https://bugzilla.balabit.com/show_bug.cgi?id=218 --- Comment #10 from Balazs Scheidler <bazsi@balabit.hu> 2013-02-04 20:46:29 --- hmm, it shouldn't depend on the facility itself. I suspect the culprit is somewhere between the applications and syslog-ng. can you run 'logger -p local6.info foo' to check that sshd is indeed using /dev/log and not the network connection accepted right after startup? it should also confirm that syslog-ng writes that message to the expected log file. if all is fine, then I'm afraid something must be wrong with the applications that perform logging, probably a configuration issue, perhaps some security module? it often happens on Linux, but AFAIK Solaris has some labeled security stuff, that might interfere with logging here. If that's the case you can troubleshoot that by running the application under truss or attach to the running instance using truss -p. The important thing is to enable enough detail in the truss log. There the opening of /dev/log should be visible, and everything the app does with the fd in question should be interesting. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.