Subject: Re: mail facility doesn't filter out completely
From: Martin Schulze (joey)
Date: Tue Nov 02 1999 - 22:38:58 CET
linux sysklogd wrote:
> On a linux slackware (kernel 2.2.10),
> I'm trying to filter out the mail facility from /usr/adm/messages
>
> *.=info;*.=notice;mail.none /usr/adm/messages
>
> and it works for all mail facility messages (I have a separate
> maillog file), except for "connect from" messages from "mail popper",
> eg.:
>
> Nov 2 11:48:33 mail popper[30525]: connect from 209.134.12.157
> Nov 2 11:48:48 mail popper[30607]: connect from 209.134.12.158
>
> If I take out "*.=info" entirely, it'll go away.
>
> I've tried all of these, none of which work:
>
> *.=info;*.=notice;mail.none /usr/adm/messages
> *.=info;*.=notice;mail.!info /usr/adm/messages
> *.=info;*.=notice;mail.!debug /usr/adm/messages
> *.=info;*.=notice;mail.none;local0.none /usr/adm/messages
> *.=info;*.=notice;mail.!info;mail.!notice /usr/adm/messages
>
> Putting the mail<WHATEVER> in front makes it worse.
>
>
> Any ideas on juggling the syslog.conf syntax? Just upgrade?
What about using a properly configured popper that does log as
mail.* instead of daemon.* (guessed).
Regards,
Joey
-- Whenever you meet yourself you're in a time loop or in front of a mirror. - To unsubscribe: send mail to Majordomo@Infodrom.North.DE with the text "unsubscribe sysklogd" in the message body.
This archive was generated by hypermail 2b25 : Tue Nov 02 1999 - 22:39:07 CET