[syslog-ng] Problems writing to files with different templates/ownership in 3.x

Brian De Wolf bldewolf at csupomona.edu
Mon Oct 31 20:00:04 CET 2011


Hello,

I'm using syslog-ng as a remote syslog server for several of our
internal groups.  As such, when a syslog arrives, I use the source
address to determine the ownership of the log file. Here is how I'm
currently doing this:

	source net { udp(ip(0.0.0.0), port(514) flags(no-multi-line)); };

	filter examplefilter  { netmask("10.0.0.0/255.255.0.0"); };
	filter example2filter { netmask("192.168.0.0/255.255.0.0"); };

	destination examplelog  { file("/var/log/remote/$HOST.log" group(examplegroup)); };
	destination example2log { file("/var/log/remote/$HOST.log" group(example2group)); };

	log { source(net); filter(examplefilter); destination(examplelog); flags(final); };
	log { source(net); filter(example2filter); destination(example2log); flags(final); };

This worked fine in 1.6.x and appears to work fine in 3.2.x, but when
logrotate pokes syslog-ng I get lines like this:

	syslog-ng: Internal error, duplicate configuration elements refer to the same persistent config; name='affile_dd_writers(/var/log/remote/$HOST.log)'

Is there a better way to do this which only produces one reference to
"/var/log/remote/$HOST.log"?

Also, I'm using a similar set of filters and destinations to apply
different templates to text that is being written to a single file.
This also produces the error, but I am more concerned that the combined
file might experience issues if the config isn't supposed to have
multiple destinations be the same location.  Is there a way to use
filters to apply templates while still only having one destination
defined?  Could my current setup result in lost log lines?

Thanks,
Brian


More information about the syslog-ng mailing list