Hi Martin, Found it ! - And changed to a stop / start sequence Then we will se tomorrow.. Thanks, rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Martin Voelker Sendt: 19. februar 2008 16:57 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 Hi Peter, I think its the Script in /etc/logrotate.d In this Directory there its an Script syslog-ng In /etc/cron.daily there is the logrotate Logrotate ist for rotating logs. rgds Martin
"Peter Michael Calum" <pemca@tdc.dk> 19.02.2008 16:46:06 >>> Hi
Can you tell me which script in the /etc/cron.daily/ who starts this reload configuration ? I have a suspicion that it is : 0logwatch -> /usr/share/logwatch/scripts/logwatch.pl rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Martin Voelker Sendt: 19. februar 2008 16:41 Til: Syslog-ng users' and developers' mailing list Emne: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 Hi I can remember the same Problem. I just restart syslog-ng instead of reload rgds martin
"Peter Michael Calum" <pemca@tdc.dk> 19.02.2008 16:36:48 >>> Hi
I'm new to syslog, and i just used the samples from php-syslog-ng to get the data into the mysql database. - and that works fine. i get no errors when i stop / start syslog-ng only if i reload the configuration. rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Geller, Sandor (IT) Sendt: 19. februar 2008 16:29 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Syslog-ng sometime dies at 04:02 Hi, To be honest I don't understand your configuration, but the error message shows the problem (what I don't understand why does actually syslog-ng start with this configuration). You're actually using the same sources at two places, I'd eliminate the s_everything source completely. Regards, Sandor
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Peter Michael Calum Sent: Tuesday, February 19, 2008 4:05 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] Syslog-ng sometime dies at 04:02
Hi
I have installed syslog-ng on RHEL 5 as an RPM (syslog-ng-2.0.8-1.fc8.i386.rpm).
It runs fine except for this problem :
Every night at 04:02 som script runs and make a reload of the configuration. This comes out with some errors in the messages file, but the real problem is, that syslog-ng sometime stops running at this time.
I'm running syslog-ng together with php-syslog-ng
Hope anyone can help
rgds, Peter Calum Denmark
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
My configuration file :
options { sync (0); chain_hostnames(on); stats(43200); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); };
source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); };
source s_everything { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(); };
destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); };
destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n")
template-escape(yes)); };
log { source(s_everything); destination(d_mysql); };
filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); };
log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); };
# vim:set ai ts=4 sw=4 sts=4 et:
-------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html Westdeutsche Lotterie GmbH & Co. OHG | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: Münster HRA 4379 Geschäftsführer: Dr. Winfried Wortmann Vorsitzender des Beirates: Ernst Gerlach Gesellschafter: Nordwestlotto in Nordrhein-Westfalen GmbH | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: HRB 3840 Geschäftsführer: Dr. Winfried Wortmann NRW.BANK | Sitz: Düsseldorf und Münster Rechtsform: Anstalt des öffentlichen Rechts Registergerichte: Amtsgerichte Düsseldorf/Münster Handelsregister: Düsseldorf HRA 15277/Münster HRA 5300 _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html