c - 如何使用 syslog-ng 仅登录 **mylog**，而不是 **mylog** 和 **syslog**？

Question

我正在为使用 yocto 构建的主板开发一些软件。对于日志系统，我使用 syslog-ng，但目前，我的应用程序将其输出写入/var/log/syslog 和/var/log/mylog。他们每个人都这样打开日志:

#include <syslog.h>

int main() {
    openlog("my_app_N", LOG_CONS | LOG_PID | LOG_NDELAY, LOG_LOCAL2);
    ...
    ...
    ...

文件/etc/syslog-ng/syslog-ng.conf具有以下内容(一旦删除了可能不相关的注释行):

@version: 3.5
#
# Syslog-ng configuration file, compatible with default Debian syslogd
# installation. Originally written by anonymous (I can't find his name)
# Revised, and rewrited by me (SZALAY Attila <sasa@debian.org>)

# First, set some global options.
options { chain_hostnames(off); keep-timestamp(yes); flush_lines(100); use_dns(no); use_fqdn(no);
          owner("root"); group("adm"); perm(0640); stats_freq(0);
          bad_hostname("^gconfd$");
};

########################
# Sources
########################
# This is the default behavior of sysklogd package
# Logs may come from unix stream, but not from another machine.
#
source s_src { unix-dgram("/dev/log"); internal();
                    file("/proc/kmsg" program_override("kernel"));
};

########################
# Templates
########################
# Syslog-ng message template
template t_timestamp {
    template("${R_DATE} ${MSGHDR}${MSG}\n");
};


########################
# Destinations
########################
# First some standard logfile
#
#--------------------------------------------------------------------------------------
#For millisecond timestamp
#Uncomment below line
options { frac_digits(3);  ts_format(iso); };
destination d_syslog { file("/var/log/syslog" template(t_timestamp) create-dirs(yes)); };
destination d_error { file("/var/log/error" template(t_timestamp) create-dirs(yes)); };
destination d_crit { file("/var/log/critical" template(t_timestamp) create-dirs(yes)); };
destination d_local1 { file("/var/log/otherlog.log" template(t_timestamp) create-dirs(yes)); };
destination d_local2 { file("/var/log/mylog" template(t_timestamp) create-dirs(yes)); };
#--------------------------------------------------------------------------------------

destination d_local0 { file("/var/log/local0.log"); };


########################
# Filters
########################
# Here's come the filter options. With this rules, we can set which
# message go where.
filter f_crit { level(crit .. emerg); };
filter f_net { level(debug, info, notice, warn, alert, emerg); };
filter f_error { level(err .. emerg) ; };

filter f_local0 { facility(local0); };
filter f_local1 { facility(local1); };
filter f_local2 { program("my_app_06") or program("my_app_05") or program("my_app_04") or program("my_app_03") or program("my_app_02") or program("my_app_01") or program("my_app_00") or program("my_app_dbus_server"); };

filter f_syslog3 { not facility(auth, authpriv, mail); };

destination d_syslog_tcp { syslog("192.168.6.7" transport("tcp") port(514)); };


########################
# Log paths
########################
log { source(s_src); filter(f_error); destination(d_error); };
log { source(s_src); filter(f_crit); destination(d_crit); };

log { source(s_src); filter(f_syslog3); destination(d_syslog); destination(d_syslog_tcp); };

log { source(s_src); filter(f_local0); destination(d_local0); };
log { source(s_src); filter(f_local1); destination(d_local1); };
log { source(s_src); filter(f_local2); destination(d_local2); };

如何使 my_apps 只将日志写入/var/log/mylog 而不向/var/log/syslog 写入任何内容？

Answer 1

从syslog-ng v3.15.1开始，可以使用if-else，例如:

log {
    source(s_src);

    if (program("my_app_06") or program("my_app_05") or program("my_app_04") or program("my_app_03") or program("my_app_02") or program("my_app_01") or program("my_app_00") or program("my_app_dbus_server")) {
        destination(d_local2);
    }
    else {
        filter(f_syslog3);
        destination(d_syslog);
        destination(d_syslog_tcp);
    };
};

syslog-ng v3.5 确实很旧，我不确定它的功能集，但是:

• 您随时可以创建另一个过滤器来否定 f_local2 或
• 您可以使用final标志来“终止”日志路径，例如:

# list this first with flags(final)
log { source(s_src); filter(f_local2); destination(d_local2); flags(final); };

# list everything else
log { source(s_src); filter(f_syslog3); destination(d_syslog); destination(d_syslog_tcp); };
# ...