How can I display pririority ( or Auth.Info) in /var/log/messages?

Discussion in 'Linux Networking' started by GS, Jul 9, 2006.

  1. GS

    GS Guest

    I need to capture syslog messages (/var/log/messages), which should
    contain "error or warning or info" also in the message, how can I
    capture, I want syslog message like this:

    Jan 1 1970 10:00:00 Auth.Info sshd: session closed for user root.
    GS, Jul 9, 2006
    1. Advertisements

  2. GS

    Unruh Guest

    Why overload /var/log/messages?

    auth.* /var/log/authmessages
    in /etc/syslog.conf and then do
    killall -1 syslogd
    Unruh, Jul 9, 2006
    1. Advertisements

  3. you can use grep, or sed for this :)

    man grep

    man sed
    Christian Fuß, Jul 9, 2006
  4. GS

    GS Guest

    Unruh, thanks for your message, appreciated.

    I selected auth.* in syslog.conf file, but also I want to see whether
    it is "error type" or "info type" or "warning type" in
    /var/log/messages file also, will it be possible, by looking into
    /var/log/messages file, I wanted to know whether that message is what

    I want keyword either "warn" or "info" or "errror" in /var/log/messages
    file, is that doable?. Thanks in advance.
    GS, Jul 9, 2006
  5. GS

    Unruh Guest

    As far as I know, no. You can put all of the levels into different files
    I find that a pain.
    Ie, syslog does not put either the loglevel or the log facility into the
    error messages. It puts the program in which the syslog was called.

    So, you could do
    auth.error /var/log/autherror;auth.!error /var/log/authinfo
    auth.debug;auth.!info /var/log/authdebug
    Which would put everything higher than error into autherror, everything
    between info and error into authinfo and everything between debug and info
    into authdebug
    Unruh, Jul 9, 2006
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.