<div>Joe, thanks for the update. Yes, that is the directory name. Now regarding the "file", I will start a little more reading, but I don't think I would have to do this for each file right? This server (along with the others in the cluster) have 12 or so virtual sites, each with it's own access and error log, so that would be at least 24 'file' sources. Is there a way to wildcard it? <br>
</div><div><br>Also, (I know this too is a basic Q) but are these defined on the server/client or both? I still don't see how they mesh, but soon, oh soon when that light comes on!</div><div><br>Thanks</div><br><div class="gmail_quote">
On Mon, Jul 20, 2009 at 8:38 PM, Fegan, Joe <span dir="ltr"><<a href="mailto:Joe.Fegan@hp.com">Joe.Fegan@hp.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div>
<div dir="ltr" align="left"><span><font face="Arial" color="#0000ff" size="2">I'm no apache expert, but I
think /var/log/apache2 is the name of a directory that contains apache log
files, right? But you have defined it as a unix-stream
source:</font></span></div>
<div dir="ltr" align="left"> </div>
<div dir="ltr" align="left"><span>source inputs {
internal();<br>
unix-stream("/var/log/apache2");<br>
udp();<br>
tcp(max_connections(100)); };<br><br><font face="Arial" color="#0000ff" size="2">unix-stream is for reading a socket, not a directory, so this can't
work...</font></span></div>
<div dir="ltr" align="left"> </div>
<div dir="ltr" align="left"><span><font face="Arial" color="#0000ff" size="2">You can use "file" sources for individual files in that
directory..</font></span></div><br>
<div lang="en-us" dir="ltr" align="left">
<hr>
<font face="Tahoma" size="2"><b>From:</b> <a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>
[mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>] <b>On Behalf Of </b>lance
raymond<br><b>Sent:</b> 20 July 2009 21:52<br><b>To:</b> Syslog-ng users' and
developers' mailing list<br><b>Subject:</b> Re: [syslog-ng] Before the basic 101
questions<br></font><br></div><div><div class="h5">
ok, here is the update. I have built a standalone ubuntu box to be
the central server so now have that I can 'play' with. It's a clean
install,and really not sure what to do as this list seems to be the best
resource. So, I would think you can specify 'a' logfile, but I need ALL
the apache logs centrally located, so going to say, take everything from
/var/log/apache2 and send it to the central log server. <br><br>The
central log server as I said is a default setup, due to size, I copied them up
to a play webserver, the server can be seen here;<br><a href="http://www.darkerforce.com/server.conf" target="_blank">server.conf</a> <br>and the client
here (the only thing changed is the remote IP)<br><a href="http://www.darkerforce.com/client.conf" target="_blank">client.conf</a><br><br>When left
like that and syslog-ng is started on the client I get the
following;<br><br>Error binding socket; addr='AF_UNIX(/var/log/apache2)',
error='Address already in use (98)'<br>Error initializing source driver;
source='inputs'<br><br>As I said before, I am not looking for anything complex,
etc. Just want ALL the weblogs to goto one box which is really the
function of syslog-ng. I am sure there is one or two things that need a
tweak, and I can go from there.<br><br>Thanks.<br><br><br>
<div class="gmail_quote">On Wed, Jul 15, 2009 at 3:45 AM, Sandor Geller <span dir="ltr"><<a href="mailto:Sandor.Geller@morganstanley.com" target="_blank">Sandor.Geller@morganstanley.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="padding-left:1ex;margin:0pt 0pt 0pt 0.8ex;border-left:rgb(204,204,204) 1px solid">Hi,<br>
<div><br>On Tue, Jul 14, 2009 at 10:06 PM, lance raymond<<a href="mailto:lance.raymond@gmail.com" target="_blank">lance.raymond@gmail.com</a>> wrote:<br>> What I thought of
was to make each file unique;<br>> ws = webserver;<br>><br>>
ws1.domain.com-access_log<br>> ws2.domain.com-access_log<br>><br>>
and just write them each to an nfs share.<br><br></div>It'd not the name of
the files which matter. When a single process<br>(like syslog-ng) writes to a
file then NFS behaves well. The problems<br>start when there are multiple
processes trying to access the same<br>file. Disabling attribute caching in
the NFS client could help, but<br>this could have a big impact on
performance.<br>
<div><br>> Not flaming the group at all, actually Bazsi your name shows up
more than<br>> any of my normal mail :) But, I have tried twice
with a reply or two, and<br>> once conf files were sent up and/or shown the
thread died. I see some very<br>> intersting questions, answers on
the group and it would be nice to see some<br>> of these things, but
really, I am talking about a handful of webservers<br>> (nothing fancy)
just to write to a central log and it's not working. The<br>> basic
syslog @server worked perfect, since the platform updates, just not<br>>
working, but I appreciate the reply.<br><br></div>So could you please tell
what is the actual problem?<br><br>Regards,<br><font color="#888888"><br>Sandor<br></font>
<div>
<div>______________________________________________________________________________<br>Member
info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Documentation:
<a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>FAQ:
<a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br><br></div></div></blockquote></div><br></div></div></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
<br></blockquote></div><br>