[syslog-ng] 3.0.3: Accessing unix-dgram source appears to break all logging

Sandor Geller Sandor.Geller at morganstanley.com
Wed Aug 5 16:56:14 CEST 2009


On Wed, Aug 5, 2009 at 3:48 PM, Markus Stalder<ms2 at lightupnet.de> wrote:
> Hello list,
> my first post to the list, so hello everybody! :-)  I'm on Ubuntu 8.04.2
> amd64 and trying to upgrade from syslog-ng 2.0.9-1ubuntu1 to syslog-ng
> 3.0.3. I've both tried the on balabit.com provided amd64 .deb package and
> also created an own amd64 .deb with the default settings in /debian using
> dpkg buildpackage.
> I have the following two sources in my config:
> source s_all { internal(); unix-stream("/dev/log"); file("/proc/kmsg"
> program_override("kernel: ")); };
> source src { internal(); unix-dgram("/dev/log"); file("/proc/kmsg"
> program_override("kernel: ")); };

You're referencing exactly the same sources (like /dev/log,
/proc/kmsg)? This config is horribly broken. I can't imagine how was
syslog-ng 2.0.9 working with such a config. You should eliminate all
duplicated sources. You can add as many log {} sections using the same
source definition as you wish.



More information about the syslog-ng mailing list