Hi. On Wed, Dec 12, 2018 at 12:52:58PM +0000, Bonno Bloksma wrote: > Hi, > > Plenty of examples on-line how to move logging from the isc-dhcp-server to a > different file using something like > log-facility local7; > in the dhcp.conf file and then in my syslog.conf: > *.debug,local6.none,local7.none /var/log/syslog > # DHCP > local7.debug /var/log/dhcp/dhcpd.log > > But.... > What I really want is all the regular DHCP log stuff in a file > /var/log/dhcp/dhcpd.log but.. I want errors like "no free leases" etc in my > syslog > > Currently my monitoring tool is complaining there are way too many updates to > the syslog file and it has trouble keeping up because currently all my DHCP > servers log to the syslog file.;-) > I want my monitor tool to keep reading the syslog file and analyze it for > critical stuff like the "no free leases" warning and not have it read > thousands of lines each day for regular dhcp lines like DHCPINFORM, DHCPACK, > DHCPREQUEST, DHCPOFFER, DHCPNAK, etc. > But of course I do want to have those regular log lines stored somewhere like > in a /var/log/dhcp/dhcpd.log file
$ cat /etc/rsyslog.d/dhcp.conf :msg, contains, "DHCPINFORM" /var/log/dhcp/dhcpd.log :msg, contains, "DHCPACK" /var/log/dhcp/dhcpd.log :msg, contains, "DHCPREQUEST" /var/log/dhcp/dhcpd.log :msg, contains, "DHCPOFFER" /var/log/dhcp/dhcpd.log :msg, contains, "DHCPNAK" /var/log/dhcp/dhcpd.log :msg, contains, "DHCPINFORM" stop :msg, contains, "DHCPACK" stop :msg, contains, "DHCPREQUEST" stop :msg, contains, "DHCPOFFER" stop :msg, contains, "DHCPNAK" stop Everything that's listed in that file goes to /var/log/dhcp/dhcpd.log only. Everything that's not listed there is processed by other rsyslog rules. Reco
