Re: Save rsyslog data -

2012-08-20 Thread Ed Greshko
On 08/21/2012 12:36 AM, Bob Goodwin - Zuni, Virginia, USA wrote: > System information under status says: > > System > Name tomato > Model Linksys WRT54G/GS/GL > Time Mon, 20 Aug 2012 12:33:00 -0400 > Uptime 1 day, 23:14:16 > CPU Load (1 / 5 / 15 mins) 0.01 / 0.01 / 0.00 > Total

Re: Save rsyslog data -

2012-08-20 Thread Bob Goodwin - Zuni, Virginia, USA
On 20/08/12 12:28, Ed Greshko responds: "tomato" is your router, right? Not a Fedora machine, right? Those log entries are being written by "localhost". They are iptables log entries. Now, I see you having 2 choices. 1. You could post your iptables rules and and have someone debug the

Re: Save rsyslog data -

2012-08-20 Thread Ed Greshko
On 08/21/2012 12:17 AM, Bob Goodwin - Zuni, Virginia, USA wrote: > Ok, but I Have not intentionally done anything to accomplish that. This must > result from tomato's logging? It' internal log displays: > > snip > >> Aug 20 12:12:09 localhost user.warn kernel: ACCEPT IN

Re: Save rsyslog data -

2012-08-20 Thread Bob Goodwin - Zuni, Virginia, USA
On 20/08/12 12:07, Ed Greshko responds: It was my understanding that you were trying to shunt log entries sent by your "router" to a file different than /var/log/messages. What you are showing are logs generated by your "localhost" that are created by iptables. You seem to have a rule set up

Re: Save rsyslog data -

2012-08-20 Thread Ed Greshko
On 08/20/2012 11:58 PM, Bob Goodwin - Zuni, Virginia, USA wrote: > [root@box9 bobg]# cat /var/log/messages > > snip a few megs > > Aug 20 11:52:44 localhost kernel: ACCEPT IN=br0 OUT=vlan1 SRC=192.168.1.9 > DST=74.126.6.130 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=30

Re: Save rsyslog data -

2012-08-20 Thread Bob Goodwin - Zuni, Virginia, USA
On 20/08/12 11:42, Ed Greshko responds: On 08/20/2012 11:29 PM, Bob Goodwin - Zuni, Virginia, USA wrote: It doesn't seem to accept double quotes, single still yields an error message. [bobg@box9 ~]$ cat /var/log/tomato.log Aug 20 11:02:27 box9 rsyslogd: the last error

Re: Save rsyslog data -

2012-08-20 Thread Ed Greshko
On 08/20/2012 11:29 PM, Bob Goodwin - Zuni, Virginia, USA wrote: >It doesn't seem to accept double quotes, single still yields an >error message. > >[bobg@box9 ~]$ cat /var/log/tomato.log > >Aug 20 11:02:27 box9 rsyslogd: the last error occured in >/etc/rsyslog.d/em

Re: Save rsyslog data -

2012-08-20 Thread Bob Goodwin - Zuni, Virginia, USA
On 20/08/12 10:54, Ed Greshko responds: On 08/20/2012 10:44 PM, Bob Goodwin - Zuni, Virginia, USA wrote: I've tried several forms: /etc/rsyslog.d/emptyfile.conf :source, isequal, 192.168.1.9 /var/log/tomato.log :source, isequal, 192.168.1.9 ~ But can't find the rig

Re: Save rsyslog data -

2012-08-20 Thread Ed Greshko
On 08/20/2012 10:44 PM, Bob Goodwin - Zuni, Virginia, USA wrote: > I've tried several forms: > >/etc/rsyslog.d/emptyfile.conf > >:source, isequal, 192.168.1.9 /var/log/tomato.log >:source, isequal, 192.168.1.9 ~ > >But can't find the right one. I believe you need either

Re: Save rsyslog data -

2012-08-20 Thread Bob Goodwin - Zuni, Virginia, USA
On 20/08/12 10:26, Bob Goodwin - Zuni, Virginia, USA responds: On 19/08/12 21:08, Ed Greshko responds: FWIW, I use rsyslog to log messages from my Dlink router. I don't use the "source" method. I simply have this in my rsyslog.conf if $msg contains 'D-Link' then /var/log/dlink.log since

Re: Save rsyslog data -

2012-08-20 Thread Bob Goodwin - Zuni, Virginia, USA
On 19/08/12 21:08, Ed Greshko responds: FWIW, I use rsyslog to log messages from my Dlink router. I don't use the "source" method. I simply have this in my rsyslog.conf if $msg contains 'D-Link' then /var/log/dlink.log since an entry from the router looks like this Aug 20 09:04:05 M

Re: Save rsyslog data -

2012-08-19 Thread Ed Greshko
On 08/20/2012 06:17 AM, Bob Goodwin - Zuni, Virginia, USA wrote: >And I changed file name, missed that on the last change. > >[root@box9 rsyslog.d]# cat emptyfile.conf ># /etc/rsyslog.d/emptyfile > >:source, isequal, tomato /var/log/tomato.log >:source, isequal, tomato ~ > >

Re: Save rsyslog data -

2012-08-19 Thread Bob Goodwin - Zuni, Virginia, USA
On 19/08/12 17:11, Heinz Diehl types: On 19.08.2012, Bob Goodwin - Zuni, Virginia, USA wrote: [bobg@box9 rsyslog.d]$ cat emptyfile # /etc/rsyslog.d/emptyfile :source, isequal, 192.168.1.9 /var/log/tomato.log :source, isequal, 192.168.1.9 ~ Actually I even tried naming

Re: Save rsyslog data -

2012-08-19 Thread Bob Goodwin - Zuni, Virginia, USA
On 19/08/12 17:11, Heinz Diehl types: On 19.08.2012, Bob Goodwin - Zuni, Virginia, USA wrote: [bobg@box9 rsyslog.d]$ cat emptyfile # /etc/rsyslog.d/emptyfile :source, isequal, 192.168.1.9 /var/log/tomato.log :source, isequal, 192.168.1.9 ~ Actually I even tried naming

Re: Save rsyslog data -

2012-08-19 Thread Heinz Diehl
On 19.08.2012, Bob Goodwin - Zuni, Virginia, USA wrote: >[bobg@box9 rsyslog.d]$ cat emptyfile ># /etc/rsyslog.d/emptyfile > >:source, isequal, 192.168.1.9 /var/log/tomato.log >:source, isequal, 192.168.1.9 ~ > >Actually I even tried naming it emptyfile.conf out of desper

Re: Save rsyslog data -

2012-08-19 Thread Bob Goodwin - Zuni, Virginia, USA
On 19/08/12 15:44, Ed Greshko types: On 08/20/2012 12:53 AM, Heinz Diehl wrote: On 19.08.2012, Bob Goodwin - Zuni, Virginia, USA wrote: Can someone tell me the proper command to save log data to " /home/bobg/xxlog" instead of filling up "var/log/messages" nothing I've tried has worked? Here's

Re: Save rsyslog data -

2012-08-19 Thread Ed Greshko
On 08/20/2012 12:53 AM, Heinz Diehl wrote: > On 19.08.2012, Bob Goodwin - Zuni, Virginia, USA wrote: > >> Can someone tell me the proper command to save log data to " >> /home/bobg/xxlog" instead of filling up "var/log/messages" nothing I've >> tried has worked? > Here's what works for me: > > 1.

Re: Save rsyslog data -

2012-08-19 Thread Heinz Diehl
On 19.08.2012, Bob Goodwin - Zuni, Virginia, USA wrote: > Can someone tell me the proper command to save log data to " > /home/bobg/xxlog" instead of filling up "var/log/messages" nothing I've > tried has worked? Here's what works for me: 1. Go to /etc/sysconfig/rsyslog and add the "-r" option

Save rsyslog data -

2012-08-19 Thread Bob Goodwin - Zuni, Virginia, USA
Can someone tell me the proper command to save log data to " /home/bobg/xxlog" instead of filling up "var/log/messages" nothing I've tried has worked? [bobg@box9 ~]$ less /etc/rsyslog.conf .. snip .#$ActionResumeRetryCount -1# infinite retries if hos