Find the answer to your Linux question:
Results 1 to 2 of 2
Hi everyone, i'm trying to build a server where i will centralize all the logs coming from 2 hosts (linux ( RH) , Windows VISTA). what i did,on the RH ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Jul 2008
    Posts
    1

    Syslog-ng ... Problems :s


    Hi everyone,
    i'm trying to build a server where i will centralize all the logs coming from 2 hosts
    (linux ( RH) , Windows VISTA).

    what i did,on the RH host is that i changed the syslog-ng.conf :


    ====================================CLIENT
    options {
    sync (0);
    time_reopen (15);
    log_fifo_size (1000);
    long_hostnames (off);
    use_dns (no);
    use_fqdn (yes);
    create_dirs (yes);
    keep_hostname (yes);
    };

    source sys { unix-stream ("/dev/log"); internal(); };

    destination serveur_syslog { tcp("172.16.1.235" port(5140)); };

    log { source(sys); destination(serveur_syslog); };



    ====================================SERVER


    options {
    sync (0);
    time_reopen (10);
    log_fifo_size (1000);
    long_hostnames (off);
    use_dns (no);
    use_fqdn (yes);
    create_dirs (yes);
    keep_hostname (yes);
    };

    source s_tcpmessages { tcp(port(5140) max-connections(100)); };
    source s_udpmessages { udp (); };
    source s_loc { unix-stream ("/dev/log"); internal(); };


    destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg)
    VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes));
    };

    log {
    source(s_tcpmessages);
    destination(d_mysql);
    };

    log {
    source(s_udpmessages);
    destination(d_mysql);
    };

    log {
    source(s_loc);
    destination(d_mysql);
    };

    and when i look on the database Syslog => table Logs

    i found lines saying :

    16855 idslan syslog err err 2b 2008-07-23 10:46:33 syslog-ng syslog-ng[18899]: Connection failed; error='Connection refused (111)',time_reopen='15'


    If Anyone can help ??? or Any suggestions ??
    Please do so.
    thanks,

  2. #2
    Linux Newbie raghaven.kumar's Avatar
    Join Date
    Mar 2008
    Location
    Bangalore, India
    Posts
    209
    did you check if the port 5140 is open in the destination system?
    if not try adding the port in /etc/services file
    and enabling traffic for the port in the firewall.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •