On 12/6/12 9:20 AM, franckm wrote:
Thanks Dennis. Do you mean LogSyslog can provide more detailed log than LogFile? Does the LogFacility setting apply to LogSyslog only or it also applies to LogFile. I have noticed my LogFacility setting does not have the default value. It is set to LOG_MAIL not LOG_LOCAL6.
The facility only determines what file will collect the logger data from the service. The severity level found in your syslog.conf (or rsyslog.conf) file determines the ultimate verbosity of that logging. If it is set to mail.* then you are getting all there is. I've brought this up only because you've not said what that logging level is in the syslog configuration, and that is ultimately the controlling factor of what gets put into the log.
I use LOCAL6.* /var/log/clamd.log to create a separate log for ClamAV messages but that is a matter of preference. Mail logs are easier to parse automatically if there is no non-MTA information in there.
dp _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
