<div>On Fri, May 14, 2010 at 2:27 AM, Андрей <span dir="ltr"><<a href="mailto:dukenukem@vpcit.ru">dukenukem@vpcit.ru</a>></span> wrote:</div><div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
I'm using syslog-ng to collect logs from different devices and everything is<br>
Ok - all log files and directories are created and being written, except<br>
syslog log files - they are just empty (e.g. /var/log/hostname/syslog size is<br>
zero). Here is my config:<br>
<br>
monitoring:~# cat /etc/syslog-ng/syslog-ng.conf<br>
@version: 3.0<br>
#<br>
# Syslog-ng configuration file, compatible with default Debian syslogd<br>
# installation. Originally written by anonymous (I can't find his name)<br>
# Revised, and rewrited by me (SZALAY Attila <<a href="mailto:sasa@debian.org">sasa@debian.org</a>>)<br></blockquote><div>... </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
destination d_syslog { file("/var/$HOST/log/syslog" suppress(15)); };</blockquote></div><br clear="all">Hi,<div><br></div><div>You've got your destination path wrong, it's pointed to /var/$hostname/log instead of /var/log/$hostname. Here take a look:</div>
<div><br></div><div>Change it to this:</div><div><font class="Apple-style-span" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse; "><span class="Apple-style-span" style="font-size: 13px; ">destination d_syslog { file("/var/log/$HOST/syslog" suppress(15)); };</span></span></font></div>
<div><font class="Apple-style-span" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse; "><span class="Apple-style-span" style="font-size: 13px; "><br></span></span></font></div><div>
<font class="Apple-style-span" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse; "><span class="Apple-style-span" style="font-size: 13px; ">You likely now have a whole bunch of /var/hostname directories in /var :), you might want to 'cp -ar' them to /var/log after fixing your config.</span></span></font></div>
<div><font class="Apple-style-span" face="arial, sans-serif"><span class="Apple-style-span" style="border-collapse: collapse; "><span class="Apple-style-span" style="font-size: 13px; "><br></span></span></font></div>-- <br>
Lance Laursen<br>Demonware Systems Engineer<br>
</div>