Date: Thu, 26 Feb 2009 11:08:36 -0500 From: Janos Dohanics <web@3dresearch.com> To: freebsd-questions@freebsd.org Cc: Paul Halliday <paul.halliday@gmail.com> Subject: Re: Can stock syslog do hostA -> fileA? Message-ID: <200902261108.36595.web@3dresearch.com> In-Reply-To: <2dab70a30902260619j67d56555g3de8dfd4a60a1abe@mail.gmail.com> References: <2dab70a30902260619j67d56555g3de8dfd4a60a1abe@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thursday 26 February 2009 09:19:34 am Paul Halliday wrote: > I am collecting syslogs from a PIX and a couple of Barracudas. It > would be a lot easier for each to have their own logfile. I have been > poking around a bit; I saw this one: > > +host1 /var/log/host1 > > but it doesn't appear to work. Is it being trumped by something else > in the config file? Is the syntax wrong? > > Thanks. > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to > "freebsd-questions-unsubscribe@freebsd.org" Here is what works for me, logging a router running pFsense:: In /etc/rc.conf: syslogd_enable="YES" syslogd_flags="-a 192.168.0.1 -v" In /etc/syslogd.conf: +pfsense *.* /var/log/pfsense.log +* In /etc/hosts: 192.168.0.1 pfsense Then, do a /etc/rc.d/syslogd restart I should note that in /etc/syslogd.conf the +pfsense entry block is after the cron.* entry and before the *.=debug. I seem to remember that when I appended the +pfsense block to the end of /etc/syslogd.conf, everything was logged to /var/log/messages - may be I made a typo then (?); I didn't think that the order of entries matters... Hope this helps, -- Janos Dohanics
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200902261108.36595.web>