[syslog-ng] Silence syslog-ng upon connection reopening?

Wolfram Schlich lists at wolfram.schlich.org
Thu Nov 23 19:35:43 CET 2006


Hi,

is it possible to silence syslog-ng running on a log client
when it reopens a TCP connection to the syslog-ng log server?

For example, when you restart syslog-ng on the server due
to some configuration change or whatever other reason, syslog-ng on
the log client logs this to syslog.err:

	syslog-ng[13214]: io.c: do_write: write() failed, EOF detected
	syslog-ng[13214]: pkt_buffer::do_flush(): Error flushing data
	syslog-ng[13214]: Connection broken to AF_INET(log-server:514), reopening in 10 seconds       

Can I make syslog-ng NOT log those messages until, let's say,
the reopening failed at least N times?

The reason is I am using tenshi to monitor the remote logs on the
log server in order to alert me about messages with the
severities err, crit and emerg.

I can, however, add special trash patterns to my tenshi config
to disregard the above messages, but I don't feel comfortable
about it (for example, when there was a real problem, like a
network outage for, let's say, more than 60 seconds).

Switching to UDP does not look like a brilliant alternative
either ;)

Best regards
-- 
Wolfram Schlich


More information about the syslog-ng mailing list