Re: [logs] Re: Central Log Server

jroyesat_private

"Robinson, Rick" wrote:

> Jason,
>
> It looks like the logging project is perfect for the central logging system
> I wanted to setup on some of our servers. The servers I wanted to setup up
> are all FreeBSD and unfortunately I am not much of a C programmer. So I was
> a little confused by your message to the log analysis list. Can you tell me
> where exactly I need to add that patch of code to get it to work with
> FreeBSD? Thanks for your help.
>
> Rick
>
> -----Original Message-----
> From: Jason Royes [mailto:jasonat_private]
> Sent: Monday, August 19, 2002 1:54 PM
> To: loganalysisat_private
> Subject: [logs] Re: Central Log Server
>
> Nick Starai wrote:
>
> > I'm working on setting up a central log server. I've lurked around the
>
> > links at http://www.counterpane.com/log-analysis.html#infrastructure
> > several times and setup central logging using 'The Logging Project'.
> It
> > was fairly simple to setup, but it seemed to be dropping or throttling
>
> > some messages. I would tail both log files and see not all of the
> original
> > making it over. Was not to pleased with it. I see there are several
> > simple ways as doing *.*        @hostname using syslogd, but i want to
> do
> > all my web logs too. There are several central links, but I was just
> > wondering on opinions from the list users of what works best for them.
> The
> > servers are linux/freebsd. Thanks!
> >
> > Nick Starai
> > Network Administrator
> > ItsYourDomain.com
> > 1005 W. Wise Road
> > Schaumburg, IL  60193
> > http://www.itsyourdomain.com
> >
> > _______________________________________________
> > LogAnalysis mailing list
> > LogAnalysisat_private
> > https://lists.shmoo.com/mailman/listinfo/loganalysis
>
> Nick,
>
> Stale (in tlp 0.8) does not work correctly on FreeBSD because it does
> not call clearerr on the monitored file pointer after bleeding data.
> I'm guessing you were monitoring a FreeBSD box, saw messages transferred
> initially but did not see anything after the initial transferr.
> Stale works fine on Linux and Solaris. This issue will be resolved in
> 0.9.
> You can manually patch it quite easily be adding the following in the
> bf() function and re-compiling:
>
> if (br) {
>     clearerr(f);
>     fflush(stdout);
> }
>
> Hope this helps.
>
> Jason Royes
>
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysisat_private
> https://lists.shmoo.com/mailman/listinfo/loganalysis

Here's the FreeBSD Patch:

142c142,146
<       if (br) fflush(stdout);
---
>       if (br) {
>               clearerr(f);
>               fflush(stdout);
>       }
>

You can apply it with:

$ patch stale.c < fbsd-patch

(Provided you copy and paste the above patch into a file called 'fbsd-patch').

Jason

_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
https://lists.shmoo.com/mailman/listinfo/loganalysis