Syslog filtering by tag?

kuchenmann

Trying to filter syslog (standard version) for tag, but it does not work!
It's just a simple ping check, which writes results with logger.
It is written to /var/log/system.log, but I'd like to have logs in own file /var/log/myping.log.
My logger command uses -t mypi (tag) and I've created file /etc/syslog.d/myping.conf, but result always is written to /var/log/system.log.

/etc/syslog.d/myping.conf
!mypi
*.*   /var/log/myping.log

Yes, I've restarted the syslogd.

Any ideas? Thanks.

stephenw10

Probably needs to be in /var/etc/syslog.d/pfSense.conf

But that would be overwritten. You'd need to patch the file creating that.

patient0

I couldn't be more wrong, it turns out. The "property-based filters" 'programname' property equals the tag send from the logger command.

~~@kuchenmann if the syslog man page and the below StackExchange answer is anything to go by then you can not filter by tag.~~

user baf on StackExchange:
"In syslog.conf you can only assign an action according to a given facility and level of the message."

~~syslogd.conf man page~~

~~"Every rule consists of two fields, a selector field and an action field. These two fields are separated by one or more spaces or tabs."~~

~~"The selector field itself again consists of two parts, a facility and a priority, separated by a period (''.'')."~~

kuchenmann

@stephenw10 said in Syslog filtering by tag?:

Probably needs to be in /var/etc/syslog.d/pfSense.conf

But that would be overwritten. You'd need to patch the file creating that.

Well thanks, that's it!
The correct directory is:
/var/etc/syslog.d/

Putting my own file myping.conf in this directory (keeping original pfSense.conf) and restarting syslogd -> now it works!

kuchenmann

@kuchenmann said in Syslog filtering by tag?:

@stephenw10 said in Syslog filtering by tag?:

Probably needs to be in /var/etc/syslog.d/pfSense.conf

But that would be overwritten. You'd need to patch the file creating that.

Well thanks, that's it!
The correct directory is:
/var/etc/syslog.d/

Putting my own file myping.conf in this directory (keeping original pfSense.conf) and restarting syslogd -> now it works!

But it is deleted when rebooting the pfSense...

patient0

@kuchenmann said in Syslog filtering by tag?:

But it is deleted when rebooting the pfSense...

Yes you are right, as @stephenw10 mentioned above.

A solution I use is to create the file in e.g. /root/files/ and install and use the Shellcmd package to copy it to its destination at boot.

kuchenmann

@patient0
Yes, thanks.
Used shellcmd package for executing a script which creates the *.conf file at reboot.