syslog written on console

Question

I have odd problem with syslog local7, my syslog configure the syslog to be written to

local7.info /var/log/syslog_info

it's working just fine for years but recent days one device syslog message written on console and I don't know why this one device syslog on console but other hundreds of devices syslog still written on the file. my question question is how I can stop that? i need syslog from that device so i don't want to stop it but the same time i don't want to written on my console. my Os is 64 bit Solaris. thanks,

this is my syslog.conf

  #
  *.err;kern.notice;auth.notice         /dev/sysmsg
  *.err;kern.debug;daemon.notice;mail.crit  /var/adm/messages

  *.alert;kern.err;daemon.err           operator
  *.alert                       root

  *.emerg                       *

  # if a non-loghost machine chooses to have authentication messages
  # sent to the loghost machine, un-comment out the following line:
  #auth.notice          ifdef(`LOGHOST', /var/log/authlog, @loghost)

  mail.debug            ifdef(`LOGHOST', /var/log/syslog, @loghost)

 #
 # non-loghost machines will use the following lines to cause "user"
 # log messages to be logged locally.
  #
 ifdef(`LOGHOST', ,
 user.err                   /dev/sysmsg
 user.err                   /var/adm/messages
 user.alert                 `root, operator'
 user.emerg                 *
 )
 local7.info        /var/log/syslog_info

Solution

Your syslog configuration will log anything at err level and above to the system console due to this line:

 *.err;kern.notice;auth.notice         /dev/sysmsg

This logs everything at err and higher, kern messages at notice and higher, and auth message at notice and higher to the system console. If your device is logging messages at these levels this would explain the console messages.

You can suppress messages from the local7 facility using the none qualifier, like this:

*.err;kern.notice;auth.notice;local7.none         /dev/sysmsg

Try that and see if the console messages stop appearing.

Comments

[user2751502]

Can you post your syslog configuration?

[eli1128]

great, that's solve the issue. thanks much for you time and good explanation.

[user2751502]

@eli1128, If this answered your question, please consider taking a moment to mark the answer as accepted by clicking on the checkmark to the left of the answer. Thanks!