<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 2 6 3 5 4 5 2 3 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:527446119;
mso-list-type:hybrid;
mso-list-template-ids:1214935134 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1
{mso-list-id:854929631;
mso-list-type:hybrid;
mso-list-template-ids:370434628 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.75in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.25in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.75in;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.25in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.75in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.25in;
text-indent:-.25in;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.75in;
text-indent:-.25in;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.25in;
text-indent:-.25in;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.75in;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">We are in the middle of a project to Migrate from 3.0 to 3.16 (latest in redhat distro)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The standard 3.14 config works fine writing to some standard logs in /var/log<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">But we need to write special files to /opt/log/
<o:p></o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-size:11.0pt">In this directory will be a file type pipe to be read by a syslog probe (parse messages into alerts). Using the following configuration NG returns unable
to write.<o:p></o:p></span></li></ul>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt">source s_dgram<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt"> { unix-dgram("/dev/log"); };<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt">source s_kernel<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt"> { file("/proc/kmsg" program_override("kernel: ")); };<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt">source s_udp<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt"> { udp(); };<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt">destination netcool { pipe("/var/log/nco.pipe"); };<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt">log { source(s_dgram);<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt"> source(s_kernel);<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt"> source(s_udp); filter(f_NOfwflow);<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt"> filter(f_NOdata_cent);<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt"> filter(f_NOtacacs);<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:1.0in"><span style="font-size:11.0pt"> filter(f_netcool); destination(netcool); };<o:p></o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-size:11.0pt">Even if I remove the filter I get the same error.<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-size:11.0pt">Also removed all of the sources with the exception of the upd and got the same error.<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-size:11.0pt">Changed the file type to file and getting:<o:p></o:p></span></li><ul style="margin-top:0in" type="circle">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level2 lfo1"><span style="font-size:11.0pt">OLLERR occurred while idle; fd='66'<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level2 lfo1"><span style="font-size:11.0pt">Apr 9 13:17:45 wbucrp-isdmz1a-lb err syslog-ng[2475]: Connection broken; time_reopen='60'<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level2 lfo1"><span style="font-size:11.0pt">Apr 9 13:17:47 wbucrp-isdmz1b-lb err syslog-ng[10934]: POLLERR occurred while idle; fd='66'<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level2 lfo1"><span style="font-size:11.0pt">Apr 9 13:17:47 wbucrp-isdmz1b-lb err syslog-ng[10934]: Connection broken; time_reopen='60'<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level2 lfo1"><span style="font-size:11.0pt">Apr 9 13:17:51 wapcrp-isdmz0a-lb err syslog-ng[3713]: I/O error occurred while writing; fd='38', error='Connection refused (111)'<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level2 lfo1"><span style="font-size:11.0pt">Apr 9 13:17:51 wapcrp-isdmz0a-lb err syslog-ng[3713]: Connection broken; time_reopen='60'<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level2 lfo1"><span style="font-size:11.0pt">Apr 9 13:17:51 wapcrp-isdmz0a-lb notice syslog-ng[3713]: Suspending write operation because of an I/O error; fd='38', time_reopen='60'<o:p></o:p></span></li></ul>
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-size:11.0pt">The permissions in /opt/log are 777 and owned by root which is the user syslog-ng is running under.<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-size:11.0pt">Also change the path to where the config was updating file (/varr/log) and attemted to create the pipe and no luck
<o:p></o:p></span></li></ul>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Here are my global options:<o:p></o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt">options {<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt"> flush_lines (0);<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt"># time_reopen (10);<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt"> log_fifo_size (1000);<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt"> chain_hostnames (on);<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt"> use_dns (yes); ## changed test<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt"> use_fqdn (yes);<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt"> keep_hostname (yes);<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt"> owner("root");<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt"> group("root");<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt"> create_dirs(yes); #Test<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt"> dir_perm(0755);<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt"> perm(0644);<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:.25in;mso-list:l1 level1 lfo2"><span style="font-size:11.0pt">};<o:p></o:p></span></li></ul>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">ANY Ideas? <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Miguel<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><img width="142" height="36" style="width:1.4791in;height:.375in" id="Picture_x0020_2" src="cid:image001.jpg@01D4EEB7.EF71DE70" alt="miki1"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:black">Miguel A Aguilu</span></b><span style="font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:black">Netcool Suite SME</span></b><span style="font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:black">Walt Disney Account</span></b><span style="font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:black">Atos Consulting</span></b><span style="font-size:11.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Mobile: (321) 261-1385<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">1120 Celebration Blvd<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Celebration, FL 34747<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><a href="mailto:Craig.Elliott@Atos.net"><span style="color:#0B4CB4">Miguel.Aguilu@Atos.net</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><a href="http://www.atos.net/"><span style="color:#0B4CB4">www.atos.net</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><img border="0" width="152" height="44" style="width:1.5833in;height:.4583in" id="Picture_x0020_1" src="cid:image002.gif@01D4EEB7.EF71DE70" alt="/Users/aguim114/Library/Containers/com.microsoft.Outlook/Data/Library/Caches/Signatures/signature_1691773396"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:red">Upcoming PTO: TBD</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately
and destroy it. As its integrity cannot be secured on the Internet, the Atos group liability cannot be triggered for the message content. Although the sender endeavors to maintain a computer virus-free network, the sender does not warrant that this transmission
is virus-free and will not be liable for any damages resulting from any virus transmitted.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>