On 08/25/2011 08:58 AM, Peter Czanik wrote:
Hello,
Maybe it is not even a systemd issue but something in the kernel? (FACTORY and Kernel-HEAD are pretty outdated, so maybe it's something already fixed upstream?) It's systemd, but with the syslog infrastructure changes it's getting better. Testing syslog-ng, as usual (and finally "zypper dup" does not reinstall rsyslog!), logging seems to work now even from systemd. It's not 100% perfect yet, as there seems to be some delay between "logger bla" and its actual appearance in logs. There is no such problem with
On 08/24/2011 11:46 AM, Stefan Seyfried wrote: traditional sysvinit. So it's time for some debugging :) Here it is. I added a few lines to my syslog-ng config:
destination d_debug { file("/var/log/czp" template("$S_DATE $R_DATE $MSG\n")); }; log { source(src); destination(d_debug); }; Which means, that logs are sent to /var/log/czp with a custom template, which consists of: sent date (the date, which is in the log message), received date (when it arrived to syslog-ng) and the message. And here are my logs. Lines, where the message starts with 'bla' are sent with logger in the following form: logger bla `date` When using tail -f on logs, it seemed to me, that logs are received only when a kernel message (like the one from firewall on ssh login) arrives. It only seems to be a problem with systemd. I'll check it with Fedora alpha, as that also has systemd and syslog-ng 3.2.4. Or just wait a few days, as syslog-ng 3.3 should arrive to factory in any minute... Aug 25 09:12:07 Aug 25 09:10:59 Accepted keyboard-interactive/pam for root from 172.16.105.1 port 52529 ssh2 Aug 25 09:12:07 Aug 25 09:12:07 [ 106.668118] SFW2-INext-ACC-TCP IN=eth0 OUT= MAC=00:0c:29:f5:0f:44:00:50:56:c0:00:08:08:00 SRC=172.16.105.1 DST=172.16.105.150 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=11651 DF PROTO=TCP SPT=52529 DPT=22 WINDOW=4380 RES=0x00 SYN URGP=0 OPT (020405B40402080A007A22EA0000000001030306) Aug 25 09:12:07 Aug 25 09:12:07 pam_apparmor(sshd:session): Unknown error occurred changing to root hat: Operation not permitted Aug 25 09:12:07 Aug 25 09:12:07 New user root logged in. Aug 25 09:12:07 Aug 25 09:12:07 New session 1 of user root. Aug 25 09:12:07 Aug 25 09:12:07 [ warning] [guestinfo] Failed to get vmstats. Aug 25 09:12:26 Aug 25 09:12:07 bla Thu Aug 25 09:12:26 CEST 2011 Aug 25 09:12:33 Aug 25 09:12:07 Received disconnect from 172.16.105.1: 11: disconnected by user Aug 25 09:12:33 Aug 25 09:12:07 Removed session 1. Aug 25 09:12:36 Aug 25 09:12:07 Accepted keyboard-interactive/pam for root from 172.16.105.1 port 52530 ssh2 Aug 25 09:12:36 Aug 25 09:12:07 pam_apparmor(sshd:session): Unknown error occurred changing to root hat: Operation not permitted Aug 25 09:12:36 Aug 25 09:12:07 New session 2 of user root. Aug 25 09:12:36 Aug 25 09:12:36 [ 135.867570] SFW2-INext-ACC-TCP IN=eth0 OUT= MAC=00:0c:29:f5:0f:44:00:50:56:c0:00:08:08:00 SRC=172.16.105.1 DST=172.16.105.150 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=23600 DF PROTO=TCP SPT=52530 DPT=22 WINDOW=4380 RES=0x00 SYN URGP=0 OPT (020405B40402080A007A952B0000000001030306) Aug 25 09:12:37 Aug 25 09:12:37 [ warning] [guestinfo] Failed to get vmstats. Aug 25 09:13:07 Aug 25 09:12:37 [ warning] [guestinfo] Failed to get vmstats. Aug 25 09:13:37 Aug 25 09:12:37 [ warning] [guestinfo] Failed to get vmstats. Aug 25 09:13:46 Aug 25 09:12:37 Started sntp Aug 25 09:13:52 Aug 25 09:12:37 Started sntp Aug 25 09:13:58 Aug 25 09:12:37 bla Thu Aug 25 09:13:58 CEST 2011 Aug 25 09:14:07 Aug 25 09:12:37 [ warning] [guestinfo] Failed to get vmstats. Aug 25 09:14:37 Aug 25 09:12:37 [ warning] [guestinfo] Failed to get vmstats. Aug 25 09:15:07 Aug 25 09:12:37 [ warning] [guestinfo] Failed to get vmstats. Aug 25 09:15:15 Aug 25 09:12:37 Accepted keyboard-interactive/pam for root from 172.16.105.1 port 40524 ssh2 Aug 25 09:15:15 Aug 25 09:15:15 [ 294.663452] SFW2-INext-ACC-TCP IN=eth0 OUT= MAC=00:0c:29:f5:0f:44:00:50:56:c0:00:08:08:00 SRC=172.16.105.1 DST=172.16.105.150 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=47574 DF PROTO=TCP SPT=40524 DPT=22 WINDOW=4380 RES=0x00 SYN URGP=0 OPT (020405B40402080A007D028A0000000001030306) Bye, CzP -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-factory+help@opensuse.org