[syslog-ng] local6 doesn't seem to work...

[Ruud Feringa]

Ok, done that: I see now:

1f imap[11480]: seen_db: ... 
1f imap[11480]: open: user supporttickets opened INBOX
1f imap[11480]: SQUAT failed to open index file
1f imap[11480]: SQUAT failed
1f imap[11480]: accepted connection

So what does it tell?  The '1f' used to be the date/timestamp.

Ps (to get output quick, I also removed the level(..) )
Regards,
-Ruud.

-----Original Message-----
From: Geller, Sandor (IT) [mailto:Sandor.Geller at morganstanley.com] 
Sent: woensdag 4 juni 2008 13:32
To: 'Syslog-ng users' and developers' mailing list'
Subject: Re: [syslog-ng] local6 doesn't seem to work...

Hi,

> Hi,
>
> When I have the following in syslog-ng.conf:
>
> filter f_cyrus   { level(warn, err, crit) and facility(local6); };
> destination cyrus { file("/var/log/cyrus.log"); };
> log { source(src); filter(f_cyrus); destination(cyrus); };
>
> nothing is being logged in /var/log/cyrus.log
>
> however when I use:
>
> filter f_cyrus   { level(warn, err, crit) and match("imap"); };
>
> it works fine, why is local6 not working??
>
> (cyrus-imap is default compiled with local6 enabled)

Well, are you sure that cyrus really uses local6? You can check
this easily by adding a template to your config like this:

destination cyrus {
        file("/var/log/cyrus.log" template("$TAG $MSG\n"));
};

And then check what $TAG is when there are log lines.

Regards,

Sandor
--------------------------------------------------------

NOTICE: If received in error, please destroy and notify sender. Sender does
not intend to waive confidentiality or privilege. Use of this email is
prohibited when received in error.
____________________________________________________________________________
__
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html