[tpop3d-discuss] logging to syslog error

[Chris Lightfoot]

On Thu, Oct 18, 2001 at 12:26:49PM +0200, Marcin Sochacki wrote:
> In tpop3d (8) I've found:
> 
>        tpop3d logs most diagnostics via syslog(3), using facility
>        mail.
> 
> Unfortunately it's not 100% correct.
> Some messages are logged with auth.info facility, which made my tpop3d
> logs spread across various files.
> 
> With 'syslogd -d' one can see:
> logmsg: auth.info<38>, flags 2, from debian, msg Oct 18 12:13:29 tpop3d[18723]:
> fork_child: [3]peter(10.0.0.248): successfully authenticated with pam
>  
> logmsg: auth.info<38>, flags 2, from debian, msg Oct 18 11:53:50 tpop3d[17783]:
> authcontext_delete: finished session for `aga' with pam

That's bizarre, and I can't reproduce the problem here.
The messages are logged with facility mail as expected. I
can't really see how the above would happen, since tpop3d
calls openlog(3) specifying facility MAIL. Unless, of
course, one of your PAM modules is calling openlog itself,
with facility auth. But that really shouldn't happen.

> My temporary solution is:
> 
> ******
> /etc/syslog.conf
> ******
> *.*;mail.none;auth.!=info         /var/log/syslog
> mail.*;auth.=info                 /var/log/mail.log
> 
> And for the wishlist, it would be nice to have an option to get
> 'compact' logs from tpop3d. Currently, one POP3 session creates about five
> lines, which fills my disks quite quickly.

Well, to a certain extent you can do this by using
syslog.conf to only record messages of ERR and above, but
I'm not sure whether I employ enough different levels of
logging for this to work usefully.

-- 
 ``If you're of average intelligence,
   you've already outwitted most burglars.'' (Chris MacKenzie)