[syslog-ng] file written in the wrong place

Paolo Supino vrkid at yahoo.com
Fri Dec 23 08:44:06 CET 2005


 I've installed syslog-ng 1.6.8 on a Linux FC4 system to act as a
centeralized logging server. For a while everything was fine, until I
tried to add another statement to one of the filters. After the
addition syslog-ng started writing the destination files in the wrong
places, writing the same file in 2 locations and ignoring messages sent
from certain origins. 
Here are the relevant parts of my syslog-ng.conf: 
# Global options
options { sync (0);
          time_reopen (1);
          log_fifo_size (999999);
          long_hostnames (yes);
          use_dns (yes);
          use_fqdn (yes);
          create_dirs (yes);
          keep_hostname (yes);

# source
source s_net { udp(ip("") port(514)); };

# destinations
destination d_switch { file("/var/log/company/switches/$HOST.log"
perm(0644)); };
destination d_edge { file("/var/log/company/edge_devices/$HOST.log"
perm(0644)); };
destination d_fw { file("/var/log/company/firewalls/$HOST.log"
perm(0644)); };
destination d_router { file("/var/log/company/routers/$HOST.log"
perm(0644)); };

# filters
filter f_edge        { host("edge*") or host("10.10.*"); };
filter f_router      { host("3600-primary") or host("backbone-3550") or
host("secondary-3550"); };
filter f_switch      { host("sw*") or host("backbone-5510") or
host(pp8600*); };
filter f_fw          { host("fw*"); };

# wrap everything up
log { source(s_net); filter(f_switch); destination(d_switch); };
log { source(s_net); filter(f_router); destination(d_router); };
log { source(s_net); filter(f_edge); destination(d_edge); };
log { source(s_net); filter(f_fw); destination(d_fw); };

# end of configuration file 

when I run the command `find /var/log/company -type f -print` I get the
following output: 

I tried to upgrade syslog-ng to 1.6.9 but it didn't resolve the
problems. Any idea on why this happnes and how to fix this will be
greatly appriciated.


PS - the systems sending the syslog messages are nortel switches,
Checkpoint firewalls and edge devices. 

Yahoo! for Good - Make a difference this year. 

More information about the syslog-ng mailing list