I have a Syslog-ng server. there are many clients that send their log to the log server. the problem is sometimes there is no log for some clients in the log server, and sometimes there is no log for any of them. when this happen I do these steps:
- I check the syslog-ng service and it almost is active.
I create a client for test, and I send this client's log to the log server. immediately after that, I see the log server start to record logs for those client that there is no log for them before. so for these some logs for a period of time don't exist.
The next log file is for example:
So some log files are missed.
Also I check UDP drop packets using
ifconfigcommand and there is no dropped packet at all.
I check the log server's log and find these logs, but I'm not sure what problems they belong to:
Syslog,error,systemd-journald: Failed to save stream data /run/systemd/journal/streams/8:6354381: Permission denied,"01 Jan 2018, 14:46:48 Syslog,error,"I/O error occurred while writing; fd='21', error='Operation not permitted (1)'","01 Jan 2018, 11:45:04 Syslog,error,"Error opening file for writing; filename='/mnt/remotelogs/syslog-services/10.1.171.54/anytype/2018_01_01.log', error='Permission denied (13)'","01 Jan 2018, 11:47:23"
Where is the problem? and how can I make the log server stable?