hi,
Just as I'm leaving, I noticed this on my loghost at work (redhat 6.2, UDP logging for around 50 hosts):
Sep 5 18:13:04 loghost syslog-ng[24136]: syslog-ng version 1.4.4 starting Sep 5 18:13:04 loghost syslog: syslog-ng startup succeeded Sep 5 18:13:04 loghost syslog: klogd startup succeeded Sep 5 18:13:06 loghost syslog-ng[24136]: io.c: do_write: write() failed (errno 27), File too large
Obviously I need to rotate the logs more often on that host, but were you aware that there is a limit to the file sizes syslog-ng could write to?
# ls -al /var/log/messages -rw----r-- 1 root root 9048923 Sep 5 18:15 messages
Ok, that's a huge logfile, but I just wanted to post that here in case it's relevant.
it's not that huge. I've syslog-ng installations where the log file size was above 1gigs, so I don't think it's syslog-ng which limits the file size. maybe your log partition was full? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt