nsca and nrpe2 syslog facility

Ryan Ordway ryan.ordway at oregonstate.edu
Tue Nov 20 21:24:16 CET 2007


On Nov 20, 2007, at 2:00 AM, Andreas Ericsson wrote:

> Brian A. Seklecki wrote:
>> nsca.c @ line 134 of 1450
>>
>>  openlog("nsca",LOG_PID|LOG_NDELAY,LOG_DAEMON);
>>
>>  prototype: void openlog(const char *ident, int logopt, int  
>> facility);
>>
>> We should probably make that a config-file defined variable.  At the
>> *very* least, a GNU autoconf compile-time configure option -> #DEFINE
>>
>
> Err... say what now?

./configure --with-log-facility=local0

becomes

#define NSCA_SYSLOG_FACILITY LOG_LOCAL0

openlog("nsca", LOG_PID|LOG_NDELAY, NSCA_SYSLOG_FACILITY);


>
>> Default syslog.conf(5)'s everywhere are going to split the  
>> destination
>> into a variety of files (because of priorities), which is insanely
>> annoying.
>>
>
> First off, let's get one thing straight right from the start.
> Syslog uses a facility and severity pair which, combined, is called
> priority. It's actually a single number, calculated like so:
>
> 	pri = (fac << 3) + sev
>
> What people normally do (in my experience) is to put logs from
> different *facilities* in one file, and additionally log LOG_WARN
> or LOG_ERR and above to somewhere else.

This isn't always the case. In some cases you want a specific level of  
a specific facility sent to a specific log file. Or if you're using  
syslog-ng you want a specific *application* (based on the const char  
*ident parameter to openlog, "nsca" in this case) logged to a  
particular log.

>
>> Then we can route it out to destinations regardless of priorities  
>> before
>> fall-back facility.priority(*) wildcard gets caught.
>>
>
> Sure, but since there aren't enough facilities for every program to  
> have
> its own, the facilities need to be shared. I fail to see the problem  
> here,
> since so far the only ones you've mentioned are downright wrong.

What about LOG_LOCAL0, LOG_LOCAL1, ... LOG_LOCAL7? 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/




More information about the Developers mailing list