Logging dhcpd to a separate file?

Currently my dhcpd logs to messages - I would like to change this to log to /var/log/dhcpd.log.

I found various articles on changing the logging facility in dhcpd.conf and then changing the syslog.conf file. Some posts say syslog is now syslog-ng.conf - I can’t find either of these files. What do I need to change to get the logging done to a separate file?

I haven’t done this, so was curious enough to do a little investigation…

I don’t have access to a running dhcpd for now, so I can only go so far in possibly pointing you in the right direction…

First thing to keep in mind is that openSUSE now sends its system events to systemd’s journal, not directly to /var/log/messages.

First thing I looked at are the messages at the end of installing dhcp-server.

output:Updating /etc/sysconfig/dhcpd...
Updating /etc/sysconfig/syslog...

To me, the above looks suspiciously like system configuration changes related to the dhcp server just being installed.
So, I inspected the files in the first location and found


## Type:    string## Default:    "/etc/dhcpd.d"
## ServiceRestart: dhcpd
# Since version 3, dhcpd.conf can contain include statements. 
# If you enter the names of any include files here, _all_ conf
# files will be copied to $chroot/etc/, when dhcpd is started in the 
# chroot jail. (/etc/dhcpd.conf is always copied.)
# For your convenience, you can also specify entire directories,
# that will be copied inclusive subdirectories. The /etc/dhcpd.d
# directory will be copied by default when it exists.
# Example: "/etc/foo.bar.conf /etc/dhcpd.bootp-clients.conf"

And, so within that file


# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
#log-facility local7;

Note the comment to this change which also likely dovetails into the other file that was modified by the dhcp-server configuration (see the second line of appended to the dhcp-server install I quoted above)

It would seem to me that instead of modifying where your dhcpd notifications are sent, you should also be able to “journalctl | grep” to extract what you want on demand.


Thanks for the info. i will need to look into how journald works.

No need to over think my suggestion, the “journal” is the “more detailed, more complete” syslog written to.

And, just like the “messages” syslog you can run “journalctl” piped to grep to parse and return specific strings of characters, so for instance the following returns <everything> with “dhcp” in the event. After running the following you would probably want to modify the string to return more specific events

journalctl | grep dhcp


Thanks - that did the trick.