Syslog
262
BLACK BOX
®
Advanced Console Server
5) To eliminate sshd debug messages:
filter f_sshd_debug { not program('sshd') or not level(debug); };
6) To filter the syslog_buffering:
filter f_syslog_buf { facility(local[0+<conf.DB_facility>]) and
level(notice); };
Task 4: Define Actions.
To define actions use this statement (note that the statement should be one line):
destination <identifier> { destination-driver([params]);
destination-driver([param]); ..};
where:
The following destination drivers are available:
identifier
Has to uniquely identify this given destination.
destination driver
Is a method of outputting a given message.
params
Each destination-driver may take parameters. Some of them
required, some of them are optional.
a) file(filename [options])
This is one of the most important destination drivers in syslog-ng. It allows you to output
log messages to the named file. The destination filename may include macros (by prefixing
the macro name with a '$' sign) which gets expanded when the message is written. Since
the state of each created file must be tracked by syslog-ng, it consumes some memory for
each file. If no new messages are written to a file within 60 seconds (controlled by the
time_reap global option), it's closed, and its state is freed.
