142

Chapter 4     Plugins, Preprocessors and Output Modules

use of /etc/syslog.conf file on UNIX systems. A typical syslog.conf file on

RedHat Linux 7.3 system follows. As you can see from this file, a log file is defined for

each type of facility. Most of the messages go into /var/log/messages files.

# Log all kernel messages to the console.

# Logging much else clutters up the screen.

kern.*             /dev/console

# Log anything (except mail) of level info or higher.

# Don t log private authentication messages!

*.info;mail.none;news.none;authpriv.none;cron.none              /var/

log/messages

# The authpriv file has restricted access.

authpriv.*          /var/log/secure

# Log all the mail messages in one place.

mail.*             /var/log/maillog

# Log cron stuff

cron.*             /var/log/cron

# Everybody gets emergency messages

*.emerg            *

# Save news errors of level crit and higher in a special file.

uucp,news.crit     /var/log/spooler

# Save boot messages also to boot.log

local7.*           /var/log/boot.log

#

# INN

#

news.=crit         /var/log/news/news.crit

news.=err          /var/log/news/news.err

news.notice        /var/log/news/news.notice

If you want to send different types of alerts using different facilities or priorities,

you can define your own actions using the ruletype keyword as mentioned earlier. After

defining these rule types, you can use them in your rules as actions. As you will remem 

ber from previous discussions, the first word in each rule is the action part.