[syslog-ng] Lots of dropped=tcp(AF_INET(

[Geller, Sandor (IT)]

Hi,

> How about filtering out these messages and putting them into
> a separate file,
> say syslog-ng-diagnostic.log? Is there a way to do this?

You can do it fairly easy: set up a filter like this:

filter f_syslogstats {
  match ("^syslog-ng\[[[:digit:]]+\]: Log statistics");
};

and then attach it to the internal log source.

> Also what is the meaning of this statement anyway:
> dropped='tcp(AF_INET($IP:
> $PORT))=0' ?

Hmm, never seen such logged... Do you have a destination with
these macros? Although neither $PORT or $IP are available as
macros.

Regards,

Sansor
--------------------------------------------------------

NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.