[Logwatch] Is syslog-ng output acceptable now for logwatch?...

seberino@spawar.navy.mil seberino@spawar.navy.mil
Tue, 1 Apr 2003 17:15:33 -0800

I used your suggested options stuff in my /etc/syslog-ng/syslog-ng.conf....

options {
        sync (0);
        time_reopen (10);
        log_fifo_size (1000);
        long_hostnames (off);
        use_dns (yes);
        use_fqdn (no);
        create_dirs (yes);
        keep_hostname (yes);
source      src  {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();};
destination dest {file("/var/log/messages");};
log              {source(src); destination(dest);};

I'm not sure the output still looks indistinguishable from plain
ol' syslog.  Does this fetchmail entry look normal to you???...

Apr  1 17:05:00 seberino CROND[22863]: (seberino) CMD (/usr/bin/fetchmail 1>
/dev/null 2> /dev/null)

I don't think plain ol' syslog would have my crontab entry
be logged with CROND in all caps with a number after it.
Does your syslog-ng output look like this??
Why do I care?? Logwatch will barf on weird nonstandard
lines if I don't do syslog-ng.conf right.

BTW, did you ever notice syslog-ng nukes your /var/log/messages
file after a few days??? It keeps happening to me.
I haven't ran with your options long enough to see if it 
will happen with your suggestions.  I hope not of course.



Dr. Christian Seberino
SPAWAR Systems Center San Diego
Code 2872
49258 Mills Street, Room 158
San Diego, CA 92152-5385

Phone: (619) 553-9973
Fax:   (619) 553-6521
Email: seberino@spawar.navy.mil