Cisco IOS Cookbook, 2nd Edition

Logging Router Syslog Messages in Different Files

Problem

You want the Unix server to send router log messages to a different logfile than the local system messages.

Solution

To disable router syslog messages from inundating your local system logfiles, use the following commands:

local7.info                             /var/log/rtrlog
*.err;kern.debug;auth.notice;mail.crit;local7.none       /var/log/syslog
*.notice;kern.debug;auth.info;mail.crit;local7.none       /var/adm/messages

Discussion

Most common syslog facilities will, by default, log all messages of a certain severity and higher (see Table 18-1) to their generic local system logfiles. However, once you configure your syslog.conf file to store all router log messages to a specific file, /var/log/rtrlog, in this case, you want to suppress this from occurring. Suppressing router log messages from being stored in your local system logfiles prevents cluttering, separates unrelated logfiles, and prevents the storing of redundant data.

The first line of the example above causes the syslog facility to store all router logs to a certain file. However, syslog will continue to archive router messages into the general system logfiles, as well. Notice that lines 2 and 3 above include a wildcard option (*.err and *.info, respectively). These wildcards match the local7 logging facility and all others as well, causing all log messages of a certain severity level and higher, to be stored. To prevent the router logs from being stored in the general system logfiles, use the local7.none ...