[syslog-ng]Re: Bad hostname from solaris (added a subject now)

Tue, 31 Dec 2002 02:14:37 -0500 (EST)

--EXCITEBOUNDARY_000__2b4fb2982b5da06b3fb982326c87d9db
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

 Hi!
It is possible to use syslog-ng on solaris, but not preferable.
I don't like the idea of replacing something core from the system. I'm trying to find a solution for the solaris syslogd, not to replace it with a different product.
As I said: When its one native solaris syslog sending to another, it works flowlessly.

Noam

>Can you replace the Solaris syslog with syslog-ng?

>Aaron

>On Monday, December 30, 2002, at 05:32 PM, Noam Meltzer wrote:

>>Hi!

>>I am using Linux running Syslog-ng as my logserver, while the logs for
>>each host i have are sent into different directory (and in the
directory, i create files for each facility.priority).

>>My clients platforms (the servers being logged) are:

>>1. Linux (runnig classic syslogd... can't remember which)

>>2. HPUX11i (running the native syslogd)

>>3. Solaris7&8

>>The mechanism works flowlessly, except for solaris.

>>What happens? If I have a one line log, it works just fine. Syslog-ng
>>identifies the host it comes from, and divide the data to files
according to the rules I mentioned above.

>>When I have a longer logs which takes two lines or more, starting from
>>the 2nd line, syslog-ng doesn't know the the message was originated
from, and creates for funny like:

>>"?DLT" "?corrupt" "?See", etc.

>>(The ? is actually 1 character or more, which the terminal can't
recognize)

>>The word you see, is actually the first word of the actual message.

>>If I look at the operation of the native on solaris, local messages
are logged just fine.

>>I did a little experiment and tried sending logs from one native
solaris syslog to another. It worked just fine (except the fact i
can't into hostnames...)

>>I looked at the big log "/var/adm/messages" (of two hosts) and saw
that the "bad" logs, were logged by the native logger just fine, with
stating the originating host as it should be in the beginning of the
line.

>>I tried simulating this using the command "logger" with no sucess.

>>I suspect that sends the data of each packet, not to lines as
syslog-ng expects and this cause its mechanism to fail recognizing the
originating host succesfully.

>>Did any1 encountered this problem? How did you solve it?

>>Noam

>>tsnoam@excite.com

_______________________________________________
Join Excite! - http://www.excite.com
The most personalized portal on the Web!

--EXCITEBOUNDARY_000__2b4fb2982b5da06b3fb982326c87d9db
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit

Hi! It is possible to use syslog-ng on solaris, but not preferable. I don't like the idea of replacing something core from the system. I'm trying to find a solution for the solaris syslogd, not to replace it with a different product. As I said: When its one native solaris syslog sending to another, it works flowlessly. Noam >Can you replace the Solaris syslog with syslog-ng? >Aaron >On Monday, December 30, 2002, at 05:32 PM, Noam Meltzer wrote: >>Hi! >>I am using Linux running Syslog-ng as my logserver, while the logs for >>each host i have are sent into different directory (and in the directory, i create files for each facility.priority). >>My clients platforms (the servers being logged) are: >>1. Linux (runnig classic syslogd... can't remember which) >>2. HPUX11i (running the native syslogd) >>3. Solaris7&8 >>The mechanism works flowlessly, except for solaris. >>What happens? If I have a one line log, it works just fine. Syslog-ng >>identifies the host it comes from, and divide the data to files according to the rules I mentioned above. >>When I have a longer logs which takes two lines or more, starting from >>the 2nd line, syslog-ng doesn't know the the message was originated from, and creates for funny like: >>"?DLT" "?corrupt" "?See", etc. >>(The ? is actually 1 character or more, which the terminal can't recognize) >>The word you see, is actually the first word of the actual message. >>If I look at the operation of the native on solaris, local messages are logged just fine. >>I did a little experiment and tried sending logs from one native solaris syslog to another. It worked just fine (except the fact i can't into hostnames...) >>I looked at the big log "/var/adm/messages" (of two hosts) and saw that the "bad" logs, were logged by the native logger just fine, with stating the originating host as it should be in the beginning of the line. >>I tried simulating this using the command "logger" with no sucess. >>I suspect that sends the data of each packet, not to lines as syslog-ng expects and this cause its mechanism to fail recognizing the originating host succesfully. >>Did any1 encountered this problem? How did you solve it? >>Noam >>tsnoam@excite.com<hr>Join Excite! - <a href=http://www.excite.com target=_blank>http://www.excite.com</a> The most personalized portal on the Web!

--EXCITEBOUNDARY_000__2b4fb2982b5da06b3fb982326c87d9db--