logging to a file other than syslog??

hoolio posted this great solution for logging selected data to alternate files via the default iRules facility by setting up appropriate filters and destinations: http://devcentral.f5.com/Default.aspx?tabid=53&view=topic&forumid=5&postid=8888

(Click here)

Building on that, here's a syslog-ng.conf snip that would log the output from 2 different iRules to 2 different files, without duplicating to the ltm log:

 set up filter to log only messages from rule_A to LogA
 local0.* /var/log/LogA
filter f_LogA {
facility(local0) and match("rule_A");
};
destination d_LogA {
file("/var/log/LogA" create_dirs(yes));
};
log {
source(local);
filter(f_LogA);
destination(d_LogA);
};
 set up filter to log only messages from rule_B to LogB
 local0.* /var/log/LogB
filter f_LogB {
facility(local0) and match("rule_B");
};
destination d_LogB {
file("/var/log/LogB" create_dirs(yes));
};
log {
source(local);
filter(f_LogB);
destination(d_LogB);
};
 optionally modify default LTM log section to exclude those entries
 local0.* /var/log/ltm
filter f_local0 {
facility(local0) and level(info..emerg) and not match("rule_A") and not match("rule_B");
};
destination d_ltm {
file("/var/log/ltm" create_dirs(yes));
};
log {
source(local);
filter(f_local0);
destination(d_ltm);
};

Sometime in 9.2 (9.2.3 I think?), the syslog-ng.conf was added to the backup roster & is now preserved thru an upgrade.

You will need to restart syslog after updating the conf file by running

bigstart restart syslog-ng

at the command line.

If the bigstart script fails to stop the daemon (i.e., it wasn't running because your last config errored out), bigstart will NOT try to start it, so you will need to run instead

bigstart startup syslog-ng

/deb