Editing rsyslog.conf from %post

[Matthew Miller]

On Fri, May 23, 2014 at 08:34:43PM -0600, Pete Zaitcev wrote:
> I have a bug 1083039 where basically an application logs everything
> to syslog making a mess out of /var/log/messages. The logging facility
> is configurable and the default is local0.
> I'm toying with an idea of doing something like this in %post
>  sed -e "s/cron.none[ \t]*\/var\/log\/messages/cron.none;local0.none\t\/var\/log\/messages/" -i- /etc/rsyslog.conf
> However, I have a feeling that such action is ill-advised.

Ooh, yeah. I agree with your feeling. Please don't do that. 

You could drop something into /etc/rsyslog.d/, not relying on just local0
but also the program name. See
(http://wiki.rsyslog.com/index.php/Filtering_by_program_name)

> For example, what does happen if the package is uninstalled and
> some other package logs to local0? Or what if we ever move to
> a different package as part of JournalD etc.

Is the application's logging useful/appropriate? Maybe it should be patched
to not log as much, or to only do so when a debug flag is enabled?


-- 
Matthew Miller    --   Fedora Project    --    <mattdm at fedoraproject.org>
                                  "Tepid change for the somewhat better!"