# syslog-ng.conf query

## trossachs

I have a prob whereas my mail information is showing up in my messages log, but I can't work out where the conflict lies. My syslog-ng.conf file is posted below:

```

options {

        chain_hostnames(off);

        sync(0);

        # The default action of syslog-ng 1.6.0 is to log a STATS line

        # to the file every 10 minutes.  That's pretty ugly after a while.

        # Change it to every 12 hours so you get a nice daily update of

        # how many messages syslog-ng missed (0).

        stats(43200);

};

source src {

    unix-stream("/dev/log" max-connections(256));

    internal();

    file("/proc/kmsg");

};

destination messages { file("/var/log/messages"); };

# By default messages are logged to tty12...

destination console_all { file("/dev/tty12"); };

# ...if you intend to use /dev/console for programs like xconsole

# you can comment out the destination line above that references /dev/tty12

# and uncomment the line below.

#destination console_all { file("/dev/console"); };

log { source(src); destination(messages); };

log { source(src); destination(console_all); };

destination mail { file("/var/log/mail.log"); };

destination mailinfo { file("/var/log/mail.log"); };

destination mailwarn { file("/var/log/mail.log"); };

destination mailerr { file("/var/log/mail.log"); };

filter f_mail { facility(mail); };

filter f_info { level(info); };

filter f_warn { level(warn); };

filter f_err { level(err); };

log { source(src); filter(f_mail); destination(mail); };

log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); };

log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); };

log { source(src); filter(f_mail); filter(f_err); destination(mailerr); };

```

What I want is for all system/machine info to go to /var/log/messages and all mail related information to terminate at /var/log/mail.log.

----------

## gentoo_ram

I use something like:

```

filter mainf { not program("dovecot") and not program("postfix") and not program("CRON");};

filter mailf { program("postfix"); };

destination messages { file("/var/log/messages"); };

destination maillog { file("/var/log/maillog"); };

log { source(src); filter(mainf); destination(messages); };

log { source(src); filter(mailf); destination(maillog); };

```

In my case, my mail is handled by "postfix".

----------

## think4urs11

You need to terminate log messages at the last log statement where they should be logged with 'flags (final)'

something like

```
options { chain_hostnames(off); sync(0); stats(43200); };

source src { unix-stream("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); };

destination messages { file("/var/log/messages"); };

destination mail { file("/var/log/mail.log"); };

filter f_mail { facility(mail); };

log { source(src); filter(f_mail); destination(mail); flags (final); };

log { source(src); destination(messages); };

```

----------

## Cyker

flags(final) FTW  :Very Happy: 

----------

## trossachs

What I require is for the messages log to track all 'system' based notification, authentication ans such like. And obviously for mail.log to track all references to Postfix.

----------

## aceFruchtsaft

 *trossachs wrote:*   

> What I require is for the messages log to track all 'system' based notification, authentication ans such like. And obviously for mail.log to track all references to Postfix.

 

First, Postfix does not start a daemon called "postfix", so it's useless to use that as a filter:

```

# ps aux | grep postfix

root      8392  0.0  0.1  47576  2292 ?        Ss   Jan31   0:16 /usr/lib/postfix/master

postfix   8449  0.0  0.1  49980  2676 ?        S    Jan31   0:03 qmgr -l -t fifo -u

postfix   9321  0.0  0.1  46696  2148 ?        S    17:52   0:00 pickup -l -t fifo -u

postfix  10509  0.0  0.1  43476  2208 ?        S    Jan31   0:01 tlsmgr -l -t unix -u

```

Second, in this case it's much smarted to filter for the mail facility, which is used by postfix daemons:

```

filter f_mail { facility(mail) ; };

```

Finally, as suggested above, use flags(final) in the log directive to prevent mail logs getting into /var/log/messages.

----------

## trossachs

Is it not possible to configure Syscon-ng to simply report different daemons to different logs depending on the name? Such as Postfix, Amavis, Clamd, Spamd etc to report to /var/log/mail.log. Cron, ssh and such like to report to /var/log/messages and so on?

----------

## swimmer

Yes it is ... I solved it as follows:

```

options { 

  group(wheel);

  perm(0640);

   chain_hostnames(off); 

   sync(0); 

   # The default action of syslog-ng 1.6.0 is to log a STATS line

   # to the file every 10 minutes.  That's pretty ugly after a while.

   # Change it to every 12 hours so you get a nice daily update of

   # how many messages syslog-ng missed (0).

   #stats(43200); 

   stats(0); 

};

source src {

    unix-stream("/dev/log" max-connections(256));

    internal();

    file("/proc/kmsg");

};

destination sshd { file("/var/log/sshd"); };

destination shorewall { file("/var/log/shorewall"); };

destination cron { file("/var/log/cron"); };

destination mail { file("/var/log/mail"); };

destination messages { file("/var/log/messages"); };

# By default messages are logged to tty12...

destination console_all { file("/dev/tty12"); };

# ...if you intend to use /dev/console for programs like xconsole

# you can comment out the destination line above that references /dev/tty12

# and uncomment the line below.

#destination console_all { file("/dev/console"); };

filter f_sshd { program("sshd"); };

filter f_shorewall { match("Shorewall:"); };

filter f_cron { facility(cron); };

filter f_mail { facility(mail); };

filter f_messages { not program("sshd") and not match("Shorewall:") and not facility(cron) and not facility(mail); };

log { source(src); filter(f_sshd); destination(sshd); };

log { source(src); filter(f_shorewall); destination(shorewall); };

log { source(src); filter(f_cron); destination(cron); };

log { source(src); filter(f_mail); destination(mail); };

log { source(src); filter(f_messages); destination(messages); };

log { source(src); destination(console_all); };
```

HTH

swimmer

----------

