SYSLOG problem. Can't seperate sendmail from cyrus.

[Aaron Bennett]

Mark London wrote:
> I have cyrus installed via redhat 4 rpms.  I thought I could separate 
> all cyrus messages from sendmail, by doing the following in syslog.conf:
>
> *.info;mail.none;news.none;authpriv.none;cron.none;local6.*             
> /var/log/messages
>
> mail.*;local6.none                                              
> -/var/log/maillog
>
As pointed out below, cyrus on redhat 4 rpms is compiled to use facility 
mail.  I deal with that by running syslog-ng on my central syslog 
server; it's _much_ more flexible then syslog and can split by 
application name as well as facility and level.  In case anyone's 
interested, here's the relevant syslog-ng section:

destination postfix { file ("/var/log/$HOST/mail.log"); };

destination cyrus { file ("/var/log/$HOST/cyrus.log"); };

filter f_calliope-postfix {

        (

                host("calliope.clarku.edu")

        ) and (

                facility(mail) and

                program(postfix)

        );

};

filter f_calliope-cyrus {

        (

                host("calliope.clarku.edu")

        ) and (

                facility(mail) and

                not program(postfix)

        );

};

log { source(net); filter(f_calliope-postfix); destination(postfix); flags(final); };

log { source(net); filter(f_calliope-cyrus); destination(cyrus); flags(final); };


Best,

Aaron Bennett
UNIX Administrator
Clark University