September 2004 - syslog-ng - lists.balabit.hu

SIGHUP not working (Plz Help)
by Shahid Shafi 23 Sep '04

23 Sep '04

Hi guys, I am in slight trouble. I installed syslog-ng, configured my stuff and everything is working fine. I am using newsyslog to rotate logs file every 2 MB. newsyslog is invoked via cron and send HUP to the syslog-ng after rotating. File is rotated and compressed but the new file never got any log data again. I then had to restart the syslog-ng process and everyhting works normally after that. Can somebody help here? I am using syslogng 1.6.5 with libol 0.3.14 thx Shahid

2 2

RE: [syslog-ng]problem with different timezones
by ARGEXT-HIDALGO, FRANCISCO 23 Sep '04

23 Sep '04

>the problem with this is that bufferring happens at a later stage, after >the message is already formatted. Maybe you could achieve the same by >putting the received timestamp at the receiving syslog-ng. No, that's just what I need, to know when originally was recieved from the router, before it's buffered. So the $S_DATE and $R_DATE macros are the solution I was looking for, thank you very much. >-- >Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng]Problems with syslog-ng remote logging on Sun/Linu x environment!
by Loïc Minier 23 Sep '04

23 Sep '04

Jörgen Ekstedt <jorgen.ekstedt(a)hiq.se> - Thu, Sep 23, 2004: > I tried to look up if the connection is beeing made with netstat and > tcpdump, and at the first glance it seem to be the problem. Now I am not > that kind of network guru to really say that IS doesnt connect. I suggest saving the output of tcpdump/snoop to a file and open it with Ethereal. Regards, -- Loïc Minier <lool(a)dooz.org>

1 0

problem with different timezones
by ARGEXT-HIDALGO, FRANCISCO 23 Sep '04

23 Sep '04

I have the following situation: I have several logging servers in different timezones and these send all their information with TCP to a central logging server. What I don't understand is that when I recieve a log in the central log server I recieve the exact same line that appears in the log server that sent the log. The date isnt updated no matter if I use or not the use_time_recvd() option. The only solution I found was to use a template with the $DATE macro. That would be my first doubt, why use_time_recvd() doesn't work? My second doubt is, is there any macro for the time sent?, so I can have in the same log (on the central logging) the time sent and the time received, so I know if there was any delay. For example if the link went down and they were retained in the original server for a while. (the servers would be sync'ed in time) Thank you.

2 1

unsubscribe
by Wyner, Peter 23 Sep '04

23 Sep '04

1 0

AIX log workaround
by bedo.sandor＠ln.matav.hu 23 Sep '04

23 Sep '04

Hi, In an earlier version of syslog-ng's changelog I have read about a patch that workarounds the AIX's "Message from xy:" and "Forwarded from xy:" idiocy. In the version 1.6.x it seems to be not fixed. I store my lod data in separate files with the name containing $HOST, but 1.6.x substitues $HOST to the string "Message" by the AIX log lines. Am I something misanderstanding? Had that patch gone about somthing else? Is there any possibility to separate my hosts log data? Thanks, bSanyI

2 1

STATS: dropped N
by bedo.sandor＠ln.matav.hu 23 Sep '04

23 Sep '04

Hi, Could You tell me what is the measure exactly of the number at the end of the "STATS: dropped" log lines? I have really great numbers found... Thanks, bSanyI

3 2

Problems with syslog-ng remote logging on Sun/Linux environment!
by Jörgen Ekstedt 22 Sep '04

22 Sep '04

Hi! I have a loghos that is running RedHat9 and everything work just fine. except for one Sun we have in the network I have configured syslog-ng to include support for Doors and sun-streams,and it logs everything well to its local logfiles. I have configured it to send the logs via tcp to my loghost, but nothing is beeing sent? Anyone got any good hint ? BR Jorgen.E

2 1

Corrupted messages in log
by Dmitri Smirnov 22 Sep '04

22 Sep '04

syslog-ng 1.6.3, Solaris 8 with latest patches. Destination to file using templates, network and local sources, multiple filters. Started to receive multiple syslog messages from different hosts concatenated in one big syslog message .. Can be a result of new filters or increased load on syslog. Did anyone see anything like this? Dmitri

2 1

STATS: dropped 0
by Angelita Soares de Camargos 21 Sep '04

21 Sep '04

Hello everybody. I installed the syslog-ng 1.6.5, storing the logs in mysql 4.0.21 and it seems to be working fine, but sometimes I get this message at the log: "STATS: dropped 0". Reading older messages I understood that some log that did not match any of my filters and was flushed. Well, how can I know what message is it. Below, a part of my syslog-ng.conf: filter f_emerg { level(emerg); }; filter f_kern_info {facility(kern) and not priority(debug); }; filter f_user_info {facility(user) and not priority(debug); }; filter f_mail_info {facility(mail) and not priority(debug); }; filter f_daemon_info {facility(daemon) and not priority(debug); }; filter f_auth_info {facility(auth) and not priority(debug); }; filter f_cron_info {facility(cron) and not priority(debug); }; filter f_err {priority(err..emerg); }; filter f_messages{ not priority(debug); }; thanks in advance, Angel.

2 2