From owner-freebsd-questions  Thu May 23 11:33:14 1996
Return-Path: owner-questions
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id LAA07691
          for questions-outgoing; Thu, 23 May 1996 11:33:14 -0700 (PDT)
Received: from phaeton.artisoft.com (phaeton.Artisoft.COM [198.17.250.211])
          by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id LAA07686
          for <questions@freebsd.org>; Thu, 23 May 1996 11:33:12 -0700 (PDT)
Received: (from terry@localhost) by phaeton.artisoft.com (8.6.11/8.6.9) id LAA07908; Thu, 23 May 1996 11:27:19 -0700
From: Terry Lambert <terry@lambert.org>
Message-Id: <199605231827.LAA07908@phaeton.artisoft.com>
Subject: Re: syslog.conf questions
To: root@edmweb.com (Steve Reid)
Date: Thu, 23 May 1996 11:27:19 -0700 (MST)
Cc: questions@freebsd.org
In-Reply-To: <Pine.BSF.3.91.960522184128.474A-100000@bitbucket.edmweb.com> from "Steve Reid" at May 22, 96 06:56:04 pm
X-Mailer: ELM [version 2.4 PL24]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-questions@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

> I'm trying to get syslog to log messages from pppd to a seperate file
> (/var/log/pppd). The man page for syslog.conf says I need to use "!pppd"
> to log messages from that program, but I can't get it to work- nothing
> appears in the /var/log/pppd file. 
> 
> Also, how can I set up two machines so that they share each other's
> messages? I've tried something like this: 
> 
> On Kirk:
> *.warning;kern.debug;auth.info;mark.info        /var/log/messages
> *.warning;kern.debug;auth.info;mark.info        @spock
> 
> On Spock:
> *.warning;kern.debug;auth.info;mark.info        /var/log/messages
> *.warning;kern.debug;auth.info;mark.info        @kirk
> 
> The problem is, one machine recieves a message from the other, it logs the
> message and sends it back, causing the messages to be bounced back and
> forth forever. Very ugly.

This facility is for centralizing log messages, not distributing them.

To avoid the loop, you will need to change:

     local                 local
     event                 event
      |  ,----.     ,----.  |
      v  v    |     |    v  v
    ,-------. |     | ,-------.
    |syslogd| |     | |syslogd|
    `-------' |     | `-------'
      |  |    `-----|-.  |  |
      v  `----------' `--'  v
     local                 local
     log                   log

To:

     local                 local
     event                 event
      |                     |
      v                     v
    ,-------.         ,-------.
    | +--.  |         |  ,--+ |
    | |  |  |         |  |  | |
    | v  |  |         |  |  v |
    | o<-|--|<.     ,>|--|->o |
    | |  |  | |     | |  |  | |
    | v  v  | |     | |  v  v |
    `-------' |     | `-------'
      |  |    `-----|-.  |  |
      v  `----------' `--'  v
     local                 local
     log                   log

You do this by making a disctintion based on whether the source is
local or remote and whether the destination is local or remote.

This is pretty much how you do mail/news gateways.  8-).

The NetBSD modified syslog might already do this (or if that's what
you are running, it might be your problem in the first place).


					Regards,
					Terry Lambert
					terry@lambert.org
---
Any opinions in this posting are my own and not those of my present
or previous employers.