<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Sandor,<br>
<br>
Thanks for you response. <br>
<br>
The logs are generated on the same host. (Originally there were
separate hosts logging to this host, but we consolidated them onto the
single server.)<br>
<br>
Hmm. Just noticed that there seem to be two processes running!<br>
On further inspection one of them was reading the
/etc/syslog-ng/syslog-ng.conf file and the other must have been reading
the one in <br>
/opt/syslog-ng/etc/syslog-ng.conf<br>
<br>
I put <br>
SYSLOGNG_OPTIONS="$SYSLOGNG_OPTIONS --cfgfile
/etc/syslog-ng/syslog-ng.conf"<br>
<br>
in /etc/default/syslog-ng and it seems to be working now. <br>
<br>
Well, actually, every 20 minutes now getting messages saying<b><br>
Nov 2 21:21:01 domU-12-31-39-07-3D-F1 -- MARK --<br>
</b><br>
And am able to turn it off with mark_freq(0).<br>
<br>
Okay, everything's good.<br>
<br>
Thanks.<br>
<br>
Liam<br>
<br>
<br>
<br>
Sandor Geller wrote:
<blockquote
cite="mid:AANLkTimLB6vLHYc3aCaF2ru7r+PyvntLdFWBxAQf-4c5@mail.gmail.com"
type="cite">
<pre wrap="">I'm filtering statistical messages based on the internal source and
the following regexp:
filter f_internal_statistics {
match("^syslog-ng\[[[:digit:]]+\]: STATS") or match
("^syslog-ng\[[[:digit:]]+\]: Log statistics");
};
(for 3.x only the latter match is needed)
600 seconds is the default setting, the timer gets activated only when
stats_freq > 0 so stats_freq(0) should turn off the generation of
statistical messages completely. Are the logs generated on the same
host or are you processing remote logs as well?
On Sat, Oct 30, 2010 at 10:17 PM, Liam Kirsher <a class="moz-txt-link-rfc2396E" href="mailto:liamk@numenet.com"><liamk@numenet.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">My log file is filling up with statistics messages from syslog-ng (v.
3.1.2) , one message every 10 minutes.
I tried turning it off by putting stats_freq(0) in the options clause,
and restarted the syslog-ng daemon but that seems to have no effect.
There must be something obvious I'm missing.
--
Liam Kirsher
PGP: <a class="moz-txt-link-freetext" href="http://liam.numenet.com/pgp/">http://liam.numenet.com/pgp/</a>
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<pre wrap=""><!---->______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Liam Kirsher
PGP: <a class="moz-txt-link-freetext" href="http://liam.numenet.com/pgp/">http://liam.numenet.com/pgp/</a>
</pre>
</body>
</html>