Debian set pound logfacility using rsyslog

Written by Peter Davies on .

Add in the pound.cfg the following:

LogFacility local1
LogLevel 3

Using webmin edit the syslog by adding:

And also update the main syslog to remove local1 (or any available localN value) from being logged twice in the main syslog and also in the messages log:

This creates the following but I found I needed to rearrange the order for the pound messages to show up in the log file I created:

local1.*                        /var/log/pound.log
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv,local1.none        -/var/log/syslog
#cron.*                         /var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
user.*                          -/var/log/user.log

#.... and further down the page
mail,news,local1.none   -/var/log/messages

To make this active on the current system you will need to restart rsyslog using:

root@server:~# /etc/init.d/rsyslog reload
Reloading enhanced syslogd: rsyslogd.

Is is then highly recommended that you setup log rotation for the new log file, especially depending on the LogLevel defined - this would generate apache sized log files after a few hours on a production server. We often leave it at level 3 until the site is ready to go live, then take it down to 1 or 0.

Despite being set at 0, you are likely to see a lot of read timeouts and connetion errors as often browsers terminate their sessions without completing their previous requests. For example, when a user is impatient and they click the refresh button before the page has been fully delivered, OR even double clicking on a link/button on a form.