<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2995" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2><SPAN class=103430710-12012007>Hi
</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=103430710-12012007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=103430710-12012007>I'm trying to start
syslog-ng for use with splunk but get the following error and am not
sure how the address is already in use. I want to configure syslog-ng so that it
receives files remotely via udp. </SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=103430710-12012007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=103430710-12012007>[root@lonrs00253
init.d]# service syslog-ng stop<BR>Stopping Kernel Logger: [ OK
]<BR>[root@lonrs00253 init.d]# service syslog-ng start<BR>Starting syslog-ng:
Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use
(98)'<BR>Error initializing source driver; source='remote'<BR>Starting Kernel
Logger: [ OK ]</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=103430710-12012007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=103430710-12012007>My syslog-ng config
file is below which i've configured for splunk using the splunk forums.
</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=103430710-12012007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN
class=103430710-12012007>Cheers</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=103430710-12012007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN
class=103430710-12012007>leena</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=103430710-12012007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN
class=103430710-12012007>--------------------------------------------------------------------------------------------------------------------------------</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=103430710-12012007></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=103430710-12012007>options { sync
(0);<BR> time_reopen
(10);<BR> log_fifo_size
(1000);<BR> long_hostnames
(on);<BR> use_dns
(yes);<BR> use_fqdn
(yes);<BR> create_dirs
(yes);<BR> group
(logs);<BR> dir_group
(logs);<BR> perm
(0640);<BR> dir_perm
(0750);<BR> keep_hostname
(yes);<BR> };</SPAN></FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=103430710-12012007>source s_sys {
unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); };</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=103430710-12012007>source remote {
udp(); };</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=103430710-12012007><BR>destination
d_cons { file("/dev/console"); };<BR>destination d_mesg {
file("/var/log/messages"); };<BR>destination d_auth { file("/var/log/secure");
};<BR>destination d_mail { file("/var/log/maillog"); };<BR>destination d_spol {
file("/var/log/spooler"); };<BR>destination d_boot { file("/var/log/boot.log");
};<BR>destination d_cron { file("/var/log/cron"); };<BR>destination d_mlal {
usertty("*"); };<BR>destination splunk { pipe("/var/log/syslog-ng/syslog_fifo");
};<BR>destination hosts { file("/var/log/syslog-ng/hosts/$HOST/messages");
};</DIV>
<DIV> </DIV>
<DIV>filter f_filter1 { facility(kern); };<BR>filter
f_filter2 { level(info)
and<BR>
not
(facility(mail)<BR>
or facility(authpriv) or facility(cron)); };<BR>filter
f_filter3 { facility(authpriv); };<BR>filter
f_filter4 { facility(mail); };<BR>filter
f_filter5 { level(emerg); };<BR>filter
f_filter6 { facility(uucp)
or<BR>
(facility(news) and level(crit)); };<BR>filter f_filter7
{ facility(local7); };<BR>filter f_filter8 {
facility(cron); };</DIV>
<DIV> </DIV>
<DIV>log { source(s_sys); filter(f_filter1); destination(d_cons); };<BR>log {
source(s_sys); filter(f_filter2); destination(d_mesg); };<BR>log {
source(s_sys); filter(f_filter3); destination(d_auth); };<BR>log {
source(s_sys); filter(f_filter4); destination(d_mail); };<BR>log {
source(s_sys); filter(f_filter5); destination(d_mlal); };<BR>log {
source(s_sys); filter(f_filter6); destination(d_spol); };<BR>log {
source(s_sys); filter(f_filter7); destination(d_boot); };<BR>log {
source(s_sys); filter(f_filter8); destination(d_cron); };<BR>log {
source(remote); destination(splunk); };<BR>log { source(remote);
destination(hosts); };</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=103430710-12012007></SPAN></FONT> </DIV>
<DIV> </DIV>
<P class=MsoNormal align=left><SPAN class=SpellE>Regards</SPAN></P>
<P class=MsoNormal align=left><FONT size=1><FONT face=Tahoma><FONT
color=#0000ff><STRONG><SPAN class=SpellE>Leena</SPAN> Patel</STRONG></FONT> |
Royal Bank of Scotland Global Banking & Markets | E-Commerce | Desk: +44 (0)
207 085 0692 </FONT></FONT></P>
<DIV><FONT face=Arial size=2></FONT> </DIV><pre>
***********************************************************************************
The Royal Bank of Scotland plc. Registered in Scotland No 90312. Registered Office: 36 St Andrew Square, Edinburgh EH2 2YB.
Authorised and regulated by the Financial Services Authority
This e-mail message is confidential and for use by the
addressee only. If the message is received by anyone other
than the addressee, please return the message to the sender
by replying to it and then delete the message from your
computer. Internet e-mails are not necessarily secure. The
Royal Bank of Scotland plc does not accept responsibility for
changes made to this message after it was sent.
Whilst all reasonable care has been taken to avoid the
transmission of viruses, it is the responsibility of the recipient to
ensure that the onward transmission, opening or use of this
message and any attachments will not adversely affect its
systems or data. No responsibility is accepted by The
Royal Bank of Scotland plc in this regard and the recipient should carry
out such virus and other checks as it considers appropriate.
Visit our websites at:
www.rbs.com
www.rbsgc.com
www.rbsmarkets.com
***********************************************************************************
</pre></BODY></HTML>