Rudder

On a Rudder 2.4 node (SLES 11 SP1), after a change at /var/rudder/cfengine-community/inputs/common/1.0/update.cf about cfserved IP, a line has been added into /etc/syslog-ng/syslog-ng.conf.

In /var/rudder/cfengine-community/inputs/common/1.0/update.cf, line 66 :

bundle common server_info {
  vars:
    any::
-      "cfserved" string => "x.x.x.x";
+      "cfserved" string => "y.y.y.y";
[...]

In /etc/syslog-ng/syslog-ng.conf, end of line:

filter(f_local_rudder);facility(local6) and program('rudder.*);}destination loghost {tcp("x.x.x.x" port (514));};log {source(src);filter(f_local_rudder);destination(loghost);};
+filter(f_local_rudder);facility(local6) and program('rudder.*);}destination loghost {tcp("y.y.y.y" port (514));};log {source(src);filter(f_local_rudder);destination(loghost);};

It will ended by a multiplication of log messages in Rudder server logs.