[syslog-ng] need help debugging some network received logs that aren't writing to files

[Austin Jorden]

Hi Chris,

Are there *any* folders/files being created at all?

There's one thing I noticed that isn't specified... which is the 
"createdirs = Yes" option. It appears (well, I assume) that you're 
wanting it to create a separate text file for each $HOST, not a separate 
directory named $HOST...

- Austin

On 2/18/2014 2:12 PM, Chris Moody wrote:
> Hello.
>
> First off, thanks a __TON__ for syslog-ng.  I've sworn by this awesome
> code for years now.  I've built all sorts of logging infrastructure with
> it.
>
> I seem to have hit on something though that's got me scratching my head
> and lacking for explanation.  Perhaps I've just been staring at it and
> debugging it too long and am missing something obvious.
>
> I've got an installation with a couple thousand network devices logging
> successfully to output spools on our log aggretor.  This is rockin' and
> works beautifully.  I've got things configured whereby each network
> source logs to it's own individual spool file with the source-ip as the
> spool name.
>
> I'm running into a case though where I have a Cisco switch sending logs
> to my log aggregator but the log-server isn't writing the output to the
> device's spool file.  It is working however for many many more devices
> just like this switch.
>
> I've confirmed via tcpdump that this log traffic does actually hit the
> box, but it never gets recorded into the log spool for that network device.
>
> Since the host is -super- busy receiving logs from other gear
> enterprise-wide, I have to treat it very gingerly, so can't enable too
> much debugging...but I'm really confused why the logs wouldn't show up
> in the log spool..
>
> Here's some bits of the config that are relevant:
> =====
> options {
>           keep_hostname(yes);
>           use_dns(no);
>           use_fqdn(no);
>           stats_freq(600);
>           stats_level(2);
>           # Allow large messages
>           log_msg_size(65536);
> };
>
> # =====================
> # UDP Packet Source
> source s_udp {
>           udp();
> };
>
> # =====================
> # TCP Packet Source
> source s_tcp {
>            tcp(ip(aaa.bbb.ccc.ddd) port(514) max-connections(50000));
> };
>
> # =====================
> destination net_perhost {
>           file("/data/log/per-host/$HOST"
>           owner(root)
>           group(nwadmin)
>           perm(0775)
>           );
> };
>
> # =====================
> log {
>           source(s_tcp);
>           source(s_udp);
>           destination(net_perhost);
> };
> =====
>
> I've checked around for perhaps a different spool name, thinking perhaps
> the data was getting recognized as something other than it's source-ip,
> but haven't seen anything.
>
> Any thoughts?
>
> Cheers,
> -Chris
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>