Re: SyslogFacility setting not working for cfservd

[Frank Ranner]

Predrag Zecevic - Solaris System Administrator wrote:
> Hi,
>
> I have in cfEngine (2.1.10 on SPARC Solaris 9):
>
>    solaris.main.conf:      Syslog            = ( on )
>    solaris.main.conf:      SyslogFacility    = ( LOG_LOCAL4 )
>
> in /etc/syslog.conf (with TABs):
>
>    # cfEngine logs
>    local4.notice           ifdef(`LOGHOST', /var/log/cfenlog, @loghost)
>    local4.debug            ifdef(`LOGHOST', /var/log/cfenlog, @loghost)
>    local4.alert            ifdef(`LOGHOST', /var/log/cfenlog, @loghost)
>    local4.info             ifdef(`LOGHOST', /var/log/cfenlog, @loghost)
>
> touched file (/var/log/cfenlog) and restarted syslog service (maybe you 
> are missing .alert or some other facility?)...
> and everything is logged to defined syslog file *but* each event 3 times 
> (???!!!):
>
>    Oct  8 03:25:54 fatboy cfengine:fatboy[26148]: [ID 702911
>    local4.notice] Group of /etc/logadm.conf was 0, setting to 3
>    Oct  8 03:25:54 fatboy cfengine:fatboy[26148]: [ID 702911
>    local4.notice] Group of /etc/logadm.conf was 0, setting to 3
>    Oct  8 03:25:54 fatboy cfengine:fatboy[26148]: [ID 702911
>    local4.notice] Group of /etc/logadm.conf was 0, setting to 3
>    Oct  8 03:25:54 fatboy cfengine:fatboy[26148]: [ID 702911
>    local4.notice] Object /etc/logadm.conf had permission 600, changed
>    it to 644
>    Oct  8 03:25:54 fatboy cfengine:fatboy[26148]: [ID 702911
>    local4.notice] Object /etc/logadm.conf had permission 600, changed
>    it to 644
>    Oct  8 03:25:54 fatboy cfengine:fatboy[26148]: [ID 702911
>    local4.notice] Object /etc/logadm.conf had permission 600, changed
>    it to 644
>    Oct  8 03:26:00 fatboy cfengine:fatboy[26148]: [ID 702911
>    local4.notice] Deleting file
>    /etc/motd_1097115946_Thu_Oct__7_04_25_55_2004_.cfsaved
>    Oct  8 03:26:00 fatboy cfengine:fatboy[26148]: [ID 702911
>    local4.notice] Deleting file
>    /etc/motd_1097115946_Thu_Oct__7_04_25_55_2004_.cfsaved
>    Oct  8 03:26:00 fatboy cfengine:fatboy[26148]: [ID 702911
>    local4.notice] Deleting file
>    /etc/motd_1097115946_Thu_Oct__7_04_25_55_2004_.cfsaved
>
> I already had this posted as '[SysLog]: logs events 3 times...' but no 
> feedback. Maybe this will help you/me...
> Regards ;-)

The messages you are logging are severity notice, which also get logged
by info and debug rules. If a message of severity 'alert' was to be 
logged, you would get 4 copies. The solution is to put only one line in 
at the minimum level you want to log, and all messages at or greater 
than that severity will be logged. You can add additional rules to send 
more severe errors to a separate log file, or to a different machine, or 
even to a script that could email or sms you.

regards, Frank Ranner