Hi <br>I am new to syslog-ng and I have gone through other post to see if I can get a resolution to my problem.<br>Syslog is not writing to the destination file any messages received on udp() or tcp().<br>I have made sure that syslog server is receiving the syslog messages as seen from the tcpdump <br>
<br><br>15:09:55.422423 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.warning, length: 153<br>15:09:55.434638 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG <a href="http://local4.info">local4.info</a>, length: 184<br>
15:09:55.470383 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG <a href="http://local4.info">local4.info</a>, length: 176<br>15:09:55.473519 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG <a href="http://local4.info">local4.info</a>, length: 190<br>
15:09:55.493361 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG <a href="http://local4.info">local4.info</a>, length: 180<br>15:09:55.493748 IP aspsyslog.sungardebs.com.ssh > nim.sungardebs.com.42703: P 128608:129696(1088) ack 289 win 461 <nop,nop,timestamp 88706531 1310848493><br>
15:09:55.495519 IP 10.140.141.9.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG <a href="http://local4.info">local4.info</a>, length: 188<br>15:09:55.495548 IP 10.140.141.9.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.debug, length: 90<br>
15:09:55.495556 IP 10.140.141.9.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.debug, length: 85<br>15:09:55.521115 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG local4.debug, length: 87<br>
15:09:55.521188 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG <a href="http://local4.info">local4.info</a>, length: 188<br>15:09:55.522041 IP 10.140.141.6.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG <a href="http://local4.info">local4.info</a>, length: 175<br>
15:09:55.522212 IP 10.140.141.7.syslog > aspsyslog.sungardebs.com.syslog: SYSLOG <a href="http://local4.info">local4.info</a>, length: 164<br><br><br><br>Here is how my syslog-ng config looks.<br><br>@version: 3.0<br>#Default configuration file for syslog-ng.<br>
#<br># For a description of syslog-ng configuration file directives, please read<br># the syslog-ng Administrator's guide at:<br>#<br># <a href="http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/bk01-toc.html">http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/bk01-toc.html</a><br>
#<br><br>options {<br> chain_hostnames(no);<br> create_dirs (no);<br> dir_perm(0755);<br> dns_cache(no);<br> keep_hostname(yes);<br> log_fifo_size(2048);<br> log_msg_size(1024);<br> log_iw_size (500);<br>
long_hostnames(on);<br> perm(0644);<br> stats_freq(3600);<br> flush_lines(100);<br> time_reopen (10);<br> use_dns(no);<br> use_fqdn(yes);<br># max_connections(100);<br><br>};<br><br>source s_all {<br>
udp(so_rcvbuf(2048576));<br>tcp();<br>unix-stream("/dev/log");<br>internal();<br>file("/proc/kmsg");<br>};<br><br>destination d_file_normal {file("/var/log/messages_syslog-ng.log"); };<br><br>
log { source(s_all); destination (d_file_normal); };<br><br><br>Any help would be greatly appreciated. <br><br>Thanks<br><br><br><br><br><br>