syslog.log entries

[CCIL]

i have HP n class server with HP-Ux 11i as OS , the server is used extensively by our clients for FTP purpose , so the /var/adm/syslog/syslog.log if i go thro" the syslog.log it shows all the FTP entries which makes nearely impossible to analyze syslog. is there any way to divert these FTP entries from syslog.log to another file

[Armin Feller]

Hi,

you have to customize the syslog.conf file.

See syslogd(1m) and syslog(3C) for more information.

Regards ...
Armin

[kish_1]

you can this script, run it on crontab and will send a mail to you

[Stefan Farrelly · Accepted solution]

Change your /etc/syslog.conf file to this and it will log ftp messages to a new ftp logfile; (then restart syslog; /sbin/init.d/syslogd stop then start)

# @(#) $Revision: 74.1 $
#
# syslogd configuration file.
#
# See syslogd(1M) for information about the format of this file.
#
local5.info;mail.none /var/adm/syslog/ftp.log
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert root
*.emerg *

[Carlo Henrico_1]

Not too sure what you want to analyse. If what you are after is the system errors and warnings (and not the FTP messages), try using "dmesg -". A normal dmesg gives you all the errors and stuff but adding a "-" (minus) shows only what you have not seen yet. The system keeps track of what you have then seen and what not.

Obviously the first time it still show everything but thereafter only what you have not seen yet.

Good luck

Carlo

[T G Manikandan]

*.info;mail.none;local5.none /var/adm/syslog/syslog.log
local5.info /var/adm/syslog/ftp.log


local5 is for ftp.

by changing the local5.info into a seperate logfile and also making the local5.none for the syslog file the ftp messages can be now re-directed to another log file

[Zeev Schultz]

grep -v ftp /var/adm/syslog/syslog.log > /tmp/syslog_no_ftp;mv /tmp/syslog_no_ftp /var/adm/syslog/syslog.log.
put anywhere from crontab to alias (ed_syslog ex.) :)

regards