancel
Showing results for 
Search instead for 
Did you mean: 

syslog.conf - How to negate a facility

 
SOLVED
Go to solution
Mauro Gatti
Valued Contributor

syslog.conf - How to negate a facility

Hi all,
Does it exist a way to negate a facility in syslog.conf?
for example: if I write
auth.info /alpha
*.info /beta
system logs auth.info both in /alpha and in /beta
I would like that system logs auht.info only in /alpha without rewrite syslog.conf putting all facility but auth in 2nd line:
auht.info /alpha
facility1,facility2,..,facilityN.info /beta

Thank You

Best Regards


Mauro
Ubi maior, minor cessat!
5 REPLIES 5
Fat Scrape
Honored Contributor

Re: syslog.conf - How to negate a facility

Mauro,

I use syslog-ng it's better and easy to use than syslogd.

You can download it from:

http://hpux.connect.org.uk/hppd/hpux/Networking/Admin/syslog_ng-1.6.12/


Fat



Mauro Gatti
Valued Contributor

Re: syslog.conf - How to negate a facility

It seems it's already installed but classic syslogd is now running.
I have to better look into
Ubi maior, minor cessat!
Fat Scrape
Honored Contributor

Re: syslog.conf - How to negate a facility

Mauro,

I think that into syslogd is no possible create the filters to deny some facilities.

see this:

http://www.dia.unisa.it/~ads/corso-security/www/CORSO-0304/Syslog/index.html

Fat
Fat Scrape
Honored Contributor
Solution

Re: syslog.conf - How to negate a facility

Mauro,

However you could write:

auth.info /alpha
*.info;auth.none /beta

none:
Do not send messages from the indicated facility to the selected file. For example, specifying:
*.debug;mail.none
sends all messages except mail messages to the selected file

Fat
Mauro Gatti
Valued Contributor

Re: syslog.conf - How to negate a facility

Thank You Fat!
Ubi maior, minor cessat!