How can I display pririority (Kernel.info or Auth.Info) in /var/log/messages?

I need to capture syslog messages (/var/log/messages), which should
contain "error or warning or info" also in the message, how can I
capture, I want syslog message like this:

Jan 1 1970 10:00:00 Auth.Info sshd: session closed for user root.

"GS" <(E-Mail Removed)> writes:

>I need to capture syslog messages (/var/log/messages), which should
>contain "error or warning or info" also in the message, how can I
>capture, I want syslog message like this:

>Jan 1 1970 10:00:00 Auth.Info sshd: session closed for user root.

Why overload /var/log/messages?

auth.* /var/log/authmessages
in /etc/syslog.conf and then do
killall -1 syslogd

On Sun, 09 Jul 2006 08:50:02 -0700, GS wrote:

> I need to capture syslog messages (/var/log/messages), which should
> contain "error or warning or info" also in the message, how can I
> capture, I want syslog message like this:
>
> Jan 1 1970 10:00:00 Auth.Info sshd: session closed for user root.


you can use grep, or sed for this

man grep

man sed

Unruh, thanks for your message, appreciated.

I selected auth.* in syslog.conf file, but also I want to see whether
it is "error type" or "info type" or "warning type" in
/var/log/messages file also, will it be possible, by looking into
/var/log/messages file, I wanted to know whether that message is what
type.

I want keyword either "warn" or "info" or "errror" in /var/log/messages
file, is that doable?. Thanks in advance.

"GS" <(E-Mail Removed)> writes:

>Unruh, thanks for your message, appreciated.

>I selected auth.* in syslog.conf file, but also I want to see whether
>it is "error type" or "info type" or "warning type" in
>/var/log/messages file also, will it be possible, by looking into
>/var/log/messages file, I wanted to know whether that message is what
>type.

>I want keyword either "warn" or "info" or "errror" in /var/log/messages
>file, is that doable?. Thanks in advance.

As far as I know, no. You can put all of the levels into different files
I find that a pain.
Ie, syslog does not put either the loglevel or the log facility into the
error messages. It puts the program in which the syslog was called.


So, you could do
auth.error /var/log/autherror
auth.info;auth.!error /var/log/authinfo
auth.debug;auth.!info /var/log/authdebug
Which would put everything higher than error into autherror, everything
between info and error into authinfo and everything between debug and info
into authdebug