<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3562" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=531142900-21072009><FONT face=Arial
color=#0000ff size=2>I'm no apache expert, but I
think /var/log/apache2 is the name of a directory that contains apache log
files, right? But you have defined it as a unix-stream
source:</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=531142900-21072009><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=531142900-21072009>source inputs {
internal();<BR>
unix-stream("/var/log/apache2");<BR>
udp();<BR>
tcp(max_connections(100)); };<BR><BR><FONT face=Arial color=#0000ff
size=2>unix-stream is for reading a socket, not a directory, so this can't
work...</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=531142900-21072009><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=531142900-21072009><FONT face=Arial
color=#0000ff size=2>You can use "file" sources for individual files in that
directory..</FONT></SPAN></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> syslog-ng-bounces@lists.balabit.hu
[mailto:syslog-ng-bounces@lists.balabit.hu] <B>On Behalf Of </B>lance
raymond<BR><B>Sent:</B> 20 July 2009 21:52<BR><B>To:</B> Syslog-ng users' and
developers' mailing list<BR><B>Subject:</B> Re: [syslog-ng] Before the basic 101
questions<BR></FONT><BR></DIV>
<DIV></DIV>ok, here is the update. I have built a standalone ubuntu box to be
the central server so now have that I can 'play' with. It's a clean
install,and really not sure what to do as this list seems to be the best
resource. So, I would think you can specify 'a' logfile, but I need ALL
the apache logs centrally located, so going to say, take everything from
/var/log/apache2 and send it to the central log server. <BR><BR>The
central log server as I said is a default setup, due to size, I copied them up
to a play webserver, the server can be seen here;<BR><A
href="http://www.darkerforce.com/server.conf">server.conf</A> <BR>and the client
here (the only thing changed is the remote IP)<BR><A
href="http://www.darkerforce.com/client.conf">client.conf</A><BR><BR>When left
like that and syslog-ng is started on the client I get the
following;<BR><BR>Error binding socket; addr='AF_UNIX(/var/log/apache2)',
error='Address already in use (98)'<BR>Error initializing source driver;
source='inputs'<BR><BR>As I said before, I am not looking for anything complex,
etc. Just want ALL the weblogs to goto one box which is really the
function of syslog-ng. I am sure there is one or two things that need a
tweak, and I can go from there.<BR><BR>Thanks.<BR><BR><BR>
<DIV class=gmail_quote>On Wed, Jul 15, 2009 at 3:45 AM, Sandor Geller <SPAN
dir=ltr><<A href="mailto:Sandor.Geller@morganstanley.com"
target=_blank>Sandor.Geller@morganstanley.com</A>></SPAN> wrote:<BR>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">Hi,<BR>
<DIV><BR>On Tue, Jul 14, 2009 at 10:06 PM, lance raymond<<A
href="mailto:lance.raymond@gmail.com"
target=_blank>lance.raymond@gmail.com</A>> wrote:<BR>> What I thought of
was to make each file unique;<BR>> ws = webserver;<BR>><BR>>
ws1.domain.com-access_log<BR>> ws2.domain.com-access_log<BR>><BR>>
and just write them each to an nfs share.<BR><BR></DIV>It'd not the name of
the files which matter. When a single process<BR>(like syslog-ng) writes to a
file then NFS behaves well. The problems<BR>start when there are multiple
processes trying to access the same<BR>file. Disabling attribute caching in
the NFS client could help, but<BR>this could have a big impact on
performance.<BR>
<DIV><BR>> Not flaming the group at all, actually Bazsi your name shows up
more than<BR>> any of my normal mail :) But, I have tried twice
with a reply or two, and<BR>> once conf files were sent up and/or shown the
thread died. I see some very<BR>> intersting questions, answers on
the group and it would be nice to see some<BR>> of these things, but
really, I am talking about a handful of webservers<BR>> (nothing fancy)
just to write to a central log and it's not working. The<BR>> basic
syslog @server worked perfect, since the platform updates, just not<BR>>
working, but I appreciate the reply.<BR><BR></DIV>So could you please tell
what is the actual problem?<BR><BR>Regards,<BR><FONT
color=#888888><BR>Sandor<BR></FONT>
<DIV>
<DIV></DIV>
<DIV>______________________________________________________________________________<BR>Member
info: <A href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"
target=_blank>https://lists.balabit.hu/mailman/listinfo/syslog-ng</A><BR>Documentation:
<A href="http://www.balabit.com/support/documentation/?product=syslog-ng"
target=_blank>http://www.balabit.com/support/documentation/?product=syslog-ng</A><BR>FAQ:
<A href="http://www.campin.net/syslog-ng/faq.html"
target=_blank>http://www.campin.net/syslog-ng/faq.html</A><BR><BR></DIV></DIV></BLOCKQUOTE></DIV><BR></BODY></HTML>