Re: how to configure syslog-ng to push log to log server

[Gentoo]

Jul  3 05:22:29 sles9 cfservd[11975]:  Unable to lookup hostname
(tux.**.**.com) or cfengine service: Name or service not known
Jul  3 05:22:29 geometry cfservd[11975]:  Unable to lookup hostname
(tux.*.*.com) or cfengine service: Name or service not known

you may notice that their pid is same, so I think it is error. but I
think 11975 is just on sles9 not geometry.


On 7/4/05, Edward F. Brown <ebrown@lanl.gov> wrote:
> I'm replying offlist because the question isn't really about cfengine.
> 
> Not sure I have enough information here (for example, where are the
> duplicates appearing?)  But I did notice that both of your f_messages
> filter definitions show spaces between the word 'filter' and the opening
> paranthesis of '(f_cfengine)'.  I'm not sure this is an error, but
> syslog-ng is fairly picky about syntax...
> 
> Also, the duplicate messages you quote show different hostnames, so you
> might want to use:
> options { keep_hostname(yes); };
> 
> hope this helps,
> Ed
> 
> > Hi all
> > I want to configure syslog-ng on one of my cfengine client to collect
> > all cfengine log from all boxes.
> >
> > now I almost succeed, but have a problem.
> > entry in syslog-ng will duplicate! would someone take a look at it,
> > please?
> > thanks for your time.
> >
> > Jul  3 05:22:29 sles9 cfservd[11975]:  Unable to lookup hostname
> > (tux.**.**.com) or cfengine service: Name or service not known
> > Jul  3 05:22:29 geometry cfservd[11975]:  Unable to lookup hostname
> > (tux.*.*.com) or cfengine service: Name or service not known
> >
> > and here is my syslog-ng.conf about cfengine --on syslog-ng loghost
> > destination cfengine { file("/var/log/cfengine.log"); };
> > filter f_cfengine { program("cfservd"); };
> > filter f_messages   { not facility( mail, cron) and not filter
> > (f_cfengine); };
> > log { source(src); filter(f_cfengine); destination(cfengine); };
> >
> >
> > syslog-ng.conf about cfengine --on cfengine server
> >
> > filter f_cfengine { program("cfservd"); };
> > filter f_messages   { not facility(news, mail, cron) and not filter
> > (f_cfengine); };
> >
> > destination d_loghost { udp("server IP"); };
> > log { source(src); filter(f_cfengine); destination(d_loghost); };
> >
> > --
> > Life is hard
> >
> >
> > _______________________________________________
> > Help-cfengine mailing list
> > Help-cfengine@gnu.org
> > http://lists.gnu.org/mailman/listinfo/help-cfengine
> >
> 
> 


-- 
Life is hard