Re: DHCP log different location but warnings in syslog

[Reco <recoverym4n@enotuniq.net>]

	Hi.

On Wed, Dec 12, 2018 at 12:52:58PM +0000, Bonno Bloksma wrote:
> Hi,
> 
> Plenty of examples on-line how to move logging from the isc-dhcp-server to a different file using something like
> log-facility local7;
> in the dhcp.conf file and then in my syslog.conf:
> *.debug,local6.none,local7.none                 /var/log/syslog
> # DHCP
> local7.debug                                    /var/log/dhcp/dhcpd.log
> 
> But....
> What I really want is all the regular DHCP log stuff in a file /var/log/dhcp/dhcpd.log but.. I want errors like "no free leases" etc in my syslog
> 
> Currently my monitoring tool is complaining there are way too many updates to the syslog file and it has trouble keeping up because currently all my DHCP servers log to the syslog file.;-)
> I want my monitor tool to keep reading the syslog file and analyze it for critical stuff like the "no free leases" warning and not have it read thousands of lines each day for regular dhcp lines like DHCPINFORM, DHCPACK, DHCPREQUEST, DHCPOFFER, DHCPNAK, etc.
> But of course I do want to have those regular log lines stored somewhere like in a  /var/log/dhcp/dhcpd.log file

$ cat /etc/rsyslog.d/dhcp.conf
:msg, contains, "DHCPINFORM" /var/log/dhcp/dhcpd.log
:msg, contains, "DHCPACK" /var/log/dhcp/dhcpd.log
:msg, contains, "DHCPREQUEST" /var/log/dhcp/dhcpd.log
:msg, contains, "DHCPOFFER" /var/log/dhcp/dhcpd.log
:msg, contains, "DHCPNAK" /var/log/dhcp/dhcpd.log
:msg, contains, "DHCPINFORM" stop
:msg, contains, "DHCPACK" stop
:msg, contains, "DHCPREQUEST" stop
:msg, contains, "DHCPOFFER" stop
:msg, contains, "DHCPNAK" stop

Everything that's listed in that file goes to /var/log/dhcp/dhcpd.log
only.
Everything that's not listed there is processed by other rsyslog rules.

Reco