[syslog-ng] Logs from Nauticus

[Nate Campi]

On Fri, Sep 07, 2007 at 04:47:31PM +0200, Delphine D wrote:
> 
> Thank you Nate for your help.
> 
> Here is the syslog-ng.conf from my logs server :
> 
> options {    create_dirs(yes);
<snip>
>                 chain_hostnames(yes);
>         };

Try chain_hostnames(no).

No matter what, you're dealing with a bad format that's close enough to
a good one to make syslog-ng guess incorrectly. This isn't the fault of
syslog-ng, just a result of the imperfect world we live in.

> I'm not sure that we've the ability to change something in the Nauticus.
> There is no Syslog or Syslog-ng running on it.  There is no configuration 
> files like in "normal" servers (Linux, Solaris,...).
> 
> There is only a parameters section in the GUI, where you have to configure :
> 
> - SysLog Host   --> IP of the logs server
> - Syslog Port     --> 514
> - Filter              --> defaultSyslog (by default)
> - Facility           --> local0, local1,.... or local7

Any other options? Any other Filter options, specifically?

I've actually run perl-based syslog proxy code I wrote to work around
really crappy syslog formats. The bad_hostname option came as a result
of me bitching about the bad formats loudly enough and long enough. :)

ISTR that syslog-ng 2.0 now has some rewriting ability. I haven't been
paying much attention to that branch, you should probably read up on it.
Possible that it's only in the dev branch - like I said I haven't been
paying much attention.
 
> But I don't find anything about hostname.
> 
> The strangest thing is that it was working fine a few weeks ago but it has 
> suddenly stopped working :-(

Somebody changed either the syslog-ng server or your client. Maybe not
even configs, but version upgrade on the client perhaps.
-- 
Nate

An Emacs reference mug is what I want. It would hold ten gallons of
coffee. -- Steve VanDevender 
And, no doubt, have a lid that could only be removed with an obscure
finger combination requiring both hands. (Ctrl-Alt-Meta-X
gimme-the-damn-coffee) -- William Beegle