"Horváth Gergely J. (Ottó)" wrote:

I have done a little research among distributions, to have a bigger perspective, and based on that, I have some ideas and questions. More important ones first:

* OpenSUSE should log auth and authpriv messages separately (like "all" other distributions do).

We certainly can not start a great debate on what to log and where, but I would like to mention some other points too:

* OpenSUSE does not log crond messages separately (while nearly "all" other ditros do). Note: This might seem like a "what to log separately and what not to" question, but considering mail as a general service and thus logging it in a separate file - in contrast to crond - make me think of an advise: "Add a filter to crond if you plan to use that special service a lot - thus spamming your messages log file" :)

* Logging some messages to other files, should not we filter them out from messages? (I did not check this one, it might be daemon specific (like ntp), but one with a deeper insight could check it).

With a few excpetions, I find the current syslog settings to be quite good. For desktops and laptops, I don't touch them, for servers, I have one or two standard modifications. Overall, an optimal syslog setup depends entirely on what a system is used for. wrt your suggestions - I would prefer keeping crond messages in /var/log/messages - on a default system I don't see enough crond activity to warrant a separate file. (but there is already a commented out entry in syslog-ng.conf). Log auth and authpriv separately - yeah, why not. Filtering out messages from /var/log/messages if logged elsewhere - it's already being done for some, e.g. firewall. To me, that depends mostly on volume and somewhat on purpose. Logging changes I usually do for a production system: disable separate logging for mail.<level>, disable separate logging for news.*, amend logrotate for our log archiving, to use lzma compression and to run at midnight. -- Per Jessen, Zürich (23.9°C) -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-factory+help@opensuse.org