The second instance youre trying to launch is using the first instance's config. Error initializing source driver; source='src', id='src#0' From that message you can see its trying to initialize the source callced 'src'. In your second config, your source is called 's_node', the first instance is called 'src'. Make sure youre passing the proper '-f' option to syslog-ng when you start it. Sent: Saturday, June 26, 2010 8:18:22 PM From: John R. Dunning <jrd@jrd.org> To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Subject: [syslog-ng] ***SPAM*** Re: Two instances of syslog-ng on the same host?

From: "Patrick H." <syslogng@feystorm.net> Date: Sat, 26 Jun 2010 19:33:10 -0600

Yes, that should work just fine.

Well, ok, then I'm dense.

Here's the config for the proxy:

---------------------------------------------------------------- # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo,v 1.5 2005/05/12 05:46:10 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux # contributed by Michael Sterrett

# added by jrd 6/24/10 @version: 3.0

options { chain_hostnames(no); keep_hostname(yes);

log_fifo_size(40000); flush_lines(10000);

stats_freq(43200); # Stats message every 12 hours };

source s_node { tcp(max-connections(1000) port(1514) ); };

#source ignore #{ # internal(); #};

destination ssp { tcp ("ssp" port(1514)); };

log { source(s_node); destination(ssp); }; ----------------------------------------------------------------

and here's the config for the main instance:

----------------------------------------------------------------

@version: 3.0 # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo.3,v 1.1 2010/04/06 02:11:35 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux

options { chain_hostnames(no);

# The default action of syslog-ng is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats_freq(43200); };

source src { unix-stream("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); };

destination messages { file("/var/log/messages"); };

# By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; # ...if you intend to use /dev/console for programs like xconsole # you can comment out the destination line above that references /dev/tty12 # and uncomment the line below. #destination console_all { file("/dev/console"); };

log { source(src); destination(messages); }; log { source(src); destination(console_all); }; ----------------------------------------------------------------

When I launch the second instance I still get

* Starting syslog-ng ...Error binding socket; addr='AF_UNIX(/dev/log)', error='Address already in use (125)' Error initializing source driver; source='src', id='src#0' Error initializing message pipeline;

* Failed to start syslog-ng

This is gentoo, btw.

Further hints? Thanks in advance.... ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

From: "John R. Dunning" <jrd@jrd.org> Date: Sat, 26 Jun 2010 22:42:05 -0400 From: "Patrick H." <syslogng@feystorm.net> Date: Sat, 26 Jun 2010 20:27:41 -0600 The second instance youre trying to launch is using the first instance's config. Error initializing source driver; source='src', id='src#0' From that message you can see its trying to initialize the source callced 'src'. In your second config, your source is called 's_node', the first instance is called 'src'. Make sure youre passing the proper '-f' option to syslog-ng when you start it. Pretty sure I am. It's the second config (the one for the "main" instance) which has a source called "src". It's the proxy one (the first one) which has a source called "s_node". The start for the proxy uses -f <special-proxy-conf> whereas the start for the main one just lets it default to syslog-ng.conf. Anybody got any further ideas on this? I fear my next step is to start running the thing under gdb and try to work out why the proxy instance still wants to open /dev/log. Would like to avoid that if possible...

On Sat, 2010-06-26 at 22:42 -0400, John R. Dunning wrote:

From: "Patrick H." <syslogng@feystorm.net> Date: Sat, 26 Jun 2010 20:27:41 -0600

The second instance youre trying to launch is using the first instance's config. Error initializing source driver; source='src', id='src#0' From that message you can see its trying to initialize the source callced 'src'. In your second config, your source is called 's_node', the first instance is called 'src'. Make sure youre passing the proper '-f' option to syslog-ng when you start it.

Pretty sure I am.

It's the second config (the one for the "main" instance) which has a source called "src". It's the proxy one (the first one) which has a source called "s_node".

The start for the proxy uses -f <special-proxy-conf> whereas the start for the main one just lets it default to syslog-ng.conf.

Well, the string "/dev/log" can only come from a config file, so I'd strongly suspect that there's something wrong with the configuration file being used. You could confirm that the good one is being used by checking the command line arguments, or if those look sane, by validating via strace, that syslog-ng is indeed opening the intended configuration file. -- Bazsi