Hi,

It's a known bug on FreeBSD and fixed in v3.0.5.
Upgrade your syslog-ng, or use the follow_freq(0) option in kernel source, please.

This patch fixed it:

commit ea34eee9a1172c213aeccbf68ed4fa2881c97b29
Author: Balazs Scheidler <bazsi@balabit.hu>
Date:   Mon Nov 2 10:59:30 2009 +0100

    affile: set follow_freq to 0 on FreeBSD kernel messages
   
    FreeBSD uses /dev/klog character device for kernel messages. But
    since the file source driver set follow_freq to 0 only on Linux,
    this meant that FreeBSD config files needed an explicit
   
    follow_freq(0) in their /dev/klog source definition.
   
    This patch makes this the default on /dev/klog if the __FreeBSD__ macro is
    defined.

diff --git a/src/affile.c b/src/affile.c
index 3b92a85..15dbee0 100644
--- a/src/affile.c
+++ b/src/affile.c
@@ -395,13 +395,17 @@ affile_sd_new(gchar *filename, guint32 flags)
     {
       if ((self->flags & AFFILE_PIPE) == 0)
         self->reader_options.follow_freq = 1000;
-       
+
+      if (0 ||
 #if __linux__
-      if (strcmp(filename, "/proc/kmsg") == 0)
+          (strcmp(filename, "/proc/kmsg") == 0) ||
+#elif __FreeBSD__
+          (strcmp(filename, "/dev/klog") == 0) ||
+#endif
+          0)
         {
           self->reader_options.follow_freq = 0;
         }
-#endif
     }
 #if __linux__
   if (strcmp(filename, "/proc/kmsg") == 0)

Phusion wrote: 
I've used syslog-ng 1.x and 2.x, but am new to using 3.x. I'm using
syslog-ng 3.0.3 on a FreeBSD 8.0 server. I'm having trouble getting
kernel messages. I've made a very small config file, and this isn't
working either.

@version:3.0
source local { internal(); file("/dev/klog"); unix-dgram("/var/run/log"); };
destination all { file("/var/log/all.log"); };
log { source(local); destination(all); };

This picks up other things, but not the kernel messages. I assume it's
a small configuration issue. Let me know. Thanks.

Phusion
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html


  


-- 
pzolee