From owner-freebsd-questions@FreeBSD.ORG  Fri Apr  1 18:50:29 2005
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 0CAA616A4CE
	for <freebsd-questions@freebsd.org>;
	Fri,  1 Apr 2005 18:50:29 +0000 (GMT)
Received: from rwcrmhc12.comcast.net (rwcrmhc12.comcast.net [216.148.227.85])
	by mx1.FreeBSD.org (Postfix) with ESMTP id BEE5B43D49
	for <freebsd-questions@freebsd.org>;
	Fri,  1 Apr 2005 18:50:28 +0000 (GMT)
	(envelope-from as2sb3100@comcast.net)
Received: from 204.127.197.111 (unknown[204.127.197.127](misconfigured
	sender))          by comcast.net (rwcrmhc12) with SMTP
	id <2005040118502801400e018he>; Fri, 1 Apr 2005 18:50:28 +0000
Received: from [72.1.133.152] by 204.127.197.111;
	Fri, 01 Apr 2005 18:50:27 +0000
From: as2sb3100@comcast.net
To: freebsd-questions@freebsd.org
Date: Fri, 01 Apr 2005 18:50:27 +0000
Message-Id: <040120051850.5087.424D97F3000D1BDB000013DF2205889116CFCFCECC0D9CCD9C0E@comcast.net>
X-Mailer: AT&T Message Center Version 1 (Dec 17 2004)
X-Authenticated-Sender: YXMyc2IzMTAwQGNvbWNhc3QubmV0
Subject: ipmon logging
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 01 Apr 2005 18:50:29 -0000

According to every website I've read so far ipmon uses local0 as the facility name.  However, on my FreeBSD 5.3-RELEASE-p5 box, it logs to the security facility.  The man page (in both 5.2.1 and 5.3) for ipmon, with -s for logging to syslog says, "The default facility when compiled and installed is security".  Can anyone explain this?  I'd like ipmon to log to a separate file so it doesn't fill up the security log.  I've tried having ipmon log directly to a file, and not using syslog, but it stops logging when newsyslog rotates the file.  Does anyone have any suggestions on what I could or should do?

Eric