<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<META content="MSHTML 6.00.6000.16544" name=GENERATOR></HEAD>
<BODY style="MARGIN: 4px 4px 1px; FONT: 10pt Tahoma">
<DIV>I'v start manualy the syslog-ng service and i received this error;</DIV>
<DIV> </DIV>
<DIV>Nov 5 16:55:03 ServerNAae syslog-ng[4948]: Reaping unused destination files; template='/var/log/ServerName/$YEAR/$MONTH/$DAY/$HOST.log'</DIV>
<DIV> </DIV>
<DIV>Some one know what is going wrong? This message is repeating numerous time..</DIV>
<DIV> </DIV>
<DIV>I look for the permission of the user that run de syslog-ng service, it have rigth to write on partition.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Thanks for your support</DIV>
<DIV><BR> </DIV>
<DIV> </DIV>
<DIV>Francis Provencher<BR>Ministère de la Sécurité publique du Québec<BR>Direction des technologies de l'information<BR>Division de la sécurité informatique<BR>Tél: 1 418 646-3258<BR>Courriel: <A href="mailto:Francis.provencher@Msp.gouv.qc.ca">Francis.provencher@Msp.gouv.qc.ca</A><BR> <BR>CEH - Certified Ethical Hackers<BR>SSCP - System Security Certified Practitionner<BR>Sec+ - Security +<BR><BR>>>> "Geller, Sandor (IT)" <Sandor.Geller@morganstanley.com> 4/11/2007 10:45 >>><BR></DIV>
<DIV style="COLOR: #000000">Hi, <BR><BR>> I'v put the localhost on source, but it's an error, i change <BR>> it for the Ip adress of the nic that i connect to the tap.<BR>> <BR>> But syslog call from remote server continu to goes in the <BR>> /var/log/message instead of <BR>> /var/log/SPSSOWL1/$YEAR/$MONTH/$DAY/$HOST.log"<BR>> <BR>> Like it's configure in the syslog-ng.conf.<BR>> <BR>> Do you want i paste here my syslog-ng.conf ? (i only change <BR>> source net { udp(ip(127.0.0.1) port(514)); }; for source <BR>> net { udp(ip(192.168.33.8) port(514)); };<BR><BR>Without looking up the source my first guess would be that the <BR>problem is caused by having udp() in your configuration twice.<BR>The 'src' and the 'net' sources both have udp(). It is possible<BR>that the second bind was unsuccessful as syslog-ng already has<BR>bound to 0.0.0.0:514 UDP port. Check your logs whether this is<BR>the case, it should be logged. Optionally remove udp() from<BR>the 'src' source if you're not logging from jails running on<BR>the local machine.<BR><BR>Regards,<BR><BR>Sandor<BR>--------------------------------------------------------<BR><BR>NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.<BR>_______________________________________________<BR>syslog-ng maillist - syslog-ng@lists.balabit.hu<BR><A href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</A><BR>Frequently asked questions at <A href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</A><BR><BR></DIV></BODY></HTML>