On Wed, 2008-11-19 at 19:19 -0600, Larry Vaden wrote:
> On Wed, Nov 19, 2008 at 6:36 PM, Craig White <craigwhite@xxxxxxxxxxx> wrote:
> > On Wed, 2008-11-19 at 18:19 -0600, Larry Vaden wrote:
> >> On Wed, Nov 19, 2008 at 6:02 PM, Craig White <craigwhite@xxxxxxxxxxx> wrote:
> >> > Trying to figure out if there's a way to get syslog.conf to direct
> >> > remote logging from a wireless access point to log to a separate file
> >> > instead of the main syslog and can't figure out how that could be done
> >> > from man syslog.conf (or man 2/3 of syslog)
> >> >
> >> > this clearly doesn't work
> >> >
> >> > 192.168.1.251.* /var/log/WAP-2.log
> >> >
> >> > which according to the man page, makes sense since this the IP address
> >> > is not a facility.
> >> >
> >> > Is there a way to do this that I am missing?
> >>
> >> The AP's syslog parms must match the syslog.conf parms.
> >>
> >> e.g., for a MikroTik AP,
> >>
> >> [root@catch22 ~]# grep -i mikrotik /etc/syslog.conf
> >> # MikroTik router messages
> >> user.* /var/log/mikrotik.log
> > ----
> > I suspect I'm SOL...(Linksys WAP is Linux I think. They do have the
> > source code available for D/L)
> >
> > local0.* /var/log/local0.log
> > local1.* /var/log/local1.log
> > local2.* /var/log/local2.log
> > local3.* /var/log/local3.log
> > local4.* /var/log/local4.log
> > local5.* /var/log/local5.log
> > local6.* /var/log/local6.log
> > user.* /var/log/user.log
> >
> > restarted syslog service and then rebooted WAP but all of those files
> > are still empty ;-(
>
> <http://www.linuxquestions.org/questions/linux-networking-3/linksys-rv042-to-red-hat-syslog-337424/>
> suggests that perhaps daemon.info would work, I dunno. At any rate,
> one of the articles found by Google should reveal the answer.
----
tcpdump is my friend (but also the bearer of what appears to be bad
news)...
# tcpdump -nvvX udp port 514 -s 1500 -i eth1
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size
1500 bytes
18:32:16.412516 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto:
UDP (17), length: 74) 192.168.1.251.clearvisn > 192.168.1.5.syslog: [udp
sum ok] SYSLOG, length: 46
Facility kernel (0), Severity info (6)
Msg: WAP-2 rg_system_full:255: killall rt2500apd
0x0000: 3c36 3e57 4150 2d32 2072 675f 7379 7374
0x0010: 656d 5f66 756c 6c3a 3235 353a 206b 696c
0x0020: 6c61 6c6c 2072 7432 3530 3061 7064
0x0000: 4500 004a 0000 4000 4011 a452 c0a8 0afb
E..J..@.@..R....
0x0010: c0a8 0a05 0804 0202 0036 2c32 3c36
3e57 .........6,2<6>W
0x0020: 4150 2d32 2072 675f 7379 7374 656d 5f66
AP-2.rg_system_f
0x0030: 756c 6c3a 3235 353a 206b 696c 6c61 6c6c
ull:255:.killall
0x0040: 2072 7432 3530 3061 7064 .rt2500apd
I gather that this means that it's facility is kernel and thus I can't
separate it from the local machine.
Craig
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
