----- Original message -----
Hi, I am experiencing e problem that havent have before. Are 3 years that all seems to work fine with syslog-ng 3.05. recently I have find that some of my servers sends syslog messages to syslog server, Syslog server interface recive it, syslog-ng elaborate it but do not write on file system.
I have configured syslog-ng server to log message in the following manner /opt/logs/$YEAR/$MONTH/$DAY/SERVER/$HOST/messages What I have done:
- Listen on eth4 to look for udp syslog messages coming form server A
- Try to access via ssh to server A
- I have seen udp packet from A to syslog-server.
Than I have investigate on syslog-ng
- I have get the pid of syslog-ng and make a strace -p pid -o prova.txt
- Try to access via ssh to server A (to let server a send udp syslog message to syslog server)
- Stop strace
- Look on prova.txt for IP of server A and find It! But I cannot do more, can someone help me?
well, some more information would definitely be needed to help you out. a minimalist configuration that reproduces the issue (if your production one is too complicated or you are not allowed to share it), also the relevant lines in the strace would be helpful. and last but not least, 3.0 is ancient by syslog-ng standards, the current version is 3.3 with 3.4 soon to follow.