Removing inetd messaging from syslog.

[Ian Killer]

Our syslog which we use regularly in problem solving is full of "Connection Attempt" messages logged by inetd, making the task of problem solving more painful than it needs to be. I cant remove the informational level daemon messages from syslog without losing our service guard messages aswell. We can't turn off inetd logging without compromising our security. Is there a way of configuring inetd to log to somewhere other than syslogd without turning off logging completely?

[Bill Hassell]

Syslog logging is coded inside the programs so you have to direct syslog as to what you'd like to do. The file is /etc/syslog.conf and has the format:

facility.level location

where facility are things like kern and daemon and mail, level has values like debug and info and warn, and location can be any file, devicefile, or even a remote server. So to log all daemon messages at the info level and higher to a file called /var/adm/syslog/daemon.log, use:

daemon.info /var/adm/syslog/daemon.log

Now to remove the daemon messages from syslog.log, you'll need to change the current line for syslog.log to something like this:

*.info;mail.none;daemon.none /var/adm/syslog/syslog.log

Note that each line in syslog.conf is processed one at a time so if you leave out the daemon.none above, both syslog.log and daemon.log will get the same messages from daemons.

The best way to verify changes in syslog.conf is to use the logger command. To log a message to syslog as a daemon at the warn level:

logger -t mytest -p daemon.warn Testing

To send important messages to a separate system over the network, do something like:

*.warn @ remote.system.com

and the remote system will log all warn messages from the local system (in addition to any other logging going on in the local server).

[Ian Killer]

Thanks Bill... You provided a lot a valuable information I didn't already know about syslog, but I need to separate inetd (daemon) messages from cmcld (also daemon) messages for serviceguard. It turns out that it can not be done without an independent filter.