<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">You keep referring to /opt/log but
your configuration is for /var/log/nco.pipe</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt">destination netcool {
pipe("/var/log/nco.pipe"); };</span></p>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Is this a simple typo?<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 4/9/19 6:38 AM, Aguilu, Miguel
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:18572059-ADEC-4D2B-B1EA-B40B9D4DA228@contoso.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]-->
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:527446119;
mso-list-type:hybrid;
mso-list-template-ids:1214935134 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1
{mso-list-id:854929631;
mso-list-type:hybrid;
mso-list-template-ids:370434628 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.75in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.25in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.75in;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.25in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.75in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.25in;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.75in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.25in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.75in;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">We are in
the middle of a project to Migrate from 3.0 to 3.16 (latest
in redhat distro)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The standard
3.14 config works fine writing to some standard logs in
/var/log<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">But we need
to write special files to /opt/log/
<o:p></o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level1 lfo1"><span
style="font-size:11.0pt">In this directory will be a file
type pipe to be read by a syslog probe (parse messages
into alerts). Using the following configuration NG returns
unable to write.<o:p></o:p></span></li>
</ul>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt">source s_dgram<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt"> { unix-dgram("/dev/log"); };<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt">source s_kernel<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt"> { file("/proc/kmsg"
program_override("kernel: ")); };<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt">source s_udp<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt"> { udp(); };<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt">destination netcool {
pipe("/var/log/nco.pipe"); };<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt">log { source(s_dgram);<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt"> source(s_kernel);<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt"> source(s_udp);
filter(f_NOfwflow);<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt">
filter(f_NOdata_cent);<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt">
filter(f_NOtacacs);<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span
style="font-size:11.0pt">
filter(f_netcool); destination(netcool);
};<o:p></o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level1 lfo1"><span
style="font-size:11.0pt">Even if I remove the filter I get
the same error.<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level1 lfo1"><span
style="font-size:11.0pt">Also removed all of the sources
with the exception of the upd and got the same error.<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level1 lfo1"><span
style="font-size:11.0pt">Changed the file type to file and
getting:<o:p></o:p></span></li>
<ul style="margin-top:0in" type="circle">
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level2 lfo1"><span
style="font-size:11.0pt">OLLERR occurred while idle;
fd='66'<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level2 lfo1"><span
style="font-size:11.0pt">Apr 9 13:17:45
wbucrp-isdmz1a-lb err syslog-ng[2475]: Connection
broken; time_reopen='60'<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level2 lfo1"><span
style="font-size:11.0pt">Apr 9 13:17:47
wbucrp-isdmz1b-lb err syslog-ng[10934]: POLLERR occurred
while idle; fd='66'<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level2 lfo1"><span
style="font-size:11.0pt">Apr 9 13:17:47
wbucrp-isdmz1b-lb err syslog-ng[10934]: Connection
broken; time_reopen='60'<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level2 lfo1"><span
style="font-size:11.0pt">Apr 9 13:17:51
wapcrp-isdmz0a-lb err syslog-ng[3713]: I/O error
occurred while writing; fd='38', error='Connection
refused (111)'<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level2 lfo1"><span
style="font-size:11.0pt">Apr 9 13:17:51
wapcrp-isdmz0a-lb err syslog-ng[3713]: Connection
broken; time_reopen='60'<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level2 lfo1"><span
style="font-size:11.0pt">Apr 9 13:17:51
wapcrp-isdmz0a-lb notice syslog-ng[3713]: Suspending
write operation because of an I/O error; fd='38',
time_reopen='60'<o:p></o:p></span></li>
</ul>
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level1 lfo1"><span
style="font-size:11.0pt">The permissions in /opt/log are
777 and owned by root which is the user syslog-ng is
running under.<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:0in;mso-list:l0 level1 lfo1"><span
style="font-size:11.0pt">Also change the path to where the
config was updating file (/varr/log) and attemted to
create the pipe and no luck
<o:p></o:p></span></li>
</ul>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Here are my
global options:<o:p></o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt">options {<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt"> flush_lines (0);<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt"># time_reopen (10);<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt"> log_fifo_size (1000);<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt"> chain_hostnames (on);<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt"> use_dns (yes); ## changed
test<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt"> use_fqdn (yes);<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt"> keep_hostname (yes);<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt"> owner("root");<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt"> group("root");<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt"> create_dirs(yes); #Test<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt"> dir_perm(0755);<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt"> perm(0644);<o:p></o:p></span></li>
<li class="MsoListParagraph"
style="margin-left:.25in;mso-list:l1 level1 lfo2"><span
style="font-size:11.0pt">};<o:p></o:p></span></li>
</ul>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">ANY
Ideas? <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Miguel<o:p></o:p></span></p>
</div>
</blockquote>
<br>
<pre class="moz-signature" cols="500">--
Evan </pre>
</body>
</html>