Re: Syslog.conf and remote logging from other devices to a NetBSD server

[xover2391%hush.com@localhost]

On 7/30/2024 at 11:52 PM, xover2391%hush.com@localhost wrote:
>
>On 7/25/2024 at 6:06 AM, "RVP" <rvp%SDF.ORG@localhost> wrote:
>>
>>On Wed, 24 Jul 2024, xover2391%hush.com@localhost wrote:
>>
>>> So, based on what I had read in the syslog.conf(5) man page, I 
>>appended the following to /etc/syslog.conf :
>>>
>>>        +192.168.1.200
>>>        *.*                                /var/log/host1
>>>
>>
>>Can you reset the progname filter as shown in the man-page:
>>
>>!*			<-- add this line
>>+192.168.1.200
>>*.*		/var/log/host1
>>
>>-RVP
>
>
>
>The addition of that line does not appear to have changed what was 
>happening before that line was added. The syslog messages from 
>192.168.1.200 are still being received and are still being 
>appended to /var/log/messages instead of /var/log/host1.
>
>Any further suggestions would be appreciated. Thanks.



I decided to try one of the examples given near the end of the syslog.conf(5) man page. I removed the alterations I had made to the /etc/syslog.conf file, and appended the following example instead:

# Save non-local log messages from all programs to a separate file.
!*
-@
*.*                                     /var/log/foreign

I then created the /var/log/foreign file with:

touch /var/log/foreign

Lastly, I rebooted the NetBSD server and logged in.

The /var/log/messages file contained the usual stuff, but also the messages from the remote device (192.168.1.200) which I was not expecting.

The /var/log/foreign file contained everything logged in /var/log/messages, /var/log/maillog, /var/log/authlog, and the messages from the remote device (192.168.1.200). Definitely wasn't expecting that.

So, unless I'm doing something very wrong, something with the syslog system doesn't seem to be working as it should.