On 26Dec2007 22:45, Dean S. Messing <deanm@xxxxxxxxxxxxx> wrote: | When I start `ntpd' (service ntpd start) | messages like the following are inserted in /var/log/messages: | | Dec 26 22:00:25 medulla ntpd[17171]: ntpd 4.2.4p2@xxxxxxxx Tue Aug 21 13:58:55 UTC 2007 (1) | Dec 26 22:00:25 medulla ntpd[17172]: precision = 1.000 usec | Dec 26 22:00:26 medulla ntpd[17172]: Listening on interface #0 wildcard, 0.0.0.0#123 Disabled [...] | | Instead, I would like to get these to go into "/var/log/ntplog". But | try as I might, I've failed miserably and am ready to go bang my head | against the wall. | | What is the Magick Solution?!? | | Here's what I've tried: | | I changed | | *.info;mail.none;authpriv.none;cron.none /var/log/messages | to | *.info;mail.none;authpriv.none;cron.none;ntpd.none /var/log/messages | | and added | | # Log all the ntpd messages in one place. | ntpd.* /var/log/ntplog | | in "/etc/syslog.conf" and restarted `syslogd' (making sure there that | "/var/log/ntplog" exists.) Then I stopped and started `ntpd'. | | Nada! I now get no messages anywhere. | | I then tried adding | | logfile /var/log/ntplog | logconfig =all # log all messages | | to "/etc/ntp.conf" and restarted ntpd. | | I now get some _other_ diagnostic messages in "/var/log/ntplog", | messages like: | | 26 Dec 22:35:34 ntpd[18248]: system event 'event_restart' (0x01) status 'sync_alarm, sync_unspec, 1 event, event_unspec' (0xc010) | 26 Dec 22:35:36 ntpd[18248]: peer 155.101.3.114 event 'event_reach' (0x84) status 'unreach, conf, 1 event, event_reach' (0x8014) | 26 Dec 22:35:37 ntpd[18248]: peer 208.75.88.4 event 'event_reach' (0x84) status 'unreach, conf, 1 event, event_reach' (0x8014) | 26 Dec 22:35:37 ntpd[18248]: peer 216.184.20.83 event 'event_reach' (0x84) status 'unreach, conf, 1 event, event_reach' (0x8014) | | But I don't get the "Listening" messages anywhere. | Finally, leaving the above "logfile" lines in "/etc/ntp.conf" I tried putting | "syslog.conf" back the way it was to start with (no references to `ntpd'). | | Now the "Listening" lines are going back into "/var/log/messages". Two things. 1: Your ntp.conf file changes merely ADDED file-based logging to ntpd. So ntpd is now logging some stuff to your file. In ADDITION, ntpd logs to the syslog. 2: Syslog is very primitive. Those x.y fields are a "facility" and a "priority". Have a quick glance at the file /usr/include/sys/syslog.h for editification. In short, the facilities are predefine (kern, user, etc) and the priorities are predefined. Importantly, the facility is _not_ the program name. So for ntpd you want to know what facility it uses, and what priority the various messages are. Then you can tune things somewhat. But "ntpd.none" does nothing (I'm surprised it doesn't get an error message) because "ntpd" is not a facility name. Cheers, -- Cameron Simpson <cs@xxxxxxxxxx> DoD#743 http://www.cskk.ezoshosting.com/cs/ Politics is the art of looking for trouble, finding it everywhere, diagnosing it incorrectly and then applying the wrong remedies. - G. Marx
