[syslog-ng] syslog-ng 3.0.8, 3.0.9 not sending logs to centralized log host

[Matthew Hall]

On Tue, Dec 21, 2010 at 05:33:03PM -0500, Jarrett Lee wrote:
> Anyway, I did figure out the issue. I was editing the wrong conf file, 
> silly me! I was editing /etc/syslog-ng.conf when I should have been 
> editing /opt/syslog-ng/etc/syslog-ng.conf.

This confusion could be avoided in the longer term by creating a 
syslog-ng RPM using the spec file in the source code, and using this 
daemon in place of the system log daemon. Then you could install the RPM 
to all your new machines via kickstart, etc. and upgrade your old 
machines with the RPM to install to all your old machines.

I've done something similar in my (admittedly non RPM based) 
environment. It really does make a big improvement when you package it.

If you have a lot of different apps or logging scenarios that are in 
parallel to each other like we do here, you can write a "stub" syslog-ng 
configuration file, and use the include directive to include 
configurations from a directory such as /etc/syslog-ng.conf.d, or 
something such.

Matthew.