StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>A config file based solution is available. I think CentOS by default ships with rsyslog and even if it does not, you can always install rsyslog with yum. This solution works only with rsyslog and nothing else.</p> <p>The is a catch, though. You can not separate log messages with rsyslog (or pretty much any syslog daemon implementation) between processes with same name ie. the same executable path. However, rsyslog does allow you to filter messages based on program name. Here lies a possible solution: most programs call openlog(3) using argv[0], ie. the executable name, as the first argument. Now since you don't reveal the actual program you're running, there is no way to determine this for you, but you can always read the sources of your own program, I guess.</p> <p>In most cases the executable path is the program name, though some daemons do fiddle with argv[0] (notable examples are postfix and sendmail). Rsyslog on the other hand provides a filtering mechanism which allows one to filter messages based on the name of the sending program (you can now probably see how this is all connected to how openlog(3) is called). So, instead of trying to filter directly processes, we can do filtering on program names. And that we can affect by creating symbolic links.</p> <p>So, this solution only works given following conditions: a) the process you're running does not fiddle with argv[0] after beginning execution; b) you can create symlinks to the binary, thus creating two different names for the same program; c) your program is calling openlog(3) using argv[0] as the first parameter to the call.</p> <p>Given those two conditions, you can simply filter messages on <code>/etc/rsyslog.conf</code> like this (example directly from <a href="http://www.rsyslog.com/doc/rsyslog_conf_filter.html" rel="nofollow">rsyslog documentation</a>):</p> <pre><code>if $programname == 'prog1' then { action(type="omfile" file="/var/log/prog1.log") } if $programname == 'prog2' then { action(type="omfile" file="/var/log/prog2.log") } </code></pre> <p>E.g. if your program is called <code>/usr/bin/foobar</code> and you've created symbolic links <code>/usr/bin/prog1</code> and <code>/usr/bin/prog2</code> both pointing at <code>/usr/bin/foobar</code>, the above configuration file example will then direct messages from processes started as "prog1" and "prog2" to different log files respectively. This example will not fiddle with anything else, so all those messages are still going to general log files, unless you filter them out explicitly.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload