syslog failed to log error message ......???

[Chris Fung]

Hi all,

I am using "logger" command within the scripts to send error and notification messages to the local syslog file as well as the syslog file in an remote machine.

Recently, I encountered a strange problem that some of the notification messages were missed out in the remote machine but not the local one.

It should be noted that the remote machine is the centralized logging server that collect all the logs from all Unix servers.

I am wondering what the reason(s) is/are? Is the packet lost or the logger command cannot handle in some situations?

I have used testing machines to simulate the sending messages through loggers command continuous within a period of time. The result was that some of the notification error messages were missed.

What I can conclude so far is that the logger command is not that reliable.

I am thinking to add delays to my script file so that no messages will be sent out concurrently.

All Genius, any idea to address this issue? Appreciated for any additional recommendations!!

Many thanks,

Chris,

[Dirk Wiedemann]

Hello Chris,

afaik: are you using UDP or TCP pakets to transport the log messages to your log host?
Using tcp: in case of heavy network traffic and receiving a lot of logmessages your loghost possibly isn't able to receive all messages.
Using UDP: with UDP there is no control for successful transport for each paket. So if a paket is lost the sending system doesn't notify it and doesn't send the paket once more.

regards
Dirk

[Patrick Chim]

Hi,

Does the syslog of the remote machine got any error ? Is the syslog.log an updated one that ensure the syslogd daemon is not hang up ?

Regards,
Patrick

[Darren Prior]

Hi Chris,

Further to Dirk's response, check /etc/services - syslog uses UDP.

regards,

Darren.

[Dirk Wiedemann]

Hello Darren,

in a standard installation you're right, UDP ist the default. But it's also possibel to replace the standard syslogd with another tool like syslog-ng, which also can use TCP instead of UDP.

regards
Dirk

[Thomas Schler_1]

Chris,

how do you use logger on the remote machine?

What about 'remsh remote_node logger Hello' or 'on remote_node logger Hello'?

In the first case you have to have an appropriate entry in ~/.rhosts (logger may not run by root). In the second case you should run the rexd from /etc/inetd.conf. An appropriate entry in /var/adm/inetd.sec should be made to allow rexd on the remote node.