[syslog-ng] Question about syntax for source

[Gergely Nagy]

Phusion <phusion2k at gmail.com> writes:

> When trying to convert this for syslog-ng 3.x under OpenBSD. I have an
> error. When I use syslog-ng -s -f ../syslog-ng.conf it works, but when
> I run syslog-ng -p /var/run/syslog-ng.pid, I get the following error.
>
> # /usr/local/sbin/syslog-ng -p /var/run/syslog-ng.pid
> WARNING: you are using the pipe driver, underlying file is not a FIFO,
> it should be used by file(); filename='/dev/klog'

The warning pretty much tells you what to do, and why: change pipe() to
file(), because /dev/klog appears to be something else than your common
pipe.

In syslog-ng 2.x, things worked a bit differently (the details escape
me, I'm afraid), which changed in 3.x, and thus, the warning is printed.

> Here is the current source line using syslog-ng 3.0 under OpenBSD 4.8.
>
> source local { internal(); pipe("/dev/klog" program_override("kernel:
> ")); unix-dgram("/dev/log"); };

Change it to something like this:

source local {
       internal();
       file("/dev/klog" program_override("kernel: "));
       unix-dgram("/dev/log");
};

And voila!

-- 
|8]