[syslog-ng]config questions
MagerValp
MagerValp@cling.gu.se
Thu, 23 Nov 2000 02:07:09 +0100
With the sync parameter i can set how many lines are buffered before
logs are written to disk, but is it possible to have this buffer
flushed after a certain time period? Running with sync(0) eats up too
much I/O-performance.
I also vaguely remember someone mentioning a way of outputting all
the log messages that don't get caught by any filter rules to a file.
Anyone know what I'm talking about? It's basically to check that I'm
not missing anything important with my current config.
Another problem is a bug in Solaris 7 that causes a lot of messages
like this to show up in the logs:
Nov 9 19:24:08 src@enterprise top[7530]: ypbind client: can't get rdev
Nov 9 19:24:37 src@enterprise top[7535]: ypbind client: can't get rdev
Nov 9 19:24:42 src@enterprise top[7537]: ypbind client: can't get rdev
Nov 9 19:24:46 src@enterprise top[7539]: ypbind client: can't get rdev
Nov 10 05:40:00 src@enterprise ypcat[11591]: ypbind client: can't get rdev
Nov 10 05:40:00 src@enterprise ypcat[11591]: ypbind client: can't get rdev
Nov 10 05:40:01 src@enterprise yppush[11595]: ypbind client: can't get rdev
Nov 10 05:40:01 src@enterprise ypxfr[11596]: ypbind client: can't get rdev
Nov 10 05:40:01 src@enterprise ypxfr[11596]: ypbind client: can't get rdev
Nov 10 05:40:01 src@enterprise ypcat[11605]: ypbind client: can't get rdev
Nov 10 05:40:01 src@enterprise ypcat[11605]: ypbind client: can't get rdev
Nov 10 05:40:01 src@enterprise yppush[11609]: ypbind client: can't get rdev
There's a fix but it requires a reboot and that won't happen for a
while on the log server. Is there a way of filtering out these
messages? I guess putting and not match("client: can't get rdev") in
all the filter rules should work, but I'm looking for a more elegant
solution.
Thanks,
--
___ . . . . . + . . o
_|___|_ + . + . + . . Per Olofsson, konstnär
o-o . . . o + MagerValp@cling.gu.se
- + + . http://www.cling.gu.se/~cl3polof/