Hello there,

My syslog-ng is logging fine from 700 servers but a few times per day it is logging into a wrong folder which is created by the $HOST variable.

Normally syslog should use a hostname like host-1.worker.foobar.com but a few times a day it creates a folder names like:

4.22

p6-allrouter?

p6-localnet

p6-mc?

p6-mcastpref

p6-mcastpref?

host-1.worker.foobar.xcom

and other weird names…

It only logs one or two lines and then uses the right folder again. Does anyone have a clue where I have to look for the problem?

Here are the option line from the server and the client:

Client:

@version: 3.3

options {

    threaded(yes);

    use_dns(yes);

    use_fqdn(yes);

    dns_cache(yes);

    dns_cache_size(16384);

    dns_cache_expire(3600);

   dns_cache_expire_failed(10);

    log_msg_size(256000);

    log_fifo_size(100000);

    normalize_hostnames(yes);

    check_hostname(yes);

    bad_hostname("^gconfd$");

    create_dirs(yes);

    owner("root");

    group("root");

    perm(0640);

    time_reopen(30);

};

Server:

options {

    threaded(yes);

    owner("root");

    group("root");

    perm(0660);

    dir_owner("root");

    dir_group("root");

    dir_perm(0770);

    create_dirs(yes);

    chain_hostnames(no);

    normalize_hostnames(yes);

    check_hostname(yes);

    keep_hostname(no);

    use_fqdn(yes);

    dns_cache(yes);

    dns_cache_size(16384);

    dns_cache_expire(3600);

    dns_cache_expire_failed(60);

    log_msg_size(256000);

    log_fifo_size(1000000);

};

Destination example:

destination d_syslog { file("/log/syslog/${R_YEAR}/${R_MONTH}/${R_DAY}/$HOST/$PROGRAM"); };

--

Daniel Neubacher, Network Administrator

daniel.neubacher@xing.com

XING AG

Gaensemarkt 43, 20354 Hamburg, Germany

Tel. +49 40 419131-28, Fax +49 40 419131-11

Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 98807

Exec. Board (Vorstand): Dr. Stefan Groß-Selbeck (Vorsitzender), Dr. Thomas Vollmoeller, Ingo Chu, Dr. Helmut Becker, Jens Pape

Chairman of the Supervisory Board (Aufsichtsratsvorsitzender): Dr. Neil Sunderland

This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden and may be unlawful.