Hi, I have an issue to setup DHCP log in syslog-ng. Here are what I've done:
(1) Remove 'log-facility local7;' line from dhcpd.conf
(2) Add following lines to /etc/syslog-ng/syslog-ng.conf:
destination dhcplog { file("/var/log/dhcpd.log"); };
filter f_dhcpd { level(info) and match("dhcpd"); };
log { source(src); filter(f_dhcpd); destination(dhcplog);};
destination messages { file("/var/log/messages"); };
filter f_messages {
level(info..warn)
and not facility(auth, authpriv, mail, news)
and not match ("apache")
and not match ("dhcpd")
and not match ("sshd")
};
log { source(src); filter(f_messages); destination(messages);};
(3) touch /var/log/dhcpd.log; chmod 640 /var/log/dhcpd.log
(4) Restart syslog
(5) Restart dhcpd
It's not working. DHCP messages still go to /var/log/messages. What's wrong with the configuraiton? OS is SuSE 11.4.
Thank you in advance!