- syslog-ng - lists.balabit.hu

remote logging not reliable
by stucky 13 Mar '06

13 Mar '06

guys I've been pulling my hair out here. I gonna go insane.... Here's the story. I first setup syslog-ng-1.6.6 for remote syslogging a year ago. I seemed to work out great - all my stuff appeared to be logged remotely and everything was dandy. Then I decided to come up with some sort of check that would tell me if a machine was not logging remotely anymore cause of network problems or whatever. I have a perl logchecker which I basically told to check for the cron.hourly log message and if it finds it to grep for the source host and add this host to a file. I was then gonna check this list against a pre-defined array of hosts that should be logging blablaba.... This is how I discovered that not everything is really logged. All my clients have this conf file: options { chain_hostnames(0); time_reopen(10); time_reap(360); log_fifo_size(2048); sync(1); stats(0); create_dirs(yes); owner(root); group(root); perm(0644); dir_perm(0755); use_dns(yes); dns_cache(yes); }; source src { internal(); unix-stream("/dev/log"); file("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; destination auth { file("/var/log/auth"); }; destination cron { file("/var/log/cron"); }; destination mail { file("/var/log/mail"); }; destination loghost { tcp("**********" port(5000)); }; filter auth { facility(auth, authpriv); }; filter cron { facility(cron); }; filter mail { facility(mail); }; filter nagios { not ( match("Accepted publickey for nagios from ********") or match("COMMAND=/usr/local/nagios/home/check_duplex") or match("session opened for user nagios") or match("session closed for user nagios")); }; log { source(src); filter(cron); destination(cron); destination(loghost); flags(final); }; log { source(src); filter(mail); destination(mail); destination(loghost); flags(final); }; log { source(src); filter(auth); filter(nagios); destination(auth); destination(loghost); flags(final); }; log { source(src); filter(nagios); destination(messages); destination(loghost); }; If I check the cronlog locally on a client I can see that all the hourly logs are there: Feb 27 12:01:01 sbeta crond[31964]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 13:01:01 sbeta crond[9232]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 14:01:01 sbeta crond[18969]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 15:01:01 sbeta crond[28630]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 16:01:01 sbeta crond[5311]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 17:01:01 sbeta crond[14977]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 18:01:01 sbeta crond[22335]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 19:01:01 sbeta crond[31995]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 20:01:01 sbeta crond[9336]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 21:01:01 sbeta crond[19002]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 22:01:01 sbeta crond[28663]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 23:01:01 sbeta crond[5928]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 00:01:01 sbeta crond[15495]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 01:01:01 sbeta crond[25160]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 02:01:01 sbeta crond[2394]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 03:01:01 sbeta crond[12087]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 04:01:01 sbeta crond[21753]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 05:01:01 sbeta crond[31573]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 06:01:01 sbeta crond[8840]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 07:01:01 sbeta crond[18506]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 08:01:01 sbeta crond[28166]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 09:01:01 sbeta crond[5433]: (root) CMD (run-parts /etc/cron.hourly) However, checking the remote cron logs for that machine for that whole of February shows this: Feb 21 12:01:01 sbeta crond[23754]: (root) CMD (run-parts /etc/cron.hourly) Feb 24 05:01:01 sbeta crond[5012]: (root) CMD (run-parts /etc/cron.hourly) Feb 24 17:01:01 sbeta crond[26525]: (root) CMD (run-parts /etc/cron.hourly) Feb 25 03:01:01 sbeta crond[28212]: (root) CMD (run-parts /etc/cron.hourly) Feb 25 13:01:01 sbeta crond[30890]: (root) CMD (run-parts /etc/cron.hourly) Feb 26 01:01:01 sbeta crond[20620]: (root) CMD (run-parts /etc/cron.hourly) Feb 16 19:01:01 sbeta crond[6299]: (root) CMD (run-parts /etc/cron.hourly) Feb 17 00:01:01 sbeta crond[22138]: (root) CMD (run-parts /etc/cron.hourly) Feb 17 04:01:01 sbeta crond[28292]: (root) CMD (run-parts /etc/cron.hourly) Feb 17 08:01:01 sbeta crond[1917]: (root) CMD (run-parts /etc/cron.hourly) Feb 17 12:01:01 sbeta crond[7812]: (root) CMD (run-parts /etc/cron.hourly) Feb 17 16:01:01 sbeta crond[14136]: (root) CMD (run-parts /etc/cron.hourly) Feb 17 19:01:01 sbeta crond[10669]: (root) CMD (run-parts /etc/cron.hourly) Feb 18 00:01:01 sbeta crond[26489]: (root) CMD (run-parts /etc/cron.hourly) Feb 18 04:01:01 sbeta crond[32742]: (root) CMD (run-parts /etc/cron.hourly) Feb 18 08:01:01 sbeta crond[6852]: (root) CMD (run-parts /etc/cron.hourly) Feb 18 12:01:01 sbeta crond[13106]: (root) CMD (run-parts /etc/cron.hourly) Feb 18 15:01:01 sbeta crond[9768]: (root) CMD (run-parts /etc/cron.hourly) Feb 18 20:01:01 sbeta crond[25588]: (root) CMD (run-parts /etc/cron.hourly) Feb 12 08:01:01 sbeta crond[22554]: (root) CMD (run-parts /etc/cron.hourly) Feb 12 12:01:01 sbeta crond[28808]: (root) CMD (run-parts /etc/cron.hourly) Feb 12 16:01:01 sbeta crond[2735]: (root) CMD (run-parts /etc/cron.hourly) Feb 12 20:01:01 sbeta crond[9063]: (root) CMD (run-parts /etc/cron.hourly) Feb 13 00:01:01 sbeta crond[15268]: (root) CMD (run-parts /etc/cron.hourly) Feb 14 17:01:01 sbeta crond[22845]: (root) CMD (run-parts /etc/cron.hourly) Feb 14 21:01:02 sbeta crond[29177]: (root) CMD (run-parts /etc/cron.hourly) Feb 15 22:01:01 sbeta crond[12945]: (root) CMD (run-parts /etc/cron.hourly) Feb 16 05:01:01 sbeta crond[17917]: (root) CMD (run-parts /etc/cron.hourly) Feb 16 16:01:01 sbeta crond[29758]: (root) CMD (run-parts /etc/cron.hourly) Feb 16 18:01:01 sbeta crond[16687]: (root) CMD (run-parts /etc/cron.hourly) As you can see it seemingly randomly logs this stuff now and then. So this machine hasn't been sending logs remotely since Feb 21. ? As I said all clients run the same version of syslog-ng and the exact same config - yet some of then seem to log cron stuff every hour and others don't. I get a log ot those 'Error connecting to remote host AF_INET' messages BUT i get those for EVERY host so why is there no consistency ? I know what everbody is gonna this - your network is hosed but here is the problem with that theory. I can log on to that box and I will immediately see this on the loghost in /var/log/auth Feb 28 10:43:06 sbeta sshd[21815]: Accepted publickey for stucky from ******** port 47427 ssh2 Feb 28 10:43:06 sbeta sshd(pam_unix)[21819]: session opened for user stucky by (uid=0) This will work every time for all other machines as well. I'd understand if it didn't log at all or with a slight delay like say 1 minute. Besides it appears cron stuff really gets lost but then why doesn't any of the auth/authpriv stuff get lost ? I can't help feeling it has something to do with logging cron but looking at the config I clearly told it to log to the local file first and then again to the remote host just like auth/authpriv stuff. Here is my logservers config: options { chain_hostnames(0); time_reopen(10); time_reap(360); log_fifo_size(2048); use_fqdn(no); use_dns(yes); dns_cache(yes); keep_hostname(yes); long_hostnames(off); sync(1); stats(0); create_dirs(yes); perm(0640); dir_perm(0750); }; source src { internal(); unix-stream("/dev/log"); file("/proc/kmsg"); udp (ip("*********")); tcp (ip("*********") port(5000) max-connections(1000) keep-alive(yes)); }; destination messages { file("/var/log/messages"); }; destination auth { file("/var/log/auth"); }; destination cron { file("/var/log/cron"); }; destination mail { file("/var/log/mail"); }; destination arch { file("/usr/local/var/log_archive/$HOST/$YEAR/$MONTH/$DAY/archive"); }; filter auth { facility(auth, authpriv); }; filter cron { facility(cron); }; filter mail { facility(mail); }; filter messages { not facility(auth, authpriv, cron, mail); }; filter nagios { not ( match("Accepted publickey for nagios from *******") or match("COMMAND=/usr/local/nagios/home/check_duplex") or match("session opened for user nagios") or match("session closed for user nagios")); }; filter junk { not ( match("Accepted publickey for oracle from ***********") or match("Accepted publickey for oracle from ***********") or match("Accepted publickey for stucky from ***********") or match("COMMAND=/usr/local/nagios/home/check_duplex") or match(".+reconnecting to LDAP server.+sleeping") or match("session opened for user root") or match(".+AF_INET client connected from .+") or match(".+AF_INET client dropped connection from.+") or match(".+Connection broken to AF_INET.+")); }; log { source(src); filter(cron); destination(cron); destination(arch); flags(final); }; log { source(src); filter(mail); destination(mail); destination(arch); flags(final); }; log { source(src); filter(auth); filter(nagios); destination(auth); destination(arch); flags(final); }; log { source(src); filter(junk); filter(nagios); destination(messages); destination(arch); }; And here's the really messed up thing. EVERY time I set up a tcpdump on the loghost at the full hour to see whether the box actually sends stuff to it - it does ! Yet, if I wait again for a while and check the logs I can see again that a log of hourly cronlogs are skipped. Can anybody please take a look at my configs and at least tell me that they are not completely wrong ? I'm running out of ideas. -- stucky

4 7

Static -ll Library Rq'd and Solaris 10
by Dave Knoch 13 Mar '06

13 Mar '06

I'm attempting to install syslog-ng 1.6.9 on Solaris 10 and am receiving this error: gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet -Wl,-Bstatic -ll -Wl,-Bdynamic ld: fatal: library -ll: not found ld: fatal: File processing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /tmp/syslog-ng-1.6.9+20051127/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='. tests'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /tmp/syslog-ng-1.6.9+20051127/src *** Error code 1 make: Fatal error: Command failed for target `all' Current working directory /tmp/syslog-ng-1.6.9+20051127/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src doc contrib'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' It appears to be caused by the absence of a static -ll library. Unfortunately, Sun no longer includes static Solaris libraries with Solaris 10. Has anyone discovered a workaround for this situation? Thank you. Dave Knoch

3 2

AIX 5.2, AIX 5.3 libol compile problems "
by Mike Harvey 13 Mar '06

13 Mar '06

I get this error during make on libol 0.3.17 io.c:493: `MSG_DONTWAIT' undeclared (first use in this function) I saw a related thread for HP-UX. https://lists.balabit.hu/pipermail/syslog-ng/2006-January/008352.html Details were posted to make a download of a January 2006 patch of io.c, but I can't track down where to download this new file from. Thanks <syslog-ng(a)lists.balabit.hu>

3 2

AIX: Syslog NG 1.6.9 (tcp) send logmessages to central log server
by Jochen Kirn 13 Mar '06

13 Mar '06

Hi all, logmessages are being written to the AIX default syslog daemon which forwards certain messages to syslog ng via a named pipe "/var/adm/syslog.pipe" The log messages are being written to the destination "localfile" but not to the remote syslog ng logging server. Any idea what's going wrong here ? the exact same "syslog-ng.conf" works with a HP-UX or Solaris based Syslog NG Installation without any problem. Setup: Syslog NG: 1.6.9 with libol 0.3.17 System: AIX 5.1 ML8 and AIX 5.3 ML 3 central logging server is a linux based syslog NG 1.6.9 which can successfully receive log messages from other (non aix) hosts. syslog-ng.conf: ############## # Log sources # source src { pipe ("/var/adm/syslog.pipe"); }; ############## # filters # filter f_sshd {program("sshd"); }; ############## # Log destinations destination mylogserver{ tcp("logserver" port(514)); }; destination localfile{ file("/var/tmp/messages" template("$YEAR.$MONTH.$DAY $HOUR:$MIN:$SEC $HOST $MSG\n") template-escape(yes )); }; ############## # Perform the logging log { source(src); filter(f_sshd); destination(mylogserver); }; log { source(src); filter(f_sshd); destination(localfile); }; regards Jochen

3 3

DNS hostnames vs. /etc/hosts?
by micah milano 13 Mar '06

13 Mar '06

Hi, I'm doing remote logging from one client, whose actual hostname is "ibis", however the logs are being sent through an openVPN tunnel so the receiving log server has this in /etc/hosts: 127.0.0.1 localhost emu 10.8.0.5 ibis-vpn What I cannot figure out is why a log directory is created for both "ibis" and "ibis-vpn", I want all the logs from that host to appear in one directory. On the client I have: destination server { tcp("10.8.0.1" port(514)); }; On the server I have: options { long_hostnames(off); sync(1); stats(0); log_fifo_size(2048); dns_cache(yes); keep_hostname(yes); bad_hostname("gconfd"); create_dirs(yes); }; source tcp_src { tcp(max-connections(1000) tcp-keep-alive(yes)); }; destination remote_servers { file("/whopper/logs/$HOST/$FACILITY.log" owner(root) group(adm) perm(0640) dir_perm(0755) create_dirs(yes)); }; log { source(tcp_src); destination(remote_servers); flags(final); };

1 0

syslog-ng with samba
by Dev Anand 10 Mar '06

10 Mar '06

Hi All , Well I have a good and working version of syslog-ng with phpsyslog enabled and reports properly generated. There is only one issue . I have three different samba servers which are not sending their logs but I get other logs from the same servers like cron and logins and other stuff. Please advise. Thanks in advance. Regards Deva

2 2

RE: [syslog-ng] Splitting a single source to multiple mysql tables
by Dukes Clayton 08 Mar '06

08 Mar '06

nope... ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Dukes Clayton Sent: Tuesday, March 07, 2006 5:00 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Splitting a single source to multiple mysql tables I think this fixed it, can someone confirm? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Dukes Clayton Sent: Tuesday, March 07, 2006 4:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Splitting a single source to multiple mysql tables Hiya, Here's what I have, why doesn't it work? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") template-esc destination d_host { pipe("/var/log/mysql.pipe" template("INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") template-escape(yes)); }; destination d_mysql_facility { pipe("/var/log/mysql.pipe" template("INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; # This doesn't work #log { source(net); destination(d_mysql); destination(d_host); destination(d_mysql_facility); }; # This works log { source(net); destination(d_mysql); };

1 0

RE: [syslog-ng] Splitting a single source to multiple mysql tables
by Dukes Clayton 07 Mar '06

07 Mar '06

I think this fixed it, can someone confirm? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Dukes Clayton Sent: Tuesday, March 07, 2006 4:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Splitting a single source to multiple mysql tables Hiya, Here's what I have, why doesn't it work? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") template-esc destination d_host { pipe("/var/log/mysql.pipe" template("INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") template-escape(yes)); }; destination d_mysql_facility { pipe("/var/log/mysql.pipe" template("INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; # This doesn't work #log { source(net); destination(d_mysql); destination(d_host); destination(d_mysql_facility); }; # This works log { source(net); destination(d_mysql); };

1 0

Splitting a single source to multiple mysql tables
by Dukes Clayton 07 Mar '06

07 Mar '06

Hiya, Here's what I have, why doesn't it work? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") template-esc destination d_host { pipe("/var/log/mysql.pipe" template("INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") template-escape(yes)); }; destination d_mysql_facility { pipe("/var/log/mysql.pipe" template("INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; # This doesn't work #log { source(net); destination(d_mysql); destination(d_host); destination(d_mysql_facility); }; # This works log { source(net); destination(d_mysql); };

1 0

RE: [syslog-ng] Syslog-ng 1.6.9 just stops...
by Andreoli, Tony A. USNUNK NAVAIR B1490, R215 07 Mar '06

07 Mar '06

I had klogd off already, but this got me thinking about something else. My config file's sources are: source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); udp(); internal(); }; source t_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); tcp(); internal(); }; Could it be that both sources, attempting to read /proc/kmsg and /dev/log (and internal()?) are causing this? Thanks a lot! Tony -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Wednesday, March 01, 2006 15:25 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 1.6.9 just stops... On Wed, 2006-03-01 at 10:01 -0500, Andreoli, Tony A. USNUNK NAVAIR B1490, R215 wrote: > I'm using 1.6.9 (upgraded from 1.6.6 because I was seeing the same > problem). I have it running on 8 different servers at different > locations, some are SMP, some aren't. On these hosts, we have > anywhere from 2 to 14 devices logging to the servers, some via > 514/tcp, others via 514/udp. All of the loggers typically sit with a > load average < 1 (usually not even registering), and a cpu idle of > 99%. 7 of these remote loggers also log to our local machine, but > only 5 lines every 2 minutes (for stats). > > What I've noticed (and I've seen this on all of them at one time or > another), is that syslog-ng just stops. ps shows it running, but the > log file (/logs/messages) never changes. If I tcpdump on the > interface that it's listening on, I see traffic, and it seems that the > act of tcpdumping causes the log file to start to grow again, then a > little while later, it may stop again. It's sporadic though, on one > of my systems, it hasn't done it in over 2 months, on another, it's > done it 3 times today. > > I've pulled out my last hair and still haven't come any closer to a > solution. I've recompiled the source, loaded 3 different versions, > etc. The only thing common is that all of these systems are running > RHEL3. Don't you happen to read /proc/kmsg by both syslog-ng and klogd ? That is a known bad situation and the symptoms are exactly what you describe. (poll indicates readability but by the time syslog-ng gets to read the file the data has already been read) This is documented in the FAQ as well. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

6 8