Re: iPrint logging...Filter messages?

[Simon Flood]

On 18/02/2010 14:16, djbrightman wrote:

> My aim is to get the iprint (predominantly iprintgw) entries out of the
> /var/log/messages and /var/log/warn files on our cluster nodes...
>
> We have lots of printers that maybe turned off (or are just badly
> maintained!) so get lots of entries in these files, which clutter them
> up and make looking for more 'key' events an issue...(e.g on one of our
> clusters the node currently running the iprint resource has 6425/8036
> lines in messages from iprintgw....!)
>
> The iprint logs are fine being written to the sym linked cluster
> resource location, so I'd like to get rid of the duplication and
> clutter
>
> Anyone know where/how it is specified/configured that iprintgw will
> write log entries?
>
> I have had a dig around /etc/syslog-ng, but can find no entries in
> there pertaining to ipsmd, iprintgw, etc.... could I put entries in to
> filter out?

Yes I do this for DHCP messages or rather Novell kindly logs them to
/var/log/dhcpd.log but unfortunately they're also still going into
/var/log/messages so I changed that behaviour.

The file to edit is /etc/syslog-ng/syslog-ng.conf.in and there are two
things to do:

1) add a suitable filter at the end of the file to match required
entries. Something like

filter f_iprint { facility(daemon) and match('^(idsd|ipsmd)\['); };
destination iprintmessages { file(var/log/iprint.log); };
log { source(src); filter(f_iprint); destination(iprintmessages); };

2) change the filter f_messages to take into account new filter - add
'and not filter(f_iprint)'.

Then run SuSEconfig to put the changes into effect.

After which you should find all idsd and ipsmd messages go to
/var/log/iprint.log and not into /var/log/messages.

HTH.
--
Simon
Novell Knowledge Partner (NKP)

------------------------------------------------------------------------
Do you work with Novell technologies at a university, college or school?
If so, your campus could benefit from joining the Novell Technology
Transfer Partners (TTP) group. See www.novell.com/ttp for more details.
------------------------------------------------------------------------

[Simon Flood]

On 18/02/2010 17:56, djbrightman wrote:

> Cheers Simon, I do that for dhcpd too!
>
> However, with iprint the messages already go into the cluster resource
> logs via the sym linked /var/opt/novell/log/iprint location, but they
> also go into /var/log/messages and /var/log/warn - there are no entries
> relating to this is the /etc/syslog-ng structure...
>
> What I'm trying to understand is how ipsmd (and subsequently iprintgw
> (the real culprit)) are configured to log
>
> I guess I could just add a filter and check them to null, but would
> that stop them from going to the place I want them (the default
> location, which is nicely sym linked to my cluster resource)? I just
> want them out of the system logs, as they usually consume > 80%!!
>
> So, anyone know how the iprint components have their logging defined?

Ah now I got you but I don't currently have any clustering installed. A
quick check of the cluster-related RPMs didn't show up anything.