I'm lazy. After a bit of a think I decided to wipe it on install & uninstall. Install or re-install is the only time it gets checked anyways, and anything that gets written to it should be immediately picked up by syslog-ng.
The reason I suggested a backup rather than a replace or removal is for those who may already have syslog-ng and logratate installed. Perhaps they want to test with Scribe before deciding to cut over. They need the ability to restore their prior config. I am in this category. I may be a fringe case though.
Most people may be coming from ground zero. I did copy over the config files after the first install attempt failed. I also have jffs backups to fall back on.
Updated went well. No error messages in /opt/tmp/logrotate.daily.
The pixelserv-tls filter file ("helper file" per cmkelley terminology) is included with the install, at least it is there in syslog-ng/share.
So, the "logrotate.daily" file isn't a standard logrotate file. I just made that name up as a place to redirect any console output from the nightly logrotate run. "logrotate.status" is the file that logrotate creates when it runs. It shouldn't exist before scribe is installed, except for the very edge case where someone created a cron job for logrotate, decided to redirect the console output, and choose the same filename I did.The reason I suggested a backup rather than a replace or removal is for those who may already have syslog-ng and logratate installed. Perhaps they want to test with Scribe before deciding to cut over. They need the ability to restore their prior config. I am in this category. I may be a fringe case though.
Thanks again for your work and effort on scribe. syslog-ng is not the easiest to understand. I applaud your work and am grateful for the project.
Yep, it's just not automatically copied to /opt/etc/syslog-ng.d ... only Skynet gets that special treatment since it produces so many logs.
That, or something like that, is already on my todo list. scribe ToDo list
A quick note, as Butterfly Bones said, I do have a filter for pixelserv in /opt/share/syslog-ng/examples, however that only filters pixelsrv logs, where your example filtered pixelsrv and "DROP IN=" messages. I filter the "DROP IN=" messages through either the "Skynet" filter, which is automatically installed if Skynet is detected on installation, or the "firewall" filter, also found in /opt/share/syslog-ng/examples, which would need to be copied to /opt/etc/syslong-ng.d _IF_ Skynet is not installed. Having both firewall and Skynet filters at the same time will result in messages with "DROP IN=" not going to Skynet (and thereby making that statistics useless), since they are processed alphabetically as near as I can determine.
Just updating shouldn't have touched your syslog-ng.conf file. If you did an install without uninstalling it should have renamed your syslog-ng.conf to syslog-ng.conf-prev.
Just to clarify this, in my understanding it works like this:
You and me both. Not sure I would have started down this road if I had realized how complex it would become. I honestly thought "install, uninstall, update, a couple checks, how hard could this be?" Yeah ....
Did you post your approach to that somewhere? Might be something to think about post-2.0.
If I did it was only a fragment.
cat /tmp/syslog.log > /opt/var/log/startupmessagessource s_startup {
file("/opt/var/log/startupmessages");
};
log {
source(s_startup);
filter(f_pixelserv-tls);
destination(d_pixelserv-tls);
flags(final);
};
log {
source(s_startup);
filter(f_openvpn);
destination(d_openvpn);
flags(final);
};
log {
source(s_startup);
filter(f_skynet);
destination(d_skynet);
flags(final);
};
log {
source(s_startup);
destination(messages);
flags(final);
};
] and I'm STILL interested .
There are tons of messages that look "bad" but are really just informational. I use it to separate stuff out that I know I want to look at separately (openvpn logs) or stuff I don't want to see at all (dcd crashes, wlceventd logs, etc.), leaving the default log (messages) easier to search if something weird does happen, or I want to see the result of something without wading through unrelated stuff.
