# Custom 12.1 and broken syslog?



## pygr (Nov 25, 2019)

Hi,

I've built a custom kernel + world and things pretty much work as expected. An exception is syslog. 
Rules in syslog.conf like 

```
!devd
*.*                        /var/log/devd.log
```

don't seem to work as expected. Even after plugging and unplugging a USB thumb drive, nothing shows up in *devd.log. *A build with *KERNCONF=GENERIC *has lots of entries show up in *devd.log. *Also, for the custom build, tests like 

```
root@:~ # logger -p auth.info testing
```
 don't put anything into *auth.log*, but have the expected results in the generic build.

I suspect the cause might be an option or device I've left out of the kernel configuration or perhaps a component  left out of the world build.

Ideas? Suggestions?


----------



## Lamia (Nov 25, 2019)

pygr said:


> Rules in syslog.conf like


Syslog.conf would typically contain more rules than that one rule.

You should be able to see a sample defaultFreeBSD syslog.conf online. Do copy it.


----------



## pygr (Nov 25, 2019)

The syslog.conf file used in both cases described above was slightly modified from the default. The modification being changing the two lines near the bottom from

```
#!devd
#*.>=notice                                             /var/log/devd.log
```
to

```
!devd
*.*                                             /var/log/devd.log
```
.

I'd like to add that logging to standard facilities (e.g. mail) works as expected for rules that are not in a block associated with a program. So the thread title should have been "Custom 12.1 and partially broken syslog?".


----------



## pygr (Dec 11, 2019)

Well, I think I've found the source of the problem: a change in /lib/libc/gen/syslog.c dated 20180406 in /UPDATING. When an application sends a logging message using the new syslog(), an RFC 5424 header is prepended. Apparently syslogd hasn't been modified to appropriately deal with the messages the new syslog() sends to it. A fix that works for me is to revert to the previous version of syslog.c


----------

