[nsp] cant get syslog to work

[Charles Sprickman]

On Sat, 12 Jul 2003, Niels Bakker wrote:

> FreeBSD's syslogd does.  As far as I could tell from James's original
> message he did everything right - the router is logging remotely because
> messages end up in /var/log/messages, FreeBSD's syslogd isn't that picky
> about tabs anymore (if you have a halfway recent version of FreeBSD),
> asterisks work as expected (unlike Solaris syslogd).

Note also that in recent FreeBSD releases, remote logging is disabled by
default.  That doesn't seem to be the problem here.

The line I was speaking of that caused any entries below it to be ignored
(without warning) was this:

#
!startslip
*.*                                             /var/log/slip.log
!ppp
*.*                                             /var/log/ppp.log
#

Those are in the default syslog.conf.  I like to put my local entries
below all the default stuff, so I just commented those out.  That's a
no-no.  Remove them fully if you don't want them.

Another tip that helped me solve many a syslogd problem was running
syslogd in debug mode, ie: "syslogd -d".  It will spit everything it's
doing to STDOUT, revealing all your mistakes. :)

Charles

> Three tips:
>
> - Run a network sniffer and/or start syslogd in debug mode, to see
>   whether local0 is really used, to exclude IOS bugs;
> - Check syslogd.conf for lines starting with `!' or `#!' just above the
>   /var/log/core.log line that would make syslogd match only on certain
>   processes;
> - Check for malformed lines above the /var/log/core.log line that could
>   make syslogd stop parsing its configuration file.
>
> Otherwise I wouldn't know either.  :)  Good luck, please post here if
> you manage to find a resolution; you've definitely piqued my curiosity.
>
>
> 	-- Niels.
>
> --
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>