Is there a common way of distinguishing between the messages of multiple processes in syslog-ng beside setting different facilities? +1 if filtering and therefore logging in different files would be possible.

I have a system setup with two running sshd instances. One is running in a chrooted environment. Since syslog is used, all messages end up in the same logfile.

One possibility would be to change the facility of the jailed sshd to something like local0, but I wonder if there is some 'cleaner' way to do this.

Installing other syslog daemon, for example rsyslog is not an option here. This question is somehow related to:


Change the name of the executable (note that that also affects PAM configuration).

ln /path/to/sshd /path/to/sshd-whatever

Start as /path/to/sshd-whatever. And define PAM configuration in /etc/pam.d/sshd-whatever. Log entries will show as sshd-whatever instead of sshd.

  • Thanks, this is a possibility to distinguish in one logfile. Is there a way to filter for this and have two separate files? (edited the questions) – echox Apr 18 '14 at 7:58
  • ok, the working filter is program(regex) (balabit.com/sites/default/files/documents/…) – echox Apr 20 '14 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.