Logging, Syslog and Log Anaylsys Forums
March 12, 2010, 02:12:09 am *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News:
   Home   WIKI BLOG Help Search Recent Topics GoogleTagged Login Register  
Pages: [1]
  Print  
Author Topic: Logging event to all destination  (Read 906 times)
kalkotivinay
Newbie
*
Offline Offline

Posts: 32


View Profile Email
« on: June 10, 2009, 01:06:07 am »

hi,

I have a source /dev/log which sends events to 2 different destinations.
1. remote syslog server destination
2. a unix-stream which is started by a daemon process

The daemon process gets the events from /dev/log and processes the events. If the daemon process dies, I see some of the events from /dev/log are lost if the remote syslog  server destination is also specified.

I guess this is because the syslog-ng manages events in a fifo.

Is there a way to make sure that the events are retained till all the destinations read the events ?

Thanks,
Vinay
Logged
mutex
Administrator
Newbie
*****
Offline Offline

Posts: 895


View Profile
« Reply #1 on: June 10, 2009, 12:03:06 pm »

Not that I am aware of.  An off-the-cuff idea is to have syslog-ng read in the logs from /dev/log and rewrite them to another stream file where the daemon can pick them up, without some other process (like syslog-ng) reading them and popping the messages out of the fifo queue.
Logged
kalkotivinay
Newbie
*
Offline Offline

Posts: 32


View Profile Email
« Reply #2 on: June 11, 2009, 01:09:09 am »

If I do like this -
destination d_messages { unix-stream("/dev/mylog" log_fifo_size(1000)); };

Would it create a separate output queue for /dev/mylog ?. What if /dev/mylog is not yet created ?.
Logged
Pages: [1]
  Print  
 
Jump to:  

Information Security News | Jerry Bell's blog | Enterprise IT | Tropical Fish Information | Tropical Fish Forums
Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC | Sitemap Valid XHTML 1.0! Valid CSS!