I'm testing out logging from another host to a central syslog-ng host. The host I'm logging to is a redhat-7.0 linux box with 1.4.11. The host I'm logging from is a Solaris 7 box running sun's standard syslog. I've defined loghost in /etc/hosts, and I've seen a couple of messages arrive. However it's been forever since any messages have been logged from this host. If I do a netstat -an I see the following Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State udp 65520 0 0.0.0.0:514 0.0.0.0:* I have the following source definition source udp_src {udp();} And I'm simply trying to get it to default to a /var/log/messages log { source(udp_src); filter(DEFAULT); destination(messages);}; I'm reading the netstat as indicating the data is being sent, and is being received. However, it's not being written to the files. Other data has been written in the meantime to the log files. We currently are logging several cisco routers with the source: udp_src { udp()}; In fact this was logging messages ealier as well. I've been trying to tweak it a little and now it doesn't seem to be working. Anyone seen this? This is very frustrating. Anyone have any ideas on what I may have done wrong? Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy@chartermi.net
Anyone seen this? This is very frustrating. Anyone have any ideas on what I may have done wrong?
can you strace syslog-ng to check what it's doing? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
On Wed, 28 Mar 2001, Balazs Scheidler wrote:
Anyone seen this? This is very frustrating. Anyone have any ideas on what I may have done wrong?
can you strace syslog-ng to check what it's doing?
It had entirely nothing to do with syslog-ng. I was interpreting the netstat output as indicating messages were coming from that host, which wasn't the case at all after doing: #tcpdump port 514 all of the messages were coming in from the routers and none from that host. The fault lay with the syslog.conf for solaris. Why I don't know, but I've magically fixed what the man page stated should have worked by working my mojo. If your unfamiliar with the term mojo, let me just say I have no idea why it didn't work before. Thanks. Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy@chartermi.net
participants (2)
-
Balazs Scheidler
-
Brian E. Seppanen