Hi I have installed syslog-ng on RHEL 5 as an RPM (syslog-ng-2.0.8-1.fc8.i386.rpm). It runs fine except for this problem : Every night at 04:02 som script runs and make a reload of the configuration. This comes out with some errors in the messages file, but the real problem is, that syslog-ng sometime stops running at this time. I'm running syslog-ng together with php-syslog-ng Hope anyone can help rgds, Peter Calum Denmark Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))' My configuration file : options { sync (0); chain_hostnames(on); stats(43200); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; source s_everything { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_everything); destination(d_mysql); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; # vim:set ai ts=4 sw=4 sts=4 et:
Hi, I think logrotate ist the troeblemaker. Have a look on it Best regards Martin
"Peter Michael Calum" <pemca@tdc.dk> 19.02.2008 16:05:00 >>> Hi
I have installed syslog-ng on RHEL 5 as an RPM (syslog-ng-2.0.8-1.fc8.i386.rpm). It runs fine except for this problem : Every night at 04:02 som script runs and make a reload of the configuration. This comes out with some errors in the messages file, but the real problem is, that syslog-ng sometime stops running at this time. I'm running syslog-ng together with php-syslog-ng Hope anyone can help rgds, Peter Calum Denmark Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))' My configuration file : options { sync (0); chain_hostnames(on); stats(43200); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; source s_everything { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_everything); destination(d_mysql); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; # vim:set ai ts=4 sw=4 sts=4 et: Westdeutsche Lotterie GmbH & Co. OHG | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: Münster HRA 4379 Geschäftsführer: Dr. Winfried Wortmann Vorsitzender des Beirates: Ernst Gerlach Gesellschafter: Nordwestlotto in Nordrhein-Westfalen GmbH | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: HRB 3840 Geschäftsführer: Dr. Winfried Wortmann NRW.BANK | Sitz: Düsseldorf und Münster Rechtsform: Anstalt des öffentlichen Rechts Registergerichte: Amtsgerichte Düsseldorf/Münster Handelsregister: Düsseldorf HRA 15277/Münster HRA 5300
Hi, To be honest I don't understand your configuration, but the error message shows the problem (what I don't understand why does actually syslog-ng start with this configuration). You're actually using the same sources at two places, I'd eliminate the s_everything source completely. Regards, Sandor
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Peter Michael Calum Sent: Tuesday, February 19, 2008 4:05 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] Syslog-ng sometime dies at 04:02
Hi
I have installed syslog-ng on RHEL 5 as an RPM (syslog-ng-2.0.8-1.fc8.i386.rpm).
It runs fine except for this problem :
Every night at 04:02 som script runs and make a reload of the configuration. This comes out with some errors in the messages file, but the real problem is, that syslog-ng sometime stops running at this time.
I'm running syslog-ng together with php-syslog-ng
Hope anyone can help
rgds, Peter Calum Denmark
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
My configuration file :
options { sync (0); chain_hostnames(on); stats(43200); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); };
source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); };
source s_everything { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(); };
destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); };
destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n")
template-escape(yes)); };
log { source(s_everything); destination(d_mysql); };
filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); };
log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); };
# vim:set ai ts=4 sw=4 sts=4 et:
-------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.
Hi I'm new to syslog, and i just used the samples from php-syslog-ng to get the data into the mysql database. - and that works fine. i get no errors when i stop / start syslog-ng only if i reload the configuration. rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Geller, Sandor (IT) Sendt: 19. februar 2008 16:29 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Syslog-ng sometime dies at 04:02 Hi, To be honest I don't understand your configuration, but the error message shows the problem (what I don't understand why does actually syslog-ng start with this configuration). You're actually using the same sources at two places, I'd eliminate the s_everything source completely. Regards, Sandor
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Peter Michael Calum Sent: Tuesday, February 19, 2008 4:05 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] Syslog-ng sometime dies at 04:02
Hi
I have installed syslog-ng on RHEL 5 as an RPM (syslog-ng-2.0.8-1.fc8.i386.rpm).
It runs fine except for this problem :
Every night at 04:02 som script runs and make a reload of the configuration. This comes out with some errors in the messages file, but the real problem is, that syslog-ng sometime stops running at this time.
I'm running syslog-ng together with php-syslog-ng
Hope anyone can help
rgds, Peter Calum Denmark
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
My configuration file :
options { sync (0); chain_hostnames(on); stats(43200); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); };
source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); };
source s_everything { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(); };
destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); };
destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n")
template-escape(yes)); };
log { source(s_everything); destination(d_mysql); };
filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); };
log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); };
# vim:set ai ts=4 sw=4 sts=4 et:
-------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Hi I can remember the same Problem. I just restart syslog-ng instead of reload rgds martin
"Peter Michael Calum" <pemca@tdc.dk> 19.02.2008 16:36:48 >>> Hi
I'm new to syslog, and i just used the samples from php-syslog-ng to get the data into the mysql database. - and that works fine. i get no errors when i stop / start syslog-ng only if i reload the configuration. rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Geller, Sandor (IT) Sendt: 19. februar 2008 16:29 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Syslog-ng sometime dies at 04:02 Hi, To be honest I don't understand your configuration, but the error message shows the problem (what I don't understand why does actually syslog-ng start with this configuration). You're actually using the same sources at two places, I'd eliminate the s_everything source completely. Regards, Sandor
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Peter Michael Calum Sent: Tuesday, February 19, 2008 4:05 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] Syslog-ng sometime dies at 04:02
Hi
I have installed syslog-ng on RHEL 5 as an RPM (syslog-ng-2.0.8-1.fc8.i386.rpm).
It runs fine except for this problem :
Every night at 04:02 som script runs and make a reload of the configuration. This comes out with some errors in the messages file, but the real problem is, that syslog-ng sometime stops running at this time.
I'm running syslog-ng together with php-syslog-ng
Hope anyone can help
rgds, Peter Calum Denmark
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
My configuration file :
options { sync (0); chain_hostnames(on); stats(43200); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); };
source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); };
source s_everything { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(); };
destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); };
destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n")
template-escape(yes)); };
log { source(s_everything); destination(d_mysql); };
filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); };
log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); };
# vim:set ai ts=4 sw=4 sts=4 et:
-------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html Westdeutsche Lotterie GmbH & Co. OHG | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: Münster HRA 4379 Geschäftsführer: Dr. Winfried Wortmann Vorsitzender des Beirates: Ernst Gerlach Gesellschafter: Nordwestlotto in Nordrhein-Westfalen GmbH | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: HRB 3840 Geschäftsführer: Dr. Winfried Wortmann NRW.BANK | Sitz: Düsseldorf und Münster Rechtsform: Anstalt des öffentlichen Rechts Registergerichte: Amtsgerichte Düsseldorf/Münster Handelsregister: Düsseldorf HRA 15277/Münster HRA 5300
Hi Can you tell me which script in the /etc/cron.daily/ who starts this reload configuration ? I have a suspicion that it is : 0logwatch -> /usr/share/logwatch/scripts/logwatch.pl rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Martin Voelker Sendt: 19. februar 2008 16:41 Til: Syslog-ng users' and developers' mailing list Emne: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 Hi I can remember the same Problem. I just restart syslog-ng instead of reload rgds martin
"Peter Michael Calum" <pemca@tdc.dk> 19.02.2008 16:36:48 >>> Hi
I'm new to syslog, and i just used the samples from php-syslog-ng to get the data into the mysql database. - and that works fine. i get no errors when i stop / start syslog-ng only if i reload the configuration. rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Geller, Sandor (IT) Sendt: 19. februar 2008 16:29 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Syslog-ng sometime dies at 04:02 Hi, To be honest I don't understand your configuration, but the error message shows the problem (what I don't understand why does actually syslog-ng start with this configuration). You're actually using the same sources at two places, I'd eliminate the s_everything source completely. Regards, Sandor
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Peter Michael Calum Sent: Tuesday, February 19, 2008 4:05 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] Syslog-ng sometime dies at 04:02
Hi
I have installed syslog-ng on RHEL 5 as an RPM (syslog-ng-2.0.8-1.fc8.i386.rpm).
It runs fine except for this problem :
Every night at 04:02 som script runs and make a reload of the configuration. This comes out with some errors in the messages file, but the real problem is, that syslog-ng sometime stops running at this time.
I'm running syslog-ng together with php-syslog-ng
Hope anyone can help
rgds, Peter Calum Denmark
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
My configuration file :
options { sync (0); chain_hostnames(on); stats(43200); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); };
source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); };
source s_everything { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(); };
destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); };
destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n")
template-escape(yes)); };
log { source(s_everything); destination(d_mysql); };
filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); };
log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); };
# vim:set ai ts=4 sw=4 sts=4 et:
-------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html Westdeutsche Lotterie GmbH & Co. OHG | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: Münster HRA 4379 Geschäftsführer: Dr. Winfried Wortmann Vorsitzender des Beirates: Ernst Gerlach Gesellschafter: Nordwestlotto in Nordrhein-Westfalen GmbH | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: HRB 3840 Geschäftsführer: Dr. Winfried Wortmann NRW.BANK | Sitz: Düsseldorf und Münster Rechtsform: Anstalt des öffentlichen Rechts Registergerichte: Amtsgerichte Düsseldorf/Münster Handelsregister: Düsseldorf HRA 15277/Münster HRA 5300 _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Hi Peter, I think its the Script in /etc/logrotate.d In this Directory there its an Script syslog-ng In /etc/cron.daily there is the logrotate Logrotate ist for rotating logs. rgds Martin
"Peter Michael Calum" <pemca@tdc.dk> 19.02.2008 16:46:06 >>> Hi
Can you tell me which script in the /etc/cron.daily/ who starts this reload configuration ? I have a suspicion that it is : 0logwatch -> /usr/share/logwatch/scripts/logwatch.pl rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Martin Voelker Sendt: 19. februar 2008 16:41 Til: Syslog-ng users' and developers' mailing list Emne: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 Hi I can remember the same Problem. I just restart syslog-ng instead of reload rgds martin
"Peter Michael Calum" <pemca@tdc.dk> 19.02.2008 16:36:48 >>> Hi
I'm new to syslog, and i just used the samples from php-syslog-ng to get the data into the mysql database. - and that works fine. i get no errors when i stop / start syslog-ng only if i reload the configuration. rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Geller, Sandor (IT) Sendt: 19. februar 2008 16:29 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Syslog-ng sometime dies at 04:02 Hi, To be honest I don't understand your configuration, but the error message shows the problem (what I don't understand why does actually syslog-ng start with this configuration). You're actually using the same sources at two places, I'd eliminate the s_everything source completely. Regards, Sandor
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Peter Michael Calum Sent: Tuesday, February 19, 2008 4:05 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] Syslog-ng sometime dies at 04:02
Hi
I have installed syslog-ng on RHEL 5 as an RPM (syslog-ng-2.0.8-1.fc8.i386.rpm).
It runs fine except for this problem :
Every night at 04:02 som script runs and make a reload of the configuration. This comes out with some errors in the messages file, but the real problem is, that syslog-ng sometime stops running at this time.
I'm running syslog-ng together with php-syslog-ng
Hope anyone can help
rgds, Peter Calum Denmark
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
My configuration file :
options { sync (0); chain_hostnames(on); stats(43200); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); };
source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); };
source s_everything { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(); };
destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); };
destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n")
template-escape(yes)); };
log { source(s_everything); destination(d_mysql); };
filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); };
log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); };
# vim:set ai ts=4 sw=4 sts=4 et:
-------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html Westdeutsche Lotterie GmbH & Co. OHG | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: Münster HRA 4379 Geschäftsführer: Dr. Winfried Wortmann Vorsitzender des Beirates: Ernst Gerlach Gesellschafter: Nordwestlotto in Nordrhein-Westfalen GmbH | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: HRB 3840 Geschäftsführer: Dr. Winfried Wortmann NRW.BANK | Sitz: Düsseldorf und Münster Rechtsform: Anstalt des öffentlichen Rechts Registergerichte: Amtsgerichte Düsseldorf/Münster Handelsregister: Düsseldorf HRA 15277/Münster HRA 5300 _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Hi Martin, Found it ! - And changed to a stop / start sequence Then we will se tomorrow.. Thanks, rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Martin Voelker Sendt: 19. februar 2008 16:57 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 Hi Peter, I think its the Script in /etc/logrotate.d In this Directory there its an Script syslog-ng In /etc/cron.daily there is the logrotate Logrotate ist for rotating logs. rgds Martin
"Peter Michael Calum" <pemca@tdc.dk> 19.02.2008 16:46:06 >>> Hi
Can you tell me which script in the /etc/cron.daily/ who starts this reload configuration ? I have a suspicion that it is : 0logwatch -> /usr/share/logwatch/scripts/logwatch.pl rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Martin Voelker Sendt: 19. februar 2008 16:41 Til: Syslog-ng users' and developers' mailing list Emne: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 Hi I can remember the same Problem. I just restart syslog-ng instead of reload rgds martin
"Peter Michael Calum" <pemca@tdc.dk> 19.02.2008 16:36:48 >>> Hi
I'm new to syslog, and i just used the samples from php-syslog-ng to get the data into the mysql database. - and that works fine. i get no errors when i stop / start syslog-ng only if i reload the configuration. rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Geller, Sandor (IT) Sendt: 19. februar 2008 16:29 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Syslog-ng sometime dies at 04:02 Hi, To be honest I don't understand your configuration, but the error message shows the problem (what I don't understand why does actually syslog-ng start with this configuration). You're actually using the same sources at two places, I'd eliminate the s_everything source completely. Regards, Sandor
-----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Peter Michael Calum Sent: Tuesday, February 19, 2008 4:05 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] Syslog-ng sometime dies at 04:02
Hi
I have installed syslog-ng on RHEL 5 as an RPM (syslog-ng-2.0.8-1.fc8.i386.rpm).
It runs fine except for this problem :
Every night at 04:02 som script runs and make a reload of the configuration. This comes out with some errors in the messages file, but the real problem is, that syslog-ng sometime stops running at this time.
I'm running syslog-ng together with php-syslog-ng
Hope anyone can help
rgds, Peter Calum Denmark
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))'
My configuration file :
options { sync (0); chain_hostnames(on); stats(43200); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); };
source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); };
source s_everything { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(); };
destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); };
destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n")
template-escape(yes)); };
log { source(s_everything); destination(d_mysql); };
filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); };
log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); };
# vim:set ai ts=4 sw=4 sts=4 et:
-------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html Westdeutsche Lotterie GmbH & Co. OHG | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: Münster HRA 4379 Geschäftsführer: Dr. Winfried Wortmann Vorsitzender des Beirates: Ernst Gerlach Gesellschafter: Nordwestlotto in Nordrhein-Westfalen GmbH | Sitz: Münster Registergericht: Amtsgericht Münster Handelsregister: HRB 3840 Geschäftsführer: Dr. Winfried Wortmann NRW.BANK | Sitz: Düsseldorf und Münster Rechtsform: Anstalt des öffentlichen Rechts Registergerichte: Amtsgerichte Düsseldorf/Münster Handelsregister: Düsseldorf HRA 15277/Münster HRA 5300 _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Tue, 2008-02-19 at 17:10 +0100, Peter Michael Calum wrote:
Hi Martin,
Found it ! - And changed to a stop / start sequence
Then we will se tomorrow..
I'd be grateful if you could help me debug this problem, why syslog-ng crashes upon the receipt of a reload signal. Doing a full restart is not very good, upon restart some messages may be lost. To help me debug, please enable core dumps (ulimit -c unlimited) before starting syslog-ng, and wait for it to dump core. -- Bazsi
Hi bazsi Ok, i'll change the line in logrotate.d back to a reload parameter but you have to explain to mee, how i set up the trace, and how i get the results out. Do you want results every 04:02 or only when syslog-ng dies ? rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Balazs Scheidler Sendt: 19. februar 2008 17:39 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 On Tue, 2008-02-19 at 17:10 +0100, Peter Michael Calum wrote:
Hi Martin,
Found it ! - And changed to a stop / start sequence
Then we will se tomorrow..
I'd be grateful if you could help me debug this problem, why syslog-ng crashes upon the receipt of a reload signal. Doing a full restart is not very good, upon restart some messages may be lost. To help me debug, please enable core dumps (ulimit -c unlimited) before starting syslog-ng, and wait for it to dump core. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Tue, 2008-02-19 at 17:51 +0100, Peter Michael Calum wrote:
Hi bazsi
Ok, i'll change the line in logrotate.d back to a reload parameter
but you have to explain to mee, how i set up the trace, and how i get the results out.
Do you want results every 04:02 or only when syslog-ng dies ?
Sorry, I was in a hurry when I wrote my last email. I only need information whenever syslog-ng dies and I'd need the syslog-ng binary, with all the shared libraries it depends on in /lib and the core file produced. Core files are produced if the program is started with the 'maximum core file size' ulimit set to a high enough value, I'd suggest to set it to unlimited. Thus, please do the following: * Add this line to your syslog-ng init script: "ulimit -c unlimited" * Make sure that syslog-ng has permissions to write the directory it is started from. * Wait for syslog-ng to crash * The core file will be produced in the directory syslog-ng was started from. As the crash is quite rare, I'd suggest to test that core files are properly produced, before waiting for an overnight. You can test this by sending a fatal signal to syslog-ng, something like this: kill -ABRT <syslog-ng pid> This should create a core file in the current working directory. Once this works, you can be assurred that a core file will be created if syslog-ng crashes. Thanks in advance, -- Bazsi
Hi Baszi Ok, i will do that. When i have the files, i pack them and mail them direct to you at bazsi@balabit.hu rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Balazs Scheidler Sendt: 20. februar 2008 10:30 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 On Tue, 2008-02-19 at 17:51 +0100, Peter Michael Calum wrote:
Hi bazsi
Ok, i'll change the line in logrotate.d back to a reload parameter
but you have to explain to mee, how i set up the trace, and how i get the results out.
Do you want results every 04:02 or only when syslog-ng dies ?
Sorry, I was in a hurry when I wrote my last email. I only need information whenever syslog-ng dies and I'd need the syslog-ng binary, with all the shared libraries it depends on in /lib and the core file produced. Core files are produced if the program is started with the 'maximum core file size' ulimit set to a high enough value, I'd suggest to set it to unlimited. Thus, please do the following: * Add this line to your syslog-ng init script: "ulimit -c unlimited" * Make sure that syslog-ng has permissions to write the directory it is started from. * Wait for syslog-ng to crash * The core file will be produced in the directory syslog-ng was started from. As the crash is quite rare, I'd suggest to test that core files are properly produced, before waiting for an overnight. You can test this by sending a fatal signal to syslog-ng, something like this: kill -ABRT <syslog-ng pid> This should create a core file in the current working directory. Once this works, you can be assurred that a core file will be created if syslog-ng crashes. Thanks in advance, -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Hi bazsi i put the ulimit -c unlimited in /etc/init.d/syslog-ng start section ------------------------------------------------------------------------- start() { ulimit -c unlimited echo -n $"Starting $prog: " daemon $exec $SYSLOGNG_OPTIONS retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval } syslog-ng runs i /sbin ----------------------- exec="/sbin/syslog-ng" prog=$(basename $exec) restarted syslog-ng -------------------- /etc/init.d/syslog-ng restart get the pid -------------- [root@khk9dsg5 sysconfig]# ps -ef | grep syslog-ng root 32259 1 0 14:21 ? 00:00:00 /sbin/syslog-ng -p /var/run/syslogd.pid kill -ABRT 32259 but i cant find any core files in the sbin directory (i gave /sbin 777 rights) rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Balazs Scheidler Sendt: 20. februar 2008 10:30 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 On Tue, 2008-02-19 at 17:51 +0100, Peter Michael Calum wrote:
Hi bazsi
Ok, i'll change the line in logrotate.d back to a reload parameter
but you have to explain to mee, how i set up the trace, and how i get the results out.
Do you want results every 04:02 or only when syslog-ng dies ?
Sorry, I was in a hurry when I wrote my last email. I only need information whenever syslog-ng dies and I'd need the syslog-ng binary, with all the shared libraries it depends on in /lib and the core file produced. Core files are produced if the program is started with the 'maximum core file size' ulimit set to a high enough value, I'd suggest to set it to unlimited. Thus, please do the following: * Add this line to your syslog-ng init script: "ulimit -c unlimited" * Make sure that syslog-ng has permissions to write the directory it is started from. * Wait for syslog-ng to crash * The core file will be produced in the directory syslog-ng was started from. As the crash is quite rare, I'd suggest to test that core files are properly produced, before waiting for an overnight. You can test this by sending a fatal signal to syslog-ng, something like this: kill -ABRT <syslog-ng pid> This should create a core file in the current working directory. Once this works, you can be assurred that a core file will be created if syslog-ng crashes. Thanks in advance, -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
syslog-ng runs i /sbin ----------------------- exec="/sbin/syslog-ng" prog=$(basename $exec)
This just shows where the syslog-ng program is physically stored on disk, not the working directory of the process. Modify the "start" script to echo `pwd` That's where the core file will be written.
Date: Wed, 20 Feb 2008 14:29:53 +0100 From: pemca@tdc.dk To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02
Hi bazsi
i put the ulimit -c unlimited in /etc/init.d/syslog-ng start section ------------------------------------------------------------------------- start() { ulimit -c unlimited echo -n $"Starting $prog: " daemon $exec $SYSLOGNG_OPTIONS retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval }
syslog-ng runs i /sbin ----------------------- exec="/sbin/syslog-ng" prog=$(basename $exec)
restarted syslog-ng -------------------- /etc/init.d/syslog-ng restart
get the pid -------------- [root@khk9dsg5 sysconfig]# ps -ef | grep syslog-ng root 32259 1 0 14:21 ? 00:00:00 /sbin/syslog-ng -p /var/run/syslogd.pid
kill -ABRT 32259
but i cant find any core files in the sbin directory (i gave /sbin 777 rights)
rgds, Peter
-----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Balazs Scheidler Sendt: 20. februar 2008 10:30 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02
On Tue, 2008-02-19 at 17:51 +0100, Peter Michael Calum wrote:
Hi bazsi
Ok, i'll change the line in logrotate.d back to a reload parameter
but you have to explain to mee, how i set up the trace, and how i get the results out.
Do you want results every 04:02 or only when syslog-ng dies ?
Sorry, I was in a hurry when I wrote my last email. I only need information whenever syslog-ng dies and I'd need the syslog-ng binary, with all the shared libraries it depends on in /lib and the core file produced.
Core files are produced if the program is started with the 'maximum core file size' ulimit set to a high enough value, I'd suggest to set it to unlimited.
Thus, please do the following:
* Add this line to your syslog-ng init script: "ulimit -c unlimited" * Make sure that syslog-ng has permissions to write the directory it is started from. * Wait for syslog-ng to crash * The core file will be produced in the directory syslog-ng was started from.
As the crash is quite rare, I'd suggest to test that core files are properly produced, before waiting for an overnight. You can test this by sending a fatal signal to syslog-ng, something like this:
kill -ABRT
This should create a core file in the current working directory. Once this works, you can be assurred that a core file will be created if syslog-ng crashes.
Thanks in advance,
-- Bazsi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
_________________________________________________________________ Windows Vista + Windows Live. Open up your digital life. Get Windows Live free. http://get.live.com
Hi echo `pwd` in the start script only shows / and there's no core file rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Joe Fegan Sendt: 20. februar 2008 14:42 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02
syslog-ng runs i /sbin ----------------------- exec="/sbin/syslog-ng" prog=$(basename $exec)
This just shows where the syslog-ng program is physically stored on disk, not the working directory of the process. Modify the "start" script to echo `pwd` That's where the core file will be written.
Date: Wed, 20 Feb 2008 14:29:53 +0100 From: pemca@tdc.dk To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02
Hi bazsi
i put the ulimit -c unlimited in /etc/init.d/syslog-ng start section ------------------------------------------------------------------------- start() { ulimit -c unlimited echo -n $"Starting $prog: " daemon $exec $SYSLOGNG_OPTIONS retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval }
syslog-ng runs i /sbin ----------------------- exec="/sbin/syslog-ng" prog=$(basename $exec)
restarted syslog-ng -------------------- /etc/init.d/syslog-ng restart
get the pid -------------- [root@khk9dsg5 sysconfig]# ps -ef | grep syslog-ng root 32259 1 0 14:21 ? 00:00:00 /sbin/syslog-ng -p /var/run/syslogd.pid
kill -ABRT 32259
but i cant find any core files in the sbin directory (i gave /sbin 777 rights)
rgds, Peter
-----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Balazs Scheidler Sendt: 20. februar 2008 10:30 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02
On Tue, 2008-02-19 at 17:51 +0100, Peter Michael Calum wrote:
Hi bazsi
Ok, i'll change the line in logrotate.d back to a reload parameter
but you have to explain to mee, how i set up the trace, and how i get the results out.
Do you want results every 04:02 or only when syslog-ng dies ?
Sorry, I was in a hurry when I wrote my last email. I only need information whenever syslog-ng dies and I'd need the syslog-ng binary, with all the shared libraries it depends on in /lib and the core file produced.
Core files are produced if the program is started with the 'maximum core file size' ulimit set to a high enough value, I'd suggest to set it to unlimited.
Thus, please do the following:
* Add this line to your syslog-ng init script: "ulimit -c unlimited" * Make sure that syslog-ng has permissions to write the directory it is started from. * Wait for syslog-ng to crash * The core file will be produced in the directory syslog-ng was started from.
As the crash is quite rare, I'd suggest to test that core files are properly produced, before waiting for an overnight. You can test this by sending a fatal signal to syslog-ng, something like this:
kill -ABRT
This should create a core file in the current working directory. Once this works, you can be assurred that a core file will be created if syslog-ng crashes.
Thanks in advance,
-- Bazsi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
_________________________________________________________________ Windows Vista + Windows Live. Open up your digital life. Get Windows Live free. http://get.live.com _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Wed, 2008-02-20 at 14:49 +0100, Peter Michael Calum wrote:
Hi
echo `pwd` in the start script only shows / and there's no core file
Maybe it's prevented by AppArmor or similar tools. Try changing the current directory to /var/tmp or /tmp. -- Bazsi
Still same result I'm running RHEL5 with SE-linux disabled. Could it be, that some other things should be activated to enable core dumps ? [root@khk9dsg5 tmp]# [root@khk9dsg5 tmp]# /etc/init.d/syslog-ng restart Stopping syslog-ng: [ OK ] Starting syslog-ng: [ OK ] /tmp [root@khk9dsg5 tmp]# [root@khk9dsg5 tmp]# ps -ef | grep syslog-ng root 2810 1 0 17:25 ? 00:00:00 /sbin/syslog-ng -p /var/run/syslogd.pid root 2854 2759 0 17:26 pts/1 00:00:00 grep syslog-ng root 2880 2873 0 Feb03 ? 00:00:00 /bin/sh -c /var/www/html/syslog/scripts/syslog2mysql.sh >> /var/log/php-syslog-ng/mysql.log 2>&1 [root@khk9dsg5 tmp]# kill -ABRT 2810 [root@khk9dsg5 tmp]# [root@khk9dsg5 tmp]# ps -ef | grep syslog-ng root 2870 2759 0 17:27 pts/1 00:00:00 grep syslog-ng root 2880 2873 0 Feb03 ? 00:00:00 /bin/sh -c /var/www/html/syslog/scripts/syslog2mysql.sh >> /var/log/php-syslog-ng/mysql.log 2>&1 [root@khk9dsg5 tmp]# ls -la total 52 drwxrwxrwt 9 root root 4096 Feb 20 17:25 . drwxr-xr-x 24 root root 4096 Feb 3 09:13 .. drwxrwxrwt 2 root root 4096 Feb 3 09:13 .font-unix -rw------- 1 root root 129 Feb 20 10:36 .gdm78VZ5T srw-rw-rw- 1 root root 0 Feb 3 09:13 .gdm_socket drwxrwxrwt 2 root root 4096 Feb 3 10:36 .ICE-unix drwx------ 2 root root 4096 Feb 3 10:36 keyring-uLO3tS srwxr-xr-x 1 root root 0 Feb 3 10:36 mapping-root drwx------ 2 root root 4096 Feb 3 11:13 orbit-root drwx------ 2 rips rips 4096 Feb 20 07:57 ssh-rGpIU26042 drwx------ 2 root root 4096 Feb 3 10:36 ssh-vuDwsR4065 -r--r--r-- 1 root root 11 Feb 3 09:13 .X0-lock drwxrwxrwt 2 root root 4096 Feb 3 09:13 .X11-unix [root@khk9dsg5 tmp]# rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Balazs Scheidler Sendt: 20. februar 2008 16:54 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 On Wed, 2008-02-20 at 14:49 +0100, Peter Michael Calum wrote:
Hi
echo `pwd` in the start script only shows / and there's no core file
Maybe it's prevented by AppArmor or similar tools. Try changing the current directory to /var/tmp or /tmp. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Wed, 2008-02-20 at 17:32 +0100, Peter Michael Calum wrote:
Still same result
I'm running RHEL5 with SE-linux disabled. Could it be, that some other things should be activated to enable core dumps ?
Hmm... there might be some core management on RHEL5, what is the contents of /proc/sys/kernel/core_pattern ? -- Bazsi
just 'core' [root@khk9dsg5 tmp]# cat /proc/sys/kernel/core_pattern core -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Balazs Scheidler Sendt: 20. februar 2008 17:58 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 On Wed, 2008-02-20 at 17:32 +0100, Peter Michael Calum wrote:
Still same result
I'm running RHEL5 with SE-linux disabled. Could it be, that some other things should be activated to enable core dumps ?
Hmm... there might be some core management on RHEL5, what is the contents of /proc/sys/kernel/core_pattern ? -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Just found out that the original syslogd also was running on the server. I have stopped it. Maybe this could have a impact on the error.. rgds, peter -----Oprindelig meddelelse----- Fra: Peter Michael Calum Sendt: 20. februar 2008 17:32 Til: 'Syslog-ng users' and developers' mailing list' Emne: SV: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 Still same result I'm running RHEL5 with SE-linux disabled. Could it be, that some other things should be activated to enable core dumps ? [root@khk9dsg5 tmp]# [root@khk9dsg5 tmp]# /etc/init.d/syslog-ng restart Stopping syslog-ng: [ OK ] Starting syslog-ng: [ OK ] /tmp [root@khk9dsg5 tmp]# [root@khk9dsg5 tmp]# ps -ef | grep syslog-ng root 2810 1 0 17:25 ? 00:00:00 /sbin/syslog-ng -p /var/run/syslogd.pid root 2854 2759 0 17:26 pts/1 00:00:00 grep syslog-ng root 2880 2873 0 Feb03 ? 00:00:00 /bin/sh -c /var/www/html/syslog/scripts/syslog2mysql.sh >> /var/log/php-syslog-ng/mysql.log 2>&1 [root@khk9dsg5 tmp]# kill -ABRT 2810 [root@khk9dsg5 tmp]# [root@khk9dsg5 tmp]# ps -ef | grep syslog-ng root 2870 2759 0 17:27 pts/1 00:00:00 grep syslog-ng root 2880 2873 0 Feb03 ? 00:00:00 /bin/sh -c /var/www/html/syslog/scripts/syslog2mysql.sh >> /var/log/php-syslog-ng/mysql.log 2>&1 [root@khk9dsg5 tmp]# ls -la total 52 drwxrwxrwt 9 root root 4096 Feb 20 17:25 . drwxr-xr-x 24 root root 4096 Feb 3 09:13 .. drwxrwxrwt 2 root root 4096 Feb 3 09:13 .font-unix -rw------- 1 root root 129 Feb 20 10:36 .gdm78VZ5T srw-rw-rw- 1 root root 0 Feb 3 09:13 .gdm_socket drwxrwxrwt 2 root root 4096 Feb 3 10:36 .ICE-unix drwx------ 2 root root 4096 Feb 3 10:36 keyring-uLO3tS srwxr-xr-x 1 root root 0 Feb 3 10:36 mapping-root drwx------ 2 root root 4096 Feb 3 11:13 orbit-root drwx------ 2 rips rips 4096 Feb 20 07:57 ssh-rGpIU26042 drwx------ 2 root root 4096 Feb 3 10:36 ssh-vuDwsR4065 -r--r--r-- 1 root root 11 Feb 3 09:13 .X0-lock drwxrwxrwt 2 root root 4096 Feb 3 09:13 .X11-unix [root@khk9dsg5 tmp]# rgds, Peter -----Oprindelig meddelelse----- Fra: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] På vegne af Balazs Scheidler Sendt: 20. februar 2008 16:54 Til: Syslog-ng users' and developers' mailing list Emne: Re: [syslog-ng] Antw: Re: Syslog-ng sometime dies at 04:02 On Wed, 2008-02-20 at 14:49 +0100, Peter Michael Calum wrote:
Hi
echo `pwd` in the start script only shows / and there's no core file
Maybe it's prevented by AppArmor or similar tools. Try changing the current directory to /var/tmp or /tmp. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
participants (5)
-
Balazs Scheidler
-
Geller, Sandor (IT)
-
Joe Fegan
-
Martin Voelker
-
Peter Michael Calum