syslog-ng not logging

[Peter Boosten]

Jeffrey Goldberg wrote:
> This is the first I've heard of mtree.  I just looked mtree(8), but I 
> take it that mtree is run periodically somehow to "fix" things.  Do 
> you know where?
>
> I can always keep my logs in some place other than /var/log if this is 
> an issue.
>
IIRC it's done at boot time. Have a look at /etc/rc.d/var


>>> Will log rotation preserve daemon ownership?
>>
>> Never used the *traditional* log style with syslog-ng, I stored 
>> everything per day/month/year/server.
>
> I'm doing that for hosts that this is the remote syslod server for.  
> I'm using
>
>   /var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY-$YEAR$MONTH$DAY"
>
> for everything coming from the udp source.  I suppose I could just add 
> "localhost" under HOSTS to do a similar destination for everything 
> else, though there I would probably have FACILITY be the major 
> categorization
>
"localhost" will be created automatically by syslog-ng (although it'll 
probably use the hosts fqdn).

>> I ended up running syslog-ng as root, which is probably a bad idea as 
>> well, so I cannot give you any advice on this one.
>
> It sounds like using something other than /var/log for a destination 
> makes the most sense.
No, it's enough to grant daemon write permissions in /var/log/HOSTS. 
Since you're using the $DAY macro, you won't need log rotation anyway.


Regards,

Peter
-- 
http://www.boosten.org