Hi! I am using Linux running Syslog-ng as my logserver, while the logs for each host i have are sent into different directory (and in the directory, i create files for each facility.priority). My clients platforms (the servers being logged) are: 1. Linux (runnig classic syslogd... can't remember which) 2. HPUX11i (running the native syslogd) 3. Solaris7&8 The mechanism works flowlessly, except for solaris. What happens? If I have a one line log, it works just fine. Syslog-ng identifies the host it comes from, and divide the data to files according to the rules I mentioned above. When I have a longer logs which takes two lines or more, starting from the 2nd line, syslog-ng doesn't know the the message was originated from, and creates for funny like: "?DLT" "?corrupt" "?See", etc. (The ? is actually 1 character or more, which the terminal can't recognize) The word you see, is actually the first word of the actual message. If I look at the operation of the native on solaris, local messages are logged just fine. I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...) I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line. I tried simulating this using the command "logger" with no sucess. I suspect that sends the data of each packet, not to lines as syslog-ng expects and this cause its mechanism to fail recognizing the originating host succesfully. Did any1 encountered this problem? How did you solve it? Noam tsnoam@excite.com _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!
Can you replace the Solaris syslog with syslog-ng? Aaron On Monday, December 30, 2002, at 05:32 PM, Noam Meltzer wrote:
Hi!
I am using Linux running Syslog-ng as my logserver, while the logs for each host i have are sent into different directory (and in the directory, i create files for each facility.priority). My clients platforms (the servers being logged) are: 1. Linux (runnig classic syslogd... can't remember which) 2. HPUX11i (running the native syslogd) 3. Solaris7&8
The mechanism works flowlessly, except for solaris.
What happens? If I have a one line log, it works just fine. Syslog-ng identifies the host it comes from, and divide the data to files according to the rules I mentioned above. When I have a longer logs which takes two lines or more, starting from the 2nd line, syslog-ng doesn't know the the message was originated from, and creates for funny like: "?DLT" "?corrupt" "?See", etc. (The ? is actually 1 character or more, which the terminal can't recognize) The word you see, is actually the first word of the actual message. If I look at the operation of the native on solaris, local messages are logged just fine.
I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...) I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line.
I tried simulating this using the command "logger" with no sucess.
I suspect that sends the data of each packet, not to lines as syslog-ng expects and this cause its mechanism to fail recognizing the originating host succesfully.
Did any1 encountered this problem? How did you solve it?
Noam tsnoam@excite.com
<image.tiff>
Join Excite! - http://www.excite.com The most personalized portal on the Web!
On Mon, Dec 30, 2002 at 05:32:09PM -0500, Noam Meltzer wrote:
I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...) I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line.
I tried simulating this using the command "logger" with no sucess.
I suspect that sends the data of each packet, not to lines as syslog-ng expects and this cause its mechanism to fail recognizing the originating host succesfully.
Did any1 encountered this problem? How did you solve it?
syslog-ng terminates messages at '\n' even in UDP packets unless you are using a recent version of syslog-ng. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Yes I see it too. I found nothing on the Solaris syslog side to handle this (while using 'standard' syslog, which I must use on these systems). Since I log to a database, I have a SQL query that removes such silly things in the program and host fields. Sander On Monday 30 December 2002 23:32, you wrote:
Hi!
I am using Linux running Syslog-ng as my logserver, while the logs for each host i have are sent into different directory (and in the directory, i create files for each facility.priority). My clients platforms (the servers being logged) are: 1. Linux (runnig classic syslogd... can't remember which) 2. HPUX11i (running the native syslogd) 3. Solaris7&8
The mechanism works flowlessly, except for solaris.
What happens? If I have a one line log, it works just fine. Syslog-ng identifies the host it comes from, and divide the data to files according to the rules I mentioned above. When I have a longer logs which takes two lines or more, starting from the 2nd line, syslog-ng doesn't know the the message was originated from, and creates for funny like: "?DLT" "?corrupt" "?See", etc. (The ? is actually 1 character or more, which the terminal can't recognize) The word you see, is actually the first word of the actual message. If I look at the operation of the native on solaris, local messages are logged just fine.
I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...) I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line.
I tried simulating this using the command "logger" with no sucess.
I suspect that sends the data of each packet, not to lines as syslog-ng expects and this cause its mechanism to fail recognizing the originating host succesfully.
Did any1 encountered this problem? How did you solve it?
Noam tsnoam@excite.com
_______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!
- ---------------------------------------- Content-Type: text/html; charset="us-ascii"; name="Attachment: 1" Content-Transfer-Encoding: 7bit Content-Description: - ---------------------------------------- - -- My public key is available at http://www.sanderscorner.com/file/pgp-pubkey.txt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE+EeIPhNL8OKskREIRAkczAKDCAr46M/vKILNvygJypo+RiUSkfgCgw9y5 d/30tpW80s0veTwl+d/ra0c= =rBYu -----END PGP SIGNATURE-----
participants (4)
-
Aaron Jackson
-
Balazs Scheidler
-
Noam Meltzer
-
Sander de Boer