From owner-freebsd-questions@FreeBSD.ORG Tue Oct 9 22:34:57 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B504516A509 for ; Tue, 9 Oct 2007 22:34:57 +0000 (UTC) (envelope-from fbsd.questions@rachie.is-a-geek.net) Received: from snoogles.rachie.is-a-geek.net (rachie.is-a-geek.net [66.230.99.27]) by mx1.freebsd.org (Postfix) with ESMTP id 62E8413C45D for ; Tue, 9 Oct 2007 22:34:57 +0000 (UTC) (envelope-from fbsd.questions@rachie.is-a-geek.net) Received: from localhost (localhost [127.0.0.1]) by snoogles.rachie.is-a-geek.net (Postfix) with ESMTP id E6EF91CDEE; Tue, 9 Oct 2007 14:34:55 -0800 (AKDT) From: Mel To: freebsd-questions@freebsd.org, lists@qwirky.net Date: Wed, 10 Oct 2007 00:34:53 +0200 User-Agent: KMail/1.9.7 References: <47096FD7.4000309@rowyerboat.com> <470A3D96.3000904@qwirky.net> In-Reply-To: <470A3D96.3000904@qwirky.net> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200710100034.54218.fbsd.questions@rachie.is-a-geek.net> Cc: Stephen Allen Subject: Re: /var/log/messages filling up with DHCPDISCOVER messages X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Oct 2007 22:34:57 -0000 On Monday 08 October 2007 16:24:22 Jeff Royle wrote: > Stephen Allen wrote: > > /usr/local/etc/dhcpd.conf is configured with > > > > "log-facility local7;" > > > > and /etc/syslog.conf is also configured with > > > > "local7.* /var/log/dhcpd.log" > > > > However, /var/log/messages is filling up with "DHCPDISCOVER / no free > > leases" messages for those clients that are unknown to the DHCP server > > (eg. on a different subnet). I suspect that these messages are being > > caught by "*.notice" which is why they end up in /var/log/messages. > > > > Is there a way to prevent this happening? > > You could try filtering them out of syslog like so (in your syslogd.conf): > > "local7.!=notice /var/log/dhcpd.log" > > Which should log everything for local7 except notice. See man > syslog.conf(5) Almost correct but he doesn't want /var/log/messages filling up, so add local7.none to the line that points to /var/log/messages, ie: --- /etc/syslog.conf 2007-09-20 09:22:55.000000000 -0800 +++ /etc/syslog.conf.dhcpd 2007-10-09 14:32:18.000000000 -0800 @@ -6,7 +6,7 @@ # may want to use only tabs as field separators here. # Consult the syslog.conf(5) manpage. *.err;kern.warning;auth.notice;mail.crit /dev/console -*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages +*.notice;local7.none;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages security.* /var/log/security auth.info;authpriv.info /var/log/auth.log mail.info /var/log/maillog -- Mel