[syslog-ng] Duplicates

[Ed Lucero]

I am getting duplicate log entries for mail.notice and mail.warning.
I am also not quite clear on the garbage collecting parameters.

Thanks for your help. :)
Ed

syslog-ng 1.6.9

The initital syslog-ng.conf file was created by the FreeBSD Port.

I have modified the entries for mail to isolate mail logging.

I am logging for 13 FreeBSD servers and 1 Pix Firewall

The daily throughput is 7.3 million log entries per day.

This will increase by 5 in the next few months as we migrate from the old
mail servers to the new mail servers

Below is the current configuration file.

Here are the mail entries.

destination maillog { file("/var/log/$HOST/maillog"); }; filter f_mail {
facility(mail); }; filter f_m_info { level(info,notice,warning,debug); };
log { source(src); filter(f_mail); filter(f_m_info); destination(maillog);};


Hardware configuration
----------------------

DELL Poweredge 2850
Dual 3.0GHZ Xeon Processors
2G Memory
OS on Mirrored 73G 10K Ultra320 SCSI
SYSLOG on Mirrored 300G 10K Ultra320 SCSI

Running FreeBSD 6 using a SMP kernel


syslog-ng.conf
--------------

#
# This sample configuration file is essentially equilivent to the stock #
FreeBSD /etc/syslog.conf file.
#

#
# options
#
options {
          time_reopen (1);
          log_fifo_size (999999);
          use_fqdn(yes);
          keep_hostname (yes);
          create_dirs(yes);
          sync(0);
          use_dns (yes);
          dns_cache(yes);
          dns_cache_size(1000);
          dns_cache_expire(604800);
          gc_idle_threshold(600);
          gc_busy_threshold(500000);
        };

#
# sources
#
source src { unix-dgram("/var/run/log");
             unix-dgram("/var/run/logpriv" perm(0600));
             tcp();
             udp();
             internal();
             file("/dev/klog");
           };

#
# destinations
#
destination clamav { file("/var/log/$HOST/clamav"); }; destination messages
{ file("/var/log/$HOST/messages"); }; destination security {
file("/var/log/$HOST/security"); }; destination authlog {
file("/var/log/$HOST/auth.log"); }; destination maillog {
file("/var/log/$HOST/maillog"); }; destination firewall {
file("/var/log/firewall/firewall"); }; destination lpd-errs {
file("/var/log/$HOST/lpd-errs"); }; destination xferlog {
file("/var/log/$HOST/xferlog"); }; destination cron {
file("/var/log/$HOST/cron"); }; destination debuglog {
file("/var/log/$HOST/debug.log"); }; destination consolelog {
file("/var/log/console.log"); }; destination all { file("/var/log/all.log");
}; destination newscrit { file("/var/log/news.crit"); }; destination newserr
{ file("/var/log/news.err"); }; destination newsnotice {
file("/var/log/news.notice"); }; destination slip {
file("/var/log/slip.log"); }; destination ppp { file("/var/log/ppp.log"); };
destination console { file("/dev/console"); }; destination allusers {
usertty("*"); }; #destination loghost { udp("loghost" port(514)); };

#
# log facility filters
#
filter f_auth { facility(auth); };
filter f_authpriv { facility(authpriv); }; filter f_not_authpriv { not
facility(authpriv); }; filter f_console { facility(console); }; filter
f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter
f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr {
facility(lpr); }; filter f_mail { facility(mail); }; filter f_not_mail { not
facility(mail); }; filter f_news { facility(news); }; filter f_security {
facility(security); }; filter f_user { facility(user); }; filter f_uucp {
facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 {
facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3
{ facility(local3); }; filter f_local4 { facility(local4); }; filter
f_local5 { facility(local5); }; filter f_local6 { facility(local6); };
filter f_local7 { facility(local7); };

#
# log level filters
#
filter f_emerg { level(emerg); };
filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg);
}; filter f_err { level(err..emerg); }; filter f_warning {
level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter
f_info { level(info,debug); }; filter f_debug { level(debug..emerg); };
filter f_is_debug { level(debug); }; filter f_m_notice { level(notice); };
filter f_m_info { level(info,notice,warning,debug); };

#
# program filters
#
filter f_ppp { program("ppp"); };
filter f_slip { program("startslip"); };

#
# *.err;kern.warning;auth.notice;mail.crit              /dev/console
#
log { source(src); filter(f_err); destination(console); }; log {
source(src); filter(f_kern); filter(f_warning); destination(console); }; log
{ source(src); filter(f_auth); filter(f_notice); destination(console); };
log { source(src); filter(f_mail); filter(f_crit); destination(console); };

#
# *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err
/var/log/messages # log { source(src); filter(f_notice); filter(f_not_mail);
destination(messages); }; log { source(src); filter(f_kern);
filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr);
filter(f_info); destination(messages); }; log { source(src); filter(f_news);
filter(f_err); destination(messages); };

#
# clamav
#
log { source(src); filter(f_local6); destination(clamav); };

#
# security.*                                            /var/log/security
#
log { source(src); filter(f_security); destination(security); };

#
# auth.info;authpriv.info                               /var/log/auth.log
log { source(src); filter(f_auth); filter(f_info); destination(authlog); };
log { source(src); filter(f_authpriv); filter(f_info); destination(authlog);
};

#
# mail.info                                             /var/log/maillog
#
log { source(src); filter(f_mail); filter(f_m_info); destination(maillog);
};

#
# lpr.info                                              /var/log/lpd-errs
#
log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); };

#
# ftp.info                                              /var/log/xferlog
#
log { source(src); filter(f_ftp); filter(f_info); destination(xferlog); };

#
# cron.*                                                /var/log/cron
#
log { source(src); filter(f_cron); destination(cron); };

#
# *.=debug                                              /var/log/debug.log
#
log { source(src); filter(f_is_debug); destination(debuglog); };

#
# *.emerg                                               *
#
#log { source(src); filter(f_emerg); destination(allusers); };

#
# uncomment this to log all writes to /dev/console to /var/log/console.log
# console.info                                          /var/log/console.log
#
#log { source(src); filter(f_console); filter(f_info);
destination(consolelog); };

#
# uncomment this to enable logging of all log messages to /var/log/all.log #
touch /var/log/all.log and chmod it to mode 600 before it will work
# *.*                                                   /var/log/all.log
#
#log { source(src); destination(all); };

#
# uncomment this to enable logging to a remote loghost named loghost
# *.*                                                   @loghost
#
#log { source(src); destination(loghost); };

#
# uncomment these if you're running inn
# news.crit
/var/log/news/news.crit
# news.err
/var/log/news/news.err
# news.notice
/var/log/news/news.notice
#
#log { source(src); filter(f_news); filter(f_crit); destination(newscrit);
}; #log { source(src); filter(f_news); filter(f_err); destination(newserr);
}; #log { source(src); filter(f_news); filter(f_notice);
destination(newsnotice); };

#
# !startslip
# *.*                                                   /var/log/slip.log
#
log { source(src); filter(f_slip); destination(slip); };

#
# !ppp
# *.*                                                   /var/log/ppp.log
#
log { source(src); filter(f_ppp); destination(ppp); };