Re: [gentoo-user] I don't seem to have a system log. Help, please!

[Mick]

On Monday 09 Feb 2015 10:19:20 Alan McKinnon wrote:
> On 09/02/2015 11:48, Alan Mackenzie wrote:
> > Hello, Gentoo!
> >
> > I've pretty much got my new system up and running.  It took me less than
> > a week (compared with the month it took me when I first installed Gentoo
> > a few years ago).  The most time consuming bit was getting my email
> > server (qmail) going.  I've still got to go through my old
> > /var/lib/portage/world file, and see which packages I had I still want
> > installed.
> >
> > However, I don't seem to have a system log.  There is no file named
> > /var/log/syslog, or anything like it.
> >
> > I've got syslog-ng installed, and "rc-update show" shows that it is
> > in runlevel default.  Indeed, there exists /var/run/syslog-ng.pid and
> > /var/run/syslog-ng.ctl.  But no /var/log/syslog, if that's what the
> > logfile is indeed called.  (The syslog-ng manpages don't make this
> > clear.)
> >
> > Do I actually need to configure the name of a log file in
> > /etc/conf.d/syslog-ng?  The Gentoo installation guide didn't mention, or
> > even hint at, such being necessary.
> >
> > Clearly, I'm missing something obvious here.  What is it?
> >
> > Thanks in advance for the help.
>
> Gentoo defaults to calling it /var/log/messages
>
> (it's also constantly tailed on vt12, just in case you need to see
> what's going on it right now)

I noticed the same on a recent installation.  /var/log/syslog is not created 
by default any more, when installing syslog-ng.  I haven't looked in the 
/etc/syslog-ng/syslog-ng.conf file of the new install to see what's different, 
but it used to be that something like this would do the trick:
=============================================================
destination d_syslog { file("/var/log/syslog"); };

filter f_syslog { not facility(authpriv, mail); }

log { source(src); filter(f_syslog); destination(d_syslog); };
=============================================================

I am not sure if the format has changed since the last time I looked at it.

-- 
Regards,
Mick