[syslog-ng]AIX compatability issue?

[Balazs Scheidler]

Hi,

> I'm running a central syslog-ng server with the following syslog-ng.conf:
> 
> options { sync (0);
>           time_reopen (10);
>           log_fifo_size (1000);
>           long_hostnames (off);
>           use_dns (yes);
>           use_fqdn (no);
>           create_dirs (no);
>           keep_hostname (yes);
>         };
> 
> source s_sys { unix-stream ("/dev/log"); internal(); };
> source s_remote { udp(ip(0.0.0.0) port(514)); };
> 
> destination d_mesg { file("/var/log/messages"); };
> destination d_powerpay { file("/var/log/powerpay"); };
> 
> filter f_powerpay       { facility(local1); };
> 
> log { source(s_sys); destination(d_mesg); };
> log { source(s_remote); filter(f_powerpay); destination(d_powerpay); };
> log { source(s_remote); destination(d_mesg); };
> 
> 
> I have serveral AIX servers that don't seem to get logged.  I'm sending
> messages with facility set to local1.  If I comment out the second log line
> above I get messages from the AIX servers to my messages file.  When I
> enable the second log line as it is above I get nothing.  I've tested
> sending messages from other platforms with facility set to local1 and they
> get logged in the correct file as expected.

/var/log/messages should get a copy of each message regardless of the second
logline. you should check whether syslog-ng receives the lines correctly
with a truss or an strace.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1