0

I am trying to configure syslog-ng destination path to use unix-stream sockets for Inter process communication. I have gone throgh this documentation http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guides/en/syslog-ng-ose-v3.3-guide-admin-en/html/configuring_destinations_unixstream.html .

My syslog.conf(only part of it) for the same is as follows: 

source s_dxtcp { tcp(ip(0.0.0.0) port(514)); };
filter f_request {program("dxall");};

destination d_dxall_unixstream {unix-stream("/var/run/logs/all.log");};
log {source(s_dxtcp); filter(f_request); destination(d_dxall_unixstream);};

When I restart my syslog-ng server, I have got the following message:

Connection failed; fd='11', server='AF_UNIX(/var/run/logs/all.log)',
local='AF_UNIX(anonymous)', error='Connection refused (111)'
Initiating connection failed, reconnecting; time_reopen='60'

What this error signifies? How can I use unix sockets with syslog-ng? Could any one help me out.

Sarath Chandra Jiguru
  • 135
  • 1
  • 1
  • 10

1 Answers1

0

Till now I am not able to create a Unix Domain Socket for inter process communication. But I got a way around it. All I want is a one way communication to send data created at syslog-ng to a running java program(a process, I can say). This I achieved with Using Named Pipes in Syslog-ng. Documents for achieving is http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-guides/en/syslog-ng-ose-v3.4-guide-admin/html-single/index.html#configuring-destinations-pipe .

Reading from Named Pipe is same as reading from a normal file. One important point to note is that Reader process(here the Java program) should be started before Syslog-ng, (Writer, that writes log messages to the Named pipe).

Reason, Writer will block until there is a Reader. Absence of Reader will lead to loss of some messages, that got accumulated before Reader Started. And there should be only one instance of Reader. If there are multiple readers, the second reader will get null pointer exception, as the message it want to read is already read by the first Reader. Kindly note that this is from my experience. Let me know, If I am wrong.

Sarath Chandra Jiguru
  • 135
  • 1
  • 1
  • 10
  • I am trying to do something similar. Using local syslog for IPC. How has the experience been for you ? Is it still working ? – snegi Apr 07 '14 at 03:35
  • yes, Its working fine. I have used a java program to read from the named pipe and send the log messages to different kafka topics. Let me know ur experience as well. – Sarath Chandra Jiguru Apr 19 '14 at 07:36