Which facility is best for logging to linux syslog?

Discussion in 'Cisco' started by bob niederman, Jul 3, 2004.

  1. Right now I'm logging from our ~70 devices to local7 on a linux box.

    I note that this conflicts with the boot log in /etc/syslog.conf:

    local7.* /var/log/boot.log

    This causes the outb\pout of dmesg to contain lots of router stuff.

    Aside from not chooisng naything already referenced in syslog.cong, what
    is the facility last likely to conflict with other (not yet configured)
    apps?

    example: I started googling around and found advice to configure LDAP to
    local4.

    In fact heres the hit counts for googling in local0 thru local7:

    local0 3,500
    local1 1,870
    local2 1,910
    local3 945
    local4 967
    local5 725
    local6 858
    local7 3,450


    some of the big numbers may be influenced by odcumentation containing
    phrases like
    "values from LOCAL0, LOCAL1, up to LOCAL7 are allowed"
     
    bob niederman, Jul 3, 2004
    #1
    1. Advertising

  2. "bob niederman" <> wrote in message news:<>...
    > Right now I'm logging from our ~70 devices to local7 on a linux box.
    >
    > I note that this conflicts with the boot log in /etc/syslog.conf:
    >
    > local7.* /var/log/boot.log
    >
    > This causes the outb\pout of dmesg to contain lots of router stuff.
    >
    > Aside from not chooisng naything already referenced in syslog.cong, what
    > is the facility last likely to conflict with other (not yet configured)
    > apps?
    >
    > example: I started googling around and found advice to configure LDAP to
    > local4.
    >
    > In fact heres the hit counts for googling in local0 thru local7:
    >
    > local0 3,500
    > local1 1,870
    > local2 1,910
    > local3 945
    > local4 967
    > local5 725
    > local6 858
    > local7 3,450
    >
    >
    > some of the big numbers may be influenced by odcumentation containing
    > phrases like
    > "values from LOCAL0, LOCAL1, up to LOCAL7 are allowed"


    I don't think there is a right or wrong facility to choose. Facility
    16 messages will go to LOCAL0, facility 17 to LOCAL1 etc. You can
    organise the log files to suit your requirements. As you have already
    said, it would be best to use a facility that isn't used much by
    anything else, but most devices that can be configured to use syslog
    can also be configured to use different facilities. Therefore, you can
    configure devices of similar types to use the same facility as each
    other, but different devices to use different facilities. I'm not sure
    I have explained that very well, but you could configure routers to
    use facility 16 (LOCAL0), switches to use facility 17 (LOCAL1),
    firewalls to use facility 18 (LOCAL2) etc.

    Hope thats of some help.

    Pete
     
    Pete Mainwaring, Jul 5, 2004
    #2
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. jason b

    syslog logging on dhcp int

    jason b, Feb 1, 2004, in forum: Cisco
    Replies:
    1
    Views:
    517
    Martin Gallagher
    Feb 1, 2004
  2. Eddie
    Replies:
    2
    Views:
    2,505
    Eddie
    May 23, 2005
  3. RJ45

    logging to syslog ?

    RJ45, Oct 12, 2005, in forum: Cisco
    Replies:
    2
    Views:
    525
  4. Matt

    Logging Facility

    Matt, Apr 27, 2007, in forum: Cisco
    Replies:
    1
    Views:
    450
    Thrill5
    Apr 27, 2007
  5. Giuen
    Replies:
    0
    Views:
    1,536
    Giuen
    Sep 12, 2008
Loading...

Share This Page