Hi, IIRC I made the initial packaging, so I have the credit for the bugs :) This packaging data wasn't made to be a replacement for syslogd. In its current form it could be used in conjunction with syslogd. Up to RHEL4 there is a direct dependency on sysklogd in the RPM database (vixie-cron, initscripts). AFAIK this has been changed in RHEL5 so the syslog-ng RPM could be used as a syslogd replacement. Other comments inlined.
Here's the patch in line. Seems to have caused problems as an attachment.
--- syslog-ng-2.0.7/contrib/rhel-packaging/syslog-ng.init 2007-04-19 19:37:16.000000000 +0000 +++ rhel4/contrib/rhel-packaging/syslog-ng.init 2008-01-15 15:45:44.000000000 +0000 @@ -13,7 +13,7 @@ # Source function library. . /etc/init.d/functions
-binary="/sbin/syslog-ng" +binary="/usr/sbin/syslog-ng"
I disagree. The spec uses prefix=/, and these have to be in sync.
[ -x $binary ] || exit 0
--- syslog-ng-2.0.7/contrib/rhel-packaging/syslog-ng.conf 2007-04-19 19:37:16.000000000 +0000 +++ rhel4/contrib/rhel-packaging/syslog-ng.conf 2008-01-15 15:59:28.000000000 +0000 @@ -1,5 +1,5 @@ # -# configuration file for syslog-ng, customized for remote logging +# configuration file for syslog-ng #
source s_internal { internal(); }; @@ -7,21 +7,24 @@ log { source(s_internal); destination(d_syslognglog); };
-# Local sources, filters and destinations are commented out -# If you want to replace sysklogd simply uncomment the following -# parts and disable sysklogd +# Local sources, filters and destinations are commented out. +# +# If you want to replace syslogd and klogd simply uncomment +# the following parts. You will also need to modify +# /etc/logrotate.d/syslog and /etc/logrotate.d/syslog-ng +# appropriately. # # Local sources # #source s_local { # unix-dgram("/dev/log"); -# file("/proc/kmsg" log_prefix "kernel:"); +# file("/proc/kmsg" log_prefix("kernel:"));
OK, good catch.
#}; # # Local filters # #filter f_messages { level(info..emerg); }; #filter f_secure { facility(authpriv); }; -#filter f_mail { facility(mail); }; +#filter f_maillog { facility(mail); };
This should remain f_mail, the problem should be fixed later when it is referenced as f_maillog instead of f_mail. The remaining part of the patch is about commenting out network sources. As I've stated above the packaging/ configuration was created for its purpose. It is up to the current packager whether he will accept this part of your patch or not. Regards, Sandor Geller -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.