From owner-freebsd-questions@FreeBSD.ORG Mon Feb 27 08:55:49 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id EBC6316A420 for ; Mon, 27 Feb 2006 08:55:49 +0000 (GMT) (envelope-from r.gruyters@yirdis.nl) Received: from mail.yirdis.nl (82-148-208-109.fiber.unet.nl [82.148.208.109]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2FC9443D46 for ; Mon, 27 Feb 2006 08:55:48 +0000 (GMT) (envelope-from r.gruyters@yirdis.nl) Received: from server.yirdis.net (localhost [127.0.0.1]) by mail.yirdis.nl (8.13.3/8.13.3) with ESMTP id k1R8tjum099761 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 27 Feb 2006 09:55:45 +0100 (CET) (envelope-from r.gruyters@yirdis.nl) Received: (from www@localhost) by server.yirdis.net (8.13.3/8.13.3/Submit) id k1R8tj5m099760 for freebsd-questions@freebsd.org; Mon, 27 Feb 2006 09:55:45 +0100 (CET) (envelope-from r.gruyters@yirdis.nl) X-Authentication-Warning: server.yirdis.net: www set sender to r.gruyters@yirdis.nl using -f Received: from hp-xw4100-01.yirdis.nl (hp-xw4100-01.yirdis.nl [10.8.0.27]) by server.yirdis.net (Horde MIME library) with HTTP for ; Mon, 27 Feb 2006 09:55:45 +0100 Message-ID: <20060227095545.huljwmlni8wg0kcw@server.yirdis.net> Date: Mon, 27 Feb 2006 09:55:45 +0100 From: Robin Gruyters To: freebsd-questions@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 7bit User-Agent: Internet Messaging Program (IMP) H3 (4.0.3) / FreeBSD-5.3 X-Virus-Scanned: OK Subject: kernel message buffer not sent to remote syslog X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2006 08:55:50 -0000 Hi ya, A few weeks ago I have upgraded a few of our systems to FREEBSD 5.4 (-rRELENG_5_4). I noticed that it won't sent any system messages (which is available in the buffer. e.g. boot messages), to the remote loghost anymore. Has anything changed in the handeling of system messages since FreeBSD 5.3? Here my syslog.conf [syslog.conf] # $FreeBSD: src/etc/syslog.conf,v 1.26.6.2 2005/03/16 13:39:59 glebius Exp $ # # Spaces ARE valid field separators in this file. However, # other *nix-like systems still insist on using tabs as field # separators. If you are sharing this file between systems, you # may want to use only tabs as field separators here. # Consult the syslog.conf(5) manpage. *.err;kern.warning;auth.notice;mail.crit /dev/console *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages security.* /var/log/security auth.info;authpriv.info /var/log/auth.log mail.info /var/log/maillog lpr.info /var/log/lpd-errs ftp.info /var/log/xferlog cron.* /var/log/cron *.=debug /var/log/debug.log *.emerg * # uncomment this to log all writes to /dev/console to /var/log/console.log #console.info /var/log/console.log # uncomment this to enable logging of all log messages to /var/log/all.log # touch /var/log/all.log and chmod it to mode 600 before it will work *.* /var/log/all.log # uncomment this to enable logging to a remote loghost named loghost *.* @10.8.0.2 # uncomment these if you're running inn # news.crit /var/log/news/news.crit # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice !startslip *.* /var/log/slip.log !ppp *.* /var/log/ppp.log [/end] I have also noticed that it will sent the messages to the /var/log/all.log, but not to the remote host. Regards, -- Robin Gruyters Network and Security Engineer Yirdis B.V. / Betronic Services I: http://yirdis.com