Last week’s Techmail is Log Linux services with runit (although I’m pretty sure that’s not the original title I submitted). Anyways, it discusses logging various services running under runit using svlogd, so you can completely separate services from each other. Syslog is cool, but too much stuff gets crammed in together. For most services, you can get both… for instance, running ssh under ipsvd, with svlogd logging you can see the connections received by ipsvd (so you can see connections, IPs, whether it was rejected or accepted, concurrency, etc.) and still have authentication show up in auth.log or whatever.