stop messages from going to syslog.log

[Alan Casey]

Dec 4 05:48:21 image1 uvservd[24254]: Working dir = /usr/pentasafe/HP-UX/vsau/bin
Dec 4 05:48:21 image1 uvservd[24254]: Got connection from 10.16.4.38:4873
Dec 4 05:48:22 image1 uvservd[24254]: ping success
Dec 4 06:18:27 image1 uvservd[24655]: Working dir = /usr/pentasafe/HP-UX/vsau/bin
Dec 4 06:18:27 image1 uvservd[24655]: Got connection from 10.16.4.38:1500
Dec 4 06:18:27 image1 uvservd[24655]: ping success
Dec 4 06:48:32 image1 uvservd[27080]: Working dir = /usr/pentasafe/HP-UX/vsau/bin
Dec 4 06:48:32 image1 uvservd[27080]: Got connection from 10.16.4.38:2101
Dec 4 06:48:32 image1 uvservd[27080]: ping success


I would like to block the above messages from entering my syslog, can anyone tell me how to do this?

/etc/syslog.conf:

image1(ts9ac1)/home/ts9ac1> more /etc/syslog.conf
# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

[harry d brown jr]

What is uvservd?

live free or die
harry

[Bill McNAMARA_1 · Accepted solution]

start by re,oving the *.info
then restart the syslogd

# /sbin/init.d/syslogd
usage: /sbin/init.d/syslogd {start|stop}

(stop then start)
or kill -HUP `cat /var/run/syslog.pid`

Later,
Bill

[Bill McNAMARA_1]

start by removing the *.info
then restart the syslogd

# /sbin/init.d/syslogd
usage: /sbin/init.d/syslogd {start|stop}

(stop then start)
or kill -HUP `cat /var/run/syslog.pid`

Later,
Bill

[Robin Wakefield]

Do you know if uvservd has a logging option, perhaps it is set by default.

Otherwise, you will need to find out the syslog facility that has been attached to this process, and, if possible, exclude it if it is unique, or send it to another file, e.g. if it is against the "user" facility:

*.info;mail.none;user.none /var/adm/syslog/syslog.log
user.info /var/adm/syslog/userlog.log

This way you'll be able to separate the "user" log messages into a different file.

Don't forget to send a -HUP to syslogd to re-read the config file.

Rgds, Robin.

[Chris Wilshaw]

The first stage is to identify the message type

To do this;

vi /etc/rc.config.d/syslogd

Change the line
SYSLOGD_OPTS="-D"
to
SYSLOGD_OPTS="-D -v"

cd /sbin/init.d
./syslogd stop
./syslogd start

This will then enable the enhanced logging mode of syslogd

The messages in syslog.log will then be preceded by an identifier code

eg:

Dec 4 03:28:31 6D:xxxxxxxx above message repeats 89 times

The code 6D indicates that this is a message of severity INFO, and type DAEMON

The summary of severity /type details from man 3c syslog gives you

LOG_EMERG 0
LOG_ALERT 1
LOG_CRIT 2
LOG_ERR 3
LOG_WARNING 4
LOG_NOTICE 5
LOG_INFO 6
LOG_DEBUG 7

LOG_KERN A
LOG_USER B
LOG_MAIL C
LOG_DAEMON D
LOG_AUTH E
LOG_SYSLOG F
LOG_LPR G
LOG_NEWS H
LOG_UUCP I
LOG_CRON J
LOCAL0-7 Q-X

Which you can then filter from syslog.log using the options in syslog.conf as mentioned in the previous responses.