# syslogd syntax for redirecting to sub-folders



## Beeblebrox (Nov 27, 2012)

I want to clean up my /var/log into sub-folders. I have modified my /etc/syslog.conf file as below but I am getting errors so I have done something wrong. I tried "*.filter" and "filter.*" but neither worked. My configuration and related error messages are below:

```
*.mount					/var/log/sys/mount
utx.*					/var/log/sys/utx
pf.*					/var/log/net/
nfs.*;newnfs.*				/var/log/net/nfs.log

!Xorg
*.*					/var/log/xorg/
jail*					/var/log/jails/
```


```
unknown priority named "mount
unknown facility named "utx"
unknown facility named "pf"
unknown facility named "nfs"
/var/log/xorg is a directory
```

I would like to get all Xorg related files into the xorg folder. Maybe the best place to do this is /etc/X11/xorg.conf, but from what I have read that modification only works for root.

I also want to get all "jail_xyz_console.log" files into jails folder. The last setting does not give an error but it also does not place those logs in the "jails" sub-folder

Regards.


----------



## Morte (Nov 27, 2012)

I think you're misunderstanding how syslog works, you may want to reread the manual. Facilities and priorities are explicitly fixed within the standard ones defined by the operating system. If you want to log things prefixed by "pf" (and by prefix I mean by program name), then you need to do it the same way as your xorg entry. I'm not sure how you would break out the log for your *.mount entry.


For the last error, you want to log to a file, not directory /var/log/xorg/xorg.log for example.

** Clarifing disclaimer - whether the program in question can log to syslog, or does so is up to the program, not syslog. Sorry if I was ambiguous.


----------



## Beeblebrox (Nov 27, 2012)

> Morte Junior Member


Are you for real? That must be some good stuff the doctors have prescribed for you.



> you want to log to a file, not directory /var/log/xorg/xorg.log for example


That will break system's Xorg log file name convention.


----------



## Beeblebrox (Nov 28, 2012)

I seem to be forgetting things. pf for example, is supposed to be set in /etc/rc.conf:

```
pflog_logfile="/var/log/net/pflog"
```


----------



## SirDice (Nov 29, 2012)

You might want to look at sysutils/syslog-ng. It's much more configurable than the 'standard' syslogd(8).


----------



## Morte (Nov 30, 2012)

Beeblebrox said:
			
		

> Are you for real? That must be some good stuff the doctors have prescribed for you.



Quite good thank you.


----------

