Re: syslog-ng doesn't log to each file

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Werner Flamme [14.09.2011 17:01]:
> Hi everyone,
> 
> on SLES 11 SP1 we saw a very strange behaviour of syslog-ng yesterday.
> 
> First, we saw that the / filesystem became too crowded. We decided to
> move several logfiles (the host is a logserver) to a directory on
> another filesystem. So, syslog-ng was stopped, /var/log/loghosts was
> moved to the other filesystem (from ext3 to xfs), the config was changed
> to point to the new location, and syslog-ng was started.
> 
> Instead of writing to the logfiles, everything went into
> /var/log/messages, which became > 1 M very fast. It was all error
> notices, that syslog-ng could not write to the new destination:
> permission denied, error 13. Syslog-ng runs as root, so this is a
> strange text...

Just in case that anyone else tries to write logs outside /var/log:

The reason for my problems was AppArmor. In file
/etc/apparmor.d/sbin.syslog-ng, syslog-ng's output is restricted to
/var/log and its files and subdirectories. I added a line as copy of
line "@{CHROOT_BASE}/var/log/** w,", changed the location, and a
"rcsyslog restart" finished the work. Afterwards, sylog-ng was running
as expected.

Regards,
Werner
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/

iEYEARECAAYFAk6BqfsACgkQk33Krq8b42OS/QCeM9F55SB/w+7LGQW9/fmr1YUk
exYAn272TtZwX2hWgcxviLLS4+mn3EpI
=v/U7
-----END PGP SIGNATURE-----
_______________________________________________
suse-sles-e mailing list
[email protected]
http://listx.novell.com/mailman/listinfo/suse-sles-e