Re: Error messages from syslogd

On Thu, Jul 12, 2007 at 05:18:02PM -0500, Marcin Antkiewicz wrote:

> You can have that independent of the system log. Often logging
> happens because it is in a spec - so a programmer will syslog()
> everything (sometimes even making creative uses of facilities), and
> abuse an already existing syslog infrastructure (remote logging,
> some kind of automated log combing) because "that's what it is for".

One nifty thing about syslog is that you can actually make that policy
decision in the local syslog server/agent -- just have the local
syslog server make the decision about what to do with the
application's syslogs (i.e. store them in a local file, forward them,
or both).  Under stock Unix syslogd, this is hard if the application
didn't have a unique facility, but with syslog-ng, you can configure
destinations based on the program name.  So if you have a program that
syslog()s and you don't want it polluting your syslog server, you can
workaround this as an admin, but if you have a program that does its
own logging and you want it syslogged, it can be a lot harder to
workaround as an admin.

- Morty