<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#0050d0">
Yes, you can do this. See
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<a
href="http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.2-guides/syslog-ng-ose-v3.2-guide-admin-en.html/index.html-single.html#chapter-log-statistics">http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.2-guides/syslog-ng-ose-v3.2-guide-admin-en.html/index.html-single.html#chapter-log-statistics</a><br>
Note the bit about sending "STATS" to the syslog control socket.
Look for the "stored" lines, these are what youre after. (can use
`nc -U` instead of socat as well)<br>
<br>
You could also use the stats on the server and alert when the source
counter stops incrementing.<br>
<br>
-Patrick<br>
<br>
<br>
Sent: Fri Nov 18 2011 18:54:13 GMT-0700 (MST)<br>
From: Paul Muther <a class="moz-txt-link-rfc2396E" href="mailto:dalamars@gmail.com"><dalamars@gmail.com></a><br>
To: <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a> <br>
Subject: [syslog-ng] Monitoring syslog-ng logserver
<blockquote
cite="mid:7D07A4DB-27CA-403E-BBBB-EE1F436EBA4C@gmail.com"
type="cite">
<pre wrap="">Greetings all,
I have a question about monitoring syslog-ng itself. In the event that the log server stops listening or stops processing for messages for whatever reason is there a way to alert on hosts that messages are being queued/buffered?
In a situation recently the log server syslog-ng process was running but not accepting log messages from remote hosts for some reason. As a result they all pilled up at the sources until the clients rolled over. It would be helpful to have an alert that it is happening but I can't find anything on monitoring the buffers.
Thanks much,
PM
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
</pre>
</blockquote>
</body>
</html>