From owner-freebsd-questions Fri Nov 8 6:43:26 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BE53737B401 for ; Fri, 8 Nov 2002 06:43:25 -0800 (PST) Received: from grant.org (grant.org [206.190.164.98]) by mx1.FreeBSD.org (Postfix) with ESMTP id 176F543E97 for ; Fri, 8 Nov 2002 06:43:25 -0800 (PST) (envelope-from mgrant@splat.grant.org) Received: from splat.grant.org (mgrant@splat.grant.org [213.39.2.177]) by grant.org (8.12.6/8.12.6) with ESMTP id gA8EhH57002334 for ; Fri, 8 Nov 2002 09:43:18 -0500 (EST) (envelope-from mgrant@splat.grant.org) Received: (from mgrant@localhost) by splat.grant.org (8.11.6+Sun/8.11.6) id gA8Eg5G26305; Fri, 8 Nov 2002 15:42:06 +0100 (MET) Date: Fri, 8 Nov 2002 15:42:06 +0100 (MET) Message-Id: <200211081442.gA8Eg5G26305@splat.grant.org> From: Michael Grant To: freebsd-questions@freebsd.org Subject: syslog question Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG I have these lines in my syslog.conf: *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages !ipmon *.* /var/log/ipflog The first line says send *.notice, kern.debug...etc to messages. The second line starts a block specifically referring to the program name "ipmon". The third line says send all errors from ipmon to ipflog. I'm getting duplicate logging for ipf in both messages and ipflog. It's because ipmon sends the syslog messages at the LOG_NOTICE level. Is there any way to say in the first line "send *.notice except where programname=ipmon to /var/log/messages"? I read through the syslog.conf man page, but there doesn't seem to be any way to do this. I was just curious if anyone else has configured something like this in syslog? Michael Grant To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message