[syslog-ng](no subject)

Mon, 30 Dec 2002 17:32:09 -0500 (EST)

--EXCITEBOUNDARY_000__9e6651172503195176c5ae0f5e2f2c1c
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

 Hi!

I am using Linux running Syslog-ng as my logserver, while  the logs for each host i have are sent into different directory (and in the directory, i create files for each facility.priority).
My clients platforms (the servers being logged) are:
1. Linux (runnig classic syslogd... can't remember which)
2. HPUX11i (running the native syslogd)
3. Solaris7&8

The mechanism works flowlessly, except for solaris.

What happens? If I have a one line log, it works just fine. Syslog-ng identifies the host it comes from, and divide the data to files according to the rules I mentioned above.
When I have a longer logs which takes two lines or more, starting from the 2nd line, syslog-ng doesn't know the  the message was originated from, and creates  for funny  like:
"?DLT" "?corrupt" "?See", etc.
(The ? is actually 1 character or more, which the terminal can't recognize)
The word you see, is actually the first word of the actual message.
If I look at the operation of the native  on solaris, local messages are logged just fine.

I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't  into hostnames...)
I looked at the big  log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by  the native logger just fine, with stating the originating host as it should be in the beginning of the line.

I tried simulating this  using the command "logger" with no sucess.

I suspect that   sends the data of each  packet, not  to lines as syslog-ng expects and this cause its mechanism to fail recognizing the originating host succesfully.

Did any1 encountered this problem? How did you solve it? 

Noam
tsnoam@excite.com

_______________________________________________
Join Excite! - http://www.excite.com
The most personalized portal on the Web!

--EXCITEBOUNDARY_000__9e6651172503195176c5ae0f5e2f2c1c
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit

Hi! I am using Linux running Syslog-ng as my logserver, while the logs for each host i have are sent into different directory (and in the directory, i create files for each facility.priority). My clients platforms (the servers being logged) are: 1. Linux (runnig classic syslogd... can't remember which) 2. HPUX11i (running the native syslogd) 3. Solaris7&8 The mechanism works flowlessly, except for solaris. What happens? If I have a one line log, it works just fine. Syslog-ng identifies the host it comes from, and divide the data to files according to the rules I mentioned above. When I have a longer logs which takes two lines or more, starting from the 2nd line, syslog-ng doesn't know the the message was originated from, and creates for funny like: "?DLT" "?corrupt" "?See", etc. (The ? is actually 1 character or more, which the terminal can't recognize) The word you see, is actually the first word of the actual message. If I look at the operation of the native on solaris, local messages are logged just fine. I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...) I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line. I tried simulating this using the command "logger" with no sucess. I suspect that sends the data of each packet, not to lines as syslog-ng expects and this cause its mechanism to fail recognizing the originating host succesfully. Did any1 encountered this problem? How did you solve it? Noam tsnoam@excite.com <hr>Join Excite! - <a href=http://www.excite.com target=_blank>http://www.excite.com</a> The most personalized portal on the Web!

--EXCITEBOUNDARY_000__9e6651172503195176c5ae0f5e2f2c1c--