Syslog logging

[Vasil Labovský]

Hello,

Is there a way to prevent certain messages from being logged to syslog, specifically:

1. Role usage info

Mar 22 01:25:19 tacacs-1 tac_plus-ng[3342194]: 10.10.10.10 shell login for 'test' from 10.10.10.1 on command-api succeeded (profile=profile_admin)

2. Single-connection:
Mar 22 01:25:19 tacacs-1 tac_plus-ng[3342194]: 10.10.10.10 10.10.10.10: Possibly no single-connection support. Context feature may or may not work.

We are managing over 1k+ devices, and these messages generate quite a bit of syslog spam. I was able to disable logging entirely using the following configuration:
id = tac_plus-ng {
syslog default = deny
...
}

However, this also suppresses important warning and error messages such as:
Mar 21 13:34:07 tacacs-1 tac_plus-ng[21121]: 10.10.10.10 looking for user test in MAVIS backend
Mar 21 13:34:07 tacacs-1 tac_plus-ng[21121]: 10.10.10.10 result for user test is ERR [56 ms]
Mar 21 13:34:07 tacacs-1 tac_plus-ng[21121]: 10.10.10.10 shell login for 'test' from 10.10.10.1 on ssh failed [Invalid credentials (440)]

I’ve tried several combinations, including:

syslog severity = warning

…but nothing seems to work as expected

Is it possible to selectively disable only the info/debug messages while keeping warnings, errors,. in the logs?

[Marc Huber]

Hi,

disabling the built-in syslog per-message isn't possible yet, but it's actually a good idea and I might implement this some time.

As a work-around your syslog server might be able to drop the messages you don't care about. rsyslogd supports that, and I think others do too.

Cheers,

Marc

--
You received this message because you are subscribed to the Google Groups "Event-Driven Servers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to event-driven-ser...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/event-driven-servers/6ce889e9-2d63-46a2-8a97-df36a1a83424n%40googlegroups.com.

[Marc Huber]

Hi,

todays GIT supports a "syslog filter (the docs at https://projects.pro-bono-publico.de/event-driven-servers/doc/tac_plus-ng.html cover that).

Cheers,

Marc

To view this discussion visit https://groups.google.com/d/msgid/event-driven-servers/d57291fe-526e-4522-a216-9adaa105b8f5%40googlemail.com.

[Vasil Labovský]

Hello Marc,

thanks a lot!

Dátum: nedeľa 23. marca 2025, čas: 10:46:05 UTC+1, odosielateľ: Marc Huber