Hello Balazs Scheidler! On Sat, Apr 16, 2005 at 02:55:21PM +0200, Balazs Scheidler wrote:
Hi,
On Fri, 2005-04-15 at 17:36 +0300, Andy wrote:
get /var/log/messages.0: nothing!!! get /var/log/messages: nothing too!!!
What is "get" in the commands quoted above? I assume it is the equivalent of cat, or maybe grep.
yes. It's tail
in this time in strace I get:
......... poll([{fd=7, events=0}, {fd=8, events=0}, {fd=6, events=0}, {fd=5, events=POLLIN, revents=POLLIN}, {fd=3, events=POLLIN}, {fd=12, events=POLLIN}, {fd=11, events=POLLIN}, {fd=4, events=POLLIN}], 8, 241000) = 1 accept(5, {sin_family=AF_UNIX, path=@}, [2]) = 9
[snip[
..............
As I see your test message was written to fd 8 while all kernel messages are written to fd 6. You'll need to check out what those fds are in reality.
May be you explain how I can do this?
and (I think it very strange!!!) only _kernel_ message are normally writted:
.... Apr 15 17:09:28 vpn kernel: PPP: VJ decompression error Apr 15 17:09:28 vpn kernel: PPP: VJ decompression error Apr 15 17:09:39 vpn kernel: PPP: VJ decompression error Apr 15 17:09:39 vpn kernel: PPP: VJ decompression error .....
my syslog-ng.conf:
=cut
options { sync (0);
[snip]
=end
I've tried running syslog-ng with your exact configuration and it continued to log fine.
-- Bazsi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
-- Andy (ANDY-UANIC)