- syslog-ng - lists.balabit.hu

List of supported macros?
by ger 05 May '00

05 May '00

Hi, are the macros listed in affile.c the only ones that will be supported, or will support be introduced for others, such as $HOUR, $MIN, etc, for better granularity in creating directory structures? Thanks, Ger.

1 0

CISCO
by Ilya Krel 05 May '00

05 May '00

can syslog-ng accept logs from cisco routers?

3 2

RE: [syslog-ng] Syslog-ng Dies - core dump
by Ohrberg, Mick 02 May '00

02 May '00

I have heard that 105181-20 might not be the ultimate patch. One thing to try is to rollback -20 and apply -19. I've heard from sources within SUN that -20 is known to have a few bugs. The nature of these bugs - I don't know. Just my $.02 /Mick Well.. It was a good shot.. but. I updated the system to the latest recommended patch set. Now I have 105181-20 as well as 105181-15. Still getting nice core dump. :-( Un L'Unique wrote: John Wingenbach wrote: > > I just installed and configured syslog-ng 1.4.3 on a Solaris 2.6 system. It cores out on startup. It apparently doesn't like part of my configuration. Debug output is: > > #> /opt/syslog-ng/sbin/syslog-ng -d -v > binding fd 5, inetaddr: 0.0.0.0, port: 514 > io.c: Preparing fd 5 for reading > syslog-ng version 1.4.3 starting > Segmentation Fault(coredump) > > My configuration is (Note below the comments regarding code which if removed allows it to live): Your patch kernel may be too low, I remember some similar probleme when starting syslog-ng for the first time. Pre 105181-15 core dump and 15-17 make system crash. I have no probleme since -19. S.R. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng <http://lists.balabit.hu/mailman/listinfo/syslog-ng> -- John C. Wingenbach Pliant Systems, Inc. Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

1 0

Pre-processing ability?
by Dotson, Mike G 02 May '00

02 May '00

Hey, I'm fairly new to syslog-ng (got it today as a matter of fact). The config file is very easy to configure and get going (hat's off to you guys) even with sparse documentation (up and running in under 2 hours including compile time). I do, however, need to know if there is any pre-processing ability with m4 or cpp, etc. I plan on rolling syslog-ng to our enterprise and would like one syslog-ng.conf file on all our hosts. In order to do this I need to parse off the platform type to set the source since we're primarily a sun shop but do have other platforms we support (sco, hp, linux and sun). Is there any way of doing this with builtin functionality? I also forsee the need to have some sort of pre-processing based on whether it's a loghost, etc. Any plans on adding this or is it already there and I have to dig deeper into the documentation, etc. Thanks... Mike Dotson System Analyst Email: dotson.mike(a)emeryworld.com

2 1

strange thing
by Stefan Seufert 30 Apr '00

30 Apr '00

Hi, yesterday I experienced a very strange problem with syslog-ng which I'd like to report. Maybe someone here has a clue what might have caused this. I am not able to reproduce that problem (on a different machine and I don't want to try it on the machnie I had experienced it since this fast the main server of my company. Well, what happened? I was playing around with syslog-ng. I had added a program(); destination but for some reason it seemed not to work as i wanted (due to a name resolution problem, there always was the IP instead of the hostname in the logfiles so my script did not parse the input correctly, but that not relevant). In order to see what was going on I added a "destination home { udp(1.2.3.4); };" and a "log (source(net); destination(home); };" At home, from where i was working I had a simple VB program running on my win workstation which was listening on port 514 udp and putting everything it recieved in a log-window. However, no messages appaered. So I decided to write the messages to a log file wich should be more reliable than sending them about a dialup connection, so I modified the log statement to "log (source(net); destination(home); destination(all); };" where all was "destination all { file("/var/log/allmessages"); };". From that moment on (i.e. after the HUP) the whole system went to sleep. Every process trying to use syslog blocked. Within a few seconds I had some hundred pop3d and sendmail tasks running, my own ssh was blocked since I tried to issued a logger command. I was not able to telnet or ssh to this host since both daemon tried to log when I connected. Luckily enough someone else at my company still had an open telnet. I called him and advised him to remove the malicious lines from the config and send syslog-ng a SIGHUP. No Effect. Only a SIGKILL was able to help us out of this strange situation. Within seconds all the daemons went back to work again. I really have no idea what might have caused this and I am not able to give you more details. As I said, I was not able to reproduce this situation on a test server. I am an developer myself and I perfectly know that this description is nearly useless because it is lacking facts, but I am not able to deliever some and I thought that it might be better to state that their might be a problem so that if someone else will report something similar it might help to make it easier to puzzle the whole thing together. Please note that the system is very old (Kernel 2.0.35, still libc) and has an uptime of more than 300 days now without having ECC ram. This system became "to important to be upgraded". It will be replaced in the near future with a new machine so that we do not have to take it down but could switch softly. Maybe I can reproduce that situation then and send you some straces etc. Stefan --- Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning.

2 6

Re: syslog-ng && kern.*
by Balazs Scheidler 30 Apr '00

30 Apr '00

> Have you managed to log any kernel messages with syslog-ng? > I have tried almost anything already. What I have is latest version > of syslog-ng and redhat-6.1 klogd running. I've just checked, and it does write kernel messages to the appropriate file. > and on other console.. > [root@cyrex /root]# klogd > [root@cyrex /root]# > [root@cyrex /root]# logger -p kern.info somemessage > and on first console.. > io.c: Preparing fd 4 for reading > io.c: Preparing fd 5 for writing > io.c: Preparing fd 6 for writing > io.c: Preparing fd 7 for writing > io.c: Preparing fd 8 for writing > io.c: Preparing fd 9 for writing > Read EOF on fd 4. > Marking fd 4 for closing. > Closing fd 4. > Garbage collecting while idle... > Objects alive: 160, garbage collected: 5 > > .. and surprise: > [root@cyrex syslog-ng-1.4.3]# tail /var/log/syslog -n 1 > Apr 28 11:05:27 cyrex tontsa: somemessage > [root@cyrex syslog-ng-1.4.3]# tail /var/log/kern.log -n 1 > > Shows up nothing. Any ideas? I'm almost willing to try anything :). > Normal syslog kills my machine when I'm running syslog intensive > jobs and printk() logging isn't nice to look when klogd -f /somefile is run. hmm.. try an strace dump of klogd, and check the priority value it sends to syslog-ng. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

1.5.x?
by Jeremy Hansen 29 Apr '00

29 Apr '00

Just got on the list?. Is there an archive anywhere? Basically I'm looking for information on 1.5.x and the purposed encryption implimentation. We're looking for a way to setup a centralized syslog server and have the traffic from remote machines encrypt the data going to the syslog server. I looked at ssyslog, but it doesn't seem to work the way I initially thought. Data on the local machine is encrpyted but attackers could still potentially screw things up on the local machine. -jeremy -- http://www.xxedgexx.com | jeremy(a)xxedgexx.com ---------------------------------------------

2 1

delay
by Balazs Scheidler 26 Apr '00

26 Apr '00

Hi, Sorry for the long delay it takes for me to answer messages nowadays, but I'm in the middle of several things. (incorporating a new firm, getting furniture to my office, completing my major's thesis etc) Things will be better in one or two weeks, so please be patient, I'll answer all questions and also fix bugs. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

A question concerning filter(DEFAULT);
by Jan Niemann 26 Apr '00

26 Apr '00

Hi, can I use other log paths after using filter(DEFAULT); ? is the order of the log-path entrys important for filter(DEFAULT); ? regards, Jan Niemann

1 0

complex filtering
by Un L'Unique 25 Apr '00

25 Apr '00

Hello, Im currently building our loghost syslog-ng conf file and encounter a problem. How can I filter message so that only not-alredy-routed line will be routed/filtered again ? For example, I am trying to send ssh line to a dedicated log file, since sshd send its message to the deamon facility and that ( generic) daemon facility are send to a generic file, a given line appereas in both file and that waste my disk space :-). I am trying to solve that by adding "and not filter(f_ssh)" in my dameon filter but it does nothing ( not even syntax error message). Is there any error ? Is there another way ? Thanks for any help. Un .... filter f_ssh { program("ssh.*"); }; filter f_cyrus-imapd { program("deliver.*") or program( "imapd.*"); }; filter f_named { program("named.*"); }; filter f_ntp { program(".*ntp.*"); }; filter f_kern { facility(kern); }; filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon) and not filter(f_cyrus-imapd) and not filter(f_ssh) and not filter(f_ntp) and not filter(f_named); }; ....

2 2

regexp in match() function
by Przemek Bak 21 Apr '00

21 Apr '00

Does match() function really use regexp to match a string ? For example I'd like to match following strings: Err err ERR eRR ... What should I write in config file ? Is something like that ok: filter f { match ("[Ee][Rr][Rr]"); }; przemol

1 0

bug ?
by Jan Niemann 21 Apr '00

21 Apr '00

Hi, I think i found a bug in syslog-ng-1.4.3; I'm currently running SuSE's Linux 6.3. every user account uses his own language with glibc's locales. So if I'm logged in as normal user i speak german with my computer; some months have other abbreviations : March (Mar) -> März (Mär) May (May) -> Mai (Mai) So if the time is somewhere in may, and my user logs something it'll look like this : May ... May ... Mai ... :-( May ... The problem : if i have a destination like destination{ file("/var/log/messages-$MONTH-$YEAR"); }; and i'm in March/May 2000 and my normal user uses logger or other programs like su; a file /var/log/messages-12-1999 gets created containing all localized log-entrys. Bye, Jan Niemann

1 0

Re: Syslog - log_fifo_size?
by Balazs Scheidler 20 Apr '00

20 Apr '00

On Wed, Apr 19, 2000 at 11:20:54PM -0400, Scott Galambos wrote: > I can't get log_fifo_size to work. It appears to done nothing at all. > > For example: > destination file_misc { file("/var/log/misc.log" log_fifo_size(4)); }; > > The number of lines in misc.log goes far beyond 4. Same thing if in the > options line. How can I limit the size of the log files? Is that what > log_fifo_size is suppose to do? no. log_fifo_size controls the number of log entries in the output queue, and for files it may not be used at all, since files are always writable. output queues are used for example on TCP connections, when the destination host or network can't accept messages fast enough. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Full date?
by bryan＠tummy.com 19 Apr '00

19 Apr '00

Is there any way I can have syslog-ng include the year when it writes the current date/time of a log entry? For example currently a log entry looks like this: Apr 19 13:49:00 src@testbox PAM_pwdb[6498]: (su) session closed for user root Is there any way to have it print this instead: Apr 19 2000 13:49:00 src@testbox PAM_pwdb[6498]: (su) session closed for user root Thanks, Bryan -- http://www.tummy.com/ Consulting and Software for Linux and Unix KRUD - Kevin's Red Hat Uber Distribution - the Freshest Red Hat every month

1 0

non-root and chroot
by Aleph One 19 Apr '00

19 Apr '00

Is there any work in allowing syslog-ng to: a) change its uid and gids to non-root after is has started and opened the appropriate inputs. b) chroot itself after it has started an opened the appropriate inputs. (a) is simple to implement. (b) requires a little more thought. e.g. it should be smart enough to know that if a destination file is under /var/log/logfiles/$DAY if it chroots to /var/log it should try to open /logfiles/$DAY and not /var/log/logfiles/$DAY. -- Aleph One / aleph1(a)underground.org http://underground.org/ KeyID 1024/948FD6B5 Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01

2 1

syslog-ng 1.4.3
by Balazs Scheidler 19 Apr '00

19 Apr '00

Hi, I've released the latest stable release of syslog-ng, versioned 1.4.3. It contains a few bugfixes, for more information check out the changelog. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

mountd log entries...
by Jan Niemann 19 Apr '00

19 Apr '00

Hi, every log-file entry from mountd is followed by an empty log-message (only time and source are displayed) is this a bug in syslog-ng or mountd ? regards, Jan Niemann

2 1

Missing log entry on HUP
by bryan＠tummy.com 14 Apr '00

14 Apr '00

Ok, I've been continuing my testing of syslog-ng for reliability, and I've run into this problem/bug. When I HUP syslog-ng on the server and then a client tries to send a message, the connection is re-established to the server but the server loses the message. Example: server: [root@testbox syslog-ng]# killall -HUP syslog-ng client: [root@reptile syslog-ng]# logger test2; logger test3 log file: Apr 14 14:08:14 src@testbox syslog-ng[30283]: AF_INET client connected from 10.1.1.16, port 3724 Apr 14 14:13:51 src@reptile/reptile syslog-ng[8069]: Connection broken, reopening in 1 seconds Apr 14 14:13:51 src@reptile/reptile bryan: test3 Where did test2 go??? I have time_reopen(1); just for during testing. I'm planning on changing that to 15 or so later. Thanks, Bryan -- http://www.tummy.com/ Consulting and Software for Linux and Unix KRUD - Kevin's Red Hat Uber Distribution - the Freshest Red Hat every month

1 0

syslog-ng 1.4.2 and kernel messages on SunOS 5.6
by Massimo Loschi 14 Apr '00

14 Apr '00

Hi, I used syslog-ng 1.4.0 (very useful!) on a SunOS 5.6 sun4u host, with the following configuration: options { create_dirs(yes); sync(0); chain_hostnames(off); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source net { udp(ip(A.B.C.D) port(514)); }; [...] destination dstandard { file("/var/log/host/$HOST/$PROGRAM/$YEAR-$MONTH/$DAY.log" group("mygroup") dir_perm(0755) perm(0644) ); }; [...] log { source(local); source(net); destination(dstandard); }; When I start syslog-ng, in /var/log/host/machine appears several strange directories: drwxr-xr-x 3 other 512 Mar 31 14:48 PCI-device drwxr-xr-x 3 other 512 Mar 31 14:48 SUNW,hme0 drwxr-xr-x 3 other 512 Mar 31 14:48 SUNW,hme1 drwxr-xr-x 3 other 512 Mar 31 14:48 SunOS Release 5.6 Version Generic_105181-17 drwxr-xr-x 3 other 512 Mar 31 14:48 WARNING drwxr-xr-x 3 other 512 Mar 31 14:48 cpu0 drwxr-xr-x 3 other 512 Mar 31 14:48 glm0 drwxr-xr-x 3 other 512 Mar 31 14:48 pci0 at root drwxr-xr-x 3 other 512 Mar 31 14:48 root on drwxr-xr-x 3 other 512 Mar 31 14:48 sd0 at glm0 drwxr-xr-x 3 other 512 Mar 31 14:48 sd1 at glm0 drwxr-xr-x 3 other 512 Mar 31 14:50 sshd drwxr-xr-x 3 other 512 Mar 31 14:48 su0 at ebus0 drwxr-xr-x 3 other 512 Mar 31 14:48 su1 at ebus0 drwxr-xr-x 3 other 512 Mar 31 14:48 syslog-ng It appears the problem that the version 1.4.2 should be fix (function parse_log_msg in file src/log.c), but instaling and running this version, it works like the 1.4.0. Another strange thing happens (with both 1.4.0 and 1.4.2): the directories and the files create by syslog-ng don't have the permissions specified in the configuration ( dir_perm(0755) perm(0644) ), but those coherent with the umask of the root user. It is a my stupid error in syslog-ng.conf file or someother people have this problems? Thanks in advance Massimo ------------------------------------------------------------------------------ Massimo Loschi E-mail: m.loschi(a)nextra.it Network & Core Systems NEXTRA S.p.A. WWW: http://www.nextra.it Via Isonzo, 55/2 Tel: +39 51 6139211 40033 Casalecchio di Reno Fax: +39 51 6114455 Bologna - ITALY ------------------------------------------------------------------------------

1 0

Re: [syslog-ng] Collecting Logs on Loghost
by peter.klausner＠systor.com 14 Apr '00

14 Apr '00

Hi Wolfi + Gero Your projects look interesting, because there seems to be not much publicly available information on that area. ... :o how much net load does syslog create? : ... :o how much data does a host generate? : The overhead of the syslog protocol is rather small. The problem is the volume of logging done by the hosts/applications. Normal operations cause no significant loads. But if things go wrong, then log info ranges from 0..infinity. I saw 1 gig /var filesystems filled in no time flat by syslogd. You don't want this in your DB, do you? So a serious architecture requires some preprocessing before sending messages to the central host. ... :o common tools : :i'm aware of several analyzing tools (swatch, logsurfer ... from : Not to forget the big commercial framework packages: CA Unicenter, HP OpenView, Tivoli TME, BMC Patrol + Command/Post. A smaller product with very good reputation is Netcool Omnibus. All these provide agents, which scan and preprocess arbitrary logfiles. Yes, with central configuration and pre-defined templates for standard log entries. No, long term analysis is not [yet] easy with these, but service reporting functionality is sprouting up everywhere and hopefully useful in the near future. ... :as said, i'd be very interested on your thoughts on the topic, your :experiences and maybe references to papers/tools. : Although everybody must work on this, there is not much public stuff on this AFAIK. Maybe www.summitonline.com has a bit. For analysis of complex event patterns, a rather new approach is to visualize the conceptual relationship of events. E.g.: Girardin98: A Visual Approach for Monitoring Logs (http://www.usenix.org/events/lisa98/girardin.html) Hellerstein99: EventBrowser: A Flexible Tool for Scalable Analysis of Event Data" (http://www.research.ibm.com/PM/perf_mgt.html) HTH Peter

1 0

Log analyzer/syslog-ng problems
by Bryan Stillwell 13 Apr '00

13 Apr '00

Hello everyone, I'm currently doing research at my job about writing a log analyzer. The first step we wish to accomplish is setting up a central log server. The server will be just for logs and will be secured so that it would be almost impossible for someone who has compromised another machine on the netowrk to modify the log files. The log server will be logging both internal and external machines, so we would really like for communication to be well encrypted. As I understand this option won't be implemented until the next version of syslog-ng. After this step is done we will set it up to automatically enter all logs into a postgresql database or mysql database for easier analysis. (I've been told postgresql has some native IP address data types that will come in handy.) However our number one item on the list is to make sure that the logs get to the server in a timely, consistant, and accurate manner. So I started doing some testing on various things that might cause problems during the transfering of the log data. Some of the things that I want to watch out for are: o What happens if the network is down for a day or two at a time? I want to make sure that they don't just disappear. o What if the network is being hit with a DOS attack and packets never reach the log server? or they reach the log server but the reply never gets back to the source computer? o What kind of verification can be done to make sure all the data made it to the log server ok? Should we log locally and remotely and compare the two at the end of each day? or can syslog-ng take care of it all? o What about if the main server dies and has to be restarted? client dies? Some of those questions will probably have the same answers, but I ran into the following problem when I started doing some stress tests between two computers on the internal lan. I've included the two syslog-ng.conf files to the end of this message. reptile is the client computer and testbox is the server. I ran the command `logger -f /usr/dict/linux.words` to test out how well it works. Apr 13 10:39:27 src@reptile/reptile logger: Aarhus Apr 13 10:39:27 src@reptile/reptile logger: Aaron ... Apr 13 10:39:38 src@reptile/reptile logger: strips Apr 13 10:39:38 src@reptile/reptile logger: striptease Apr 13 10:39:40 src@reptile/reptile logger: worked Apr 13 10:39:40 src@reptile/reptile logger: worker ... Apr 13 10:39:40 src@reptile/reptile logger: worn Apr 13 10:39:40 src@reptile/reptile logger: worried Apr 13 10:39:40 src@reptile/reptile logger<13>Apr 13 10:39:38 src@reptile logger: strive Apr 13 10:39:38 src@reptile/reptile logger: striven Apr 13 10:39:38 src@reptile/reptile logger: strives ... Apr 13 10:39:40 src@reptile/reptile logger: workbook Apr 13 10:39:40 src@reptile/reptile logger: workbooks Apr 13 10:34:54 reptile/reptile : worrier Apr 13 10:39:40 src@reptile/reptile logger: worriers Apr 13 10:39:40 src@reptile/reptile logger: worries ... Apr 13 10:39:40 src@reptile/reptile logger: Zulus Apr 13 10:39:40 src@reptile/reptile logger: Zurich So it works until it hits 'striptease' (purely coincidence btw) and then skips to 'worked'. When it hits 'worried' it switches back to where it left off and continues until it hits 'workbooks' where the previous group was supposed to be at. Other than that problem everything transferred fine. Any ideas on how to have that autofix itself, maybe I don't have the conf files setup correctly? Would it be better to use udp even though dropped packets will never be known about? I just want to maintain the upmost integrity in the log files. --- testbox(server) syslog-ng.conf --- options { long_hostnames(on); sync(0); log_fifo_size(100); }; source src { unix-dgram("/dev/log"); tcp(); internal(); }; destination local_log { file("/tmp/deleteme.log"); }; log { source(src); destination(local_log); }; --- testbox(server) syslog-ng.conf --- --- reptile(client) syslog-ng.conf --- options { sync(0); log_fifo_size(100000); }; source src { unix-dgram("/dev/log"); internal(); }; destination master_log_server { tcp("10.1.1.10" port(514)); }; log { source(src); destination(master_log_server); }; --- reptile(client) syslog-ng.conf --- Thank you, Bryan Stillwell -- http://www.tummy.com/ Consulting and Software for Linux and Unix KRUD - Kevin's Red Hat Uber Distribution - the Freshest Red Hat every month

1 0

Recommended server specs
by syslog-ng＠moe.co.uk 12 Apr '00

12 Apr '00

Hi All, Was just wondering what people recommend spec wise for a loghost? Currently have a P2-350, 320mb (ish) of ram and 18gb to store logs to. There are about 80 to 90 machines logging to this machine. I think it will run out of disk space before anything else. syslog-ng tends to use 3% to 7% cpu with a sync(5). Anyone have any interesting loghost information/experiences? Cheers, John

1 0

local[0-7], can't get them to write to file.
by i＠moe.co.uk 12 Apr '00

12 Apr '00

Hi All, I'm having a few minor problems writing local 6 and 7 to files. I'm most likely doing something incorrect in the config file, can some one help me out please. source src { unix-dgram("/var/run/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination local6 { file("/var/log/local6.log"); }; destination local7 { file("/var/log/local7.log"); } filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; log { source(src); filter(f_local6); destination(local6); }; log { source(src); filter(f_local7); destination(local7); }; Cheers, John

2 3

RE: [syslog-ng] complex filtering
by Hamilton, Andrew Mr. 12 Apr '00

12 Apr '00

I am using 1.4.2 which I assume is still the latest version since I haven't heard of anything new lately and that being the latest on the web site. I will see if I can duplicate what I was doing and get the config to you and the logs I'm getting from it. Drew > -----Original Message----- > From: Leopold Toetsch [SMTP:lt@toetsch.at] > Sent: Thursday, April 06, 2000 12:17 PM > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re: [syslog-ng] complex filtering > > > ----- Original Message ----- > From: Hamilton, Andrew Mr. <HamiltonA(a)hq.5sigcmd.army.mil> > To: <syslog-ng(a)venus.terrasoft.hu> > Sent: Donnerstag, 06. April 2000 07:10 > Subject: RE: [syslog-ng] complex filtering > > > > I've also had problems with the "and not" filtering in syslog-ng. I > ended > > up having to do a kind of a DeMorgan method and change the filtering > around > > a little. I got it to do what I wanted but not quite the way I > expected. > > Are you using the latest version? > There was a bug concerning 'not', which should be fixed now. > > leo > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

write() failed (errno 32)
by Przemek Bak 07 Apr '00

07 Apr '00

Hi, I have following lines in syslog-ng.conf filter aaa { match ("aaa"); }; destination aaa { program ("/usr/bin/mail -s WARN user"); }; log { source(src); filter (aaa); destination(aaa); }; When I run logger: # logger aaaIIII in messages file I have: Apr 5 13:06:26 src@host syslog-ng[1627]: io.c: do_write: write() failed (errno 32), Broken pipe What does it mean ? It happen from time to time, not always. przemol

2 6