Thanks to both of you... I'd already sussed out and used what Mel suggested, but I've learnt for the future, from Jeff's suggestion. It all makes sense going back through the man pages, when you get a couple of examples explained to you.

Many thanks,
Steve ;)
--

Mel wrote:
On Monday 08 October 2007 16:24:22 Jeff Royle wrote:
Stephen Allen wrote:
/usr/local/etc/dhcpd.conf is configured with

     "log-facility local7;"

and /etc/syslog.conf is also configured with

     "local7.*  /var/log/dhcpd.log"

However, /var/log/messages is filling up with "DHCPDISCOVER / no free
leases" messages for those clients that are unknown to the DHCP server
(eg. on a different subnet).  I suspect that these messages are being
caught by "*.notice" which is why they end up in /var/log/messages.

Is there a way to prevent this happening?
You could try filtering them out of syslog like so (in your syslogd.conf):

"local7.!=notice  /var/log/dhcpd.log"

Which should log everything for local7 except notice. See man
syslog.conf(5)

Almost correct but he doesn't want /var/log/messages filling up, so add local7.none to the line that points to /var/log/messages, ie:
--- /etc/syslog.conf    2007-09-20 09:22:55.000000000 -0800
+++ /etc/syslog.conf.dhcpd      2007-10-09 14:32:18.000000000 -0800
@@ -6,7 +6,7 @@
 #      may want to use only tabs as field separators here.
 #      Consult the syslog.conf(5) manpage.
 *.err;kern.warning;auth.notice;mail.crit               /dev/console
-*.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err  
/var/log/messages
+*.notice;local7.none;authpriv.none;kern.debug;lpr.info;mail.crit;news.err      
/var/log/messages
 security.*                                     /var/log/security
 auth.info;authpriv.info                                /var/log/auth.log
 mail.info                                      /var/log/maillog


_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to