Forum Discussion

smp_86112's avatar
smp_86112
Icon for Cirrostratus rankCirrostratus
Sep 18, 2008

Custom syslog-ng facility

I've got a log statement in an iRule which generates quite a bit of information to the local0 syslog-ng facility. Instead of logging to the local0 facility, I'd like to isolate these entries from local0, and instead put them into their own log file.

I was thinking I could do this by using a custom syslog-ng facility like this:

iRule:

   
   when HTTP_REQUEST {   
     log local100. "some log entry"   
   }   
   

Then in syslog-ng.conf, I'd have something like this:

   
   filter custom_filter {   
       facility(local100);   
   };   
      
   destination custom_log {   
       file("/var/log/customlog");   
   };   
      
   log {   
      source(local);   
      filter(custom_filter);   
      destination(custom_log);   
   };   
   

But the LTM log indicates local100 is an invalid facility. Is it possible to define your own syslog-ng facilities like this in some other manner?

3 Replies

  • I don't think syslog facilities out of the standard are allowed. Maybe someone can correct me here though.

     

     

    Even with the existing facilities, you could use the same facility, but use separate destinations based on filters. You can check this post for an example (Click here).

     

     

    Aaron
  • Yeah, I think that's what we're going to end up doing. I am hesitant twiddling with the defaults because they always seem to break during upgrades. Oh well, another thing to doc.
  • Yep... you can include it in the UCS file, but it will most likely get overwritten in an upgrade if there are any changes to the installation's syslog-ng configuration file.

     

     

    Aaron