Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

If anyone has got syslog-ng working on Solaris 10, do you have a set of instructions I could follow to get it installed and working?

I tried following this http://opensystems.wordpress.com/2006/06/01/replacing-syslog-on-solaris-10-with-syslog-ng/ but got stuck with the syslog-ng service stuck restarting with no indication of why.

Thanks for any help. NickB

share|improve this question
    
Can you post the result of svcs -x ? –  Antoine Benkemoun Jan 26 '10 at 10:12
    
NDBCA2:/var/adm# svcs -x svc:/site/system-log-ng:default (system log ng) State: maintenance since Tue Jan 26 09:38:44 2010 Reason: Restarting too quickly. See: sun.com/msg/SMF-8000-L5 See: syslog-ng(1M) See: /var/svc/log/site-system-log-ng:default.log Impact: This service is not running. NDBCA2:/var/adm# –  NickB Jan 26 '10 at 10:15
    
Maybe a problem with the /usr/local/etc/syslog-ng/syslog-ng.conf file? permissions look OK - root:root and -rw-r--r-- –  NickB Jan 26 '10 at 10:17
    
And the linked log file has this (repeated) syslog service starting. [ Jan 26 09:38:44 Method "start" exited with status 0 ] [ Jan 26 09:38:44 Stopping because all processes in service exited. ] [ Jan 26 09:38:44 Executing stop method (:kill) ] [ Jan 26 09:38:44 Restarting too quickly, changing state to maintenance ] –  NickB Jan 26 '10 at 10:18
1  
Have you tried starting things up manually, in the same way that is being done by SMF? You might get some error message clues as to why syslog-ng is exiting. –  Tekhne Jun 17 '10 at 21:09

2 Answers 2

I do not like the instructions on the opensystems blog you pointed to, as it replaces the default service in SMF. This is bad as it is likely that a future system patch will revert your changes. Here's my take on it, from a default system state:

  1. Disable the system syslog:
    svcadm disable system-log
  2. Download and install (using pkgadd) syslog-ng from sunfreeware.com
    http:// sunfreeware.com/programlistintel10.html#syslogng
    Do not forget to also download and install its dependencies.
  3. Create a configuration file /usr/local/etc/syslog-ng.conf (the one offered on the Open Systems blog is a good start).
  4. Setup the SMF voodoo:
    • Create /var/svc/manifest/site/syslog-ng.xml from http://pastebin.com/QrGC3u6p (I could not paste the file here as the formatting was mangled)
    • Load the new service: svccfg import /var/svc/manifest/site/syslog-ng.xml
    • Enable the service: svcadm enable syslog-ng

Now, your system is not vanilla if you followed the procedure on Open Systems blog. Here's what you need to do to revert:

  1. Disable the modified SMF service:
    • svcadm disable system-log-ng
    • svccfg delete system-log-ng
  2. Remove the syslopg-ng package
    • pkgrm NCsysng
  3. Re-import the original system log service:
    • svccfg import /var/svc/manifest/system/system-log.xml
    • svcadm enable system-log

Hope this helps.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.