Hacktopia

So I did not want my dhcpd messages to be lumped in with all the other /var/log/syslog messages.  I am running Debian 5 with comes running with syslog-ng.  While syslog-ng is much more customizable then plain syslog, it can also be very confusing.  Below is a example of all that I had to add to make syslog send all dhcpd messages to /var/log/dhcpd.log.  All I had to do was add those lines to the end of the /etc/syslog-ng/syslog-ng.conf configuration file, and then restart syslog-ng with /etc/init.d/syslog-ng  restart.  Did not even have to touch /var/log/dhcpd.log, syslog-ng took care of creating that while writing the first log entry.

filter f_daemon     {facility(daemon); };
filter f_dhcpd       {match(“dhcpd”); };
destination dhcpmessages { file(“/var/log/dhcpd.log”); };
log { source(s_all); filter(f_daemon);  filter(f_dhcpd); destination(dhcpmessages); };