- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Error in running syslogng client - source plugin sun-streams not found
by Balla, Hithendra (EXT-Other - IN/Bangalore) 04 Jun '12

04 Jun '12

Hi all, In the below conf file, I can see @include "scl.conf". If I remove that line or if I change it to --> include "scl.conf"; [i.e remove @ and add ; at the end], it did not complain any error. Is that expected behavior? Thanks Hithendra _____________________________________________ From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Monday, June 04, 2012 4:01 PM To: 'Syslog-ng users' and developers' mailing list' Subject: Error in running syslogng client - source plugin sun-streams not found Hi all, Can somebody help here in identifying the issue here. It says source plug-in sun-streams not sound. I have configured syslog-ng with --enable-ssl --enable-sun-streams A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -V syslog-ng 3.4.0alpha2 Installer-Version: 3.4.0alpha2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainli ne--3.4--master#ab25c4c2a32988d86a5e024d784db7ad48f17cd2 Compile-Date: Jun 4 2012 18:38:40 Available-Modules: afsocket,afsocket-notls,afstreams,affile,afprog,afuser,afmongodb,csvpars er,confgen,syslogformat,basicfuncs,dbparser,tfuuid,afsocket-tls Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: on A02-LEM-CSLPN01A# This is the client config file ######################################################################## ##### #Syslog-ng Client configuration File. # @version: 3.3 @include "scl.conf" options { keep_hostname (yes); log_fifo_size (1000); }; source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); }; A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -fFvde ~/syslog_conf/mod/syslog-ng_client.conf nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Starting to read include file; filename='/usr/local/etc/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/local/share/include/scl' Global value changed; define='include-path', value='/usr/local/etc:/usr/local/share/include' Starting to read include file; filename='/usr/local/etc/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Module loaded and initialized successfully; module='syslogformat' Module loaded and initialized successfully; module='basicfuncs' Module loaded and initialized successfully; module='afsocket' Module loaded and initialized successfully; module='affile' Module loaded and initialized successfully; module='afprog' Module loaded and initialized successfully; module='afuser' Module loaded and initialized successfully; module='dbparser' Module loaded and initialized successfully; module='csvparser' Finishing include; filename='/usr/local/etc/modules.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/usr/local/etc/scl.conf', depth='1' Error parsing source, source plugin sun-streams not found in /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, column 18: source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)) ;}; ^^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng A02-LEM-CSLPN01A

1 0

Re: [syslog-ng] Need help in running syslog-ng
by Balla, Hithendra (EXT-Other - IN/Bangalore) 04 Jun '12

04 Jun '12

Hi, This is the output with Fvde. It is showing relocation error for libafsocket.so. Any idea why it is coming ? A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -fFvde ~/syslog_conf/mod/syslog-ng_client.conf nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Starting to read include file; filename='/usr/local/etc/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/local/share/include/scl' Global value changed; define='include-path', value='/usr/local/etc:/usr/local/share/include' Starting to read include file; filename='/usr/local/etc/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Module loaded and initialized successfully; module='syslogformat' Module loaded and initialized successfully; module='basicfuncs' Error opening plugin module; module='afsocket', error='ld.so.1: syslog-ng: fatal: relocation error: file /usr/local/lib/syslog-ng/libafsocket.so: symbol request_init: referenced symbol not found' Module loaded and initialized successfully; module='affile' Module loaded and initialized successfully; module='afprog' Module loaded and initialized successfully; module='afuser' Module loaded and initialized successfully; module='dbparser' Module loaded and initialized successfully; module='csvparser' Finishing include; filename='/usr/local/etc/modules.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/usr/local/etc/scl.conf', depth='1' Error parsing source, source plugin sun-streams not found in /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, column 18: source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)) ;}; ^^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng A02-LEM-CSLPN01A# Thanks Hithendra -----Original Message----- From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Friday, June 01, 2012 5:49 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Need help in running syslog-ng Hi, Please find the attached output of configure. I tried running the command with -Fvde along with -f, but it says "excess number of args". Can you tell me if I missed anything here.? A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -f -Fvde /export/home/root/syslog_conf/mod/syslog-ng_client.conf Excess number of arguments Thanks Hithendra -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ext Gergely Nagy Sent: Friday, June 01, 2012 5:29 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Need help in running syslog-ng "Balla, Hithendra (EXT-Other - IN/Bangalore)" <hithendra.balla.ext(a)nsn.com> writes: > A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -f > /export/home/root/syslog_conf/mod/syslog-ng_client.conf > > WARNING: Configuration file format is too old, please update it to use > the 3.4 format as some constructs might operate inefficiently; > Error parsing source, source plugin sun-streams not found in > /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, > column 18: > > source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); }; Could you post the output of configure, or config.log, perhaps? Also, you can try running syslog-ng with the -Fvde parameters (in addition to -f), which will output quite a lot of debug info to stderr, which might help us determine what's going wrong. >From both errors you showed, it seems syslog-ng is unable to find a module or two. Why that is so, I can't tell. config.log and the output of running syslog-ng with -Fvde could help us figure out the reason. -- |8] ________________________________________________________________________ ______ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

Error in running syslogng client - source plugin sun-streams not found
by Balla, Hithendra (EXT-Other - IN/Bangalore) 04 Jun '12

04 Jun '12

Hi all, Can somebody help here in identifying the issue here. It says source plug-in sun-streams not sound. I have configured syslog-ng with --enable-ssl --enable-sun-streams A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -V syslog-ng 3.4.0alpha2 Installer-Version: 3.4.0alpha2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainli ne--3.4--master#ab25c4c2a32988d86a5e024d784db7ad48f17cd2 Compile-Date: Jun 4 2012 18:38:40 Available-Modules: afsocket,afsocket-notls,afstreams,affile,afprog,afuser,afmongodb,csvpars er,confgen,syslogformat,basicfuncs,dbparser,tfuuid,afsocket-tls Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: on A02-LEM-CSLPN01A# This is the client config file ######################################################################## ##### #Syslog-ng Client configuration File. # @version: 3.3 @include "scl.conf" options { keep_hostname (yes); log_fifo_size (1000); }; source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); }; A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -fFvde ~/syslog_conf/mod/syslog-ng_client.conf nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Starting to read include file; filename='/usr/local/etc/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/local/share/include/scl' Global value changed; define='include-path', value='/usr/local/etc:/usr/local/share/include' Starting to read include file; filename='/usr/local/etc/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Module loaded and initialized successfully; module='syslogformat' Module loaded and initialized successfully; module='basicfuncs' Module loaded and initialized successfully; module='afsocket' Module loaded and initialized successfully; module='affile' Module loaded and initialized successfully; module='afprog' Module loaded and initialized successfully; module='afuser' Module loaded and initialized successfully; module='dbparser' Module loaded and initialized successfully; module='csvparser' Finishing include; filename='/usr/local/etc/modules.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/usr/local/etc/scl.conf', depth='1' Error parsing source, source plugin sun-streams not found in /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, column 18: source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)) ;}; ^^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng A02-LEM-CSLPN01A

1 0

(no subject)
by pedro castro 03 Jun '12

03 Jun '12

Gain Your Freedom, Manage Your Own Business http://www.fastauditores.com/httppxdvxdz-2.php?rytnumberID=353 Sun, 3 Jun 2012 12:57:56 _______________ Fiber board may also be used, but this is moredifficult to handle. journey wynwode

1 0

Need help in running syslog-ng
by Balla, Hithendra (EXT-Other - IN/Bangalore) 01 Jun '12

01 Jun '12

<<mod_client.conf>> <<mod_server.conf>> Hi all, This is Hithendra. I have succefully compiled and installed syslog-ng-3.4 version on Solaris Sparc10. I have used the following options while configuring syslog-ng. ./configure --with-ssl=/usr/local/ssl/ --enable-ssl --enable-sun-streams When I try to run the client /usr/local/sbin/syslog-ng -f /export/home/root/syslog_conf/mod/syslog-ng_client.conf --> I am getting the following error. A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -f /export/home/root/syslog_conf/mod/syslog-ng_client.conf WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Error parsing source, source plugin sun-streams not found in /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, column 18: source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)) ;}; ------------------------------------------------------------------------ --------------------------------------------------- When I try to run the server A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -f /export/home/root/syslog_conf/mod/syslog-ng_server.conf --> I am getting the following error WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Using a global log-iw-size() option was removed, please use a per-source log-iw-size(); Error parsing afsocket, syntax error, unexpected LL_IDENTIFIER in /export/home/root/syslog_conf/mod/syslog-ng_server.conf at line 21, column 13: tls( ^^^ Can somebody help here in identifying issue and provide some input on how to get rid of it. Please find the attached conf files. Thanks Hithendra

2 2

syslog_ng 3.3.4 make error on HPUX HPPA 11.11
by Rakesh Rajasekharan 01 Jun '12

01 Jun '12

Hi, I am trying to compile syslog-ng 3.3.4 version on an HPUX HPPA 11.11 machine. The configure options I used were. ./configure --enable-dynamic-linking --prefix=/opt/soe/local/syslog-ng-3.3.4 Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -pthread -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -D_REENTRANT -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/syslog-ng-3.3.4/eventlog/include/eventlog -I/usr/local/include -I$(top_srcdir)/lib/ivykis/lib/include -I$(top_builddir)/lib/ivykis/lib/include -I$(top_srcdir)/lib/ivykis/modules/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lcl prefix : /opt/soe/local/syslog-ng-3.3.4 linking mode : dynamic __thread keyword : no Submodules: ivykis : internal libmongo-client : internal Features: Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : no Linux capability support : no PCRE support : yes Env wrapper support : no systemd support : no (unit dir: none) Modules: Module search path : /opt/soe/local/syslog-ng-3.3.4/lib/syslog-ng Default module list : affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat Sun STREAMS support (module): no SSL support (module) : no SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : no (using no) The make though fails with the below error. /bin/sh ../../libtool --tag=CC --mode=link gcc -Wall -g -O2 -o client client.o ../libivykis.la -lpthread libtool: link: gcc -Wall -g -O2 -o client client.o ../.libs/libivykis.a -lpthread /usr/ccs/bin/ld: Unsatisfied symbols: pthread_sigmask (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_init (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_destroy (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_unlock (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_lock (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) /usr/ccs/bin/ld: (Warning) Linker features were used that may not be supported in future releases. The +vallcompatwarnings option can be used to display more details, and the ld(1) man page contains additional information. This warning can be suppressed with the +vnocompatwarnings option. collect2: ld returned 1 exit status make[7]: *** [client] Error 1 make[7]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis/lib/test' make[6]: *** [all-recursive] Error 1 make[6]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis/lib' make[5]: *** [all-recursive] Error 1 make[5]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis' make[4]: *** [all] Error 2 make[4]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis' make[3]: *** [all-recursive] Error 1 make[3]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib' make[2]: *** [all] Error 2. I have compiled glib-2.16.5 statically and eventlog_0.2.12. make[2]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/compile/syslog/syslog-ng-3.3.4' make: *** [all] Error 2. Please help me fix this. I have tried tweaking with the comfigure options but could no tget anywhere. Regards, Rakesh

3 6

[Bug 157] New: syslog-ng 3.2.x/3.3.x: test_sql.py and 64-bit systems
by bugzilla＠bugzilla.balabit.com 01 Jun '12

01 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=157 Summary: syslog-ng 3.2.x/3.3.x: test_sql.py and 64-bit systems Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=45) --> (https://bugzilla.balabit.com/attachment.cgi?id=45) Add '/usr/lib64/dbd/' to the search paths Hi, In 64-bits systems we need to add lib64 directories to the libdbi/libdbdsqlite3 module search path in order to successfully run the test_sql functional test. Location of libdbdsqlite3.so in 64-bit Fedora/RHEL: ---------- $ rpm -ql libdbi-dbd-sqlite /usr/lib64/dbd/libdbdsqlite3.so ---------- Affected syslog-ng versions: At least the 3.2 and 3.3 branches (I haven't check the 3.4 development branch). Fix: The attached patch adds the '/usr/lib64/dbd/' directory to the search path. Adding '/usr/local/lib64/dbd' should also make sense (but it is not done by the attached patch). /jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 180] New: README file in spec files but not in tar.gz
by bugzilla＠bugzilla.balabit.com 31 May '12

31 May '12

https://bugzilla.balabit.com/show_bug.cgi?id=180 Summary: README file in spec files but not in tar.gz Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mark.ulmer(a)apollogrp.edu Type of the Report: bug Estimated Hours: 0.0 During rpmbuild process, I've noticed that the syslog-ng.spec and syslog-ng.spec.in files expect a README file that does not exist in the source tar.gz. Unknown if the README was intended to be removed? ./install-sh -o root -g root -m 0644 README \ ${RPM_BUILD_ROOT}/%{_prefix}/share/doc/syslog-ng-3.3.5/README I of course commented out these lines to get past the issue. Mark Ulmer -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 143] New: syslog-ng supervisor dies on SIGHUP
by bugzilla＠bugzilla.balabit.com 31 May '12

31 May '12

https://bugzilla.balabit.com/show_bug.cgi?id=143 Summary: syslog-ng supervisor dies on SIGHUP Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 The process which supervises syslog-ng and restarts it in the event of a crash dies when it receives a SIGHUP. This is a problem as when sending a HUP to syslog-ng to have it reload its config, the HUP will get sent to both the supervisor process and the worker process if doing something like `pkill -HUP syslog-ng`. I attached a gdb to the supervisor and its not a segfault or anything, it just quits. I'm guessing the supervisor doesnt have a signal handler for HUP, so it uses the default action which is to quit. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 175] New: syslog-ng doesnt perform fsync() with fsync option enabled on file destinations
by bugzilla＠bugzilla.balabit.com 31 May '12

31 May '12

https://bugzilla.balabit.com/show_bug.cgi?id=175 Summary: syslog-ng doesnt perform fsync() with fsync option enabled on file destinations Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 While trying to track down an issue on our production system where our box would experience hanging issues every 30 seconds, I discovered this was because syslog-ng wasnt flushing its data, and so when the linux pdflush woke up, it would flush out a ton of data to NFS causing syslog and other applications to hang until the flush completed. Ultimately this was causing messages to be dropped as input buffers were filling up while syslog-ng was hung. This shouldnt have been happening as I have syslog-ng configured with the flush option enabled on the file destination which writes to NFS. I have a workaround in place by forcing pdflush to run more frequently, and have also increased several of the input buffers so they dont fill up so fast. I confirmed this issue by building syslog-ng-3.3.5 and putting a gdb break point on lib/logtransport.c:170, and the break point never triggers. I do have a question about the fsync option as well. Does this option tell syslog-ng to flush() after every write, or after all lines have been written (like from the flush_lines or flush_timeout() options)? If it flushes after every write, would it be possible to get an option to flush only once all the messages in the batch have been written? This is the stripped down configuration I have duplicated the issue with: @version: 3.3 options { keep_hostname(yes); chain_hostnames(no); normalize_hostnames(yes); use_dns(no); use_fqdn(yes); stats_freq(0); mark_freq(0); create_dirs(yes); dir_perm(0755); perm(0644); }; source s_sys { unix-dgram("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; destination d_default { file("/var/log/$FACILITY" flush_lines(1) fsync(yes)); }; log { source(s_sys); destination(d_default); flags(fallback); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7