[syslog-ng]TCP Questions
Jeff McReynolds
jeffm@unixlords.com
Mon, 11 Nov 2002 16:23:38 -0600
This is a multi-part message in MIME format.
------=_NextPart_000_0034_01C2899E.B1231660
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
We are in need of a solution to move many different kinds of logs across =
our network. Traditionally our developers have pretty much just dumped =
log files where ever which of course is unmanagable after a while. We =
are currently using NG with Apache and are comfortable with the idea of =
loosing a log every now and then. What we cannot do is loose logs that =
our developer's applications are sending to the server. It appeared =
that a good way to accomplish this would be to use the TCP functionality =
built into NG. I have had some difficulty getting NG to accept the =
parameters listed on the docs page for the TCP connection. I even =
copied them verbatim at one point and still receive a parse error on the =
destination line in question.
So, Two questions I guess:
1.) Can the TCP functionality be used as a fault tolerant solution for =
our developers logging needs?
2.) Does anyone have any suggestion as to why the following line would =
fail?
destination d_joust { tcp("192.168.30.225" port(1999); localport(999)); =
}; <------------ Line 22 causing the parse error.
filter f_tcp { (level(info) and facility (local7)); }
log { source(s_sys); filter(f_tcp); destionation(d_joust); };
parse error at 22
Parse error reading configuration file, exiting.
Thanks for any suggestions.
-JMc
------=_NextPart_000_0034_01C2899E.B1231660
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 5.50.4916.2300" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>We are in need of a solution to move =
many different=20
kinds of logs across our network. Traditionally our developers =
have pretty=20
much just dumped log files where ever which of course is unmanagable =
after=20
a while. We are currently using NG with Apache and are =
comfortable with the idea of loosing a log every now and then. =
What we=20
cannot do is loose logs that our developer's applications are sending to =
the=20
server. It appeared that a good way to accomplish this would be to =
use the=20
TCP functionality built into NG. I have had some difficulty =
getting NG to=20
accept the parameters listed on the docs page for the TCP =
connection. I=20
even copied them verbatim at one point and still receive a parse error =
on the=20
destination line in question.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>So, Two questions I guess:</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>1.) Can the TCP functionality be used =
as a fault=20
tolerant solution for our developers logging needs?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>2.) Does anyone have any suggestion as =
to why the=20
following line would fail?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>destination d_joust { =
tcp("192.168.30.225"=20
port(1999); localport(999)); }; <------------ Line 22 causing =
the parse=20
error.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>filter =
f_tcp {=20
(level(info) and facility (local7)); }<BR></FONT></DIV>
<DIV><FONT face=3DArial size=3D2>log { source(s_sys); filter(f_tcp);=20
destionation(d_joust); };</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>parse error at 22<BR>Parse error =
reading=20
configuration file, exiting.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Thanks for any =
suggestions.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>-JMc</DIV></FONT></BODY></HTML>
------=_NextPart_000_0034_01C2899E.B1231660--