On Monday 02 March 2009, Matthew Flaschen wrote:
Gene Heskett wrote:
>> I think it's something like:
>> :hostname, isequal, "router"
>>
>> *.* /var/log/DD_WRT_router.log
>
> I tried that, and it duplicated the host machines log to the target. :)
Can you clarify? You put it as three lines like that?
No, two lines, somewhere a blank got added that wasn't there when it left
here.
> So I'm now trying:
> :msg, contains, "router" /var/log/dd-wrt/router.log
Counter-intuitively (but seemingly confirmed by some quick testing), I
don't think hostname is part of the message. I have another idea that
DID appear to work (obviously I tested with my own hostname), though it
didn't log as much as I expected ...</ominous>:
:HOSTNAME, isequal, "router" /var/log/dd-wrt/router.log
I have that in
there now. But even disabled the router is silent at the
moment. Here is a sample of what one of its messages looks like as I rebooted
it:
Mar 2 19:41:12 router syslog: syslogd : syslog daemon successfully stopped
Mar 2 19:41:12 router kernel: klogd started: BusyBox v1.11.1 (2008-07-26
11:32:32 CEST)
Mar 2 19:41:12 router syslog: klogd : klog daemon successfully started
Note the 'router' identifier
All one line, capitalized HOSTNAME. Also, just to be safe make sure
/var/log/dd-wrt/router.log already exists with the same permissions
(user/group/mode) as /var/log/messages before you restart rsyslogd.
I did.
> If I put it on two lines, it fussed on the restart because there was a
> line without an action.
Right, my mistake.
> Is it an absolute requirement? If not, how to stop it?
You /might/ be able to disable it if you hard-coded the MAC address of
every machine (including routers, firewalls, etc.) on your LAN.
However, I highly advise against attempting this.
Yeah, but its only this machine I'm seeing, and there a 2 other ubuntu
machines on this network that don't do that. And it just keeps hammering
away, probably 90% of the local traffic here, and that is counting fetchmail
checking 3 servers at 90 second intervals. I have attached a 60 second
tcpdump -i eth0 -nn capture. This cannot be right.
Matt Flaschen
Thanks Matt
--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
I have seen these EGG EXTENDERS in my Supermarket ... I have read the
INSTRUCTIONS ...