Gene Heskett wrote:
This, after removing the appropriate # comments, and restarting
rsyslog seems
to have worked, however the messages are being intermixed with this machines
messages. They are marked as coming from the 'router', I presume by a
gethostbynumber call someplace.
This gives a nice trigger if I can figure out how to use it:
I think it's something like:
:hostname, isequal, "router"
*.* /var/log/DD_WRT_router.log
It may be exactly that, but I haven't tested so I won't say that.
See
http://www.rsyslog.com/index.php?module=Static_Docs&func=view&f=/...,
http://www.rsyslog.com/doc-rsyslog_conf_filter.html,
http://www.rsyslog.com/doc-property_replacer.html,
http://www.rsyslog.com/doc-rsyslog_conf_actions.html, and
http://wiki.rsyslog.com/index.php/LighttpdVhostErrorlogs
I would like to put those in their own log. Is that possible?
Yes.
> which appears to be what you have to uncomment to receive messages.
> Do you want to receive TCP or UDP?
Not sure, so I enabled both. :)
That will slow it down, and rsyslog is speed-critical (to ensure you
don't miss any logs).
> Try to understand if data is coming to your machine with
>
> tcpdump -i eth0 -n -n
That was very informative, the major portion of the net traffic here is
being generated by arp, scanning the local subnet asking whohas, getting
to .254 and resuming at 1. That was so noisy if I saw anything from the
router it scrolled offscreen so fast I couldn't read it.
Try:
tcpdump -i eth0 -n -n | grep "\.514"
Or you could grep based on your router's IP.
That could be
turned off because I use host files here for the majority of my stuff.
That's not right. ARP resolves IPs to MAC addresses. It doesn't matter
if you never transmit hostnames across the network.
AFAIKT from the services config there is no arp daemon running.
Oh, ARP is running.
Matt Flaschen