syslog is controlled by
/etc/syslog.conf which SME creates from the templates in /etc/e-smith/templates/etc/syslog.conf/*
To customize /etc/syslog.conf:
* locate the template fragments that control the section of /etc/syslog.conf you want to customize
* copy them to /etc/e-smith/templates-custom/etc/syslog.conf
* (create this directory if it doesn't exist using
mkdir -p /etc/e-smith/templates-custom/etc/syslog.conf)
* customize them
* recreate syslog.conf using
expand-template /etc/syslog.conf* restart syslogd using
/etc/init.d/syslog restart[/list]
So, if you want everything that now goes to /var/log/messages to go to your logging server, create a custom copy of
00filenames and change the value of
$messages. On the other hand, if you only want "auth" messages to go to your logging server, customize
auth.
Warning: I have no idea what impact these changes will have on the security or performance of your SME server.
Of course you'll need to configure your logging server to accept logs from remote hosts, plus, many SME processes use multilog instead of syslog so you may not get the data you want from syslog.