<div dir="ltr"><div><div><div><div><div><div><div><div><div><div>Dear Francesco,<br><br></div>Sorry for the significant delay in answering to the data you sent.<br></div>Judging from the data you sent, there are no misconfigurations in regard to UDP log processing that would explain the behavior you mentioned.</div><div> Also your config looks fine.<br></div>Tonight tried doing a reproduction but I used 3.5.6, which in turn worked just fine.<br></div>(Although it is true that I did use a different version, and that i used loggen on the server itself.)<br></div>Did you try sending logs to the IPs/ports from the same server? Did it behave the same way?<br></div>Furthermore could you please try the reproduction with a more recent syslog-ng version? 3.7 is quite old, but 3.5.6 is in deed older.<br><br></div>And in case you already overcame the issue: How did you find out and what was causing the problem?<br><br></div>Thanks!<br><br></div>Cheers,<br></div>János<br><br>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">Janos SZIGETVARI<br><span>RHCE, License no. <a href="https://www.redhat.com/rhtapps/verify/?certId=150-053-692" target="_blank">150-053-692</a></span><br></div><div dir="ltr"><span><br></span></div><div dir="ltr"><span>LinkedIn: <a href="http://linkedin.com/in/janosszigetvari" target="_blank">linkedin.com/in/janosszigetvari</a></span><br><br>__@__˚V˚<br>Make the switch to open (source) applications, protocols, formats now:<br>- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice<br>- msn -> jabber protocol (Pidgin, Google Talk)<br>- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div class="gmail_extra"><br><div class="gmail_quote">2017-07-28 10:04 GMT-04:00 Vincenti Francesco <span dir="ltr"><<a href="mailto:Francesco.Vincenti@acciaiterni.it" target="_blank">Francesco.Vincenti@acciaiterni.it</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="IT">
<div class="gmail-m_4834105368470809127WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)" lang="EN-US">Dear Jànos<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)" lang="EN-US">Thank you for you answer.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)" lang="EN-US">In this moment syslog-ng is up and running, with the “rebel” network devices logging on the original NIC.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)" lang="EN-US">Anyway I’m going to send you what you need as attachment.</span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)" lang="EN-US">In ipaddr.txt I changed the IP of the card, for security reason; UDP “rebel” devices are logging on ens32 while they should log (and they logged
before network services restart) on ens35. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)" lang="EN-US">Cheers.<u></u><u></u></span></p><span class="gmail-">
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)" lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10pt;font-family:"Calibri","sans-serif";color:navy" lang="EN-GB">Francesco Vincenti</span></b><b><span style="color:navy" lang="EN-GB"> <br>
</span></b><b><span style="font-size:8pt;font-family:"Calibri","sans-serif";color:navy" lang="EN-GB">RHCSA Area Data Center Open Source, Quality and Security</span></b><span style="font-size:8pt;font-family:"Calibri","sans-serif";color:navy" lang="EN-GB"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:9pt;font-family:"Calibri","sans-serif";color:navy" lang="EN-US">Aspasiel
</span><span style="font-size:9pt;font-family:"Cambria","serif";color:navy" lang="EN-US">Divisione</span><span style="font-size:9pt;font-family:"Cambria","serif";color:rgb(51,51,153)" lang="EN-US"> della Società</span><span style="font-size:8pt;color:rgb(51,51,153)" lang="EN-US"><br>
</span><span style="font-size:9pt;font-family:"Calibri","sans-serif";color:rgb(51,51,153)" lang="EN-US">Acciai
</span><span style="font-size:9pt;font-family:"Calibri","sans-serif";color:rgb(51,51,153)">Speciali Terni S.p.A. con Unico Socio</span><span style="font-size:8pt;color:navy"><br>
</span><span style="font-size:9pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">Strada di Pentima, 3 – 05100 Terni</span><span style="font-size:8pt;font-family:TKTypeRegular;color:rgb(31,73,125)">
</span><span style="font-size:8pt;font-family:TKTypeRegular;color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8pt;font-family:"Calibri","sans-serif";color:navy"><a href="mailto:francesco.vincenti@acciaiterni.it" target="_blank">francesco.vincenti@<wbr>acciaiterni.it</a><br>
</span><u><span style="font-size:8pt;font-family:"Calibri","sans-serif";color:blue"><a href="http://www.aspasiel.it/" target="_blank">www.aspasiel.it</a></span></u><span style="font-family:"Calibri","sans-serif";color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)">Ufficio: <a href="tel:+39%200744%20203224" value="+390744203224" target="_blank">+39 0744 203224</a><br>
Fax: <a href="tel:+39%200744%20203444" value="+390744203444" target="_blank">+39 0744 203444</a></span><span style="font-family:"Calibri","sans-serif";color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:"Calibri","sans-serif";color:rgb(31,73,125)"><u></u> <u></u></span></p>
</span><p class="MsoNormal"><b><span style="font-size:10pt;font-family:"Segoe UI","sans-serif"">Da:</span></b><span style="font-size:10pt;font-family:"Segoe UI","sans-serif""> syslog-ng [mailto:<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">syslog-ng-bounces@<wbr>lists.balabit.hu</a>]
<b>Per conto di </b>SZIGETVÁRI János<br>
<b>Inviato:</b> venerdì 28 luglio 2017 15:27<br>
<b>A:</b> Syslog-ng users' and developers' mailing list<br>
<b>Oggetto:</b> Re: [syslog-ng] UDP devices stop logging after network services restart.<u></u><u></u></span></p><div><div class="gmail-h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt">Dear Francesco,<u></u><u></u></p>
</div>
<p class="MsoNormal">To rule out the possiblity of losing UDP logs, I would ask you to share the output of the following commands:<u></u><u></u></p>
</div>
<div>
<pre># cat /proc/net/udp<u></u><u></u></pre>
<pre># netstat -su<u></u><u></u></pre>
<pre># sysctl net.core.rmem_max<u></u><u></u></pre>
<pre># ps auxfw<u></u><u></u></pre>
<pre># top<u></u><u></u></pre>
<pre># lspci<u></u><u></u></pre>
<pre># /usr/sbin/syslog-ng --preprocess-into ~/syslog-ng.pp.conf<br># ip addr show<u></u><u></u></pre>
</div>
<p class="MsoNormal">Furthermore, you may find further useful information about sizing UDP buffers and other best practice infomation here:<br>
<a href="https://www.balabit.com/documents/syslog-ng-pe-6.0-guides/en/syslog-ng-tutorial-udp-source/html-single/index.html" target="_blank">https://www.balabit.com/<wbr>documents/syslog-ng-pe-6.0-<wbr>guides/en/syslog-ng-tutorial-<wbr>udp-source/html-single/index.<wbr>html</a><u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Another useful infomation is that the net.core.rmem_max kernel parameter has to be at least the double of so-rcvbuf() setting. See man 7 socket for further information.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">In higher traffic UDP logging scenarios 256 MB for the rmem_max, and 128 MB for so-rcvbuf() might be useful.<u></u><u></u></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Please share the above information with us so that we can get a better picture of your setup.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt">Thank you!<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Cheers,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">János<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><br>
-- <u></u><u></u></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Janos SZIGETVARI<br>
RHCE, License no. <a href="https://www.redhat.com/rhtapps/verify/?certId=150-053-692" target="_blank">
150-053-692</a><br>
<br>
__@__˚V˚<br>
Make the switch to open (source) applications, protocols, formats now:<br>
- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice<br>
- msn -> jabber protocol (Pidgin, Google Talk)<br>
- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">2017-07-27 8:50 GMT+02:00 Vincenti Francesco <<a href="mailto:Francesco.Vincenti@acciaiterni.it" target="_blank">Francesco.Vincenti@<wbr>acciaiterni.it</a>>:<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hello</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">I have syslog-ng 3.7 installed on a CentOS7 Server with 4G RAM and 4 CPU.</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">The server is receiving logs from almost 300 devices, either network devices (UDP) and servers (TCP).
</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">The problem I have is the following: to reduce incoming traffic on initial two NICs I added two more NICs to the server, where I sent some UDP devices and it
worked immediately, without any issue. </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">But when I restarted network services (systemctl restart network) the devices stopped to log, they restarted only after I resent them to the initial NIC, without
any other action on syslog-ng server. </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">When I started syslog-ng in debug mode to verify this behavior I saw that these devices ARE NOT considered by syslog-ng at all, they are not present in logs generated
by debug, but they REACH the server (tcpdump shows them entering). </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">I'm getting mad about this issue, any suggestion will be welcome.
</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> Following my configuration files:</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">-</span><span style="font-size:7pt" lang="EN-US">
</span><span style="background:yellow none repeat scroll 0% 0%" lang="EN-US">/etc/syslog-ng/syslog-ng.conf</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"># Note: it also sources additional configuration files (*.conf)</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"># located in /etc/syslog-ng/conf.d/</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">options {</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> flush_lines (0);</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> time_reopen (10);</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> log_fifo_size (1000);</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> chain_hostnames (off);</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> use_dns (persist_only);</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> dns-cache-hosts(/etc/hosts);</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> use_fqdn (no);</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> create_dirs (yes);</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> keep_hostname (yes);</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> owner ("1007");</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> group ("1007");</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> dir_owner ("1007");</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> dir_group ("1007");</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> dir_perm (0750);</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">};</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">source s_sys {</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> system();</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> internal();</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> # udp(ip(0.0.0.0) port(514));</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">};</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">destination d_cons { file("/dev/console"); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">destination d_mesg { file("/var/log/messages"); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">destination d_auth { file("/var/log/secure"); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">destination d_mail { file("/var/log/maillog" flush_lines(10)); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">destination d_spol { file("/var/log/spooler"); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">destination d_boot { file("/var/log/boot.log"); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">destination d_cron { file("/var/log/cron"); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">destination d_kern { file("/var/log/kern"); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">destination d_mlal { usertty("*"); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">destination d_auth_loc { network ("127.0.0.1" port (601) ); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">filter f_kernel { facility(kern); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">filter f_default { level(info..emerg) and</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> not (facility(mail)</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> or facility(authpriv)</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> or facility(cron)); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">filter f_auth { facility(authpriv); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">filter f_mail { facility(mail); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">filter f_emergency { level(emerg); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">filter f_news { facility(uucp) or</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> (facility(news)</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> and level(crit..emerg)); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">filter f_boot { facility(local7); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">filter f_cron { facility(cron); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">#log { source(s_sys); filter(f_kernel); destination(d_cons); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">log { source(s_sys); filter(f_kernel); destination(d_kern); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">log { source(s_sys); filter(f_default); destination(d_mesg); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">log { source(s_sys); filter(f_auth); destination(d_auth); destination(d_auth_loc); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">log { source(s_sys); filter(f_mail); destination(d_mail); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">log { source(s_sys); filter(f_emergency); destination(d_mlal); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">log { source(s_sys); filter(f_news); destination(d_spol); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">log { source(s_sys); filter(f_boot); destination(d_boot); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">log { source(s_sys); filter(f_cron); destination(d_cron); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"># Source additional configuration files (.conf extension only)</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">@include "/etc/syslog-ng/conf.d/*.conf"</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"># vim:ft=syslog-ng:ai:si:ts=4:<wbr>sw=4:et:<u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"> <u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">-</span><span style="font-size:7pt" lang="EN-US">
</span><span style="background:yellow none repeat scroll 0% 0%" lang="EN-US">/etc/syslog-ng/conf.d/network_<wbr>dev.conf</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">source s_network_appa</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">{</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> network ( ip(0.0.0.0) port (514) transport ("udp") so-rcvbuf (4096000) );</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">};</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"># Destinazioni</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">destination d_network_udp { file("/var/log/syslog-ng/<wbr>APPARATI/${YEAR}${MONTH}${DAY}<wbr>/${HOST}/${YEAR}${MONTH}${DAY}<wbr>_hh${HOUR}_${HOST}" create_dirs(yes) dir_perm(0755)
perm(0755) ) ; };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">filter f_appa_rete { not host ("SymantecServer") and not host ("part8") and not host ("parti") and not host ("partd") and not host ("part1") and not host ("parte")
and not host ("part10") and not host ("part11") and not host ("part12") and not host ("part3") and not host ("part6") and not host ("part8") and not host ("part9") and not host ("parta") and not host ("partc") and not host ("partd") and not host ("partf")
and not host ("partg") and not host ("parth") and not host ("partn") and not host ("parto") and not host ("<a href="http://SLITES8736.sercom.aspasiel.it" target="_blank">SLITES8736.sercom.aspasiel.<wbr>it</a>") and not host ("172.23.112.47") and not host ("<a href="http://SLITES4557.sercom.aspasiel.it" target="_blank">SLITES4557.sercom.aspasiel.<wbr>it</a>")
and not host ("172.23.X.Y") and not host ("<a href="http://SLITES4558.sercom.aspasiel.it" target="_blank">SLITES4558.sercom.aspasiel.<wbr>it</a>") and not host ("172.23.X.Y") and not host ("<a href="http://SLITES4559.sercom.aspasiel.it" target="_blank">SLITES4559.sercom.aspasiel.<wbr>it</a>")
and not host ("172.23.X.Y") and not host ("<a href="http://SLITES4560.sercom.aspasiel.it" target="_blank">SLITES4560.sercom.aspasiel.<wbr>it</a>") and not host ("172.23.X.Y") and not host ("<a href="http://SLITES8731.sercom.aspasiel.it" target="_blank">SLITES8731.sercom.aspasiel.<wbr>it</a>")
and not host ("172.23.X.Y") and not host ("<a href="http://SLITES8732.sercom.aspasiel.it" target="_blank">SLITES8732.sercom.aspasiel.<wbr>it</a>") and not host ("172.23.X.Y") and not host ("<a href="http://SLITES8733.sercom.aspasiel.it" target="_blank">SLITES8733.sercom.aspasiel.<wbr>it</a>")
and not host ("172.23.X.Y") and not host ("<a href="http://SLITES8734.sercom.aspasiel.it" target="_blank">SLITES8734.sercom.aspasiel.<wbr>it</a>") and not host ("172.23.X.Y") and not host ("<a href="http://SLITES8735.sercom.aspasiel.it" target="_blank">SLITES8735.sercom.aspasiel.<wbr>it</a>")
and not host ("172.23.X.Y") and not host ("slitdd2727"); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">log { source(s_network_appa); filter(f_appa_rete); destination(d_network_udp); };</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">-</span><span style="font-size:7pt" lang="EN-US">
</span><span style="background:yellow none repeat scroll 0% 0%" lang="EN-US">/etc/syslog-ng/conf.d/server_<wbr>TCP.conf</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">source s_server_sop</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">{</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> network ( ip(0.0.0.0) port(601) transport("tcp") max-connections(200) log_fetch_limit(100) log_iw_size(20000) );</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">};</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">destination d_server_sop</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">{</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> file("/var/log/syslog-ng/<wbr>SERVER/${YEAR}${MONTH}${DAY}/$<wbr>{HOST}/${YEAR}${MONTH}${DAY}_<wbr>hh${HOUR}_${HOST}" create_dirs(yes) dir_perm(0755) perm(0755) flush_lines(100)
);</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">};</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US"># Indirizzo le destinazioni.</span><u></u><u></u></p>
<p class="gmail-m_4834105368470809127gmail-m7164147658391925482gmail-m4058230334373719609msolistparagraph"><span lang="EN-US">log { source(s_server_sop); destination(d_server_sop); flags(flow-control); };</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">I changed the following kernel parameters as follow:</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">net.core.rmem_max = 4096000</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">net.core.wmem_max = 4096000</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US">Thanks in advance</span><u></u><u></u></p>
<p class="MsoNormal"><span lang="EN-US"> </span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:10pt;color:navy" lang="EN-GB">Francesco Vincenti</span></b><b><span style="color:navy" lang="EN-GB"> <br>
</span></b><b><span style="font-size:8pt;color:navy" lang="EN-GB">RHCSA Area Data Center Open Source, Quality and Security</span></b><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:9pt;color:navy">Aspasiel
</span><span style="font-size:9pt;font-family:"Cambria","serif";color:navy">Divisione</span><span style="font-size:9pt;font-family:"Cambria","serif";color:rgb(51,51,153)"> della Società</span><span style="font-size:8pt;color:rgb(51,51,153)"><br>
</span><span style="font-size:9pt;color:rgb(51,51,153)">Acciai Speciali Terni S.p.A. con Unico Socio</span><span style="font-size:8pt;color:navy"><br>
</span><span style="font-size:9pt;color:rgb(31,73,125)">Strada di Pentima, 3 – 05100 Terni</span><span style="font-size:8pt;color:rgb(31,73,125)">
</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8pt;color:navy"><a href="mailto:francesco.vincenti@acciaiterni.it" target="_blank">francesco.vincenti@<wbr>acciaiterni.it</a><br>
</span><u><span style="font-size:8pt;color:blue"><a href="http://www.aspasiel.it/" target="_blank">www.aspasiel.it</a></span></u><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:8pt;color:rgb(31,73,125)">Ufficio: <a href="tel:+39%200744%20203224" target="_blank">+39 0744 203224</a><br>
Fax: <a href="tel:+39%200744%20203444" target="_blank">+39 0744 203444</a></span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10pt" lang="EN-US">This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient
or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify
the error at the following email address: </span><a href="mailto:helpdesk@aspasiel.it" target="_blank"><span style="font-size:10pt" lang="EN-US">helpdesk@aspasiel.it</span></a><span style="font-size:10pt" lang="EN-US"> or at Aspasiel Helpdesk Team by phone
(phone number <a href="tel:+39%200744%20203555" target="_blank">+390744203555</a>), and then delete this message from your system.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:22pt;font-family:Webdings;color:green" lang="EN-GB">P
</span><span style="font-size:10pt;font-family:"Comic Sans MS";color:green" lang="EN-GB">Please consider our environment and think before you print. Thank you!</span><span style="color:blue" lang="EN-GB">
</span><span style="font-size:22pt;font-family:Webdings;color:green" lang="EN-GB">q</span><u></u><u></u></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12pt"><br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">
https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">
http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<u></u><u></u></p>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div></div></div><div><div class="gmail-h5">
<div class="gmail-m_4834105368470809127WordSection1">
<p class="MsoNormal" style="margin-bottom:0.0001pt;line-height:normal">
<span style="font-size:10pt;font-family:"TKTypeRegular","serif"" lang="EN-US">This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent
responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the error at
the following email address: </span><span style="font-size:12pt;font-family:"Times New Roman","serif""><a href="mailto:helpdesk@aspasiel.it" target="_blank"><span style="font-size:10pt;font-family:"TKTypeRegular","serif"" lang="EN-US">helpdesk@aspasiel.it</span></a></span><span style="font-size:10pt;font-family:"TKTypeRegular","serif"" lang="EN-US">
or at Aspasiel Helpdesk Team by phone (phone number <a href="tel:+39%200744%20203555" value="+390744203555" target="_blank">+390744203555</a>), and then delete this message from your system.</span></p>
<p class="MsoNormal"><span style="font-size:22pt;line-height:115%;font-family:Webdings;color:green" lang="EN-GB">P
</span><span style="font-size:10pt;line-height:115%;font-family:"Comic Sans MS";color:green" lang="EN-GB">Please consider our environment and think before you print. Thank you!</span><span style="font-size:12pt;line-height:115%;font-family:"Times New Roman","serif";color:blue" lang="EN-GB">
</span><span style="font-size:22pt;line-height:115%;font-family:Webdings;color:green" lang="EN-GB">q</span></p>
</div>
</div></div></div>
<br>______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>