[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: bind and syslog

* Steve Greenland said:
> On 19-Dec-99, 15:49 (CST), Marek Habersack <grendel@vip.net.pl> wrote: 
> > In my opinion (whether it is narrow-minded or not) syslog is not for
> > logging everything but to report about events significant to the
> > system as a whole. And how much noise is in your logs? 60%? 70%?
> Edit your syslog.conf. Change the levels that are logged, or where they
> are logged. If a particular program is logging informational messages
> at level warn, then that's a problem with the program, not the syslog
> mechanism.
OK, before it goes to far I want to explain something. I have syslog-ng
configured so that it sorts out the messages in a nice way, I have no
problem with that. I have no objection as to the usefulness or correctness
of the syslog mechanism, no. I merely say that programs misuse the mechanism
outputting too many useless messages and in many times they go under the
default facility which produces a mess - the standard syslogd isn't capable
of sorting them out - with syslog-ng you can sort based, e.g., on a program
name. The above mess was the reason for which I said that programs should
use the openlog/syslog/closelog sequence on each message output to the
syslog - because it cures two problems: 1) the connection is never lost, 2)
much less messages are output under the standard facility which makes it
easier to sort the messages out.
To make myself clear: I like syslog, I have nothing against it, I'm just
trying to find a way for _programs_ NOT to make _bad_ use of syslog. And
despite how good is the syslog.conf many, too many, useless messages will
still get into the logs just because syslog is abused by many programs.


Attachment: pgpQEzUyk9267.pgp
Description: PGP signature

Reply to: