Syslog-ng 2.1.4 – File Sources Are Read Only When Reload Or Restart Is Performed?

Home » CentOS » Syslog-ng 2.1.4 – File Sources Are Read Only When Reload Or Restart Is Performed?
CentOS 3 Comments

Hi All ;)

I am using a virtual machine with:
Red Hat Enterprise Linux Server release 5.7 (Tikanga)
Linux logserver01 2.6.18-274.el5 #1 SMP Fri Jul 8 17:36:59 EDT 2011 x86_64
x86_64 x86_64 GNU/Linux syslog-ng 2.1.4

I have following configuration:

…
9 options {
10 create_dirs (yes);
11 dir_group (root);
12 dir_owner (root);
13 dir_perm (0700);
14 group (root);
15 owner (root);
16 perm (0600);
17 flush_lines(1);
18 flush_timeout (1000);
19 keep_hostname (yes);
20 log_fifo_size (1);
21 use_dns (no);
22 use_fqdn (no);
23 };
…
39 source s_stdout {
40 # file (“/logs/stdout.log” flags(no-parse) follow_freq(1));
41 file (“/logs/stdout.log” flags(no-parse));
42 };
…
61 destination d_stdout { file(“/var/log/$YEAR$MONTH$DAY/stdout”);
};
…
80 log { source(s_stdout); destination(d_stdout); };

The problem is that changes in /logs/stdout.log are only visible in
/var/log/20140717/stdout when I perform /etc/init.d/syslog-ng reload or restart. I tried several settings of flush_*, log_fifo_size and follow_freq but with no luck :D

Is it a problem withe the version that I use (quite old :D ) or is there a mistake in my configuration maybe?

BR, Rafal.

3 thoughts on - Syslog-ng 2.1.4 – File Sources Are Read Only When Reload Or Restart Is Performed?

  • afaik, syslog-ng isn’t part of CentOS 5, and there is no top level directory /logs/ at all, logging is done to /var/log and the syslog config files are in /etc, so you must have a heavily customized system configuration. Since noone can possibly know what all you’ve done, it seems like you’re on your own here.

    —
    john r pierce 37N 122W
    somewhere on the middle of the left coast

  • syslog-ng is available in EPEL for RHEL 5. Interestingly, it appears to log to /var/lib/syslog-ng. (I don’t use syslog-ng; I’m just going by the output of ‘repoquery -l syslog-ng’.)

    —

    Liam

  • and EPEL is not /part of CentOS/.

    anyways, I suspect the OP’s question would best be handled on an syslog-ng mail list