syslog problems

[Mike Duffy]

Good morning,

I have a strange problem with syslog.

We have four servers (9000 l class running 11.00) and perform a weekly batch that involves some rebooting of three of the servers. To make to monitoring of the batches easier I setup all the messages to go to local6.info which is pointed at @devsystemname and syslog.conf on that system points to a specific logfile.

My problem is that it works on all the servers just not all the time! The batches can start and one system will happily send then stop altogether (even though it logs locally_ and another system will no send anything (again logging locally)

Has anyone seen or heard of this before?

Yes syslog has been restarted to read the new config

[John Palmer]

Hi,

I use this technique a lot and have never seen this problem.

It sounds as though the local syslogs are OK so you either have a problem with syslog on devsystemname or a comms issue.

Could the syslog messages be blocked by a firewall?

Regards,
John

[Mike Duffy]

Hi,

We have investigated the comms stuff and cannot find any issues.

We are bemused because sometimes the messages are forwarded and sometime they are not. I have been unable to see any pattern with which servers are sending messages and which are not.

[John Palmer]

Could there be networking issues or are the relevant servers on the same subnet?

Just to be certain, I'd make sure that I'd got the latest syslogd cumulative patch applied but I don't think this is likely to be a problem.

Regards,
John