On Sat, 2007-01-20 at 11:58 -0600, Paul Krizak wrote:
I am having some trouble understanding what constitutes conditions under which MARK messages will appear in log files. I recently brought up a log server on a fairly quiet network (less than one message/hour) and I was expecting to see at least one MARK message in my logs every five minutes, since I have mark_freq set to 300.
However, the logs just sit there idle, sometimes for hours at a time, with no mark messages appearing at all.
Perhaps I'm missing something in the log { } statement? The documentation is fairly sparse about what is required to enable the MARK stuff...
Currently MARK messages are generated by the 'internal' source, if syslog-ng itself is completely idle for a period specified by mark_freq(). So if a single message arrives on any of the sources, MARK will not be generated. -- Bazsi