<div dir="ltr">Maybe a local firewall/packet filter that is running on the Solaris 11 server? </div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 27, 2016 at 1:11 PM, Cottington-Bray, Ian <span dir="ltr"><<a href="mailto:ian.cottington-bray@mclaren.com" target="_blank">ian.cottington-bray@mclaren.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-GB" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">PS I restarted syslog-ng on one client system in the hope that it would prevent the client having issues – it made no difference.<u></u><u></u></span></p><span class="">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Ian<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<div>
<p class="MsoNormal"><b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray">Ian Cottington-Bray | Senior Infrastructure Engineer – Linux/Unix |</span></b><b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d">
</span></b><b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray">McLaren Technology Group Limited</span></b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d"><br>
</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray">McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d">
<br>
<br>
</span><b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red">T:</span></b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d">
</span><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray"> <a href="tel:%2B44%20%280%29%201483%20261%20900" value="+441483261900" target="_blank">+44 (0) 1483 261 900</a></span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red">D:</span></b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d">
</span><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray"> <a href="tel:%2B44%20%280%29%201483%20262%20357" value="+441483262357" target="_blank">+44 (0) 1483 262 357</a></span><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d"><br>
</span><b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red">E:</span></b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red"> </span><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray"><a href="mailto:ian.cottington-bray@mclaren.com" target="_blank">ian.cottington-bray@mclaren.com</a></span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red">W:</span></b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d">
</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d"><a href="http://www.mclaren.com/" target="_blank"><span lang="DE" style="color:gray">www.mclaren.com</span></a>
</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
</span><div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a> [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a>]
<b>On Behalf Of </b>Cottington-Bray, Ian<br>
<b>Sent:</b> 27 April 2016 12:07</span></p><div><div class="h5"><br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> Re: [syslog-ng] Switching the syslog-ng central server - client messages go missing<u></u><u></u></div></div><p></p>
</div>
</div><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Thanks for the feedback – had to wait for a period to test again.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Comments below<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray">Ian Cottington-Bray | Senior Infrastructure Engineer – Linux/Unix |</span></b><b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d">
</span></b><b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray">McLaren Technology Group Limited</span></b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d"><br>
</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray">McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d">
<br>
<br>
</span><b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red">T:</span></b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d">
</span><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray"> <a href="tel:%2B44%20%280%29%201483%20261%20900" value="+441483261900" target="_blank">+44 (0) 1483 261 900</a></span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red">D:</span></b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d">
</span><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray"> <a href="tel:%2B44%20%280%29%201483%20262%20357" value="+441483262357" target="_blank">+44 (0) 1483 262 357</a></span><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d"><br>
</span><b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red">E:</span></b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red"> </span><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray"><a href="mailto:ian.cottington-bray@mclaren.com" target="_blank">ian.cottington-bray@mclaren.com</a></span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red">W:</span></b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d">
</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1f497d"><a href="http://www.mclaren.com/" target="_blank"><span lang="DE" style="color:gray">www.mclaren.com</span></a>
</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">
<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@lists.balabit.hu</a> [<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">mailto:syslog-ng-bounces@lists.balabit.hu</a>]
<b>On Behalf Of </b>Scheidler, Balázs<br>
<b>Sent:</b> 21 April 2016 10:33<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>><br>
<b>Subject:</b> Re: [syslog-ng] Switching the syslog-ng central server - client messages go missing<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">hmm... couple of things come to mind, not all syslog-ng related:<u></u><u></u></p>
</div>
<p><u></u><span>1)<span style="font:7.0pt "Times New Roman"">
</span></span><u></u>are those messages actually arriving on the host (check with tcpdump)<u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Sometimes – I see network packets being sent some of the time (by the client) but not always<u></u><u></u></span></p>
</div>
<p><u></u><span>2)<span style="font:7.0pt "Times New Roman"">
</span></span><u></u>is the local firewall letting them through?<u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">There is no firewall on this network<u></u><u></u></span></p>
</div>
<p><u></u><span>3)<span style="font:7.0pt "Times New Roman"">
</span></span><u></u>is syslog-ng bound to a specific ip/port or it is bound to 0.0.0.0? (check that with netstat)<u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Specific IP/port (514) – several IPs in fact<u></u><u></u></span></p>
</div>
<p><u></u><span>4)<span style="font:7.0pt "Times New Roman"">
</span></span><u></u>you should be able to use telnet/netcat on the client host to check if the port on the solaris11 box is open<u></u><u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">The port is open<u></u><u></u></span></p>
</div>
<p style="margin-bottom:12.0pt">
<u></u><span style="color:#1f497d"><span>5)<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u>if all else fails, check the syslog-ng config, but that shouldn't be a problem<span style="color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">It looks OK to me ..<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">It almost looks like the client systems don’t send all the time – which is VERY strange and I’m struggling to understand why. The
client systems seem to send a few messages immediately after syslog-ng starts on the central server and then stop sending …
<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">If I shutdown the new server and bring up the old one the messages start appearing in the logs as I would expect.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Any suggestions ?<u></u><u></u></span></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Bazsi<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<div>
<div>
<p class="MsoNormal">-- <br>
Bazsi<u></u><u></u></p>
</div>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Wed, Apr 20, 2016 at 4:51 PM, Cottington-Bray, Ian <<a href="mailto:ian.cottington-bray@mclaren.com" target="_blank">ian.cottington-bray@mclaren.com</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal">Hi<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I have a Solaris 10 server running version 3.0 of syslog-ng.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I have built a new server running Solaris 11 with version 3.6 of syslog-ng installed.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I have tested the new server by pointing another client at it and messages appear in the configured files as expected.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I then shut down the Solaris 10 server – change the Solaris 11 server IP configuration to match the details for the Solaris 10 server – restart syslog-ng on the Solaris 11 server.
Things seem to be working ok – except for the (Solaris and Linux) clients using syslog-ng (and referencing the central syslog-ng server by IP) their messages do not arrive at the expected files.
<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Any suggestions ?<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Ian<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:gray">Ian Cottington-Bray | Senior Infrastructure Engineer – Linux/Unix |</span></b><b><span style="font-size:7.5pt;font-family:"Arial",sans-serif">
<span style="color:gray">McLaren Technology Group Limited</span></span></b><span style="font-size:7.5pt;font-family:"Arial",sans-serif"><br>
<span style="color:gray">McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK</span>
<br>
<br>
</span><b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red">T:</span></b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif">
<span style="color:gray"> <a href="tel:%2B44%20%280%29%201483%20261%20900" target="_blank">+44 (0) 1483 261 900</a></span></span><u></u><u></u></p>
<p class="MsoNormal"><b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red">D:</span></b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif">
<span style="color:gray"> <a href="tel:%2B44%20%280%29%201483%20262%20357" target="_blank">+44 (0) 1483 262 357</a></span><br>
<b><span style="color:red">E:</span></b><span style="color:red"> </span><span style="color:gray"><a href="mailto:ian.cottington-bray@mclaren.com" target="_blank">ian.cottington-bray@mclaren.com</a></span></span><u></u><u></u></p>
<p class="MsoNormal"><b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif;color:red">W:</span></b><span lang="DE" style="font-size:7.5pt;font-family:"Arial",sans-serif">
</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif"><a href="http://www.mclaren.com/" target="_blank"><span lang="DE" style="color:gray">www.mclaren.com</span></a>
</span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<p class="MsoNormal"><br clear="all">
The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it
from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited.
<br>
McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal"><br>
The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it
from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited.
<br>
McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715<u></u><u></u></p>
</div></div></div><div><div class="h5">
<br clear="both">
The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. <br>
McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715<br>
</div></div></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>