<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7652.24">
<TITLE>Help on syslog-ng</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">Hello,</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">I have install syslog-ng on solaris 10(machine A],it configured as log proxy server</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">more /etc/syslog-ng/syslog-ng.conf</FONT>
<BR><FONT SIZE=2 FACE="Arial">options {</FONT>
<BR><FONT SIZE=2 FACE="Arial">chain_hostnames(no);</FONT>
<BR><FONT SIZE=2 FACE="Arial">keep_hostname(yes);</FONT>
<BR><FONT SIZE=2 FACE="Arial">use_fqdn(yes);</FONT>
<BR><FONT SIZE=2 FACE="Arial">log_fifo_size(1000);</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">source local {</FONT>
<BR><FONT SIZE=2 FACE="Arial">sun-stream("/dev/log");</FONT>
<BR><FONT SIZE=2 FACE="Arial">udp(ip(0.0.0.0) port(514));</FONT>
<BR><FONT SIZE=2 FACE="Arial">internal();</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">filter notdebug {</FONT>
<BR><FONT SIZE=2 FACE="Arial">level(info...emerg);</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">destination ercmas13.eurocontrol.fr{</FONT>
<BR><FONT SIZE=2 FACE="Arial">udp("ercmas13.eurocontrol.fr" port (514));</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
<BR><FONT SIZE=2 FACE="Arial">log {</FONT>
<BR><FONT SIZE=2 FACE="Arial">source(local);</FONT>
<BR><FONT SIZE=2 FACE="Arial">filter (notdebug);</FONT>
<BR><FONT SIZE=2 FACE="Arial">destination(ercmas13.eurocontrol.fr);</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">A client (Machine C) on solaris 10 send logs on (Machine A)</FONT>
<BR><FONT SIZE=2 FACE="Arial">I say the log on ercmas13 (logs server)</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">A client (Machine B) on redhat 4 send log on (Machine B)</FONT>
<BR><FONT SIZE=2 FACE="Arial">I have nothing on the log server</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">I change this information in this files syslog-ng.conf on log proxy server</FONT>
</P>
<P><FONT SIZE=2 FACE="ArialMT">Each possible communication mechanism has a corresponding source driver in syslog-ng. For example, to</FONT>
<BR><FONT SIZE=2 FACE="ArialMT">open a unix socket with<I></I></FONT><I> <FONT SIZE=2 FACE="Courier">SOCK_DGRAM</FONT></I> <FONT SIZE=2 FACE="ArialMT">style communication use the driver</FONT><I></I><I> <FONT SIZE=2 FACE="Courier">unix-dgram</FONT></I><FONT SIZE=2 FACE="ArialMT">. The same socket using</FONT>
<BR><FONT SIZE=2 FACE="ArialMT">the</FONT><I></I><I> <FONT SIZE=2 FACE="Courier">SOCK_STREAM</FONT></I> <FONT SIZE=2 FACE="ArialMT">style — as used under Linux — is called</FONT><I></I><I> <FONT SIZE=2 FACE="Courier">unix-stream</FONT></I><FONT SIZE=2 FACE="ArialMT">.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">source local {</FONT>
<BR><FONT COLOR="#FF0000" FACE="Arial">unix-stream</FONT><FONT SIZE=2 FACE="Arial">("/dev/log");</FONT>
<BR><FONT SIZE=2 FACE="Arial">udp(ip(0.0.0.0) port(514));</FONT>
<BR><FONT SIZE=2 FACE="Arial">internal();</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">But when i restart le syslog-ng on log proxy server</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">/etc/init.d/syslog-ng start</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">syslog-ng service starting.</FONT>
<BR><FONT SIZE=2 FACE="Arial">Error binding socket; addr='AF_UNIX(/dev/log)', error='Address already in use (125)'</FONT>
<BR><FONT SIZE=2 FACE="Arial">Error initializing source driver; source='local'</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">What is the problem ?</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">Best regards</FONT>
</P>
<P><FONT SIZE=2 FACE="Batang">Eric FELLMANN </FONT>
</P>
<BR>
</BODY>
</HTML>
<pre>____
This message and any files transmitted with it are legally privileged and intended for the sole use of the individual(s) or entity to whom they are addressed. If you are not the intended recipient, please notify the sender by reply and delete the message and any attachments from your system. Any unauthorised use or disclosure of the content of this message is strictly prohibited and may be unlawful.
Nothing in this e-mail message amounts to a contractual or legal commitment on the part of EUROCONTROL, unless it is confirmed by appropriately signed hard copy.
Any views expressed in this message are those of the sender.