From owner-freebsd-questions@FreeBSD.ORG Thu Feb 26 16:08:39 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 908781065672 for ; Thu, 26 Feb 2009 16:08:39 +0000 (UTC) (envelope-from web@3dresearch.com) Received: from smtp.3dresearch.com (dorabella.3dresearch.com [66.167.251.2]) by mx1.freebsd.org (Postfix) with ESMTP id 5FB108FC25 for ; Thu, 26 Feb 2009 16:08:39 +0000 (UTC) (envelope-from web@3dresearch.com) Received: from fracasso.3dresearch.com (pool-96-236-181-134.pitbpa.east.verizon.net [96.236.181.134]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by vmail.3dresearch.com (Postfix) with ESMTP id 0B21997355; Thu, 26 Feb 2009 11:08:38 -0500 (EST) Received: from fracasso.3dresearch.com (fracasso.3dresearch.com [10.61.70.2]) by fracasso.3dresearch.com (Postfix) with ESMTP id 7CCF9172EC; Thu, 26 Feb 2009 11:08:37 -0500 (EST) From: Janos Dohanics Organization: 3D RESEARCH To: freebsd-questions@freebsd.org Date: Thu, 26 Feb 2009 11:08:36 -0500 User-Agent: KMail/1.9.7 References: <2dab70a30902260619j67d56555g3de8dfd4a60a1abe@mail.gmail.com> In-Reply-To: <2dab70a30902260619j67d56555g3de8dfd4a60a1abe@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200902261108.36595.web@3dresearch.com> Cc: Paul Halliday Subject: Re: Can stock syslog do hostA -> fileA? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Feb 2009 16:08:40 -0000 On Thursday 26 February 2009 09:19:34 am Paul Halliday wrote: > I am collecting syslogs from a PIX and a couple of Barracudas. It > would be a lot easier for each to have their own logfile. I have been > poking around a bit; I saw this one: > > +host1 /var/log/host1 > > but it doesn't appear to work. Is it being trumped by something else > in the config file? Is the syntax wrong? > > Thanks. > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to > "freebsd-questions-unsubscribe@freebsd.org" Here is what works for me, logging a router running pFsense:: In /etc/rc.conf: syslogd_enable="YES" syslogd_flags="-a 192.168.0.1 -v" In /etc/syslogd.conf: +pfsense *.* /var/log/pfsense.log +* In /etc/hosts: 192.168.0.1 pfsense Then, do a /etc/rc.d/syslogd restart I should note that in /etc/syslogd.conf the +pfsense entry block is after the cron.* entry and before the *.=debug. I seem to remember that when I appended the +pfsense block to the end of /etc/syslogd.conf, everything was logged to /var/log/messages - may be I made a typo then (?); I didn't think that the order of entries matters... Hope this helps, -- Janos Dohanics