RE: [syslog-ng]Syslog messages are getting combined...
Here are a few lines from syslog that are combined... Apr 26 13:46:20 dnsserver OK" proto=ht<27>named[10268]: check_hints: no A records for nccnt01.jacobs.com class 1 in hints Apr 26 13:46:20 dnsserver 0 OK" proto<29>named[10268]: check_root: 1 root servers after query to root server < min Apr 26 13:57:40 dnsserver - Bryan, TX\\\"<p<29>named[9492]: starting (/etc/named.conf). named 8.2.3-REL After the time and the hostname there is some extra data that comes from my firewalls syslog messages. Then comes named and it's data. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, April 27, 2001 1:59 AM To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng]Syslog messages are getting combined... On Thu, Apr 26, 2001 at 01:47:17PM -0400, Scott, Joshua wrote:
Has anyone ever had an issue where sometimes you get the information from one syslog message combined with another syslog message? Every one in a while I get some of my firewall syslog messages combined with messages from my DNS servers. This causes my scripts to fail since there is invalid data in the log message. Can anyone shed some light for me? Thank you very much!
Could you send me some examples. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng
On Fri, Apr 27, 2001 at 01:20:42PM -0400, Scott, Joshua wrote:
Here are a few lines from syslog that are combined...
Apr 26 13:46:20 dnsserver OK" proto=ht<27>named[10268]: check_hints: no A records for nccnt01.jacobs.com class 1 in hints Apr 26 13:46:20 dnsserver 0 OK" proto<29>named[10268]: check_root: 1 root servers after query to root server < min Apr 26 13:57:40 dnsserver - Bryan, TX\\\"<p<29>named[9492]: starting (/etc/named.conf). named 8.2.3-REL
After the time and the hostname there is some extra data that comes from my firewalls syslog messages. Then comes named and it's data.
Can you check the exact packets received by syslog-ng? using strace -s 1024 or truss? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
participants (2)
-
Balazs Scheidler
-
Scott, Joshua