Hi My name is Shetkar Ravi and AS i am new to syslog-ng I am interested to become a new syslog-ng member to learn more about syslog-ng. I am currently working on logging server project. I searched the web and found lot of good things and recommendations about the syslog-ng and decided install and test in my solaris/HP/Aix environment. I down loaded libol-0.3.9 and syslog-ng-1.6.0rc3 and installed and compiled on solaris 8 server. I added /etc/syslog-ng/syslog-ng.conf file and modified the /etc/init.d/syslog file, but when try to start the syslog-ng (/etc/init.d/syslog start) it giving me following error on the console.. io.c: bind_inet_socket() bind failed 0.0.0.0:514 Address already in use Need your help and suggestion for syslog-ng configuration...to make it work on my syslog -ng centralize logging server. Do i need to install syslog-ng on all the clients also or the default syslog will work.? and then what will be the syslog.conf file on clients. Follwing are my configuration files.. /etc/syslog-ng/syslog-ng.conf file.. # more syslog-ng.conf # # Syslog-ng example configuration file for Solaris # #use_fqdn() add FQDN instead of short hostname #use_dns() use DNS (may cause DOS) #sync() number of lines buffered before written to file #log_fifo_size() number of lines fitting to the output queue # #options { use_fqdn(no); # keep_hostname(yes); # use_dns(no); # long_hostnames(off); # sync(0); # log_fifo_size(1000); }; options { sync(0); keep_hostname(yes); chain_hostnames(no); log_fifo_size(30000); }; source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_net_udp { udp(); }; destination d_local { file("/logs/messages"); }; log { source(s_local); source(s_net_udp); destination(d_local); }; # # local and network sources # # + will accept udp/tcp connections on port 514 from any host # + keepalive option is for tcp only and will keep connection open # when the SIGHUP signal is seen # #source s_stream { sun-streams("/dev/log" door("/etc/.syslog_door"); }; #source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal();}; #source network { udp(); tcp(); }; #source s_tcp { tcp(ip(127.0.0.1) port(19990) max-connections(10)); }; #Source s_udp { udp(); }; # # standard destinations for local standard system messages # destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination kern { file("/var/log/kern.log"); }; destination maillog { file("/var/log/maillog"); }; # # special log destinations for our remote hosts # (pixlog, switchlog) and for our IP Filter firewall (ipflog) # #destination ipflog { file("/var/log/ipf.log"); }; #destination pixlog { file("/var/log/pix.log"); }; #destination switchlog { file("/var/log/switch.log"); }; # # Some log files used to catch remaining messages # destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; # # console destination # destination console { file("/dev/sysmsg"); }; # # filters for standard local system messages which come # in on non-local facilities # filter f_authpriv { facility(auth) ; }; filter f_syslog { not facility(auth) and not facility(mail); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; # # filters for IPFilter and the Cisco equipment # #filter f_ipf { facility(local0); }; #filter f_pix { facility(local4); }; #filter f_switch { facility(local6, local7); }; # # catch the rest # filter f_debug { not facility(kern, auth, mail, local6, local7, local4, local0); }; filter f_messages { level(info .. warn) and not facility(auth, mail, local0, local4 , local6, local7); }; # # filters for various emergency level messages # filter f_emergency { level(emerg); }; # # log emergency level messages out to console # log { source(local); filter(f_emergency); destination(console); }; # # log messages from local machine # log { source(local); filter(f_authpriv); destination(authlog); }; log { source(local); filter(f_syslog); destination(syslog); }; log { source(local); filter(f_kern); destination(kern); }; log { source(local); filter(f_mail); destination(maillog); }; # # log IP Filter messages to the ipf.log # #log { source(local); filter(f_ipf); destination(ipflog); }; # # log switch and pix messages # #log { source(network); filter(f_pix); destination(pixlog); }; #log { source(network); filter(f_switch); destination(switchlog); }; # # catch the rest of the messages # log { source(local); source(network); filter(f_debug); destination(debug); }; log { source(local); source(network); filter(f_messages); destination(messages); }; # # Automatic sorting of host messages by $HOST and $YEAR$MONTH$DAY # # + will automatically create a directory structure for all messages # sorted first by host, then by date, then by facility. # + with use_dns(no) we will have files based on ip address not hostname # destination hosts { file("/var/log/HOSTS/$HOST/$YEAR$MONTH$DAY/$FACILITY" owner(roo t) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; # # logs all incoming messages from network source to the sorted # destination # log { source(network); destination(hosts); }; My /etc/init.d/syslog file is # more syslog #!/sbin/sh # # script to start syslog-ng on boot up for a Solaris machine. # This script replaces /etc/init.d/syslog on a Solaris machine. # case "$1" in 'start') if [ -f /etc/syslog-ng.conf -a -f /usr/local/sbin/syslog-ng ]; then echo 'syslog-ng service starting.' # # Before syslogd starts, save any messages from previous # crash dumps so that messages appear in chronological order. # /usr/bin/savecore -m if [ -r /etc/dumpadm.conf ]; then . /etc/dumpadm.conf [ "x$DUMPADM_DEVICE" != xswap ] && \ /usr/bin/savecore -m -f $DUMPADM_DEVICE fi if [ ! -f /var/adm/messages ]; then /usr/bin/cp /dev/null /var/adm/messages /usr/bin/chmod 0644 /var/adm/messages fi /usr/local/sbin/syslog-ng >/dev/msglog 2>&1 & fi ;; 'stop') echo 'syslog-ng service stopping.' if [ -f /var/run/syslog-ng.pid ]; then syspid=`/usr/bin/cat /var/run/syslog-ng.pid` [ "$syspid" -gt 0 ] && kill -15 $syspid fi ;; *) echo "Usage: $0 { start | stop }" exit 1 ;; esac my daemon is in /usr/loca/sbin/syslog-ng thanks for your help. Shetkar Ravi Unix systel Administrator. WebMD rshetkar@webmd.net rshetkar88@yahoo.com --------------------------------- Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software