I've found a nice feature of the syslog-ng: if I use the logger to log things from the user process, I get the logging user name. Around so:

peterh$ echo test log message|logger

then I get this in /var/log/messages:

Oct 12 16:38:29 thehost peterh: test log message

Where "thehost" is the hostname of the server, and "peterh" is the user name below I gave the command.

Now what I want: I want to collect the log entries of a specific user into a specific file with the syslog-ng.

The bad-looking, but sometimes working features of the syslog-ng to filter the whole log entry didn't work:

# Doesn't work - it doesn't do anything
filter f_peterh { match('peterh'); };
destination d_filter { file("/var/log/peterh.log"); };
log { source(s_src); filter(f_peterh); destination(d_peterh); };

The documentation available manywhere on the net talk about everything from the binary format of the log messages until the related RFCs, except that how can I filter the syslog for user names.

How to do it?

  • Logger puts your username in for where the daemon usually goes. Are you looking to capture people who are running logger (and not overriding the username)? – Jeff Schaller Oct 12 '18 at 15:36
  • @JeffSchaller Yes. Actually, I want to run a wonderful software capable to log only to stdout/stderr, on a way that it runs as a daemon and I see its output in the syslog. To do that, I am wrapping it with a script, pipe its output to a logger command, and run this script as a daemon. The daemon will run as a specific user, this user exists only for this daemon. Now I want to separate its log entries into its file. If I could filter for the user, it would be a very nice and simple setting in the syslog-ng - but the syslog-ng documentation is a little bit cloudy, unfortunately. – peterh - Reinstate Monica Oct 12 '18 at 15:48
  • @JeffSchaller (simply redirecting the output of the daemon into a logfile is a no-go, there is also a network logging and an alarm/security watch system behind that, and anyways I see no reason to do something sub-optimally because a good software with a trash doc). – peterh - Reinstate Monica Oct 12 '18 at 15:52
  • it seems to me that you'd have to match() against the MESSAGE, unless MSGHDR contains more than rfc3164 specifies as the header , since I don't (yet) see syslog-ng support for rfc5424's APP-NAME – Jeff Schaller Oct 12 '18 at 16:08
  • @JeffSchaller Probably this should be reached, however the question is, how could I make syslog-ng to filter for that? The basic "match" filter won't work, but if syslog-ng can write this into the syslog, then it surely should be able to also filter for that. But how? The syslog-ng doc talks about everything, except that. – peterh - Reinstate Monica Oct 12 '18 at 16:36

I don't know if this is still on going for you, but for reference for anyone else trying to filter by username, this is how I was able to do it.

I created the following filter.

filter sampleUserFilter {
        facility (user) and match ("myUser" value ("PROGRAM"));

That allowed me to route messages from a specific user (using logger) to a separate file.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.