Amos Jeffries wrote:
Chris Robertson wrote:a bv wrote:Hi, On a squid on Redhat EL , syslog-ng is installed and while also squid is logging on the local itself also its configured to send the logs also to an other syslog-ng server. I dont know if it begin from the begiing of this sys-logng and other configuration , it seems that now also on the squid server send the logs also to the its /var/log/messages file. After commenting the syslog-ng servers related config on squid configuration file it stopped sending to var/log mesages. How and why this var/log/mesaages thing happened any idea?"rpm -q --changelog squid" will give you the documentation available for the changes made to the RPM. Run that command through "less" or "grep" to search for any mention of "syslog".Squid (as distributed from squid-cache.org) exclusively uses it's own logging routines.He said it was explicitly configured to log to syslog. Which Squid can do.
Understood, but the default config (as distributed from squid-cache.org) doesn't do this (last I looked). The original poster also stated that he is using RedHat EL, which leads me to believe that he is using the official RedHat distributed RPMs. The changelog of RedHat's Squid RPM might (should?) give insight into when they set logging up to use syslog-ng*.
Echoing certain information levels (critical etc) to local messages file is one of the things syslog-ng does unless configured not to AFAIK. I suspect something changed during an upgrade of either Squid (maye higher levels?) or syslog-ng (maybe replaced/altered the orginal config).
The former change should be documented in the changelog for the Squid RPM, the latter would be unlikely (usually configuration files are marked as such in the RPM spec file, and are not over-written), but should be documented in the syslog-ng ROM changelog.
Amos
Chris* Assuming they did. The Squid RPM shouldn't overwrite the Squid config file, so I am further assuming this is all in reference to a new install. I probably should have asked more questions instead of making so many assumptions. Bleh.
