Yea, I got a bunch;<br>COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME<br>apache2 692 www-data 35w REG 8,1 100778670 2089232 /var/log/apache2/ws8.iwindsurf.com-access_log<br><br>as just an example, and now that I am looking at it, I think I see the obvious. I haven't changed apache to stop writing local (I didn't think I had to) as I thought I could have the local and the remote (in case the remote failed). But that might not be the case.<br>
<br>So I would assume the first step is to remove the vhost access log line. But now that I am thinking, the setup said what file was the local file in which it would be the /var/log/apache2/.... right? So if I tell apache not to write that access file how do you setup the client ?<br>
<br>As I said, really new at this, so sorry if this seems basic, but the webmin module made it kinda easier, but still ... not easy enough!<br><br>Thanks<br><br><div class="gmail_quote">On Fri, Jun 5, 2009 at 10:53 AM, Fegan, Joe <span dir="ltr"><<a href="mailto:Joe.Fegan@hp.com">Joe.Fegan@hp.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div dir="ltr" align="left"><span><font size="2" color="#0000ff" face="Arial">That looks like a bind() error message which suggests that
another process is already listening on the socket in question. Use lsof to find
out which process that is.</font></span></div>
<div dir="ltr" align="left"><span><font size="2" color="#0000ff" face="Arial"></font></span> </div>
<div dir="ltr" align="left"><span><font size="2" color="#0000ff" face="Arial"># lsof
/var/log/apache2/ws8.mydomain.com-access_log</font></span></div><br>
<div dir="ltr" align="left" lang="en-us">
<hr>
<font size="2" face="Tahoma"><b>From:</b> <a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>
[mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>] <b>On Behalf Of </b>lance
raymond<br><b>Sent:</b> 04 June 2009 18:11<br><b>To:</b>
<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br><b>Subject:</b> [syslog-ng] New to syslog-ng,
basic setup help reuqested<br></font><br></div><div><div></div><div class="h5">
<div></div>Afternoon, looking to do some real basic logging for our
webservers. They are all running ubuntu-server 8.10, and I have a
standalone box which will act as the 'log server'. They have webmin
installed, so I setup using that as it seemed pretty straight forward.
<br><br>So the server is running and when I start one of the webservers which I
configured, I recive the following error;<br> * Starting system logging
syslog-ng Error binding socket;
addr='AF_UNIX(/var/log/apache2/ws8.mydomain.com-access_log)', error='Address
already in use (98)'<br><br>I thought it might be due to apache running, so
stopped that, but still the same error.<br><br><br>the conf file is HUGE, and
95% is a stock install, so I will just put what the client / server has that is
specific to this item I wish to remote log.<br><br>Client:<br>destination
WFLogger {<br> udp(192.168.2.60);<br> };<br>source domain_access
{<br> unix-stream("/var/log/apache2/ws8.domain.com-access_log");<br>
};<br>log {<br> source(domain_access);<br>
destination(WFLogger);<br> flags(catchall);<br> };<br><br>On the
server, I don't see anything that stands out that say's "accept connections" so
not sure if there is anything special that has to be done, but the error on the
client is immediate so that part seems to be a local
issue.<br><br>Thanks<br><br></div></div></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
<br></blockquote></div><br>