On Tue, Feb 04, 2003 at 10:22:47AM -0700, Kai Wang wrote:
In the log file, it showes:
Feb 4 09:28:15 lcomm5 syslog-ng[23965]: STATS: dropped 0 Feb 4 09:38:15 lcomm5 syslog-ng[23965]: STATS: dropped 0 Feb 4 09:48:15 lcomm5 syslog-ng[23965]: STATS: dropped 0
I suspect that you have a quiet system, and you're only checking one log. Check every log from syslog-ng.conf that has a "log" entry for contents. Make sure syslog-ng.conf has these three lines: destination authlog { file("/var/log/auth.log"); }; filter f_authpriv { facility(auth, authpriv); }; log { source(src); filter(f_authpriv); destination(authlog); }; ...then run $ logger -p auth.notice foo bar $ logger -p auth.notice foo bar bar baz $ logger -p auth.notice foo bar bar baz bam $ tail /var/log/auth.log You should see the three lines above in /var/log/auth.log (even if you only sync every three messages). -- Nate Campi http://www.campin.net