April 2006 - syslog-ng - lists.balabit.hu

Growing log files (i.e. access.log) and regex.
by Robert.Becker＠motoristsgroup.com 08 Mar '07

08 Mar '07

Here's the scenario. We have a JBoss server that outputs to *.log files. After doing all the research I could, I found out the only way to get these logs sent to syslog-ng was through a tail & logger command. The problem with that is logger appends the date and some other information to that logged message. When attempting to put that information in a mysql database I'm getting errors. So, what I would like to do is use some form of regex to alter the statement so it can be inserted into a database. There are basically two things that need to be changed. First, logger appends the date/time it receives the message and it also says it is coming from logger. I would like to remove that date and switch logger to jboss or something similar. Here is an example of what I am doing. This is a line from the jboss log file: 2005-10-11 13:14:15,848 DEBUG [org.jboss.resource.connectionmanager.IdleRemover] run: IdleRemover notifying pools, interval: 450000 Then I send the log through logger to syslog-ng: #!/bin/sh tail -f /opt/jboss/server/default/log/boot.log | logger -p local7.info The log gets turned into this: Oct 11 13:14:15 src@linuxp17 logger: 2005-10-11 13:14:15,848 DEBUG [org.jboss.resource.connectionmanager.IdleRemover] run: IdleRemover notifying pools, interval: 450000 What I need is: Oct 11 13:14:15 src@linuxp17 jboss: DEBUG [org.jboss.resource.connectionmanager.IdleRemover] run: IdleRemover notifying pools, interval: 450000 Now, I've thought of using awk in the tail/logger script to remove the date, but that does not take care of the logger/jboss substitution. Anyone have any ideas? Can syslog-ng do this with the match() function? -Rob Becker Systems Engineer Motorists Insurance ********************************************************************** The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error or there are any problems please notify the originator immediately. The unauthorized use, disclosure, copying or alteration of this message is strictly forbidden. Motorists Insurance Group will not be liable for direct, special, indirect or consequential damages arising from the alteration of the contents of this message by a third party or as a result of any virus being passed on. **********************************************************************

6 5

ignore src{}; contents at startup?
by Brian A. Seklecki 25 Oct '06

25 Oct '06

All: On FreeBSD, /dev/klog provides for output from the kernel (normally redirected to /dev/console before syslog starts). At startup, /etc/rc.d/dmesg copies the kernel boot hardware paramters to /var/run/dmesg.boot. If I have my src(); set to: source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; ...at starup, syslog-ng drains the contents of /dev/klog. By default it tsends to them to user.notice. I like to log{} these to an SMS pager (so I know if a RAID is failing or other hardware problem). However, I'd like to avoid duplication of the efforts of /etc/rc.d/dmesg on behalf of syslog-ng(8) ...especially since I route user.notice to my pager, and kernel boot dmesg(8) can grow over 50 lines. /dev/klog really isn't a socket. It's a special char device. Is there anyway to tell syslog-ng(8) to ignore it's contents at startup? If it was tail(1), i'd say "tail -0 -f /file". Perhaps clear out the contents of /dev/klog somehow? TIA, ~BAS

2 2

syslog-ng blocking on read() from /proc/kmsg
by John Morrissey 07 May '06

07 May '06

I'm running the Debian 1.6.9-1 package with the 'read from each file descriptor n times or until EAGAIN' patch backported. There seems to be a problem with this behavior when it's applied to /proc/kmsg. Here's the source we use: source s_kmsg { file("/proc/kmsg" log_prefix("kernel: ")); }; What happens is: 1. syslog-ng calls poll(2) and waits. 2. Data appears on /proc/kmsg and causes poll() to return. 3. syslog-ng read(2)s from /proc/kmsg, grabbing some data. 4. Since it hasn't received EAGAIN or read n times from this file descriptor, syslog-ng happily read()s again. Since it's exhausted the available data, the read() blocks. Forever. 5. Meanwhile, other syslog traffic to /dev/log piles up. Eventually, whatever buffer there is on Unix domain sockets fills up and causes other applications on the machine to block, waiting to syslog. 6. The box eventually runs out of file descriptors since other processes (cron is a big culprit because it runs jobs so often) are piling up, holding onto file descriptors and blocking on writes to /dev/log. The blocking behavior on /proc/kmsg is interesting, since if I'm reading the source correctly, file sources are set O_NONBLOCK: affile.c: 152 static int do_init_affile_source(struct log_handler *c, struct syslog_con 153 { 154 CAST(affile_source, self, c); 155 int fd, flags; 156 157 if (self->flags & AFFILE_PIPE) 158 flags = O_RDWR | O_NOCTTY | O_NONBLOCK | O_LARGEFILE; 159 else 160 flags = O_RDONLY | O_NOCTTY | O_NONBLOCK | O_LARGEFILE; Any thoughts? thanks, john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

2 2

TTL patch, helpful for multicasting logs
by Alexander Clouter 04 May '06

04 May '06

Hi, After my earlier multicast patch I quickly realised that if syslog-ng is actually sending UDP multicast syslog data the TTL on the IP packets is by default 1. This results in the packet being expired at the gateway and never being able to leave the subnet....not too handy :( After clobbering it around for a few days I have rolled out this patch to address the problem which should be applied in addition, and after, the multicast patch I released the other day (also re-included in this email). The patch adds a new parameter to the destination tcp()/udp() drivers called ttl() and it takes a number between 0 and 255. When set to zero, it uses the default kernel parameter[1] but when set to 1->255 the TTL on the packet being sent is set to this. Of course if the parameter is not specified it defaults to zero. This should now allow you to use destination du_moo { udp("239.1.2.3" port(514) ttl(7)); }; in your config files. It works on unicast traffic too, I guess you could use it as a layer of defence to guarentee that your syslog packets never leave your network by setting the TTL to a low value. I always wanted to get around to emailing the samba folk a TTL patch to do this sort of thing, so roaming samba laptop users could get some feeling of security that only the local network can get access to their shares....however this is now getting a bit offtopic :) Hope you all find it useful, now back to my multicasting syslog cluster :) Cheers Alex [1] under linux its one, and probably the same for most OS's

2 5

Re: HP-UX pipe read errors
by Andy G. 01 May '06

01 May '06

On 04/25/06 09:08, Andrew Gill wrote: > Hello, > > I'm new to syslog-ng and am trying to configure it to run on HP-UX 10.20 > and 11.11. It seems to have problems reading from the /dev/log pipe. > Each time a message is received on the pipe, syslog-ng hits an I/O error > and closes the filehandle, and no more messages are received. However, > the first message is always processed correctly. > > Here is my syslog-ng.conf: > source src { > pipe("/dev/log" pad_size(2048)); > internal(); > }; > > destination d_file { > file("/var/adm/syslog-ng/messages" > owner(root) > group(systaff) > perm(0640) > ); > }; > > destination d_net { > tcp(testy port(1514)); > }; > > log { > source(src); > destination(d_file); > destination(d_net); > }; > > When I run syslog-ng in the foreground with debug and verbose options, > this is what I see: > > io.c: Preparing fd 3 for reading > io.c: connecting using fd 6 > connecting fd 6 to inetaddr testy, port 1514 > syslog-ng version 1.6.10 starting > io.c: Preparing fd 6 for writing > io.c: Preparing fd 7 for writing > io.c: do_read: read() failed (errno 11), Resource temporarily > unavailable > fd = 3, buffer = 00098b0, length = 2048 > Marking fd 3 for closing. > Closing fd 3. > > The do_read line is when the message is received. syslog-ng continues > to run, and internal messages (e.g. STATS) continue to show up on the > local host and the remote loghost. > > Any thoughts would be greatly appreciated. > > -Andy > > I think I figured this out...in libol's src/io.c an assumption is made that EAGAIN == EWOULDBLOCK, but this is not the case for HP-UX. > egrep "EAGAIN|EWOULD" /usr/include/sys/errno.h #define EAGAIN 11 /* No more processes */ #define EWOULDBLOCK 246 /* Operation would block */ I applied the following change to src/io.c and recompiled libol, and it works correctly now. -Andy -- io.c.orig Mon Mar 13 10:01:31 2006 +++ io.c Mon Mar 13 10:01:31 2006 @@ -361,6 +361,7 @@ case EINTR: continue; /* FIXME: Is it really worth looping here, * instead of in the select loop? */ + case EAGAIN: case EWOULDBLOCK: /* aka EAGAIN */ return 0; case EPIPE: @@ -415,6 +416,7 @@ continue; /* FIXME: Is it really worth looping here, * instead of in the select loop? */ case EWOULDBLOCK: /* aka EAGAIN */ + case EAGAIN: return 0; case EPIPE: werror("io.c: recvfrom() returned EPIPE! Treating it as EOF.\n");

2 1

Compiling & Using syslog-ng 1.9.10 on Solaris 10
by Philippe JOYEZ 01 May '06

01 May '06

Hello all, I've finally succedeed in compiling syslog-ng on my new Solaris 10 box using the following tasks: Modifications src/Makefile (Add -lrt) 75c75 < LIBS = -lpthread -lnsl -lsocket -ldoor -ll -L/usr/local/lib -lglib-2.0 -lintl -L/usr/local/lib -levtlog --- > LIBS = -lpthread -lrt -lnsl -lsocket -ldoor -ll -L/usr/local/lib -lglib-2.0 -lintl -L/usr/local/lib -levtlog Modification src/filter.c (Adding macros): /* Define G_LIKELY() and G_UNLIKELY() so that they are available when * using GLib 1.2 as well. These allow optimization by static branch * prediction with GCC. */ #ifndef G_LIKELY #define G_LIKELY(x) (__builtin_expect(x, 1)) #define G_UNLIKELY(x) (__builtin_expect(x, 0)) #endif /* !G_LIKELY */ But when I start syslog-ng, I have the following error message: Apr 26 09:50:55 sewerrat syslog-ng[752]: syslog-ng starting up; version='1.9.10' Apr 26 09:50:55 sewerrat syslog-ng[752]: Insufficient buffer space for retrieving STREAMS log message; res='ffffffff' Any idea? Best regards, Philippe JOYEZ -- Disclaimer ------------------------------------ Ce message ainsi que les eventuelles pieces jointes constituent une correspondance privee et confidentielle a l'attention exclusive du destinataire designe ci-dessus. Si vous n'etes pas le destinataire du present message ou une personne susceptible de pouvoir le lui delivrer, il vous est signifie que toute divulgation, distribution ou copie de cette transmission est strictement interdite. Si vous avez recu ce message par erreur, nous vous remercions d'en informer l'expediteur par telephone ou de lui retourner le present message, puis d'effacer immediatement ce message de votre systeme. *** This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender by phone or by replying this message, and then delete this message from your system.

2 1

RE: [PATCH] Re: [syslog-ng] time_sleep()
by Vaibhav Goel 30 Apr '06

30 Apr '06

That did the trick. I was going through the code and I suspected that was the problem in cfg-grammar.y but I am no code monkey so I let it be ;-) Thanks again for your help. Now I hope that this parameter will help bring down the CPU load on one of my loghosts (it has a whole bunch of parallel connections). Thanks, -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Roberto Nibali Sent: April 26, 2006 2:19 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [PATCH] Re: [syslog-ng] time_sleep() ADDENDUM: > The grammar was missing an entry, the attached patch should fix it. > Please try and report back if this solves the problem for you. And my patch was missing the documentation update, which I've obtained by fraud from the marvellous syslog-ng-2 tree. > ------------------------------------------------------------------------ > > --- syslog-ng-1.6.10/src/cfg-grammar.y 2006-03-14 00:34:13.000000000 +0100 > +++ syslog-ng-1.6.10-ratz/src/cfg-grammar.y 2006-04-26 22:58:20.000000000 +0200 > @@ -631,6 +631,7 @@ > | KW_USE_DNS '(' yesno ')' { configuration->use_dns = $3; } > | KW_TIME_REOPEN '(' NUMBER ')' { configuration->time_reopen = $3; } > | KW_TIME_REAP '(' NUMBER ')' { configuration->time_reap = $3; } > + | KW_TIME_SLEEP '(' NUMBER ')' { configuration->time_sleep = $3; } > | KW_LOG_FIFO_SIZE '(' NUMBER ')' { configuration->log_fifo_size = $3; } > | KW_GC_BUSY_THRESHOLD '(' NUMBER ')' { configuration->gc_busy_threshold = $3; } > | KW_GC_IDLE_THRESHOLD '(' NUMBER ')' { configuration->gc_idle_threshold = $3; } And attached is the better version for Bazsi to apply if he's inclined to do so. This is about the third time I've chased down a parser-based bug, so I wonder if using (f)lex/yacc for this really pays off ;)? Considering my state of mind, I reckon I could be really off the track with this patch as well ... Cheers, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc

2 1

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 30 Apr '06

30 Apr '06

I can't post the whole thing since its too big but I am posting the relevant portion of it: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); owner(mdirect); group(mdirect); keep_hostname (yes); log_msg_size(20480); }; The rest of the file is just a bunch of source, destination, filter and log entries for various stuff Also: [root@clxd01md syslog-ng]# strings /sbin/syslog-ng | grep time_sleep time_sleep So looks like there could be some time_sleep code in the binary at least... -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of John Morrissey Sent: April 25, 2006 1:48 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() On Tue, Apr 25, 2006 at 01:00:17PM -0700, Vaibhav Goel wrote: > I did exactly that... > > [root@clxd01md syslog-ng]# /etc/init.d/syslog-ng restart > Shutting down system logger: [ OK ] > Starting system logger: syntax error at 20 > Parse error reading configuration file, exiting. (line 20) > [FAILED] > [root@clxd01md syslog-ng]# cat /etc/syslog-ng/syslog-ng.conf | grep time > time_reopen (10); > time_sleep(30); > > [root@clxd01md syslog-ng]# /sbin/syslog-ng -V > syslog-ng 1.6.10 > > > Am I doing something wrong? Strange. I backported the time_sleep change to the Debian package I'm running (1.6.9) so I can't speak for the pristine 1.6.10 source, but it's been working fine for us. I glanced at the 1.6.10 tarball and see some time_sleep code there. Could you post your entire syslog-ng.conf? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

RE: [syslog-ng] HUP does not work
by Lumir Unzeitig (DHL CZ) 30 Apr '06

30 Apr '06

Piece of command output strace -s 256 -o /tmp/output-file -p 4893 --------------------------------------------- poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18, events=0}, {fd=15, events=POLLOUT, revents=POLLOUT}, {fd=14, events=0}, {fd=13, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=12, events=POLLIN}, {fd=11, events=POLLIN}, {fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 2 recv(15, 0xbfffaf7b, 1, MSG_PEEK|MSG_DONTWAIT) = -1 ENOTSOCK (Socket operation on non-socket) write(15, "Apr 20 16:56:38 czchols020 sendmail[13901]: k3KEuWpW013859: to=<mrk(a)erwerwerwwer.com>, delay=00:00:04, xdelay=00:00:03, mailer=esmtp, pri=88225, relay=mrucontsv00001.mru-co.mu.asdasda.cz. [152.141.145.16], dsn=2.0.0, stat=Sent (mrucontsv00001.mru-co.mu.uuuu"..., 293) = 293 recv(4, 0xbfffaf7b, 1, MSG_PEEK|MSG_DONTWAIT) = -1 ENOTSOCK (Socket operation on non-socket) write(4, "Apr 20 16:56:38 czchols020 sendmail[13901]: k3KEuWpW013859: to=< mrk(a)erwerwerwwer.com >, delay=00:00:04, xdelay=00:00:03, mailer=esmtp, pri=88225, relay=mrucontsv00001.mru-co.mu.asdasda.cz. [152.141.145.16], dsn=2.0.0, stat=Sent (mrucontsv00001.mru-co.mu.uuuu"..., 293) = 293 time(NULL) = 1145544998 poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18, events=0}, {fd=15, events=0}, {fd=14, events=0}, {fd=13, events=0}, {fd=4, events=0}, {fd=12, events=POLLIN, revents=POLLIN}, {fd=11, events=POLLIN}, {fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 1 recvfrom(12, "<22>sendmail[13954]: k3KEub8A013945: to=<werwerw(a)asdasdasd.cz>, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=43032, relay=smtp-out-vip.asdasda.cz [85.72.196.13], dsn=2.0.0, stat=Sent (OK - Data received)\n", 2048, 0, {sa_family=AF_INET, sin_port=htons(514), sin_addr=inet_addr("2.252.103.89")}, [16]) = 215 time(NULL) = 1145544998 time(NULL) = 1145544998 time(NULL) = 1145544998 time(NULL) = 1145544998 time(NULL) = 1145544998 poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18, events=0}, {fd=15, events=POLLOUT, revents=POLLOUT}, {fd=14, events=0}, {fd=13, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=12, events=POLLIN}, {fd=11, events=POLLIN}, {fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 2 recv(15, 0xbfffaf7b, 1, MSG_PEEK|MSG_DONTWAIT) = -1 ENOTSOCK (Socket operation on non-socket) write(15, "Apr 20 16:56:38 czchols020 sendmail[13954]: k3KEub8A013945: to=<rrr(a)rrrr.co.uk>, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=43032, relay=smtp-out-vip.asdasda.cz [85.72.196.13], dsn=2.0.0, stat=Sent (OK - Data received)\n", 238) = 238 recv(4, 0xbfffaf7b, 1, MSG_PEEK|MSG_DONTWAIT) = -1 ENOTSOCK (Socket operation on non-socket) write(4, "Apr 20 16:56:38 czchols020 sendmail[13954]: k3KEub8A013945: to=<sarah.queen(a)city-link.co.uk>, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=43032, relay=smtp-out-vip.asdasda.cz [85.72.196.13], dsn=2.0.0, stat=Sent (OK - Data received)\n", 238) = 238 time(NULL) = 1145544998 poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18, events=0}, {fd=15, events=0}, {fd=14, events=0}, {fd=13, events=0}, {fd=4, events=0}, {fd=12, events=POLLIN}, {fd=11, events=POLLIN}, {fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = -1 EINTR (Interrupted system call) --- SIGHUP (Hangup) @ 0 (0) --- rt_sigaction(SIGHUP, {0x804a7b0, [HUP], SA_RESTORER|SA_RESTART, 0xaa20d8}, {0x804a7b0, [HUP], SA_RESTORER|SA_RESTART, 0xaa20d8}, 8) = 0 sigreturn() = ? (mask now []) open("/etc/resolv.conf", O_RDONLY) = 19 fstat64(19, {st_mode=S_IFREG|0644, st_size=52, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb75e3000 read(19, "search prg-dc.asdasda.cz asdasda.cz\n\nnameserver 127.0.0.1\n", 1024) = 52 read(19, "", 1024) = 0 close(19) = 0 munmap(0xb75e3000, 4096) = 0 write(2, "SIGHUP received, restarting syslog-ng\n", 38) = 38 time(NULL) = 1145544998 time(NULL) = 1145544998 poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18, events=0}, {fd=15, events=0}, {fd=14, events=0}, {fd=13, events=0}, {fd=4, events=0}, {fd=12, events=POLLIN, revents=POLLIN}, {fd=11, events=POLLIN}, {fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 1 recvfrom(12, "<22>sendmail[13950]: k3KEucD1013950: from=<gematracing(a)asdasda.cz>, size=747, class=0, nrcpts=1, msgid=<5228949.1145544998753.JavaMail.weblogic(a)czhs0119.prg-dc.asdasda.c z>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]\n", 2048, 0, {sa_family=AF_INET, sin_port=htons(514), sin_addr=inet_addr("2.252.103.89")}, [16]) = 232 time(NULL) = 1145544998 time(NULL) = 1145544998 time(NULL) = 1145544998 time(NULL) = 1145544998 --------------------------------- >And an idea, isn't it postfix that stops logging? No, it is remotely logged sendmail 8.12.11. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, April 20, 2006 3:55 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] HUP does not work On Thu, 2006-04-20 at 13:47 +0200, Lumir Unzeitig (UUUU CZ) wrote: > The problem is: A central syslog server logs huge number of maillog > messages from a server. HUP signal is sent to the syslog-ng in > postrotate instructions when logrotate runs. All log files are rotated > properly except maillog. The old maillog messages are in the proper > file, but no new file is created and thus nothing is logged for the > facility . When I stop/start syslog-ng daemon it's working good. > We would need some more information about syslog-ng when in this bad state. Please attach to the syslog-ng process with strace right before sending a HUP signal and wait till some mail log is generated. Use the following strace command: strace -s 256 -o /tmp/output-file -p <syslog-ng pid> And an idea, isn't it postfix that stops logging? -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

DJBDNS&SYslog-ng
by Hamilton Vera 28 Apr '06

28 Apr '06

How to make djbdns and syslog-ng to work together? Thanks

1 0