Ifdef statement in syslog.conf

Hello,
what means the following lines in syslog.conf:
auth.notice               
ifdef(`LOGHOST', /var/log/authlog, @loghost)
ifdef(`LOGHOST', ,
user.err                                        /dev/sysmsg
user.err                                        /var/adm/messages
user.alert                                      `root, operator'
user.emerg                                      *
How to configure syslog to send messages to both local file and loghost server.
Thanks and regards,
Piotr

Hi,
syslog.conf is processed by m4(1) before it is used. Please see syslog.conf(4):
The file /etc/syslog.conf contains information used  by  the
system  log daemon, syslogd(1M), to forward a system message
to appropriate log files and/or users. syslogd  preprocesses
this  file  through  m4(1) to obtain the correct information
for certain log files, defining LOGHOST if  the  address  of
"loghost"  is  the  same as one of the addresses of the host
that is running syslogd.
Taking the first statement: If you want to log auth.notice to both /var/log/authlog and to a remote loghost
you may want to change the line into something like:
auth.notice                         /var/log/authlog
auth.notice                         @loghost
Make sure not to create forwarding loops that way.
Regards,
  Ronald

Similar Messages

  • Configuration issue of syslog.conf

    Dear All,
    My client is facing a configuration issue of syslog.conf.
    They have set a cacti on a Linux server for monitoring of all servers snmp & syslog.
    The part of snmp has set up successfully but cannot send the syslog to the cacti.
    My client want the syslog can keep on the localhost and send to cacti for monitoring
    we have tried to do the following things for make it work:
    Insert the information (*.* @10.251.99.74) in /etc/syslog.conf
    Restart service of system-log
    Deleted all word of loghost in the /etc/hosts file
    But still not work. Anyone can give me suggestion or idea about this?

    Thank you for your reply.
    It is tab. But I think the problem is solaris cannot use *.* to represent all logs.
    I have used the following is work
    *.err;ker.debug;daemon.notice;mail.crit @10.251.99.74
    If that is not the mail reason, please put me right.

  • Missing syslog.conf file in /etc folder!

    How do I create a syslog.conf file that I need in the /etc folder to resolve an isssue with DoorStop?

    /etc/syslog.conf already exists - you just need to edit it to your needs.
    The issue, of course, is that only root can edit this file. Your best bet is to run your favorite text editor using sudo in Terminal.app, e.g.:
    sudo vi /etc/syslog.conf

  • Deleted syslog.conf file

    Hello. I was trying to configure proftpd and intended to delete proftpd.conf, but instead I deleted syslog.conf. I am using the following version of Mac OS X:
    System Version: Mac OS X 10.4.10 (8R2232)
    Kernel Version: Darwin 8.10.1
    Could somebody with a similar configuration please post the contents of their syslog.conf file so that I can re-create the file on my system without having to re-install the OS?

    /etc/syslog.conf already exists - you just need to edit it to your needs.
    The issue, of course, is that only root can edit this file. Your best bet is to run your favorite text editor using sudo in Terminal.app, e.g.:
    sudo vi /etc/syslog.conf

  • Cisco Prime Soft Appliance not saving changes to syslog.conf

    Greetings,
    I'm having an issue with the syslog.conf file on a Cisco Prime LMS 4.2.4 soft appliance with a Solaris base.  My workplace uses local4 as the logging facility for its network devices, and according to a discussion I found on this site, I need to add the line:
    local4.info  /var/log/syslog_info
    I have attempted this several times; we're approaching at least 5 attempts today.  I have attached text files created from putty logs where I've attempted to make the necessary change.  I appreciate any assistance the community can provide.
    Regards,
    Rob

    Hi, Afroz,
    I really appreciate your assistance, but I'm afraid my hopes have been dashed.  The syslog.conf reverted to its original configuration.  I will go through my steps to be sure that I understood your suggestion properly.
    I edited the syslog.conf to put all messages from local4 in /opt/CSCOpx/conf/syslog-entries.txt.  Then, I exited the shell to the console, issued the 'write mem' command, and closed the session.  Upon my reconnection, I found that my changes to the syslog.conf were not saved.
    Did I make the correct edits in the correct places?  Another question, is this bug present in the versions of Prime LMS running Linux and/or Windows, or does it only exist in the soft appliance running Solaris?
    Regards,
    Rob
    Edit:
    I'm reading the "Installation and Migration of Cisco Prime" PDF, and it gives me the impression that Cisco Prime is only supported as Windows, Solaris, and soft appliance installations.  Is that correct?  If it is correct, then installation of Cisco Prime LMS is not supported on other Linux distros such as Ubuntu Server, CentOS, Fedora, etc.?
    My thanks.

  • Syslog.conf settings

    I'm seeing tons of syslog in in var/log/messages. when I look at the logs they are mostly duplicate of what I see in the syslog_info file. Due to this my var/log is filling up so fast. Do I need to update my syslog.conf file, what is the recommended settings for prime LMS 4.2 ?
    -rw------- 1 root  root    808570913 Dec 16 04:05 messages.1
    -rw-rw-r-- 1 root  sys   14259416649 Dec 17 08:59 syslog_info
    -rw------- 1 root  root    201355173 Dec 17 08:59 messages
    Here is my current syslog.conf file
    local6.info                                                                     /var/log/ade/ADE.log
    *.info;mail.none;news.none;authpriv.none;cron.none;local0.none;local1.none      /var/log/messages
    authpriv.*                                                                      /var/log/secure
    mail.*                                                                          -/var/log/maillog
    cron.*                                                                          /var/log/cron
    *.emerg                                                                         *
    uucp,news.crit                                                                  /var/log/spooler
    local7.*                                                                        /var/log/boot.log
    #Application LMS Generated config
    #BEGIN CSCOmd - DO NOT EDIT THESE COMMENTS OR CONTENTS CONTAINED WITHIN - local0 1
    local0.emerg;local0.alert;local0.crit;local0.err;local0.warning;local0.notice;local0.info;local0.debug  /var/adm/CSCOpx/log/dmgtd.lo
    g
    #END CSCOmd DO NOT EDIT BEFORE THIS LINE  1
    local7.info  /var/log/syslog_info

    Usually we dont recommend to change anything on syslog.conf. Syslog_info is the file where all the syslogs coming from network pointed to LMS server is written.
    Usually they should be controlled at the device level by checking the logging level of devices.
    Mostly ASA/FW's send excessively huge amount of syslogs to LMS server which should be controlled. Also, you can check the logrot utility to control the syslog_info log size to keep in check. Logrot is an Log file rotation utilit in LMS.
    Log files can expand and fill up disk space. Log files rotation helps you manage the log files more efficiently. See
    Maintaining Log Files  for an overview of maintaining the log files in LMS Server.
    For more details on logrot check userguide :
    http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/user/guide/admin/server.html#wp1055307
    -Thanks

  • Syslog.conf woes

    I have configured my /etc/syslog.conf to split up my whole-house central logs, however I am missing something.  All log files are getting all the data.  I had this perfect last week, did a restore, and had to re-author it and am getting super fustrated.  All the docs are so conflicting so I'm looking for someone to just smack me in the right direction
    # /etc/syslog.conf
    +switch1.mydomain
    *.*             /var/log/mydomain/switch1.mydomain
    +switch2.mydomain
    *.*             /var/log/mydomain/switch2.mydomain
    ========
    -rw-r--r--   1 root  wheel  1946 May  6 09:22 switch1.mydomain
    -rw-r--r--   1 root  wheel  1946 May  6 09:22 switch2.mydomain
                                       ^^^^^
          All logs are going to all files. 
    Some folks say put a +* after the *.*  or a ! or a *+ or a this or a that.
    What is the correct answer?
    While you're here, what is the appropriate syntax to have a master file, based upon ip subnet
    +1.2.3.*
    *.* /var/log/myfile
    and how do I filter myself (the mac)
    +1.2.3.* but filter 1.2.3.10
    *.* /var/log/myfile

    Obviously since I had stuff streaming to syslog, I had already put that there.
    I have plutil whatnot -binary1.  So the config files, I converted to xml, edited, restored to binary, ran the things you are suposed to run.  I have since done several clean reboots.
    The current question is why do I have this all configured properly, however acl.conf is being basically ignored?
    > plutil -convert xml1 /System/Library/LaunchDaemons/com.apple.syslogd.plist
    > pico /System/Library/LaunchDaemons/com.apple.syslogd.plist
    > plutil -convert binary1 /System/Library/LaunchDaemons/com.apple.syslogd.plist
    > launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist
    > launchctl load /System/Library/LaunchDaemons/com.apple.syslogd.plist
    ===============
    == /System/Library/LaunchDaemons/com.apple.syslogd.plist
    ===============
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
            <key>EnableTransactions</key>
            <true/>
            <key>EnvironmentVariables</key>
            <dict>
                    <key>ASL_DISABLE</key>
                    <string>1</string>
            </dict>
            <key>HopefullyExitsLast</key>
            <true/>
            <key>JetsamProperties</key>
            <dict>
                    <key>JetsamMemoryLimit</key>
                    <integer>300</integer>
                    <key>JetsamPriority</key>
                    <integer>-49</integer>
            </dict>
            <key>Label</key>
            <string>com.apple.syslogd</string>
            <key>MachServices</key>
            <dict>
                    <key>com.apple.system.logger</key>
                    <dict>
                            <key>ResetAtClose</key>
                            <true/>
                    </dict>
            </dict>
            <key>OnDemand</key>
            <false/>
            <key>ProgramArguments</key>
            <array>
                    <string>/usr/sbin/syslogd</string>
                    <string>-bsd_out</string>
                    <string>1</string>
            </array>
            <key>Sockets</key>
            <dict>
                    <key>AppleSystemLogger</key>
                    <dict>
                            <key>SockPathMode</key>
                            <integer>438</integer>
                            <key>SockPathName</key>
                            <string>/var/run/asl_input</string>
                    </dict>
                    <key>BSDSystemLogger</key>
                    <dict>
                            <key>SockPathMode</key>
                            <integer>438</integer>
                            <key>SockPathName</key>
                            <string>/var/run/syslog</string>
                            <key>SockType</key>
                            <string>dgram</string>
                    </dict>
                    <key>NetworkListener</key>
                    <dict>
                            <key>SockServiceName</key>
                            <string>syslog</string>
                            <key>SockType</key>
                            <string>dgram</string>
                    </dict>
            </dict>
    </dict>
    </plist>
    ===============
    === /etc/syslog.conf
    ===============
    bash-3.2# cat /etc/syslog.conf
    # Note that flat file logs are now configured in /etc/asl.conf
    install.*                                               @127.0.0.1:32376
    local6.warn                                             /Library/Logs/Mail/mailaccess.log
    =============
    === /etc/asl.conf
    =============
    # Mail access log facility
    ? [= Facility dovecot] [<= Level info] file /Library/Logs/Mail/mailaccess.log mode=0640 uid=214 gid=6 format=bsd
         ======= [Standard file above here] ==========
         ===== mydomain is actually a FQDN that I redacted
         ====================================
    # example showing how everything above this is out-of-the box standard...  My stuff @ the end of asl.conf
    #mydomain
    ? [= Host core1.mydomain] file /var/log/mydomain/core1.mydomain
    ? [= Host switch1.mydomain] file /var/log/mydomain/switch1.mydomain
    ? [= Host switch2.mydomain] file /var/log/mydomain/switch2.mydomain
    ? [= Host wirelessu.mydomain] file /var/log/mydomain/wirelessu.mydomain
    ? [= Host wirelessd.mydomain] file /var/log/mydomain/wirelessd.mydomain
    ? [= Host air1.mydomain] file /var/log/mydomain/air1.mydomain
    ? [= Host cap1.mydomain] file /var/log/mydomain/cap1.mydomain
    ? [= Host tv1.mydomain] file /var/log/mydomain/tv1.mydomain
    ? [Z= Host .mydomain] file /var/log/mydomain/mydomain aslmanager_debug=1
    ===============
    == bash-3.2# ls -la /var/log/mydomain/
    ===============
    total 0
    drwxr-xr-x  11 root  wheel   374 May  6 11:02 .
    drwxr-xr-x  69 root  wheel  2346 May  6 11:31 ..
    -rw-r--r--   1 root  wheel     0 May  6 11:02 air1.mydomain
    -rw-r--r--   1 root  wheel     0 May  6 11:02 cap1.mydomain
    -rw-r--r--   1 root  wheel     0 May  6 11:02 core1.mydomain
    -rw-r--r--   1 root  wheel     0 May  6 11:02 mydomain
    -rw-r--r--   1 root  wheel     0 May  6 11:02 switch1.mydomain
    -rw-r--r--   1 root  wheel     0 May  6 11:02 switch2.mydomain
    -rw-r--r--   1 root  wheel     0 May  6 11:02 tv1.mydomain
    -rw-r--r--   1 root  wheel     0 May  6 11:02 wirelessd.mydomain
    -rw-r--r--   1 root  wheel     0 May  6 11:02 wirelessu.mydomain
    Recap...
    When I edit syslog.conf, I was getting my data, however my understanding of syslog is way too advanced - this - that - huge arrays of syslog servers - ngsyslog - logrotate - newsyslog - the works.. but when I edit the OG classic BSD format, I fail with the !'s and +'s... so I was asking for help there.  Also I tried to do asl.conf first, and that gave me 0 byte files.  I did proove that I am getting syslog data and routing it when using syslog.conf, just due to my borked config, all logs were going to all files.  So now I rolled that back and am just using asl.conf, but I get no logs.

  • What is syslog.conf facility?

    what is syslog.conf facility?

    HI,
    /etc/syslog.conf — the configuration file used to control the logging and routing of system log events
    For more details please refer to http://www.nongnu.org/lpi-manuals/lpi-102/html/ch09.html#syslogconf
    Regards
    Terry

  • Oracle auditing using syslogs

    Hello all....I am working on setting up the auditing to write to syslogs. I am having trouble understanding what to use for the facility and level. Can anyone point me in the right direction as to what these facilities and levels mean?
    TIA

    i believe those terms are related to syslog which is used on nix systems. if you are using nix then you should check the man page on syslog.conf.
    as the docs state, the facility indicates where the message is coming from (such as the kernel, cron, local0 - local 7), and there's the level, which indicates how urgent the message is (info, warning, critical...).
    i say this with never actually having used it though...
    if you're using windows, well, .... i can't say.

  • Syslog logging issues

    I am having trouble setting up a server for syslogd files on Solaris 10 update 8 (october release, i think). I have this working find on another machine, it has solaris 10 update 7, although I doubt that the difference in Solaris updates is the problem. The working machine is host "Ysera" and the non-working machine is host "malygos".
    I have logs coming from a remote host, and I'd like them to be logged to their own log file (travistest). They are coming in through the local4 facility.
    Following is the syslog.conf file. This file is identical for both hosts.
    ### comments ####
    local4.debug                     /tmp/travistest
    local3.debug                     /tmp/travistest
    local1.debug                     /tmp/travistest
    *.debug                            /var/adm/messages
    *.alert                              root
    #  These are tabs and NOT spaces, and no trailing whitespace after the actionThe /etc/services file DOES have the line. This is true for both machines.
    syslog      514/udpI can verify that remote logging is activated on both:
    root@malygos#svccfg -s system-log listprop | grep remote
    config/log_from_remote                     boolean true
    root@ysera#svccfg -s system-log listprop | grep remote
    config/log_from_remote                     boolean true true trueAny idea why Ysera gives a value of "true true true"?? that is crazy talk to me. Also, strangely, look at the /etc/default/syslogd for Ysera (the working machine)
    # all those comments that say that this file is deprecated
    # The LOG_FROM_REMOTE setting used to affect the logging of remote messages.
    # Its definition here will override the svccfg(1M) settings for log_from_remote
    # log_from_remote=yeslog_from remote is still commented out!! so how is it still active?
    I have altered the /ect/default/syslogd file in the Malygos (non-working) machine to match this, and also to uncomment it and had no luck. I've attempted to use the setprop command to match the "true true true" property and recieved a syntax error. I tried again trying to put quotes are the "true true true", single quotes, ticks, no marks, and nothing works.
    Does anyone have any ideas how I can get the remote log to work?? I know that the port is open...
    root@malygos#netstat -an | grep 514
        *.514                         *.*                         0            0      49152           0         LISTENI cannot just make Ysera my log server. Both of these machines are development machines and do not carry the "gold" copy of the system files. In order to send a delivery I need to know why Ysera is working so I can duplicate that code for our final product. Thanks ahead of time for any ideas.

    Thanks again for the response!!
    root@malygos#svcs -a | grep ipf
    disabled 13:59:02 svc:/network/ipfilter:defaultipf.conf
    root@malygos#cat /etc/ipf/ipf.conf | grep 514
    pass in quick proto tcp from pool/700 to any port = 514 keep state
    pass in quick proto udp from pool/800 to any port = 514
    root@ysera#more /etc/ipf/ipf.conf
    #ipf.conf
    # IP Filter rules to be loaded during startup
    # See ipf(4) manpage for more information on
    #IP Filter rules syntaxDespite the IP filter being disabled, I think that these files being so different is a sign of something. I'll have to check with the team to see why they are different, because I dont' think that they are supposed to be!! (let me know if i'm chasing a ghost again)
    The machines are on the same subnet, and I have used Malygos to send message OUT and have other Ysera recieve them...and that works fine. It will not work backwards though, so I agree it's a blocked port or perhaps some of the scripts that start syslogd are not providing the -r option as I expect. A big part of me just wants to jump to Ysera and make that our baseline...but I need to be able to replicate the files. Currently I'm trying to alter /lib/svc/method/system-log to force the -r option. (no worries...I kept the original :-)
    I'm also trying to get it to log the parameters that syslogd is started with...so I know exactly what the computer THINKS its doing.
    Thanks again dude!!
    Edited by: mandarbshadar on Mar 2, 2010 10:34 AM

  • Trying to configure syslog process, for Oracle auditing, Oracle 10gR2

    Folks,
    I am trying to use the OS (UNix Sun Solaris 10), syslog process. So I can write my Oracle db 10gR2 audit logs to a location, where Oracle userid on unix cannot modify/delete.
    For that I have set following values in the Oracle 10gR2 parameters :
    audit_file_dest string /flood/u01/app/oracle/product/
    10.2.0/db_1/rdbms/audit
    audit_sys_operations boolean TRUE
    audit_syslog_level string USER
    audit_trail string OS
    Actually I have set audit_syslog_level = 'user.notice' value in the database
    Also made following entry in the syslog.conf file
    ## oracle audit records
    user.notice /var/log/oraaudit.log
    # if a non-loghost machine chooses to have authentication messages
    # sent to the loghost machine, un-comment out the following line:
    #auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)
    mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost)
    # non-loghost machines will use the following lines to cause "user"
    # log messages to be logged locally.
    ifdef(`LOGHOST', ,
    user.err /dev/sysmsg
    user.err /var/adm/messages
    user.alert `root, operator'
    user.emerg *
    It is still not logging the audit logs in that location.
    What am I missing here
    Thanks for your help.
    Ashish

    By chance did you restart the database and syslogd? ( I think that a "kill -1 syslogd" will work for that.)
    Your configuration looks very similar to what I did - and mine is working ok. One difference I noticed: when I do the "show parameter audit", I get the whole string of "audit_syslog_level string LOCAL5.NOTICE"
    Greg

  • Syslog logging for zone.cpu-shares ???

    Hi,
    I have defined two zones (zone1 and zone2) and set zone.cpu-shares in global zone.
    I've set also global state for zone.cpu-shares for logging.
    The questions is why I do not get any messagess in "/var/adm/messges.warning" when some zone use more cpu-shares than defined.??
    Configuration follows:
    root@sol10test# prctl -i zone 0 1 2
    zone: 0: global
    zone.cpu-shares
            privileged         20       -   none                                 -
            system          65.5K     max   none                                 -
    zone: 1: zone2
    NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT
    zone.cpu-shares
            privileged         10       -   none                                 -
            system          65.5K     max   none                                 -
    zone: 2: zone1
    NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT
    zone.cpu-shares
            privileged         70       -   none                                 -
            system          65.5K     max   none                                 -
    root@sol10test# rctladm
    zone.cpu-shares             syslog=warning [ no-basic no-deny no-signal count ]
    root@sol10test# cat /etc/syslog.conf
    *.warning                                       /var/adm/messages.warning
    ...P.S. does not work with syslog=notice either :((

    Hi,
    I have defined two zones (zone1 and zone2) and set zone.cpu-shares in global zone.
    I've set also global state for zone.cpu-shares for logging.
    The questions is why I do not get any messagess in "/var/adm/messges.warning" when some zone use more cpu-shares than defined.??
    Configuration follows:
    root@sol10test# prctl -i zone 0 1 2
    zone: 0: global
    zone.cpu-shares
            privileged         20       -   none                                 -
            system          65.5K     max   none                                 -
    zone: 1: zone2
    NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT
    zone.cpu-shares
            privileged         10       -   none                                 -
            system          65.5K     max   none                                 -
    zone: 2: zone1
    NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT
    zone.cpu-shares
            privileged         70       -   none                                 -
            system          65.5K     max   none                                 -
    root@sol10test# rctladm
    zone.cpu-shares             syslog=warning [ no-basic no-deny no-signal count ]
    root@sol10test# cat /etc/syslog.conf
    *.warning                                       /var/adm/messages.warning
    ...P.S. does not work with syslog=notice either :((

  • Design flaw in logadm(1M)/logadm.conf(4) and patch bug

    I really like logadm(1M)/logadm.conf(4) but it has a design flaw:
    1) /etc/logadm.conf should be a clean conf and not interfered with /var-ish state data!
    Please move the "Timestamps" to somewhere else!
    /etc/logadm.conf sould be distributable (scp/rsync/rdist) to a fleet of similar servers. Now it is not.
    2) I have non default /etc/syslog.conf and /var/adm/messages is not the syslog here.
    I have changed /etc/logadm.conf accordingly and made /var/adm/messages a symlink to the kernel log for convenience and it works perfectly until I patch.
    I'm annoyed by Sun-patches that insist in putting /var/adm/messages back into the /etc/logadm.conf every now and then.
    Sun-patches should not alter config-files that have been customized, but rather give a hint by placing a .new file (or so) along.
    I guess 2) is related to 1) as the /etc/logadm.conf is allways "customized" by timestamps.
    P�l

    Hi Harry (and others),
    I have seen similar behavior. It seems like the client side rendering for some reason has a hard time processing the collection model wrapping the ArrayList in this particular case. The table renders empty. After sorting in ascending order, the rows are all back (visible) again.
    Is anyone aware of issues with the rich table based directly on ArrayList (in combination with a changing set of values and/or sorting)? (seems like a corner case but is still not uncommon). Is there any indication that wrapping the ArrayList in a CollectionModel ourselves might be required?
    Harry: do you know whether this issue is introduced with PS3 (11.1.1.4) or already existed in previous releases?
    kind regards,
    Lucas

  • Spannintree syslogs messages

    Hi
    Iam trying to get spannintree logging events. Path "conf t-int gi 0/1-logging event status and spanning tree. After spantree change "taking off cable from switch which have to legs to core" any spantree syslogs appears. I was waiting spannintree state change syslogs but i could not see any spannintree syslogs.Any experience.
    Switch WS-C2970G-24TS-E
    ios c2970-i6k91l2-mz.122-20.SE3.bin
    Juha

    Hi Juha,
    Can you please confirm if you are trying to see the logs on console, telnet session or on syslog server.
    Also have you changed any logging level or its default.
    Regards,
    Ankur

  • Can't get syslog to work

    I have been trying to get syslog to work to accept logging from my router (which is directed to syslog to the IP address of my primary Mac), but with no success.
    I've gone through Aaron Adams' procedures:
    http://www.aaronadams.net/index.php/2005/06/02/configuringsyslogd_to_accept_logsfrom
    I've edited my /etc/syslog.conf file:
    .err;kern.;auth.notice;authpriv,remoteauth,install.none;mail.crit /dev/console
    *.notice;authpriv,remoteauth,ftp,install.none;kern.debug;mail.criti /var/log/system.log
    # COMMENT this out for now to see any local4 messages on system log?
    # ;local4.none
    # Send messages normally sent to the console also to the serial port.
    # To stop messages from being sent out the serial port, comment out this line.
    #.err;kern.;auth.notice;authpriv,remoteauth.none;mail.crit /dev/tty.serial
    # The authpriv log file should be restricted access; these
    # messages shouldn't go to terminals or publically-readable
    # files.
    authpriv.*;remoteauth.crit /var/log/secure.log
    lpr.info /var/log/lpr.log
    mail.* /var/log/mail.log
    ftp.* /var/log/ftp.log
    netinfo.err /var/log/netinfo.log
    install.* /var/log/install.log
    install.* @127.0.0.1:32376
    local0.* /var/log/ipfw.log
    *.emerg *
    local0.* /var/log/Airport.log
    local4.* /var/log/local4.log
    # DEBUG: what happens on the other local facilities?
    local1.* /var/log/local1.log
    local2.* /var/log/local2.log
    local3.* /var/log/local3.log
    local5.* /var/log/local5.log
    local6.* /var/log/local6.log
    local7.* /var/log/local7.log
    I've re-loaded /System/Library/LaunchDaemons/com.apple.syslogd.plist, and edited /etc/daily.local, and those mechanisms are working, but always local4.log is an empty file. Empty log files exist in /var/log:
    $ ls -al /var/log | grep "local"
    -rw-r--r-- 1 root wheel 0 Dec 11 11:56 local1.log
    -rw-r--r-- 1 root wheel 41975 Mar 16 16:38 local2.log
    -rw-r--r-- 1 root wheel 0 Dec 11 11:56 local3.log
    -rw-r--r-- 1 root wheel 0 Mar 20 03:15 local4.log
    -rw-r--r-- 1 root wheel 0 Dec 11 11:56 local5.log
    -rw-r--r-- 1 root wheel 0 Dec 11 11:56 local6.log
    -rw-r--r-- 1 root wheel 0 Dec 11 11:56 local7.log
    netstat shows two syslog connections:
    $netstat -f inet -a | grep "syslog"
    udp4 0 0 *.syslog .
    udp46 0 0 *.syslog .
    But a port scan (Apple network Utility) from another LAN computer doesn't show port 514 open. I am not running Apple's software firewall.
    It seems to me that without port 514 open, I'll never get anything, but how do I open it. I had assumed that all of the syslog set-up gyrations would cause it to be open.
    Any ideas?
    G4 "Gigabit" Dual-500   Mac OS X (10.4.8)   1.5GB RAM, 1TB internal, SCSI, 802.11g, USB2.0

    Your question about local4 got me to dig further into a few things.
    Aaron Adams has a couple of good posts on how to set up the syslog.conf and daily actions:
    http://www.aaronadams.net/index.php/2005/06/02/configuringsyslogd_to_accept_logsfrom
    But the following article is what got me on the local4 bandwagon (I don't know why it assumes local4 would be used):
    http://www.macosxhints.com/article.php?story=20060327074531639
    As we now know nothing happens on local4 unless it is specifically set up to do so. The following article has the best big-picture summary and references on how to handle logs from different sources (i.e., setting up syslog to redirect messages from the IP address of my router to a special log:
    http://macosx.com/forums/howto-faqs/47791-howto-syslog-remote-events-etc.html
    Anyway, to make a long story short, the router IS actually sending to syslog (I was expecting messages in local4 and never saw anything in syslog because it only shows *.notice and above, and the router mainly spews out *.info. It took a bunch of playing with tcpdump to figure it out (I can't seem to get tcpflow to show UDP, even though the man page says it uses the same library and expresions as tcpdump). So everything is good now, messages are coming in to a special log and overwhelming syslog, logs get rotated properly overnight, with some filtering I get the distilled info I want, and via GeekTool even see it on my desktop in real-time. Thanks for your help!

Maybe you are looking for