- syslog-ng - lists.balabit.hu

POLLERR occurred while idle
by Tom Ritter 05 Jul '10

05 Jul '10

I'm getting a large volume of messages that look like this: 23:09:53 hn syslog-ng[30]: POLLERR occurred while idle; fd='13' 23:09:54 hn syslog-ng[30]: POLLERR occurred while idle; fd='14' 23:09:55 hn syslog-ng[30]: POLLERR occurred while idle; fd='13' 23:09:56 hn syslog-ng[30]: POLLERR occurred while idle; fd='14' 23:09:57 hn syslog-ng[30]: POLLERR occurred while idle; fd='13' 23:09:58 hn syslog-ng[30]: POLLERR occurred while idle; fd='14' 23:09:59 hn syslog-ng[30]: POLLERR occurred while idle; fd='13' I have no idea what they are but they won't stop =( I looked at the file descriptors: # ls /proc/30/fd total 0 lr-x------ 1 root root 64 Jul 4 23:21 0 -> /dev/null l-wx------ 1 root root 64 Jul 4 23:21 1 -> /dev/null l-wx------ 1 root root 64 Jul 4 23:21 10 -> /var/log/messages/messages l-wx------ 1 root root 64 Jul 4 23:21 11 -> /var/log/hn/20100704.log l-wx------ 1 root root 64 Jul 4 23:21 13 -> pipe:[28238824] l-wx------ 1 root root 64 Jul 4 23:21 2 -> /dev/null lrwx------ 1 root root 64 Jul 4 23:21 3 -> socket:[28238645] l-wx------ 1 root root 64 Jul 4 23:21 4 -> pipe:[28238641] lrwx------ 1 root root 64 Jul 4 23:21 5 -> socket:[28238650] lr-x------ 1 root root 64 Jul 4 23:21 6 -> /proc/kmsg l-wx------ 1 root root 64 Jul 4 23:21 7 -> /var/log/syslog/syslog.log l-wx------ 1 root root 64 Jul 4 23:21 8 -> /var/log/fw/important.log l-wx------ 1 root root 64 Jul 4 23:21 9 -> /var/log/debug/debug.log And I ran strace looking for fd's 13 and 14. Here are some grep results: strace.log.30964:open("/dev/null", O_WRONLY) = 14 ---- strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 0) = 0 (Timeout) strace.log.30962:poll([{fd=13, events=POLLOUT}], 1, 0) = 1 ([{fd=13, revents=POLLOUT}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 29014) = 1 ([{fd=13, revents=POLLERR}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 0) = 0 (Timeout) strace.log.30962:poll([{fd=13, events=POLLOUT}], 1, 0) = 1 ([{fd=13, revents=POLLOUT}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 27100) = 1 ([{fd=13, revents=POLLERR}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 0) = 0 (Timeout) strace.log.30962:poll([{fd=13, events=POLLOUT}], 1, 0) = 1 ([{fd=13, revents=POLLOUT}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 25102) = 1 ([{fd=13, revents=POLLERR}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 0) = 0 (Timeout) strace.log.30962:poll([{fd=13, events=POLLOUT}], 1, 0) = 1 ([{fd=13, revents=POLLOUT}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 23291) = 1 ([{fd=13, revents=POLLERR}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 0) = 0 (Timeout) strace.log.30962:poll([{fd=13, events=POLLOUT}], 1, 0) = 1 ([{fd=13, revents=POLLOUT}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 21398) = 1 ([{fd=13, revents=POLLERR}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 0) = 0 (Timeout) strace.log.30962:poll([{fd=13, events=POLLOUT}], 1, 0) = 1 ([{fd=13, revents=POLLOUT}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 19680) = 1 ([{fd=13, revents=POLLERR}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 0) = ? ERESTART_RESTARTBLOCK (To be restarted) strace.log.30962:poll([{fd=13, events=POLLOUT}], 1, 0) = 1 ([{fd=13, revents=POLLOUT}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 18183) = 1 ([{fd=13, revents=POLLERR}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 0) = 0 (Timeout) strace.log.30962:poll([{fd=13, events=POLLOUT}], 1, 0) = 1 ([{fd=13, revents=POLLOUT}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 16697) = 1 ([{fd=13, revents=POLLERR}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 0) = 0 (Timeout) strace.log.30962:poll([{fd=13, events=POLLOUT}], 1, 0) = 1 ([{fd=13, revents=POLLOUT}]) strace.log.30962:poll([{fd=13, events=0}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}], 4, 15221) = 1 ([{fd=13, revents=POLLERR}]) ----- strace.log.30962:fcntl(13, F_GETFL) = 0x1 (flags O_WRONLY) strace.log.30962:fcntl(13, F_SETFL, O_WRONLY|O_NONBLOCK) = 0 strace.log.30962:write(13, "POLLERR occurred while idle; fd="..., 168) = 168 strace.log.30962:close(13) = 0 I mussed some pid's around to try and format the email as best I could. Can anyone suggest more debugging steps, or what might be causing this? I haven't seen this error elsewhere, the search results are barren, except the for commit logs. I'm on gentoo using 3.1.1: # syslog-ng --version syslog-ng 3.1.1 Installer-Version: 3.1.1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8747d74491eac3fdf5052194f47a68e659633ca9 Compile-Date: Jun 17 2010 13:37:53 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on -tom

3 2

Syslog-ng writing to files once per minute
by Eric Cables 02 Jul '10

02 Jul '10

I'm hoping this is a really stupid question, but after implementing what I thought to be the fix to this, I can't seem to get it working. I have a number of hosts logging to facility local5, and the destination log file is only updated once per minute (HH:MM.30s to be precise). I've implemented flush_lines(0); and flush_interval(0);, to the global options, but it doesn't seem to have an effect. syslog-ng 3.0.3 My goal is to have logs written to the destination file with minimal latency after syslog-ng receives the message. -- Eric Cables

2 6

[Bug 88] New: rewrite FACILITY does not work.
by bugzilla＠bugzilla.balabit.com 01 Jul '10

01 Jul '10

https://bugzilla.balabit.com/show_bug.cgi?id=88 Summary: rewrite FACILITY does not work. Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Windows Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: alex-pub.balabit(a)reflexion.net Type of the Report: --- Estimated Hours: 0.0 Here is the fragment of my syslog-ng.conf file that demonstrates the problem source remote_sys { tcp( ip( "0.0.0.0" ) port( 514 ) max-connections( 1152 ) ); udp( ip( "0.0.0.0" ) port( 514 ) ); }; destination d_remote_consolidated_log { file( "/var/log/remote/$FACILITY/$FACILITY.log" create_dirs( yes ) perm( 0644 ) dir_perm( 0755 ) template( "$R_ISODATE $HOST -$LEVEL- $PROGRAM[$PID]: $MSGONLY\n" ) frac_digits( 6 ) template_escape( no ) ); }; filter f_apache { facility( local1 ); }; rewrite r_rewrite_apache_facility { set("apache" value("FACILITY")); }; log { source( remote_sys ); filter( f_apache ); rewrite( r_rewrite_apache_facility ); destination( d_remote_consolidated_log ); flags( final ); }; If I issue the following command from the host connected to this syslog-ng server: $ echo this is apache log test | logger -t apache-test -p local1.info Then the output is sent to "/var/log/remote/local1/local1.log" instead of expected "/var/log/remote/apache/apache.log". Also, if I include $FACILITY into the destination template it prints "local1" If I run syslog-ng with -d flag I see this in output: >>Rewrite expression evaluation result; value='FACILITY', new_value='apache' Below is a full log for this test >>Incoming log entry; line='<142>Jun 22 17:36:11 host-1 apache-test: this is a test 2' >>Filter rule evaluation begins; filter_rule='f_filter1' >>Filter node evaluation result; filter_result='not-match', filter_type='facility' >>Filter rule evaluation result; filter_result='not-match', filter_rule='f_filter1' >>Filter rule evaluation begins; filter_rule='f_filter2' >>Filter node evaluation result; filter_result='not-match', filter_type='facility' >>Filter rule evaluation result; filter_result='not-match', filter_rule='f_filter2' >>Filter rule evaluation begins; filter_rule='f_apache' >>Filter node evaluation result; filter_result='match', filter_type='facility' >>Filter rule evaluation result; filter_result='match', filter_rule='f_apache' >>Rewrite expression evaluation result; value='FACILITY', new_value='apache' So this makes me believe that rewrite does happen, but the value is not picked up later. BTW, the documentation for `set` command says that there should be a comma between "apache" and value, but other samples do not put it there. I've tried it both ways to no avail. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 9

spoof-source performance issues
by Martin Holste 01 Jul '10

01 Jul '10

I'm finding that with a destination of udp("10.x.x.x", port(514) spoof_source(yes)) about half of messages get lost when going from one syslog-ng host to another at a high message rate (> 3k/sec). This is on 3.1 OSE and the hosts are on the same subnet and switch, so there shouldn't be any network devices interfering. Has anyone else had this same issue? My hunch is that it's either a performance issue with the way the libnet (I'm using 1.1.2.1 on SuSE 10.2) API is implemented or it's an issue within the libnet API. Has anyone else noticed performance problems when using spoof_source?

5 12

[Bug 91] New: Cisco ASA log parsing issues
by bugzilla＠bugzilla.balabit.com 01 Jul '10

01 Jul '10

https://bugzilla.balabit.com/show_bug.cgi?id=91 Summary: Cisco ASA log parsing issues Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jon(a)jonjames.net Type of the Report: bug Estimated Hours: 0.0 Orignal LOG as seen my TCPDUMP 16:42:08.734684 IP 172.16.32.157.syslog > 172.16.32.172.syslog: SYSLOG local4.notice, length: 95 E..{.......^.. ... ......g<.<165>Jul 01 2010 00:32:59: %ASA-5-111001: Begin configuration: 172.16.16.154 writing to memory After being relayed as seen my TCPDUMP 16:42:59.208826 IP 172.16.32.172.33753 > 172.16.32.225.syslog: SYSLOG local4.notice, length: 120 E...a.@.@.?... ... ........?<165>1 2010-07-01T00:33:50-04:00 172.16.32.157 %ASA-5-111001 - - - Begin configuration: 172.16.16.154 writing to memory As you can see, syslog-ng appears to be messing with the datestamp and therefore the RSA envision device I'm relaying to does not recognize the log as being from a cisco asa. Is there a way to update the log parser in syslog to resolve this issue ? syslog-ng.conf (parts) @version: 3.0 options { time_sleep(30); time_reap(30); mark_freq(30); dns_cache(yes); use_fqdn(no); keep_hostname(yes); chain_hostnames(no); use_dns(no); dns_cache_size(250000); dns_cache_expire(300); dns_cache_expire_failed(300); stats_freq(3600); log_msg_size(10000); }; source s_extranet { udp(ip("172.16.32.172") port(514)); }; log { source(s_extranet); destination(d_syslog_udp); }; destination d_syslog_udp { syslog("172.16.32.225" transport("udp") port(514)); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 3

Memory leak can occur with supressed duplicate log messages
by andy kitchingman 30 Jun '10

30 Jun '10

Hi Due to my company firewall, I do not have access to the git public repository, so I will post this here. I believe there is a memory leak when duplicate messages are suppressed and messages cannot be consumed: logwriter.c: log_writer_last_msg_flush(LogWriter *self) ------------------------------------------- log_queue_push_tail(self->queue, m, &path_options) can return FALSE (message cannot be consumed), in which case the local LogMessage m is leaked. The fix should be something like if (!log_queue_push_tail(self->queue, m, &path_options)) { log_msg_unref(m); } Regards Andy Kitchingman

2 1

[Bug 89] New: DOCUMENTATION: incorrect structure of embedded log statement.
by bugzilla＠bugzilla.balabit.com 30 Jun '10

30 Jun '10

https://bugzilla.balabit.com/show_bug.cgi?id=89 Summary: DOCUMENTATION: incorrect structure of embedded log statement. Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Windows Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: alex-pub.balabit(a)reflexion.net Type of the Report: --- Estimated Hours: 0.0 In syslog-ng-ose-v3.1-guide-admin-en.pdf. Topic "4.5.1. Using embedded log statements" Shows incorrect structure of embedded log statement: log { source(s1); source(s2); ... optional_element(filter1|parser1|rewrite1); optional_element(filter2|parser2|rewrite2);... destination(d1); destination(d2); ... <<<<<<<<<<<<<<<<<<<<<< ! Wrong position ! flags(flag1[, flag2...]); <<<<<<<<<<<<<<<<<<<<<< #embedded log statement log { optional_element(filter1|parser1|rewrite1); optional_element(filter2|parser2|rewrite2);... destination(d1); destination(d2); ... #another embedded log statement log { optional_element(filter1|parser1|rewrite1); optional_element(filter2|parser2|rewrite2);... destination(d1); destination(d2); ... }; }; }; If you follow this structure, the resulting config file will not compile, because `flags` element must appear after the embedded log statement, at least according to cfg-grammar.y: log_stmt : '{' log_items log_forks log_flags '}' { LogPipeItem *pi = log_pipe_item_append_tail($2, $3); $$ = log_connection_new(pi, $4); } ; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

WARNING: the match() filter without the use of the value() ...
by ml ml 29 Jun '10

29 Jun '10

Hello List, i am getting this error: WARNING: the match() filter without the use of the value() option is deprecated and hinders performance, please update your configuration; Restarting syslog-ng: Stopping syslog-ng: OK. Starting syslog-ng: WARNING: the match() filter without the use of the value() option is deprecated and hinders performance, please update your configuration; with this config: @version: 3.0 #Default configuration file for syslog-ng. # # For a description of syslog-ng configuration file directives, please read # the syslog-ng Administrator's guide at: # # http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/bk01-toc.html # ### 1.) OPTIONS options { long_hostnames(off); }; source src { unix-stream("/dev/log"); internal(); }; source kernsrc { file("/proc/kmsg"); }; ### 2.) DESTINATION destination ldap { file("/var/log/ldap.log"); }; destination authlog { file("/var/log/auth.log"); }; destination syslogmsg { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination user { file("/var/log/user.log"); }; destination mail { file("/var/log/mail.log"); }; destination lighttpd { file("/var/log/lighttpd.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination all { file("/var/log/all.log"); }; destination fcron { file("/var/log/fcron.log"); }; destination sshd { file("/var/log/sshd.log"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; ### 3.) FILTERS filter f_ldap { match("slapd"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_debug { not facility(auth, authpriv, news, mail) ; }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_lighttpd { match("lighttpd"); }; filter f_fcron { match("fcron"); }; filter f_sshd { match("sshd"); }; filter f_syslog { not facility(authpriv, mail) and not filter(lapd) and not filter(sshd) and not filter(fcron) ; }; log { source(src); filter(f_sshd); destination(sshd); }; log { source(src); filter(f_fcron); destination(fcron); }; log { source(src); filter(f_ldap); destination(ldap); }; log { source(src); filter(f_syslog); destination(syslogmsg); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(kernsrc); filter(f_kern); destination(kern); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); destination(all); }; Any idea what i am doing wrong?

3 5

Two instances of syslog-ng on the same host?
by John R. Dunning 29 Jun '10

29 Jun '10

Hi wizards. Apologies if this is an FAQ or something, but I've dug all around and failed to find the answer. I have a system on which, for reasons I'd rather not go into here, it makes sense to run two instances of syslog-ng, one for standard logging of local events, the other acting as a proxy for a flock of other systems. The proxy starts first, very early in the init sequence, the regular one starts later. This all worked great with syslog-ng 2, but I recently upgraded to version 3.1.1 and I can't get it to work correctly. The proxy instance is supposed to only be listening on a tcp socket, but it seems to also be opening the AF_UNIX socket to /dev/log. This causes the launch of the main instance to fail. I've been through the docs, but it's not obvious to me how to get syslog-ng to start without opening the socket to /dev/log. Hints? Thanks in advance...

4 7

Re: [syslog-ng] Two instances of syslog-ng on the same host?
by Rory Toma 27 Jun '10

27 Jun '10

As a point of reference, I have a setup with over 200 syslog-ng processes and it works fiine. "Patrick H." <syslogng(a)feystorm.net> wrote: >Yes, that should work just fine. I run a box with 4 syslog instances and >they all place nice together. My setup isnt exactly the same, but I have >no problems which you are experiencing. My setup: I have a master >syslog-ng process that does nothing but accept connections from remote >hosts and from the local system. That process then relays the messages >to other local syslog-ng processes which do the actual work (lots and >lots of parsing). >I only included the options and source sections as theyre the only ones >that matter. > >Master syslog-ng process that accepts from local & remote & forwards to >other local processes >@version: 3.0 ># syslog-ng configuration file. ># ># This should behave pretty much like the original syslog on RedHat. But ># it could be configured a lot smarter. ># ># See syslog-ng(8) and syslog-ng.conf(5) for more information. ># > >options { > time_reopen(1); > use_dns(no); > use_fqdn(yes); > keep_hostname(yes); > create_dirs(yes); > perm(0644); > dir_perm(0755); > log_iw_size(50000); > log_fifo_size(100000); > #time_sleep(1); >}; > >source s_sys { > file("/proc/kmsg" program-override("kernel")); > unix-stream ("/dev/log"); > internal(); >}; >source s_net { > tcp(ip(0.0.0.0) port(514) max-connections(1000)); > udp(ip(0.0.0.0) port(514)); >}; > > >syslog-ng that accepts the forwarded messages >@version: 3.0 ># syslog-ng configuration file. ># ># This should behave pretty much like the original syslog on RedHat. But ># it could be configured a lot smarter. ># ># See syslog-ng(8) and syslog-ng.conf(5) for more information. ># > >options { > time_reopen(1); > long_hostnames(off); > use_dns(no); > use_fqdn(no); > keep_hostname(yes); > create_dirs(yes); > perm(0644); > dir_perm(0755); > #log_fetch_limit(100000); > #log_iw_size(200000); > #log_fifo_size(400000); > flush_lines(50); > flush_timeout(5000); > #stats_freq(10); > #stats_level(2); > #time_sleep(1); >}; > > >source s_master { > #syslog(ip(127.0.0.1) port(515) transport('tcp') so_keepalive(yes) >log_iw_size(1000)); > tcp(ip(127.0.0.1) port(515) flags('syslog-protocol')); >}; >source s_syslog { > internal(); >}; > > > > > > > > > > >Sent: Saturday, June 26, 2010 6:08:42 PM >From: John R. Dunning <jrd(a)jrd.org> >To: syslog-ng(a)lists.balabit.hu >Subject: [syslog-ng] Two instances of syslog-ng on the same host? >> Hi wizards. Apologies if this is an FAQ or something, but I've dug >> all around and failed to find the answer. >> >> I have a system on which, for reasons I'd rather not go into here, it >> makes sense to run two instances of syslog-ng, one for standard >> logging of local events, the other acting as a proxy for a flock of >> other systems. >> >> The proxy starts first, very early in the init sequence, the regular >> one starts later. >> >> This all worked great with syslog-ng 2, but I recently upgraded to >> version 3.1.1 and I can't get it to work correctly. The proxy >> instance is supposed to only be listening on a tcp socket, but it >> seems to also be opening the AF_UNIX socket to /dev/log. This causes >> the launch of the main instance to fail. >> >> I've been through the docs, but it's not obvious to me how to get >> syslog-ng to start without opening the socket to /dev/log. Hints? >> Thanks in advance... >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html >> >> > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >FAQ: http://www.campin.net/syslog-ng/faq.html >

1 0