Rules for logging of client messages

Samhain
Prev | Chapter 6. Configuring yule, the log server | Next

# 6.6. Rules for logging of client messages

As the log server may receive quite a large number of log messages from clients (depending on the number of clients and their threshold settings), client messages are treated specially and by default are only logged to facilities suitable for bulk logging: console, log file, relational database (if enabled), and external (if enabled).

To override this behavior, you can set the option UseClientSeverity=`yes` in the [Misc] section of the configuration file. In that case, the client message severity is used, and client messages are treated just like local messages (i.e. like those from the server itself).

If you also want to filter by message class, there is also an option UseClientClass=`yes`

All client messages are recorded in the main log file by default. However, it is possible to use separate log files for individual clients. This can be enabled with UseSeparateLogs=`yes/no` in the Misc section of the server configuration file. No locking will be performed for such separate client log files (only one instance of the server can listen on the TCP port, thus there will be no concurrent access).

Prev | Home | Next
Enabling baseline database / configuration file download from the server | Up | Detecting 'dead' clients