Local sources seem not to be working
Alexandre Santos <[email protected]>
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <CO6PR10MB56029F131326CC5703182CF3D0109@CO6PR10MB5602.namprd10.prod.outlook.com> |
Hi,
I have syslog-ng 3.32.1 running in a Debian GNU/Linux 10 (buster) with the configuration in the attachement.
After sometime running, syslog-ng seems be unable to read from system() and internal() sources.
Log messages from syslog(ip(10.20.30.40) transport("udp") port(514) keep-alive(no)); are seen in the output folders.
Also journald logs are working fine.
After a reload of configuration in which what changes is this line:
rewrite r_host { set("MACHINE-${HOST}", value("HOST")); };
logging is resumed.
Here is the time gap for logs:
<43>1 2022-03-11T11:55:23.802+00:00 xmm4-1-1 syslog-ng 8283 - [meta sequenceId="767"] Last message 'Destination reliable' repeated 8933 times, suppressed by syslog-ng on xmm4-1-1
<46>1 2022-03-14T07:19:01.817+00:00 xmm4-1-1 syslog-ng 8283 - [meta sequenceId="1"] Module loaded and initialized successfully; module='syslogformat'
Do you know why this is happening?
Thanks & Regards,
Alex
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq
42116.syslog-ng.conf
(application/octet-stream, 13.5 KB)
@version: 3.32
# First, set some global options.
options {
chain_hostnames(off);
flush_lines(0);
use_dns(no);
use_fqdn(no);
owner("root");
group("root");
perm(0644);
stats_freq(0);
bad_hostname("^gconfd$");
ts-format("iso");
time_zone("UTC");
mark-freq(0);
frac-digits(3);
keep-hostname(yes);
};
# common block end
source s_src {
system();
internal();
syslog(ip(10.20.30.40) transport("udp") port(514) keep-alive(no));
};
rewrite r_host { set("MACHINE-${HOST}", value("HOST")); };
# localFile: apps
destination d_localfile_apps {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/apps.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_apps_local7 {
facility(local7) and level(info .. emerg);
};
filter f_localfile_apps {
filter(f_localfile_apps_local7); };
log {
source(s_src);
filter(f_localfile_apps);
destination(d_localfile_apps);
flags(flow-control);
};
# end of localFile: apps
# localFile: kernel
destination d_localfile_kernel {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/kernel.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_kernel_kern {
facility(kern) and level(info .. emerg);
};
filter f_localfile_kernel {
filter(f_localfile_kernel_kern); };
log {
source(s_src);
filter(f_localfile_kernel);
destination(d_localfile_kernel);
flags(flow-control);
};
# end of localFile: kernel
# localFile: messages
destination d_localfile_messages {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/messages.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_messages_mail {
facility(mail) and level(info .. emerg);
};
filter f_localfile_messages_daemon {
facility(daemon) and level(info .. emerg);
};
filter f_localfile_messages_syslog {
facility(syslog) and level(info .. emerg);
};
filter f_localfile_messages_lpr {
facility(lpr) and level(info .. emerg);
};
filter f_localfile_messages_uucp {
facility(uucp) and level(info .. emerg);
};
filter f_localfile_messages_cron {
facility(cron) and level(info .. emerg);
};
filter f_localfile_messages_ftp {
facility(ftp) and level(info .. emerg);
};
filter f_localfile_messages_ntp {
facility(ntp) and level(info .. emerg);
};
filter f_localfile_messages_security {
facility(security) and level(info .. emerg);
};
filter f_localfile_messages_console {
facility(console) and level(info .. emerg);
};
filter f_localfile_messages_solaris-cron {
facility(solaris-cron) and level(info .. emerg);
};
filter f_localfile_messages {
filter(f_localfile_messages_mail) or filter(f_localfile_messages_daemon) or filter(f_localfile_messages_syslog) or filter(f_localfile_messages_lpr) or filter(f_localfile_messages_uucp) or filter(f_localfile_messages_cron) or filter(f_localfile_messages_ftp) or filter(f_localfile_messages_ntp) or filter(f_localfile_messages_security) or filter(f_localfile_messages_console) or filter(f_localfile_messages_solaris-cron); };
log {
source(s_src);
filter(f_localfile_messages);
destination(d_localfile_messages);
flags(flow-control);
};
# end of localFile: messages
# localFile: security
destination d_localfile_security {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/security.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_security_auth {
facility(auth) and level(info .. emerg);
};
filter f_localfile_security_authpriv {
facility(authpriv) and level(info .. emerg);
};
filter f_localfile_security {
filter(f_localfile_security_auth) or filter(f_localfile_security_authpriv); };
log {
source(s_src);
filter(f_localfile_security);
destination(d_localfile_security);
flags(flow-control);
};
# end of localFile: security
# localFile: user
destination d_localfile_user {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/user.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_user_user {
facility(user) and level(info .. emerg);
};
filter f_localfile_user {
filter(f_localfile_user_user); };
log {
source(s_src);
filter(f_localfile_user);
destination(d_localfile_user);
flags(flow-control);
};
# end of localFile: user
# localFile: alarm
destination d_localfile_alarm {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/alarm.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_alarm_local1 {
facility(local1) and level(info .. emerg);
};
filter f_localfile_alarm {
filter(f_localfile_alarm_local1); };
log {
source(s_src);
filter(f_localfile_alarm);
destination(d_localfile_alarm);
flags(flow-control);
};
# end of localFile: alarm
# localFile: cli-command
destination d_localfile_cli-command {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/cli-command.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_cli-command_match {
match("<CLI>" value("MESSAGE"));
};
filter f_localfile_cli-command_local3 {
facility(local3) and level(info .. emerg) and filter(f_localfile_cli-command_match);
};
filter f_localfile_cli-command {
filter(f_localfile_cli-command_local3); };
log {
source(s_src);
filter(f_localfile_cli-command);
destination(d_localfile_cli-command);
flags(flow-control);
};
# end of localFile: cli-command
# localFile: configuration
destination d_localfile_configuration {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/configuration.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_configuration_local2 {
facility(local2) and level(info .. emerg);
};
filter f_localfile_configuration {
filter(f_localfile_configuration_local2); };
log {
source(s_src);
filter(f_localfile_configuration);
destination(d_localfile_configuration);
flags(flow-control);
};
# end of localFile: configuration
# localFile: event
destination d_localfile_event {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/event.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_event_local6 {
facility(local6) and level(info .. emerg);
};
filter f_localfile_event {
filter(f_localfile_event_local6); };
log {
source(s_src);
filter(f_localfile_event);
destination(d_localfile_event);
flags(flow-control);
};
# end of localFile: event
# localFile: grpc-command
destination d_localfile_grpc-command {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/grpc-command.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_grpc-command_match {
match("<GRPC>" value("MESSAGE"));
};
filter f_localfile_grpc-command_local3 {
facility(local3) and level(info .. emerg) and filter(f_localfile_grpc-command_match);
};
filter f_localfile_grpc-command {
filter(f_localfile_grpc-command_local3); };
log {
source(s_src);
filter(f_localfile_grpc-command);
destination(d_localfile_grpc-command);
flags(flow-control);
};
# end of localFile: grpc-command
# localFile: linecard
destination d_localfile_linecard {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/linecard.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_linecard_local4 {
facility(local4) and level(info .. emerg);
};
filter f_localfile_linecard {
filter(f_localfile_linecard_local4); };
log {
source(s_src);
filter(f_localfile_linecard);
destination(d_localfile_linecard);
flags(flow-control);
};
# end of localFile: linecard
# localFile: netconf-command
destination d_localfile_netconf-command {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/netconf-command.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_netconf-command_match {
match("<NETCONF>" value("MESSAGE"));
};
filter f_localfile_netconf-command_local3 {
facility(local3) and level(info .. emerg) and filter(f_localfile_netconf-command_match);
};
filter f_localfile_netconf-command {
filter(f_localfile_netconf-command_local3); };
log {
source(s_src);
filter(f_localfile_netconf-command);
destination(d_localfile_netconf-command);
flags(flow-control);
};
# end of localFile: netconf-command
# localFile: shell-command
destination d_localfile_shell-command {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/shell-command.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_shell-command_match {
match("<SHELL>" value("MESSAGE"));
};
filter f_localfile_shell-command_local3 {
facility(local3) and level(info .. emerg) and filter(f_localfile_shell-command_match);
};
filter f_localfile_shell-command {
filter(f_localfile_shell-command_local3); };
log {
source(s_src);
filter(f_localfile_shell-command);
destination(d_localfile_shell-command);
flags(flow-control);
};
# end of localFile: shell-command
# localFile: sysinfo
destination d_localfile_sysinfo {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/sysinfo.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_sysinfo_local5 {
facility(local5) and level(info .. emerg);
};
filter f_localfile_sysinfo {
filter(f_localfile_sysinfo_local5); };
log {
source(s_src);
filter(f_localfile_sysinfo);
destination(d_localfile_sysinfo);
flags(flow-control);
};
# end of localFile: sysinfo
# localFile: tl1-command
destination d_localfile_tl1-command {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/tl1-command.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_tl1-command_match {
match("<TL1>" value("MESSAGE"));
};
filter f_localfile_tl1-command_local3 {
facility(local3) and level(info .. emerg) and filter(f_localfile_tl1-command_match);
};
filter f_localfile_tl1-command {
filter(f_localfile_tl1-command_local3); };
log {
source(s_src);
filter(f_localfile_tl1-command);
destination(d_localfile_tl1-command);
flags(flow-control);
};
# end of localFile: tl1-command
# localFile: ztp
destination d_localfile_ztp {
program("/opt/machine/local/bin/write_with_rotation.sh /var/log/ztp.log 10 10"
flags(syslog-protocol)
suppress(5)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
filter f_localfile_ztp_match {
match("<ZTP>" value("MESSAGE"));
};
filter f_localfile_ztp_local7 {
facility(local7) and level(info .. emerg) and filter(f_localfile_ztp_match);
};
filter f_localfile_ztp {
filter(f_localfile_ztp_local7); };
log {
source(s_src);
filter(f_localfile_ztp);
destination(d_localfile_ztp);
flags(flow-control);
};
# end of localFile: ztp
destination d_mgmt_vrf_socket {
unix-stream("/dev/uds_log"
flags(syslog-protocol, no-multi-line)
disk-buffer(
mem-buf-size(2097152)
disk-buf-size(4194304)
reliable(yes)
dir("/tmp")
)
);
};
log {
source(s_src);
rewrite(r_host);
destination(d_mgmt_vrf_socket);
};
42116.syslog-ng.log.gz
(application/x-gzip, 226.4 KB) - not displayed