Re: [gentoo-user] syslog-ng: filter plugin NOT not found ????

[Dan Egli]

Well, I'm starting to make progress. But something isn't right. I found 
out the plugin error was due to the fact that despite syslog-ng.com 
showing the reversal as NOT, the actual statement is not (all lower case 
vs all upper case). So that means that syslog-ng loads just fine. But I 
can't get the dhcp output to where I want it. If I have the syslog 
facility in dhcpd turned on, or if I redirect the output to a file in 
systemd, then I get dhcpd messages in the file AND in the syslog itself 
(/var/log/messages). No matter what I try, the dhcpd output ALWAYS goes 
to syslog. I can get it to go to a separate file TOO, but not ONLY. 
Here's the entire syslog-ng.conf and the service file for dhcpd. 
Hopefully you guys can figure something out I missed:


(dhcpd4.service)
[Unit]
Description=DHCPv4 Server Daemon
Documentation=man:dhcpd(8) man:dhcpd.conf(5)
After=network.target
After=time-sync.target
After=network-online.target
Wants=network-online.target
StandardOut=null
StandardError=null

[Service]
ExecStart=/usr/sbin/dhcpd -f -cf /etc/dhcp/dhcpd.conf -user dhcp -group 
dhcp --no-pid

[Install]
WantedBy=multi-user.target


With everyhing going to null, you'd think that with the syslog statement 
in dhcpd.conf disabled, I'd get no log at all. But I still get the log 
in /var/log/messages. Here's syslog-ng.conf:
@version: 3.26

options {
         threaded(yes);
         chain_hostnames(no);
         stats_freq(43200);
         mark_freq(3600);
};
filter dhcpfilter { facility(local7); };
filter nondhcp { not filter(dhcpfilter); };
source src { system(); internal(); };
destination messages { file("/var/log/messages"); };
destination dhcplog { file("/var/log/dhcpd.log");  };
destination console_all { file("/dev/tty12"); };
log { source(src); filter(nondhcp); destination(messages);  };
log { source(src); destination(console_all); };
log { source(src); filter(dhcpfilter); destination(dhcplog);  };


And for what it's worth, here's my dhcpd.conf:
default-lease-time 3600;
max-lease-time 43200;

# Use this to enble / disable dynamic dns updates globally.
ddns-update-style interim;

authoritative;

# log-facility local7;


allow booting;

subnet 10.0.2.0 netmask 255.255.255.0 {
# no services at all!
}

subnet 192.168.10.0 netmask 255.255.255.0 {
         range 192.168.10.128 192.168.10.254;
         if exists user-class and option user-class = "iPXE" {
         filename "pxelinux.efi";
         } else {
         filename "pxelinux.0";
         }
         next-server 192.168.10.3;
         option domain-name-servers 192.168.10.2, 8.8.8.8;
         option domain-name "eglifamily.name";
         option routers 192.168.10.1;
}

host testbox-1 {
         hardware ethernet 08:00:27:D5:AA:3C;
         fixed-address 192.168.10.64;
         option host-name "testbox-1";
         ddns-hostname "testbox-1.eglifamily.name";
}


-- 
Dan Egli
 From my Test Server