From owner-freebsd-stable  Mon Jul  2 11:43:52 2001
Delivered-To: freebsd-stable@freebsd.org
Received: from salmon.maths.tcd.ie (salmon.maths.tcd.ie [134.226.81.11])
	by hub.freebsd.org (Postfix) with SMTP id D5BAF37B401
	for <stable@freebsd.org>; Mon,  2 Jul 2001 11:43:49 -0700 (PDT)
	(envelope-from dwmalone@maths.tcd.ie)
Received: from walton.maths.tcd.ie by salmon.maths.tcd.ie with SMTP
          id <aa77499@salmon>; 2 Jul 2001 19:43:48 +0100 (BST)
Date: Mon, 2 Jul 2001 19:43:48 +0100
From: David Malone <dwmalone@maths.tcd.ie>
To: Rasputin <rara.rasputin@virgin.net>
Cc: stable@freebsd.org
Subject: Re: filtering syslog by remote host?
Message-ID: <20010702194348.A26764@walton.maths.tcd.ie>
References: <20010702155700.A18774@dogma.freebsd-uk.eu.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20010702155700.A18774@dogma.freebsd-uk.eu.org>; from rara.rasputin@virgin.net on Mon, Jul 02, 2001 at 03:57:00PM +0100
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-stable.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-stable>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-stable>
X-Loop: FreeBSD.ORG

On Mon, Jul 02, 2001 at 03:57:00PM +0100, Rasputin wrote:
> 
> Hi there - wondered if BSD's native syslog could
> filter events based on the orginating host?
> 
> man syslog.conf seems to indicate it can, but I can't get it working.

Last time I checked it, it worked OK, but I'm going to check again
to be on the safe side. There is a gotcha though. The hostname you
give in syslog.conf must match the name which shows up in the log
file exactly. Usually this means the full host name, but if the
remote machine and the machine logging the message are in the same
domain then you must leave off the everything after the first dot.

I'm going to try to make syslogd more helpful in this respect, but
unfortunately the code which removes everything after the first
dot is a long way from the code which does the comparison, so it
may not be easy to fix.

	David.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message