<div dir="ltr"><span style="font-family:arial,sans-serif;font-size:12.727272033691406px">So here was the issue.</span><div style="font-family:arial,sans-serif;font-size:12.727272033691406px">having udp(so_rcvbuf(1024000) in the syslog-ng conf was creating the issue.</div>
<div style="font-family:arial,sans-serif;font-size:12.727272033691406px">when i commented this it would have visibility only to the logs specificly forwarded to it..</div><div style="font-family:arial,sans-serif;font-size:12.727272033691406px">
<br></div><div style="font-family:arial,sans-serif;font-size:12.727272033691406px">And talking about log rotation, </div><div style="font-family:arial,sans-serif;font-size:12.727272033691406px">Any ideas other than using $YEAR/$MONTH/ basically date parameters to rotate logs on and successfully have crons to delete them?</div>
<div style="font-family:arial,sans-serif;font-size:12.727272033691406px"><br></div><div style="font-family:arial,sans-serif;font-size:12.727272033691406px">regards</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Wed, Mar 5, 2014 at 11:58 PM, Evan Rempel <span dir="ltr"><<a href="mailto:erempel@uvic.ca" target="_blank">erempel@uvic.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
We do exactly what you describe without any issues.<br>
<br>
Strictly a config issue, so you could attach your config file(s) so I can have a look.<br>
<div class="im HOEnZb"><br>
On 03/04/2014 10:23 PM, Shashank Rohatgi wrote:<br>
> i was able to run the second instance with all three parameters but I am more confused..<br>
> The intent was to reroute messages from production instance to dev instances on the same machine and take out a selected steam of logs on a different port.<br>
> rather than just the selected stream the second instance can see all the logs. Both the instances are listening on different ports.<br>
><br>
> Port 514- gets logs from two products (say windows and unix) i write Windows to disk and route the unix logs on say port 517 (to second instance)<br>
> Second instance is configure to write anything that it receives to a file.<br>
> To my surprise the above file has logs for Windows and there is no network exchange at all.<br>
><br>
> Could it be that the second instance internally confusing sources and destinations?<br>
</div><div class="HOEnZb"><div class="h5">______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</div></div></blockquote></div><br></div>