new policy topic --- syslog() [was Re: syslog facilities]
[Redirected to <debian-policy@lists.debian.org>]
[You (Manoj Srivastava)]
> Is there any policy/convention about using facilities local0
> though local 7? I notice that ppp has take onver local2 and local5
> now belogs to hylafax (on my machine).
> I ask this since I want to add a chanel to named for logging
> all the queries, and I could use local?; however, I do not want to
> stomp on any toes. Can we have a facility or two reserved for the
> local admin? Like maybe local1 and local2 or something?
I think this should be taken up as a policy issue. I know current policy
doesn't touch log levels at all. However, they are a standardized Unix
feature, and as such, their allocation (esp. for the local* facilities)
should fall under policy.
In fact, I'd even go farther. I think policy should also cover what goes
into /var/log/{syslog,messages,debug,auth.log,daemon.log,mail.log} (at
least) should be documented by policy.
I'm not a big fan of adding bureaucracy to our packaging system, but
here's my reasons:
* I don't think a lot of packages would require changes, especially if we
just approached policy with a conservative mindset w.r.t. existing
practice. The point is to minimize sysadmin suprise and to minimize
repetition in messages (which is a Good Thing since lots of syslog
duplication can fill a partition fast).
* canonnifing syslog message conforms to the intent of the policy manual
as I read it. I'm referring here to bits of policy like Sec 3.5 Cron jobs, and
3.2 Users and groups. Controlling core parts of the system operation.
* Also, in a way, sysklogd's syslog.conf bugs me. Debug messages aren't
filtered from important logs like syslog and message, lots of messages
are duplicated.
* A sufficiently abstracted definition will also allow alternatives to
sysklogd, while still giving that creamy consistency!
And of course I volunteer to help if policy group agrees it would be a
Good Thing To Do.
.....A. P. Harris...apharris@onShore.com...<URL:http://www.onShore.com/>
Reply to: