- syslog-ng - lists.balabit.hu

Message aggregation: or, 'Last message repeated umpteen times'.
by G.W. Haywood 28 Aug '07

28 Aug '07

Hi there, On Mon, 15 Jul 2002 12:33:17 +0200 Balazs Scheidler wrote: > On Tue, Jul 09, 2002 at 07:02:19PM -0400, Kevin Welch wrote: > > I know this issue has been discussed before, but I never saw an answer other > > than 'syslog-ng doesnt do that'. > > > > Perhaps someone could provide insight as to why syslog-ng doesnt aggregate > > messages received? Is this on a feature list for future releases? > > It might be implemented once I have time, though IMHO message aggregation > makes log analysis more difficult, especially if you have multiple cascaded > log relays. Balazs, I read the manpage, Googled and grepped the source and I believe I know the answer, but I'd like to have your confirmation. Is it still the case that syslog-ng does no message aggregation? (I'm not asking because I want it. I'm asking because I _don't_ want it. :) -- 73, Ged. PS: I also found this about not aggregating messages if the output is a pipe http://lists.hellug.gr/pipermail/linux-greek-users/2007-April/068169.html

2 1

File reopen
by Szeti, Balazs 28 Aug '07

28 Aug '07

Hi! Syslog-ng reopens destination files, if I send a SIGHUP to the process, which is a common way of handling logrotates in Linux. If I don't write in to a file (idle), syslog-ng will close the file according to time_reap() value. If the file was deleted from the directory, will it create the file next time it logs to the deleted destination file? I've found, that it doesn't, can I config it somehow? (My log files are read by different users, and sometimes they delete it, so it should be recreated again.) Is it a soultion, if I send a SIGHUP to syslog-ng every minute? I was looking for a solution in the archive, but I haven't found a clear answer. Thanks, Balazs Szeti

2 1

syslog-ng unable to starts
by mailing list 26 Aug '07

26 Aug '07

syslog-ng 2.0.4, Solaris 10, attempting to replace syslogd on Solaris. I stopped syslogd before starting syslog-ng on my system and I keep getting the below error messages in /var/adm/messages: (ps -ef shows syslog-ng is running) Aug 23 14:39:52 server1 syslog-ng[7764]: Connection failed; error='Connection refused (146)' Aug 23 14:39:52 server1 syslog-ng[7764]: Initiating connection failed, reconnecting; time_reopen='10' I've edited /etc/inet/services to include port 5140 and stop/start inetd via Solaris smf (svcadm). Was there something else I need to make the port open or perhaps something in syslog-ng.conf? Additionally, I used the config file from http://www.campin.net/syslog-ng/solaris-conf.txt and only make changes to the "destination loghost" is there anything specific to Solaris 10 that I need to add/remove in the configuration file? Thank you for any pointers. Regards, -- Mike ____________________________________________________________________________________ Fussy? Opinionated? Impossible to please? Perfect. Join Yahoo!'s user panel and lay it on us. http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7

2 3

Revisiting: problem with filter behavior in 2.0.4
by aero1967＠fastmail.fm 23 Aug '07

23 Aug '07

Hello. I posted the below message on 13 July to the list, but still received no response. I'm wondering if I'm seeing a bug in syslog-ng, or there's some configuration detail I've overlooked. Balazs, could you comment on this please? Since I posted the original message, I'm seeing all kinds of messages in the "critical.log" file that shouldn't belong, according to my understanding of the filtering, e.g. messages from facility+priority combination "user.info" without the string "crit" anywhere within the message (though oddly enough in that example, the word "subscription" is present in the message, which differs from "crit" by the addition of the "p" before the "t", but I'm not sure if that's anything more than coincidence). Anyway, I'd appreciate it if someone could help me look into this. -- aero1967(a)fastmail.fm -- http://www.fastmail.fm - A no graphics, no pop-ups email service ----- Original message ----- I'm seeing some results with filtering that I don't expect / understand. I have the following statements in syslog-ng.conf (I am just giving the relevant configuration lines): source src { unix-stream("/dev/log"); internal(); file("/proc/kmsg"); }; filter kern { facility(kern); }; filter kern_critical { filter(kern) and priority(emerg .. err); }; filter critical { filter(kern_critical) or match("crit*") or priority(emerg .. crit); }; template verbose_msg_fmt { template("$FULLDATE $FACILITY.$PRIORITY $MSG\n"); template_escape(no); }; destination root_tty { usertty("root"); }; destination critical_logfile { file("/var/log/critical.log" template(verbose_msg_fmt)); }; log { source(src); filter(critical); destination(root_tty); destination(critical_logfile); }; There are no other configuration lines which reference the critical_logfile destination , and no destination has a "final" flag. Now, when I check /var/log/critical.log, I get messages from the facility.priority combination of daemon.warning that do not contain any string starting with "crit". I also get messages from daemon.err, which also shouldn't match the filter. For example: 2007 Jul 12 10:51:07 daemon.warning <message, not containing the string crit anywhere> 2007 Jul 11 20:33:57 daemon.err <message, not containing the string crit anywhere> IIRC, I was using these same lines in a syslog-ng 1.6.x installation without these kinds of results.

2 1

cisco tcp syslog weirdness/merkwuerdigkeit
by Blurry 22 Aug '07

22 Aug '07

When a certain cisco router is set to UPD syslog delivery it creates a unique message for each unique message, duh ! But when this same router is set to TCP syslog, it takes all messages and tacks them back to back until syslog-ng runs out of buffer space in one line. I kept increasing the message log size, but the real problem is that the messages would have to be parsed out of this massive long line. My router guy says he can't make the cisco router behave any differently. How do I handle this problem ? Ideas ? Thanks

3 7

Custom Syslog-ng logs and remote syslog-ng
by Corey Bobb 22 Aug '07

22 Aug '07

Greetings, I am trying to accomplish something and am requiring some assistance. I have custom logs that write needed output to this directory: /production/server/20070822/xxxx.log This log file rotates every day so the next date will be 20070823 and so on. How can I direct a custom destination file to log remotely that log file to the central server and have it pick it up everyday? So for example . . . I have a central syslog server that writes all its input to /remote/logs/<date>/<HOST> On the server sending the remote logs I have this parameter: destination { file("/production/server/$YYYY$MM$DD/xxxx.log"); }; For some reason I think its not working properly due to the $DATE variables, I tried also using % to no avail. All the necessary logs do log remotely as I wish them to. Is this the proper way to configure this scenario? What I want to do is log the custom logging @ xxxx.log to the correct server $hostname on the central server This would be the idea: Custom.log -> local syslog-ng -> central-syslog-ng -> /remote/logs/<date>/<HOST> I am currently logging all the servers logging locally and remotely, but I cannot get syslog-ng to log that custome log file to the remote server. I hope this makes sense! Thanks. Regards, Corey M. Bobb Data Center Manager 850 South Concourse Suite 150 Maitland, FL 32751 D: 321.445-2150 M: 321-262-2845 F: 407.333.7701 cbobb(a)cygnus.com www.cygnus.com

1 0

Multiple woes with sles10sp1 / syslog-ng-1.6.8-20.18
by Robin P. Blanchard 22 Aug '07

22 Aug '07

# syslog-ng -d -f /etc/syslog-ng/syslog-ng.conf [snip] Cannot open file /export/syslog/10.10.0.2102007/08/21/messages for writing (Permission denied) # ls -ald /export/ ; ls -ald /export/syslog/ drwxr-xr-x 5 root root 4096 Aug 21 10:16 /export/ drwxrwsr-x 2 root root 4096 Aug 21 09:41 /export/syslog/ # fgrep "\$HOST" /etc/syslog-ng/syslog-ng.conf |fgrep messages destination localmessages { file("/export/syslog/$HOST/$YEAR/$MONTH/$DAY/localmessages"); }; destination messages { file("/export/syslog/$HOST/$YEAR/$MONTH/$DAY/messages"); }; #destination allmessages { file("/export/syslog/$HOST/$YEAR/$MONTH/$DAY/allmessages"); }; So...it would apppear that: 1) macro expansion is not working ? (I can hand hack-in an extra "/" to force that path to look correct) 2) syslog-ng cannot write to its output dir (regardless if I hack in that extra "/" Ideas ? # uname -a Linux auth 2.6.16.46-0.14-default #1 Thu May 17 14:00:09 UTC 2007 i686 i686 i386 GNU/Linux # rpm -qa |fgrep -i syslog syslog-ng-1.6.8-20.18 --------------------------------------- Robin P. Blanchard Systems Integration Specialist The University of Georgia Center for Continuing Education Conference Center & Hotel fon: 706.542.2404 < > fax: 706.542.1587 ---------------------------------------

3 3

REGEX rewrites on packet body possible?
by Eli Stair 21 Aug '07

21 Aug '07

I've got a problem with some network devices that is leading me to need to find some way to do regex rewriting of portions of the message body of syslog messages. Problem: I've got a bunch of Foundry devices that put their hostname followed by a comma in the body of the message (and some that do not). Some of these look like this: { 2007-08-16:2007-08-16T09:50:16-07:00 hostname [hostname.local7.notice] hostname, Linecard Module 13 temperature 50.0 C degrees is normal } # template("$R_ISODATE $HOST [$PROGRAM.$FACILITY.$PRIORITY] $MSG\n") As you can see from the template, the second hostname reported with the comma is part of the MSG body. For reasons of properly searching/indexing this data I need to strip this out. I've seen mention of a tool called 'syslog-mailer' that sounds like it would do the job somewhat. Additionally, I've seen blog chatter about potentially adding full regex rewrite capability to syslog-ng in the recent past. I can't find evidence of either of these methods however. My first try at solving this using an external program showed that when passing data OUT of syslog-ng to a defined program, only the message body is sent and before application of a template, the other information is dropped. Thus it's not possible to do processing of the whole payload externally, re-import the data via a socket and finish writing because the facility and HOST information is all gone! I'm looking at writing a log proxy using Net::Dev::Tools::Syslog in perl to handle listening, rewriting if necessary, and forwarding full messages on to syslog-ng after. I'd just like to know if there are any better suggestions, or if this has been done before successfully in another way? Cheers, and thanks for any insight. /eli

2 2

syslog-ng feature request
by Andreas Kurz 17 Aug '07

17 Aug '07

Hello, I am currently integrating syslog-ng as an HA cluster resource, because the remote syslog logging (MySQL error logfile on shared filesystem) for one resource should be moved around the cluster with the resource. I encounterd one syslog-ng feature that would be nice to have: A configureable path for the persistent state file (like the config file or pid file) to allow several instances of syslog-ng per node and to place a persistant state file also on a shared file system. Regards, Andreas

1 0

syslog-ng 2.0.5 does not remember last sent log line position for file() source
by Andreas Kurz 17 Aug '07

17 Aug '07

Hello all, I've installed syslog-ng 2.0.5 (compiled from src) on a CentOS 4.5 server and wanted to include a MySQL logfile via a file() source directive: ... source s_db_com { file("/var/lib/mysql/community/community.err" log_prefix("mysql-community: ") follow_freq(1) flags(no-parse)); }; filter f_db_com { match("mysql-community"); }; log { source(s_db_com); filter(f_db_com); destination(ha_local6); destination(ha_tcp); flags(final); }; ... But when I restart syslog-ng the complete MySQL error file is read and logged again by syslog-ng. Is there a special option that has to be set to get this feature working? Where does syslog-ng store its persistant data to get the information after a restart? Regards, Andreas

2 2

Re: [syslog-ng] Logging Third party application logs to Syslog-NG
by Wilson Lai 17 Aug '07

17 Aug '07

Dear Bill, If there is a Scalix application which generate the log file in "/var/opt/Scalix/ml/s/logs/fatal", where "fatal" is the log file. How could the source be defined to be listened by Syslog-NG? Thanks. Regards, Wilson Lai System Engineer IT Dept., SJM Office ( : (853)2978585 Mobile ( : (853)66506709 Email +: : wilsonlai(a)macausjm.com -----Original Message----- From: syslog-ng-request(a)lists.balabit.hu [mailto:syslog-ng-request@lists.balabit.hu] Sent: Thursday, August 16, 2007 6:00 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 28, Issue 20 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. GLib version problem? (Burns Andrew) 2. Re: GLib version problem? (Geller, Sandor (IT)) 3. Re: GLib version problem? (Valdis.Kletnieks(a)vt.edu) 4. Logging Third party application logs to Syslog-NG in Linux! (Wilson Lai) 5. Re: Logging Third party application logs to Syslog-NG in Linux! (Bill Nash) 6. Troubles with SE-Linux Syslog-ng and ntpd (Martin Voelker) ---------------------------------------------------------------------- Message: 1 Date: Wed, 15 Aug 2007 08:02:38 -0500 From: "Burns Andrew" <aburns(a)snyderdrug.com> Subject: [syslog-ng] GLib version problem? To: <syslog-ng(a)lists.balabit.hu> Message-ID: <699402D08697B94EAB9429B5083FAA1C042C2290(a)exchange_2k.snyderdrug.co m> Content-Type: text/plain; charset="us-ascii" Hello, I'm trying to install syslog-NG onto a Cent OS 5 server, and running into a problem. The problem appears to be more of a RedHat/Cent problem (or even Glib problem) rather than Syslog-NG problem, but I thought I'd check with the community before I harass Red Hat. I have the RPM verion of glib2.12 installed, however the libraries seemed to be labled 2.0.0. When I configure syslog-ng, I run across the following error: checking pkg-config is at least version 0.9.0... yes checking for GLIB... no configure: error: Cannot find GLib library version >= 2.2: is pkg-config in path? [root@syslog syslog-ng-2.0.5]# I have the rpm installed: [root@syslog syslog-ng-2.0.5]# yum list installed glib2 Loading "installonlyn" plugin Loading "fastestmirror" plugin Installed Packages glib2.i386 2.12.3-2.fc6 installed [root@syslog syslog-ng-2.0.5]# However the libraries seem to be mislabeled: [root@syslog syslog-ng-2.0.5]# locate glib | grep "/lib/libg" /lib/libglib-2.0.so.0 /lib/libglib-2.0.so.0.1200.3 [root@syslog syslog-ng-2.0.5]# Am I just missing something simple, or is this a problem I should be trying to speak to Cent/Red Hat about? Thanks! Andrew

2 1

Buffer Overflow : Insufficient buffer space for retrieving STREAMS log message; res='2'
by Nicolas de Marqué - Fromentin 17 Aug '07

17 Aug '07

Hello, During a big flow from a local server to a central server, we have a "buffer overflow" on the local server. After this message, syslog-ng is crash and don't be capable to send any messages. The local server is a solaris 10 product, the central linux a redhat EL4. Do you know a rule to stop this problem Best regard, Nicolas

3 2

new syslog-ng white paper published
by Balazs Scheidler 16 Aug '07

16 Aug '07

Dear all, We have published a new, syslog-ng related white paper on our website titled: "Distributed syslog architectures with syslog-ng" It basically contains the various deployment scenarios, their pros and cons we've encountered in our experience. It does contain information on syslog-ng Premium Edition, but still we tried to concentrate on the technical content, and some of it equally applies to syslog-ng OSE. We'd appreciate feedback at documentation(a)balabit.com. Thanks. -- Bazsi

1 0

Troubles with SE-Linux Syslog-ng and ntpd
by Martin Voelker 16 Aug '07

16 Aug '07

Hi, I have some troubles using syslog-ng on RHEL4 with SE Linux. There comes following message: audit(1187252020.581:514): avc: denied { write } for pid=2646 comm="ntpd" name="log" dev=tmpfs ino=14840162 scontext=root:system_r:ntpd_t tcontext=root:object_r:device_t tclass=sock_file What can I do??? Thanks Martin Westdeutsche Lotterie GmbH & Co. OHG | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: Münster HRA 4379 Geschäftsführer: Dr. Winfried Wortmann Vorsitzender des Beirates: Ernst Gerlach Gesellschafter: Nordwestlotto in Nordrhein-Westfalen GmbH | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: HRB 3840 Geschäftsführer: Dr. Winfried Wortmann NRW.BANK | Sitz: Düsseldorf und Münster Rechtsform: Anstalt des öffentlichen Rechts Registergerichte: Amtsgerichte Düsseldorf/Münster Handelsregister: Düsseldorf HRA 15277/Münster HRA 5300

1 0

Logging Third party application logs to Syslog-NG in Linux!
by Wilson Lai 16 Aug '07

16 Aug '07

Dear ALL, I am now using the Syslog-NG OSE for centralized logging system. How could I get the third party application (Linux Client) logs logging to the Syslog-NG server? These third party application logs are not managed by the Linux syslog daemon. Would there be someone gives some information or suggestion! Thanks a lot!!! Regards, Wilson Lai System Engineer IT Dept., SJM Office ( : (853)2978585 Mobile ( : (853)66506709 Email +: : wilsonlai(a)macausjm.com

2 1

GLib version problem?
by Burns Andrew 15 Aug '07

15 Aug '07

Hello, I'm trying to install syslog-NG onto a Cent OS 5 server, and running into a problem. The problem appears to be more of a RedHat/Cent problem (or even Glib problem) rather than Syslog-NG problem, but I thought I'd check with the community before I harass Red Hat. I have the RPM verion of glib2.12 installed, however the libraries seemed to be labled 2.0.0. When I configure syslog-ng, I run across the following error: checking pkg-config is at least version 0.9.0... yes checking for GLIB... no configure: error: Cannot find GLib library version >= 2.2: is pkg-config in path? [root@syslog syslog-ng-2.0.5]# I have the rpm installed: [root@syslog syslog-ng-2.0.5]# yum list installed glib2 Loading "installonlyn" plugin Loading "fastestmirror" plugin Installed Packages glib2.i386 2.12.3-2.fc6 installed [root@syslog syslog-ng-2.0.5]# However the libraries seem to be mislabeled: [root@syslog syslog-ng-2.0.5]# locate glib | grep "/lib/libg" /lib/libglib-2.0.so.0 /lib/libglib-2.0.so.0.1200.3 [root@syslog syslog-ng-2.0.5]# Am I just missing something simple, or is this a problem I should be trying to speak to Cent/Red Hat about? Thanks! Andrew

3 2

valid HOSTNAME characters in syslog?
by dave 15 Aug '07

15 Aug '07

What is the source of information for syslog-ng to treat '@' a valid character in HOSTNAME field of syslog message? RFC 3164 refers to another RFC for the validity of HOSTNAME field. Syslog-ng's Syslog Relay treats '@' a valid HOSTNAME character while forwarding syslog. I am trying to find valid character set to be used in HOSTNAME field of syslog message. So that I would know when a Syslog Relay inserts a new HOSTNAME/IP in the syslog message to be forwarded. Appreciate any pointers. ____________________________________________________________________________________Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV. http://tv.yahoo.com/

4 9

Writing line by line
by Diluka Moratuwage 14 Aug '07

14 Aug '07

Hi, Can I configure the syslog-ng, so that, it writes only line by line. Now few lines at the same time. I mean, I wanna, write one line, and then another, not as a a bunch of lines. What I actually need to do, is reading one line, process it and do some things, and then listen to next line and so on. I highly appreciate if you can provide me information, on how to do this. Thanks Diluka.

2 2

Writing line by line in Syslog-ng
by Diluka Moratuwage 14 Aug '07

14 Aug '07

Hi, Can I configure the syslog-ng, so that, it writes only line by line. Now few lines at the same time. I mean, I wanna, write one line, and then another, not as a a bunch of lines. What I actually need to do, is reading one line, process it and do some things, and then listen to next line and so on. I highly appreciate if you can provide me information, on how to do this. Thanks Diluka.

2 2

how rewrite the HOST macro?
by mobidyc 13 Aug '07

13 Aug '07

Hello, i want to use syslog-ng to receive and log messages, the goal is to write log messages to: /appli/syslog-ng/logs/server0/messages but server0 can have multiples names: server0 server0e1 server0e2 server0g1 server0g2 server0gt1 etc... how can retrieve the name "server0" only ? Regards, Mobidyc

5 9

Problem when getting data from syslog-ng into a socket program
by Diluka Moratuwage 13 Aug '07

13 Aug '07

Hi, I have a little problem which I need to solve. I wrote a small program, which listens to the syslog-ng. I think I have encountered a problem with the timing I'm connecting and disconnecting to the syslog-ng. I almost always get the following msg with other msgs, <43>Aug 11 19:39:03 diluka-laptop syslog-ng[5084]: Connection broken; time_reopen='10' <43>Aug 11 19:39:13 diluka-laptop syslog-ng[5084]: EOF occurred while idle; fd='20' Please let me know whether following code snippet has anything irrelevent or unsuitable. while(1) { int len, read = 0; new_fd = accept(sockfd, (struct sockaddr *)&their_addr, &sin_size); while((len = recv (new_fd, buffer, BUFF_SIZE - 1, MSG_PEEK)) > 0) { read = recv(sockfd, buffer, BUFF_SIZE - 1, 0); buffer[read] = '\0'; printf(buffer); memset(buffer, '\0', BUFF_SIZE * sizeof(char)); break; } close(new_fd); new_fd = 0; } I highly appreciate if you can give some help for me to get the problem solved. Thanks, Diluka.

2 4

Binding error
by Diluka Moratuwage 13 Aug '07

13 Aug '07

Hi, When I'm trying to listen to a port, using syslog-ng the following error occurs. Can u pls help me to figure out the problem. > Starting system logging: syslog-ngError binding socket; addr='AF_INET(10.100.1.67:5000)', error='Cannot assign requested address (99)' Error initializing source driver; source='s_jabber_machine' start failed. < I highly appreciate if you can give me atleast a hint regarding this. Thanks, Diluka.

2 3

My server that listens to Syslog-ng
by Diluka Moratuwage 12 Aug '07

12 Aug '07

Hi, I wrote a program which listens to a port (5001), which the syslog-ng was configured to write to. Everything works fine, but sometimes I get msgs like, <43>Aug 11 19:39:03 diluka-laptop syslog-ng[5084]: Connection broken; time_reopen='10' <43>Aug 11 19:39:13 diluka-laptop syslog-ng[5084]: EOF occurred while idle; fd='20' Can anybody pls let me know what my mistake would be ??? Following is the code snippet shows how I read from the syslog-ng. I think there is a problem, in the way I read from the syslog-ng. Pls correct me, if I have missed any points. I really appreciate if you can provide me some help in getting through the problem. Thanks, Diluka.

1 1

Re: [syslog-ng] Routers don´t send syslog
by Maurice Manurung 11 Aug '07

11 Aug '07

Can you ping from other routers to the syslog-ng server and vice versa? Have you checked whether there is firewall or ACL in the router toward the syslog server? Warm Regards, Maurice Manurung http://www.flixya.com/referrer.php?ref=osmaniaindo ----- Original Message ---- From: Roberto Dud <roberto.dud(a)gmail.com> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Sent: Thursday, August 9, 2007 7:51:41 AM Subject: Re: [syslog-ng] Routers don´t send syslog Helo Mrs, Humm...maybe this is my problem. My syslog-ng server is behind a VLAN, the only Router with send syslog messages for the server is the same router with my syslog-ng is conected. Other routers, don´t send. I run tcpdump on the server and don´t get anyone messages, but in the routers everyhting is ok. Other equipments is ok, linux servers and switchs. Have any idea? Thanks, Dud. On 8/8/07, John Hala < john.hala(a)villanova.edu> wrote:I had a similar issue where my Management VLAN was blackholing the messages and it was never getting to the syslog server. I don't know your setup, but I had to blow away this Management VLAN. regards -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu ] On Behalf Of Werner Thal Sent: Wednesday, August 08, 2007 4:33 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Routers don´t send syslog Hallo Roberto, my Router-Config looks similar to yours, so I think this will be correct. So did you check if the router-messages reach your syslog-ng server? If not, just use a sniffer like ethereal/wireshark for that. regards Werner Am Mittwoch, 8. August 2007 05:08 schrieb Roberto Dud: > Mrs, > > I have a lot of Routers configured to send logs to syslog-ng, but isn´t > work. Only 1 router send ok, others 10 not ok. > > My configuration on routers is the same: > > service timestamps debug datetime msec localtime show-timezone > service timestamps log datetime msec localtime show-timezone > > logging <my ip> > logging buffered 10000 debugging > logging trap debugging > > I check with command : > > show logging > > And it´s ok, for me. > > Anyone have a problema with routers? > > Thanks, > > Dud. > -- ___________________________________________________________________________ A Linux-Server is like a tent: no windows, no gates and an apache inside... _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

Syslog-ng" daemon killing the "setroubleshoot" daemon on RHEL5_X86_64
by Shamim 10 Aug '07

10 Aug '07

Hi , When there was no daemon of "syslog-ng" was running ******************************************************************** [root@svllgg181 tmp]# ps -eaf |grep -i syslog-ng root 2631 2597 0 10:58 pts/0 00:00:00 grep -i syslog-ng [root@svllgg181 tmp]# ********************************************************************* in the absence of "syslog-ng" daemon I was easily able to restart the "setroubleshootd" daemon [root@svllgg181 tmp]# /etc/init.d/setroubleshoot restart Stopping setroubleshootd: [ OK ] Starting setroubleshootd: [ OK ] [root@svllgg181 tmp]# ******************************************************************************************* Now I started the "syslog-ng" daemon [root@svllgg181 tmp]# ps -eaf |grep -i syslog-ng root 2718 1 0 10:59 ? 00:00:00 syslog-ng root 2746 2597 0 11:00 pts/0 00:00:00 grep -i syslog-ng [root@svllgg181 tmp]# ***************************************************************************************** And I tried to start the "setroubleshoot", now it gives error. [root@svllgg181 tmp]# /etc/init.d/setroubleshoot restart Stopping setroubleshootd: [ OK ] Starting setroubleshootd: [ OK ] [root@svllgg181 tmp]# Traceback (most recent call last): File "/usr/sbin/setroubleshootd", line 59, in ? from setroubleshoot.config import cfg File "/usr/lib/python2.4/site-packages/setroubleshoot/__init__.py", line 24, in ? log_init(sys.argv[0]) File "/usr/lib/python2.4/site-packages/setroubleshoot/log.py", line 127, in log_init syslog = logging.handlers.SysLogHandler(address='/dev/log') File "/usr/lib64/python2.4/logging/handlers.py", line 602, in __init__ self._connect_unixsocket(address) File "/usr/lib64/python2.4/logging/handlers.py", line 617, in _connect_unixsocket self.socket.connect(address) File "<string>", line 1, in connect socket.error: (13, 'Permission denied') [root@svllgg181 tmp]# [root@svllgg181 tmp]# /etc/init.d/setroubleshoot restart Stopping setroubleshootd: [FAILED] Starting setroubleshootd: [ OK ] [root@svllgg181 tmp]# Traceback (most recent call last): File "/usr/sbin/setroubleshootd", line 59, in ? from setroubleshoot.config import cfg File "/usr/lib/python2.4/site-packages/setroubleshoot/__init__.py", line 24, in ? log_init(sys.argv[0]) File "/usr/lib/python2.4/site-packages/setroubleshoot/log.py", line 127, in log_init syslog = logging.handlers.SysLogHandler(address='/dev/log') File "/usr/lib64/python2.4/logging/handlers.py", line 602, in __init__ self._connect_unixsocket(address) File "/usr/lib64/python2.4/logging/handlers.py", line 617, in _connect_unixsocket self.socket.connect(address) File "<string>", line 1, in connect socket.error: (13, 'Permission denied') Note: "Syslog-ng" daemon killing the "setroubleshoot" daemon. Can anyone please suggest me the cause and any work around. I'm using syslog-ng-2.0.2 release. Thanks in advance Shamim, --------------------------------- Yahoo! Mail is the world's favourite email. Don't settle for less, sign up for your freeaccount today.

3 5