Hi,
It's a known bug on FreeBSD and fixed in v3.0.5.
Upgrade your syslog-ng, or use the follow_freq(0) option in kernel
source, please.
This patch fixed it:
commit ea34eee9a1172c213aeccbf68ed4fa2881c97b29
Author: Balazs Scheidler <bazsi at balabit.hu>
Date: Mon Nov 2 10:59:30 2009 +0100
affile: set follow_freq to 0 on FreeBSD kernel messages
FreeBSD uses /dev/klog character device for kernel messages. But
since the file source driver set follow_freq to 0 only on Linux,
this meant that FreeBSD config files needed an explicit
follow_freq(0) in their /dev/klog source definition.
This patch makes this the default on /dev/klog if the __FreeBSD__
macro is
defined.
diff --git a/src/affile.c b/src/affile.c
index 3b92a85..15dbee0 100644
--- a/src/affile.c
+++ b/src/affile.c
@@ -395,13 +395,17 @@ affile_sd_new(gchar *filename, guint32 flags)
{
if ((self->flags & AFFILE_PIPE) == 0)
self->reader_options.follow_freq = 1000;
-
+
+ if (0 ||
#if __linux__
- if (strcmp(filename, "/proc/kmsg") == 0)
+ (strcmp(filename, "/proc/kmsg") == 0) ||
+#elif __FreeBSD__
+ (strcmp(filename, "/dev/klog") == 0) ||
+#endif
+ 0)
{
self->reader_options.follow_freq = 0;
}
-#endif
}
#if __linux__
if (strcmp(filename, "/proc/kmsg") == 0)
Phusion wrote:
> I've used syslog-ng 1.x and 2.x, but am new to using 3.x. I'm using
> syslog-ng 3.0.3 on a FreeBSD 8.0 server. I'm having trouble getting
> kernel messages. I've made a very small config file, and this isn't
> working either.
>
> @version:3.0
> source local { internal(); file("/dev/klog"); unix-dgram("/var/run/log"); };
> destination all { file("/var/log/all.log"); };
> log { source(local); destination(all); };
>
> This picks up other things, but not the kernel messages. I assume it's
> a small configuration issue. Let me know. Thanks.
>
> Phusion
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>
--
pzolee
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100222/ef4399d3/attachment.htm