Re: Local sources seem not to be working

Hi Szilard,

There is no filter:

source syslog_ng_src {
    internal();
};

destination d_localfile_syslog_ng {
    program("/opt/machine/local/bin/write_with_rotation.sh /var/log/syslog-ng-internal.log 10 10"
        flags(syslog-protocol)
        suppress(5)
        disk-buffer(
            mem-buf-size(2097152)
            disk-buf-size(4194304)
            reliable(yes)
            dir("/tmp")
        )
    );
};
log {
    source(syslog_ng_src);
    destination(d_localfile_syslog_ng);
    flags(flow-control);
};

Thanks and Regards,
Alex

From: syslog-ng <[email protected]> On Behalf Of Szilard Parrag (sparrag)
Sent: 19 de maio de 2022 08:59
To: [email protected]
Subject: Re: [syslog-ng] Local sources seem not to be working

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.

Hi Alex,

We've checked it too and syslog-ng does not release the file descriptor of journald even with flow-control enabled.

Also, your internal logs seem rather terse, maybe there is a filter which filters out the important parts. Could you please check it?

Szilard

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq