Duplicate data recording

Esteemed,

I created an entry in syslog-ng to collect OpenLdap information (slapd) from message.log, 
but it is writing the same information in the log where I put it to record and is also writing to /var/log/message

Below is the entry created:

@version: 7.0
#Default configuration file for syslog-ng.
#
# For a description of syslog-ng configuration file directives, please read
# the syslog-ng Administrator's guide at:
#
# www.balabit.com/.../documentation
#
@include "scl.conf"
@include 'clm-syslogng.conf'

options {
stats_freq(0);
};

######
# sources
# message generated by Syslog-NG
source s_local { internal(); system(); monitoring_welf(); };

######
## filters
filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); };
filter f_slapd { program("slapd"); };
filter f_not_slapd { not match (program("slapd")); };

######
# destinations
destination d_messages { file("/var/log/messages"); };
destination d_slapd { file("/apps/logs/slapd.log" owner(ldap) group(guia) perm(0644)); };

######
# logs
log { source(s_local); destination(d_messages); };
log { source(s_local); filter(f_slapd); destination(d_slapd); flags(final); };

I would like to know how to leave only the recording in /apps/logs/slapd.log ?

  • Good morning Diogo A Silva,

    When calling s_local in your logs, you are calling all logs captured by this source, thus in your first log statement, you are writing all s_local logs to the d_messages location.

    Then in the next statement, you are choosing only to take the slapd logs from the s_local source using a filter and are sending them to the d_slapd destination.

    Therefore, you will see the slapd logs in both locations.

    If you want the slapd logs removed from the d_messages location you will want to filter them out.

    It seems you have created a filter for this already in the f_not_slapd filter, so you will want to call this in your first log statement to ensure everything except those logs are written to d_messages.

    Below you can find an example of what you would want to do:

    ######
    # logs
    log { source(s_local); filter(f_not_slapd); destination(d_messages); };
    log { source(s_local); filter(f_slapd); destination(d_slapd); flags(final); };

    Once done you should see all logs except slapd written to d_messages, and then only slapd logs written to d_slapd.

    If you have any other questions please do not hesitate to reach out as we would be more than happy to be of further assistance.

    Thank you so much, Diogo A Silva, and have a great rest of your day!

    Best Regards,
    Justin VanAusdall