Split view logging?

[Hauke Lampe]

Gregory Hicks wrote:

> First, create a 'pipe' in the /var/log directory with the name of the
> logging file.  (You probably want to do this in the named startup
> script.)  Log absolutely EVERYTHING to the log file.

Your method reminds me that I wanted to take a look at rsyslog filters
for a while now. It's the default syslog daemon in Debian Lenny, I just
never used its advanced features before.

This is what I use with BIND and rsyslog now:

$AddUnixListenSocket /var/cache/bind/dev/log   # inside chroot
:msg, contains, ": view authoritative: query: "
/var/log/bind/queries-auth.log
:msg, contains, ": view recursive-local: query: "
/var/log/bind/queries-recursive-local.log




Hauke.