Re: [gentoo-user] mysterious syslog message "."

[Mick]

On Tuesday 02 February 2010 02:06:14 Iain Buchanan wrote:
> On Fri, 2010-01-29 at 17:29 +0200, Alan McKinnon wrote:
> > On Friday 29 January 2010 16:26:42 Iain Buchanan wrote:
> > > I don't really care about any killswitch operation, but I'm interested
> > > in why I'm getting a "." message.  NetworkManager bug or
> > > misconfiguration error?
> >
> > Run syslog-ng with the -d switch to enable it's debug output (normally to
> > messages), or use -dd to get even more debug output.
> >
> > Beware, this adds up real quick, so don't run it for long like that. The
> > output may give you more of a clue as to what syslog-ng thinks the
> > incoming messages are.
>
> Holy Debug Messages, Batman!  Sure does add up real quick.
>
> 56,599 messages all with the same timestamp Feb 2 11:13:00; 100% cpu
> usage, and 200+Mb before I killed it.
>
> Shirley that's not right?
>
> The 50k of messages all look like this:
>
> Feb  2 11:12:59 orpheus syslog-ng[3739]: Filter rule evaluation begins;
>  filter_rule='f_networkmanager' Feb  2 11:12:59 orpheus syslog-ng[3739]:
>  Filter node evaluation result; filter_result='not-match' Feb  2 11:12:59
>  orpheus syslog-ng[3739]: Filter rule evaluation result;
>  filter_result='not-match', filter_rule='f_networkmanager'
>
> my syslog conf is directing network manager to a separate file:
>
> @version: 3.0
> # $Header:
>  /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo.3.
> 0,v 1.1 2009/05/25 20:07:21 mr_bones_ Exp $ #
> # Syslog-ng default configuration file for Gentoo Linux
>
> options {
> 	chain_hostnames(no);
>
> 	# The default action of syslog-ng is to log a STATS line
> 	# to the file every 10 minutes.  That's pretty ugly after a while.
> 	# Change it to every 12 hours so you get a nice daily update of
> 	# how many messages syslog-ng missed (0).
> 	stats_freq(43200);
> };
>
> source src {
>     unix-stream("/dev/log" max-connections(256));
>     internal();
>     file("/proc/kmsg");
> };
>
> destination messages { file("/var/log/messages"); };
>
> # By default messages are logged to tty12...
> destination console_all { file("/dev/tty12"); };
> # ...if you intend to use /dev/console for programs like xconsole
> # you can comment out the destination line above that references /dev/tty12
> # and uncomment the line below.
> #destination console_all { file("/dev/console"); };
>
> # NetworkManager log to different file
> log {
>          source(src);
>          filter(f_networkmanager);
>          destination(df_networkmanager);
>          flags(final);
> };
> log { source(src); destination(messages); };
> log { source(src); destination(console_all); };
>
> filter f_networkmanager { program("NetworkManager"); };

Could it be that "NetworkManager" should be "networkmanager"?  Also try it 
without " " and see if it fixes it.

> destination df_networkmanager { file("/var/log/NetworkManager.log"); };

Have you already created this file?

> any ideas?  thanks,
>

-- 
Regards,
Mick