Prevent application being able to log into Syslog

[olympia]

Now, that I managed to run Tvheadend on my unRAID box, it's "spamming" over the syslog with all kind of unnecessary messages (or errors) which I don't care and/or don't want to track.

 

There is no option to run Tvheadend without logging. Is there any way I can prohibit the app to inject lines into syslog on OS level? I was trying to look around on the Internet, but it seems unRAID's syslog facility is some stripped down version, so I am not sure how this could be worked out.

 

Thank you for any help in advance.

[BRiT]

It shouldn't be stripped down. It should be the same as the Slackware version. You should also be able to manage this via some syslog.conf changes.

[olympia]

I've already tried to add the following to /etc/syslog.conf

*.*;tvheadend[6368].none                                -/var/log/syslog

 

and restart syslog daemon by

/etc/rc.d/rc.syslog restart

 

with no luck.

 

...and I discovered this comment in /etc/syslog.conf

 tmm - modified so that everything goes to syslog.

 

that's why I thought it is stripped down, although I don't know what "tmm" is, nor if this comment made by Tom for unRAID or comes from somewhere else.

[BRiT]

Try it without the process number, ie: tvheadend and not tvheadend.

You might also want to try it with this before any other entries:

 

tvheadend.* -/dev/null

 

Also, 'tmm' means a comment by LimeTech and in this case only applies to the syslog.conf file. Typical Slackware has items going to /var/log/messages and /var/log/syslog.

[olympia]

Thanks for following this up with me.

 

However unfortunatelly I am still not able to sort this out.

I copied the wrong line above with tvheadend including the process number. First I tried without the process number, then I tried with that as well, then I just copied this here by accident. All in all it, not having the process number in their is not stopping tvheadend to log into syslog either.

 

tried

tvheadend.* -/dev/null

but this doesn't help either.

 

Are you sure syslog.conf is getting processed un unRAID?

Also, what do you mean by try "ie: tvheadend and not tvheadend"?

 

 

[WeeboTech]

You cannot without changing this line.

 

# Everything to syslog:

*.*                                                    -/var/log/syslog

 

syslog does not work on program names or applications, it works on general facilities and levels.

syslog-ng does allow you to filter based on program names, but it''s config file is much more involved.

 

It's possible to write to a pipe, then have another program filter the pipe and write the log, but now you have a co-process in the middle.

 

If you an find the facility and level of the application you can set syslog to ignore it, but then you may miss other messages.

 

Here;'s an example from a RHEL system.

 

# Don't log private authentication messages!

*.info;mail.none;news.none;authpriv.none;cron.none      /var/log/messages

 

[WeeboTech]

According to this code it uses the LOG_DAEMON facility.

 

http://www.lonelycoder.com/redmine/projects/tvheadend/repository/revisions/e544180acf9fdf1f54ffb6a6ccfd4e40a9614fc9/entry/main.c

 

if you could recompile the source to use the log_local1 facility.

127

  int logfacility = LOG_DAEMON;

127

  int logfacility = LOG_LOCAL1;

 

Then it would be easy to exclude all messages with.

*.*;local1.none      /var/log/messages

 

but with

*.*,daemon.none  /var/log/messages you may loose some important messages.

[olympia]

WOW, WeeboTech! Many thanks for taking the time to even look in the code.

 

...and your suggested solution works perfectly! Thank you again!

[WeeboTech]

Which way did you go?

 

Recompiled with LOG_LOCAL1 or

 

daemon.none in the /etc/syslog.conf file?

[olympia]

Recompiled with LOG_LOCAL1 and the syslog.conf configured like this:

 

# /etc/syslog.conf
# For info about the format of this file, see "man syslog.conf"
# and /usr/doc/sysklogd/README.linux.  Note the '-' prefixing some
# of these entries;  this omits syncing the file after every logging.
# In the event of a crash, some log information might be lost, so
# if this is a concern to you then you might want to remove the '-'.
# Be advised this will cause a performation loss if you're using
# programs that do heavy logging.

# tmm - modified so that everything goes to syslog.

# Uncomment this to see kernel messages on the console.
#kern.*                                                 /dev/console

*.debug;local1.none                                     -/var/log/syslog

# Emergency level messages go to all users:
*.emerg                                                 *

 

Thank you again!

[olympia]

Hi WeeboTech,

 

that solution works perfectly for a while, but then all of a sudden Tvheadend starts logging in the name of 'nss_wins'. I couldn't find out what is the trigger of that.

 

I tried to do some search on this and found some forum posts about this issue/bug, but couldn't figure out any solution to my case.

 

Did you experienced anything like that or do you know any potential solution for that?

 

Thank you in advance!