[syslog-ng] Redirecting logs and UDP issues

[Aldrich, Jamie S]

All,

  I am trying to redirect a log file from an NFS mount (AIX server = source and Redhat server = target).  The redirect is going to a LogLogic device over UDP, and I am seeing quite a few dropped packets in /var/log/messages. Samples below:

Aug 31 07:34:16 lxfwossecp3 syslog-ng[30574]: syslog-ng starting up; version='2.1.4'
Aug 31 07:44:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=15', processed='center(received)=15', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro
cessed='destination(d_auth)=2', processed='destination(d_cron)=1', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=1', processed='destination(d_cons)=0', processed='destination(d_spol)=
0', processed='destination(d_mail)=0', processed='source(s_sys)=4', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0'
Aug 31 07:54:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=17', processed='center(received)=17', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro
cessed='destination(d_auth)=2', processed='destination(d_cron)=2', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=2', processed='destination(d_cons)=0', processed='destination(d_spol)=
0', processed='destination(d_mail)=0', processed='source(s_sys)=6', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0'
Aug 31 08:04:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=20', processed='center(received)=20', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro
cessed='destination(d_auth)=2', processed='destination(d_cron)=4', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=3', processed='destination(d_cons)=0', processed='destination(d_spol)=
0', processed='destination(d_mail)=0', processed='source(s_sys)=9', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0'
Aug 31 08:14:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=22', processed='center(received)=22', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro
cessed='destination(d_auth)=2', processed='destination(d_cron)=5', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=4', processed='destination(d_cons)=0', processed='destination(d_spol)=
0', processed='destination(d_mail)=0', processed='source(s_sys)=11', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0'
Aug 31 08:24:16 lxfwossecp3 syslog-ng[30574]: Log statistics; dropped='udp(10.13.33.11:514)=0', processed='center(queued)=28', processed='center(received)=28', processed='destination(d_messages)=11', processed='destination(d_boot)=0', pro
cessed='destination(d_auth)=6', processed='destination(d_cron)=6', processed='destination(d_mlal)=0', processed='destination(d_kern)=0', processed='destination(d_mesg)=5', processed='destination(d_cons)=0', processed='destination(d_spol)=
0', processed='destination(d_mail)=0', processed='source(s_sys)=17', processed='source(s_file)=11', suppressed='udp(10.13.33.11:514)=0'

Here is what my syslog-ng.conf file looks like:

# syslog-ng configuration file.
#
# This should behave pretty much like the original syslog on RedHat. But
# it could be configured a lot smarter.
#
# See syslog-ng(8) and syslog-ng.conf(5) for more information.
#

options {
        time_reopen (10);
        flush_lines (2000);
        flush_timeout (20000);
        log_fifo_size (30000);
        long_hostnames (off);
        use_dns (no);
        use_fqdn (no);
        create_dirs (no);
        keep_hostname (yes);
};

source s_sys {
        file ("/proc/kmsg" log_prefix("kernel: "));
        unix-stream ("/dev/log");
        internal();
        # udp(ip(0.0.0.0) port(514));
};

destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/log/messages"); };
destination d_auth { file("/var/log/secure"); };
destination d_mail { file("/var/log/maillog" sync(10)); };
destination d_spol { file("/var/log/spooler"); };
destination d_boot { file("/var/log/boot.log"); };
destination d_cron { file("/var/log/cron"); };
destination d_kern { file("/var/log/kern"); };
destination d_mlal { usertty("*"); };

filter f_kernel     { facility(kern); };
filter f_default    { level(info..emerg) and
                        not (facility(mail)
                        or facility(authpriv)
                        or facility(cron)); };
filter f_auth       { facility(authpriv); };
filter f_mail       { facility(mail); };
filter f_emergency  { level(emerg); };
filter f_news       { facility(uucp) or
                        (facility(news)
                        and level(crit..emerg)); };
filter f_boot   { facility(local7); };
filter f_cron   { facility(cron); };

#log { source(s_sys); filter(f_kernel); destination(d_cons); };
log { source(s_sys); filter(f_kernel); destination(d_kern); };
log { source(s_sys); filter(f_default); destination(d_mesg); };
log { source(s_sys); filter(f_auth); destination(d_auth); };
log { source(s_sys); filter(f_mail); destination(d_mail); };
log { source(s_sys); filter(f_emergency); destination(d_mlal); };
log { source(s_sys); filter(f_news); destination(d_spol); };
log { source(s_sys); filter(f_boot); destination(d_boot); };
log { source(s_sys); filter(f_cron); destination(d_cron); };

# vim:ft=syslog-ng:ai:si:ts=4:sw=4:et:

# Setup for PeopleSoft logs to transmit to Loglogic

source s_file {
file("/tmp/APPSRV_current.LOG" flags(no-parse));
};
destination d_messages{
udp("10.13.33.11" port(514) log_fifo_size(900000000));
};
log {
source(s_file);
destination(d_messages);
};

Does anyone see anything wrong with the setup?  Could the NFS link be an issue?  Any help would be greatly appreciated!


Thanks,
Jamie

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110831/b26b9fa7/attachment-0001.htm