i noticed yesterday that syslog-ng won't log to anything in a destination() section if one of them fails. we have a remote logging machine colocated somewhere...here is its config(just the useful stuff) destination macrogenerateddaily { tcp(208.210.124.50 port(514)); file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" dir_per m(0755) perm(0644)); }; destination macrogeneratedhourly { tcp(208.210.124.50 port(514)); file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY.$HOUR" d ir_perm(0755) perm(0644)); }; now....we lost internet connectivity (so the tcp link failed) unfortunately, it also stopped logging to the disk. does it log to destinations, then just die as soon as one fails?
On Mon, Apr 02, 2001 at 01:51:27PM -0400, jon@dumbo.pobox.com wrote:
destination macrogenerateddaily { tcp(208.210.124.50 port(514)); file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" dir_perm(0755) perm(0644)); };
now....we lost internet connectivity (so the tcp link failed) unfortunately, it also stopped logging to the disk. does it log to destinations, then just die as soon as one fails?
Ouch. Probably a bug. What version are you running? Also, obvious workaround for now is to create a new destination with just the file as a driver and double your "log" entries. -- Chad Walstrom <chewie@wookimus.net> | a.k.a. ^chewie http://www.wookimus.net/ | s.k.a. gunnarr Key fingerprint = B4AB D627 9CBD 687E 7A31 1950 0CC7 0B18 206C 5AFD
syslog-ng-1.4.11/ libol-0.2.21/ i guess i'll try upgrading.... how does one log to multiple destinations without putting everything into the same destination XXX {} container? i've tried seperate destinations ie... destination x { tcp(208.210.124.50 port(514)); } destinayion y { file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" dir_perm(0755) perm(0644)) } and then in the log directive log { source(src); destination(x); destination(y); } but that gives me errors On Mon, Apr 02, 2001 at 02:10:20PM -0500, Chad C. Walstrom wrote: | On Mon, Apr 02, 2001 at 01:51:27PM -0400, jon@dumbo.pobox.com wrote: | > destination macrogenerateddaily { | > tcp(208.210.124.50 port(514)); | > file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" | > dir_perm(0755) perm(0644)); | > }; | | > now....we lost internet connectivity (so the tcp link failed) | > unfortunately, it also stopped logging to the disk. does it log to | > destinations, then just die as soon as one fails? | | Ouch. Probably a bug. What version are you running? Also, obvious | workaround for now is to create a new destination with just the file | as a driver and double your "log" entries. | | -- | Chad Walstrom <chewie@wookimus.net> | a.k.a. ^chewie | http://www.wookimus.net/ | s.k.a. gunnarr | Key fingerprint = B4AB D627 9CBD 687E 7A31 1950 0CC7 0B18 206C 5AFD | | | _______________________________________________ | syslog-ng maillist - syslog-ng@lists.balabit.hu | https://lists.balabit.hu/mailman/listinfo/syslog-ng
On Mon, Apr 02, 2001 at 04:38:30PM -0400, jon@dumbo.pobox.com wrote:
syslog-ng-1.4.11/ libol-0.2.21/
i guess i'll try upgrading....
how does one log to multiple destinations without putting everything into the same destination XXX {} container?
i've tried seperate destinations ie... destination x { tcp(208.210.124.50 port(514)); } destinayion y { file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" dir_perm(0755) perm(0644)) }
and then in the log directive log { source(src); destination(x); destination(y); }
but that gives me errors
Try: log{ source(src); destination(x); }; log{ source(src); destination(y); }; -- Chad Walstrom <chewie@wookimus.net> | a.k.a. ^chewie http://www.wookimus.net/ | s.k.a. gunnarr Key fingerprint = B4AB D627 9CBD 687E 7A31 1950 0CC7 0B18 206C 5AFD
On Mon, Apr 02, 2001 at 01:51:27PM -0400, jon@dumbo.pobox.com wrote:
i noticed yesterday that syslog-ng won't log to anything in a destination() section if one of them fails.
we have a remote logging machine colocated somewhere...here is its config(just the useful stuff)
destination macrogenerateddaily { tcp(208.210.124.50 port(514)); file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" dir_per m(0755) perm(0644)); };
destination macrogeneratedhourly { tcp(208.210.124.50 port(514)); file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY.$HOUR" d ir_perm(0755) perm(0644)); };
now....we lost internet connectivity (so the tcp link failed) unfortunately, it also stopped logging to the disk. does it log to destinations, then just die as soon as one fails?
no, it shouldn't. destinations are completely independent. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
hrm..i guess i'll upgrade both the client and the server, then test it out.... i will let everyone know if a new version fixes it... On Tue, Apr 03, 2001 at 10:30:12AM +0200, Balazs Scheidler wrote: | On Mon, Apr 02, 2001 at 01:51:27PM -0400, jon@dumbo.pobox.com wrote: | > i noticed yesterday that syslog-ng won't log to anything in a destination() section if | > one of them fails. | > | > we have a remote logging machine colocated somewhere...here is its config(just the useful stuff) | > | > destination macrogenerateddaily { | > tcp(208.210.124.50 port(514)); | > file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" dir_per | > m(0755) perm(0644)); | > }; | > | > destination macrogeneratedhourly { | > tcp(208.210.124.50 port(514)); | > file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY.$HOUR" d | > ir_perm(0755) perm(0644)); | > }; | > | > | > now....we lost internet connectivity (so the tcp link failed) | > unfortunately, it also stopped logging to the disk. | > does it log to destinations, then just die as soon as one fails? | | no, it shouldn't. destinations are completely independent. | | -- | Bazsi | PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 | | _______________________________________________ | syslog-ng maillist - syslog-ng@lists.balabit.hu | https://lists.balabit.hu/mailman/listinfo/syslog-ng
Hi, I'm running syslog-ng 1.4.11 with Liblol 0.2.21 on a fresh install of Solaris 8. I start syslog-ng with a -v and -p, it runs for a few minutes/hours and then just stops (no warnings or error messages that I can find). Here's a sample of my config: options { log_fifo_size (1440000); create_dirs(yes); use_fqdn(no); long_hostname s(off); sync(3); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source net { udp(); }; #NETWORK DEVICES ONLY!!!!! destination unsorted { file("/var/log/unsorted.log"); }; destination by_host { file("/var/log/Cisco/$HOST.$DAY$MONTH$YEAR.log" perm( 0777));}; destination all { file("/var/log/SunLocal/$DAY$MONTH$YEAR.messages" perm(0777)); }; #FILTER FOR NETWORK EQUIPMENT!!!! filter f_hosta { host("hosta"); }; filter f_hostb { host("hostb"); }; filter f_hostc { host("hostc"); }; filter f_host1 { host("host1"); }; filter f_host2 { host("host2"); }; filter f_host3 { host("host3"); }; #LOGGING FOR NETWORK EQUIPMENT!!!!! log { source(net); filter(f_hosta); destination(by_host); }; log { source(net); filter(f_hostb); destination(by_host); }; log { source(net); filter(f_hostc); destination(by_host); }; log { source(net); filter(f_host1); destination(by_host); }; log { source(net); filter(f_host2); destination(by_host); }; log { source(net); filter(f_host3); destination(by_host); }; log { source(net); filter(DEFAULT); destination(unsorted); }; log { source(local); destination(all); }; Has anyone seen this before, or have any ideas how I can find out why it's dying? Thanks in advance for any help you can provide. Sincerely, JonM
participants (4)
-
Balazs Scheidler
-
Chad C. Walstrom
-
jmad
-
jon＠dumbo.pobox.com