Re: [syslog-ng] Syslog-ng sometime dies at 04:02

19 Feb 2008

      Hi

I'm new to syslog, and i just used the samples from php-syslog-ng
to get the data into the mysql database. - and that works fine.
i get no errors when i stop / start syslog-ng only if i reload
the configuration.

rgds,
Peter 

-----Oprindelig meddelelse-----
Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Geller, Sandor (IT)
Sendt: 19. februar 2008 16:29
Til: Syslog-ng users' and developers' mailing list
Emne: Re: [syslog-ng] Syslog-ng sometime dies at 04:02

Hi,

To be honest I don't understand your configuration, but the
error message shows the problem (what I don't understand why
does actually syslog-ng start with this configuration).
You're actually using the same sources at two places, I'd
eliminate the s_everything source completely.

Regards,

Sandor
...
-----Original Message-----
From: syslog-ng-bounces@lists.balabit.hu 
[mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of 
Peter Michael Calum
Sent: Tuesday, February 19, 2008 4:05 PM
To: syslog-ng@lists.balabit.hu
Subject: [syslog-ng] Syslog-ng sometime dies at 04:02
Hi
I have installed syslog-ng on RHEL 5 as an RPM 
(syslog-ng-2.0.8-1.fc8.i386.rpm).
It runs fine except for this problem :
Every night at 04:02 som script runs and make a reload of the 
configuration. This comes out 
with some errors in the messages file, but the real problem 
is, that syslog-ng sometime stops 
running at this time.
I'm running syslog-ng together with php-syslog-ng
Hope anyone can help
rgds, 
Peter Calum 
Denmark
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: 
Configuration reload request received, reloading configuration; 
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal 
error, duplicate configuration elements refer to the same 
persistent config; 
name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal 
error, duplicate configuration elements refer to the same 
persistent config; 
name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: 
Configuration reload request received, reloading configuration; 
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal 
error, duplicate configuration elements refer to the same 
persistent config; 
name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: 
Configuration reload request received, reloading configuration; 
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal 
error, duplicate configuration elements refer to the same 
persistent config; 
name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
My configuration file :
options { 
    sync (0); 
    chain_hostnames(on); 
    stats(43200); 
    time_reopen (10); 
    log_fifo_size (1000); 
    long_hostnames (on); 
    use_dns (yes); 
    use_fqdn (no); 
    create_dirs (no); 
    keep_hostname (yes); 
};
source s_sys { 
    file ("/proc/kmsg" log_prefix("kernel: ")); 
    unix-stream ("/dev/log"); 
    internal(); 
    udp(ip(0.0.0.0) port(514)); 
    tcp(ip(0.0.0.0) port(514)); 
};
source s_everything { internal(); pipe("/proc/kmsg"); 
unix-stream("/dev/log"); udp(); };
destination d_cons { file("/dev/console"); }; 
destination d_mesg { file("/var/log/messages"); }; 
destination d_auth { file("/var/log/secure"); }; 
destination d_mail { file("/var/log/maillog" sync(10)); }; 
destination d_spol { file("/var/log/spooler"); }; 
destination d_boot { file("/var/log/boot.log"); }; 
destination d_cron { file("/var/log/cron"); }; 
destination d_mlal { usertty("*"); };
destination d_mysql { 
    program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" 
    template("INSERT INTO logs (host, facility, priority, 
level, tag, datetime, program, msg) 
    VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', 
'$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n")
template-escape(yes)); 
    };
log { 
    source(s_everything); 
    destination(d_mysql); 
    };
filter f_filter1   { facility(kern); }; 
filter f_filter2   { level(info..emerg) and 
                     not facility(mail,authpriv,cron); }; 
filter f_filter3   { facility(authpriv); }; 
filter f_filter4   { facility(mail); }; 
filter f_filter5   { level(emerg); }; 
filter f_filter6   { facility(uucp) or 
                     (facility(news) and level(crit..emerg)); }; 
filter f_filter7   { facility(local7); }; 
filter f_filter8   { facility(cron); };
log { source(s_sys); filter(f_filter1); destination(d_cons); }; 
log { source(s_sys); filter(f_filter2); destination(d_mesg); }; 
log { source(s_sys); filter(f_filter3); destination(d_auth); }; 
log { source(s_sys); filter(f_filter4); destination(d_mail); }; 
log { source(s_sys); filter(f_filter5); destination(d_mlal); }; 
log { source(s_sys); filter(f_filter6); destination(d_spol); }; 
log { source(s_sys); filter(f_filter7); destination(d_boot); }; 
log { source(s_sys); filter(f_filter8); destination(d_cron); };
# vim:set ai ts=4 sw=4 sts=4 et:
--------------------------------------------------------

NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.
_______________________________________________
syslog-ng maillist  -  syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html