<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.m4692089798487277835msolistparagraph, li.m4692089798487277835msolistparagraph, div.m4692089798487277835msolistparagraph
{mso-style-name:m_4692089798487277835msolistparagraph;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1027412924;
mso-list-type:hybrid;
mso-list-template-ids:-1649891160 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1
{mso-list-id:1571767317;
mso-list-template-ids:535714338;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Balázs –<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What guarantee is there that I won’t lose traps? <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo2">Does logrotate make sure snmptrapd has finished writing to
<b>"/var/log/snmptrapd.log"? </b>Is the write by snmptrapd 5.7.3+ always atomic for one or more traps?<o:p></o:p></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo2">Does syslog-ng 3.20.1 make sure it instantly reads every trap written by snmptrapd to
<b>"/var/log/snmptrapd.log" </b>before it’s switched out by logrotate?<o:p></o:p></li></ol>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I apologize if this is basic knowledge I’m not aware of.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best Regards,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">-Allen<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> <b>
On Behalf Of </b>Scheidler, Balázs<br>
<b>Sent:</b> Monday, May 20, 2019 11:55 AM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br>
<b>Subject:</b> Re: [syslog-ng] snmptrap handler parses SNMP traps correctly, but the file it reads from is not emptying<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:red">[External Email]</span></b><span style="font-size:12.0pt;color:red"><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal">Just set up logrotate on that file, syslog-ng will read till the end and start the new one if the rotation happens.
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So instead of truncating, rename it to a new name, and let snmptrapd write to a new file.<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Mon, May 20, 2019, 15:55 Allen Pouratian <<a href="mailto:Allen.Pouratian@alticeusa.com">Allen.Pouratian@alticeusa.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hello –<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I set up snmptrapd to write to
<b>/var/log/snmptrapd.log</b> and syslog-ng is configured to read from it like this …<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-family:Consolas">source {
</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-indent:.5in">
<b><span style="font-family:Consolas">snmptrap(filename("/var/log/snmptrapd.log"));
</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-family:Consolas">};</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">… but
<b>/var/log/snmptrapd.log</b> is not getting emptied, so it needs to be truncated every so often to avoid filling up the filesystem.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">But the problem with truncating
<b>/var/log/snmptrapd.log</b> is that we’re going to lose traps, since we get a lot of them.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">When I was testing this syslog-ng snmptrap facility with a few traps a minute, I saw
<b>/var/log/snmptrapd.log</b> empty, but with hundreds of traps incoming per second, it does not empty any more.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I have what looks like a work-around to the syslog-ng snmptrap handler/parser where …<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<ol start="1" type="1">
<li class="m4692089798487277835msolistparagraph" style="mso-list:l1 level1 lfo1">
1) Snmptrapd 5.7.3 writes to syslog with -Lsd<o:p></o:p></li><li class="m4692089798487277835msolistparagraph" style="mso-list:l1 level1 lfo1">
2) Syslog-ng 3.20 reads from syslog with system-journal()<o:p></o:p></li><li class="m4692089798487277835msolistparagraph" style="mso-list:l1 level1 lfo1">
3) Rewrite the trap $MESSAGE with a series of “substitutions” (subst) into space separated key=value pairs<o:p></o:p></li><li class="m4692089798487277835msolistparagraph" style="mso-list:l1 level1 lfo1">
4) point kv-parser() at $MESSAGE and specify “ “ as a separator <o:p></o:p></li><li class="m4692089798487277835msolistparagraph" style="mso-list:l1 level1 lfo1">
5) delete the original $MESSAGE block<o:p></o:p></li></ol>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">… but perhaps I didn’t have to do that, since perhaps I’m mis-using the snmptrap facility built into syslog-ng, and thus causing
<b>/var/log/snmptrapd.log</b> to not empty.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Your comments and insights would be appreciated.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">- Allen<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<br>
--------------------------------------------------------<br>
The information transmitted in this email and any of its attachments is intended only for the person or entity to which it is addressed and may contain information concerning Altice USA and/or its affiliates and subsidiaries that is proprietary, privileged,
confidential and/or subject to copyright. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient(s) is prohibited and may be unlawful. If
you received this in error, please contact the sender immediately and delete and destroy the communication and all of the attachments you have received and all copies thereof.<br>
--------------------------------------------------------<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">______________________________________________________________________________<br>
Member info: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.balabit.hu_mailman_listinfo_syslog-2Dng&d=DwMFaQ&c=j5qhuXVFDG9qAPVzJdE5nsirLGtagR5tRVwNBd9MNeo&r=BBDIJ7y03FqO0tp_wGoZn961RS3d3lkq0jHFc3Knid4&m=uVtE5BY0NtoZSHcV7M9rVxkmtCUx34u93UPnbMDlgco&s=-wSgv6P6Tu67nZwvsDpZ8FSGWw3vRdbr9k2k8lOsYN8&e=" target="_blank">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.balabit.com_support_documentation_-3Fproduct-3Dsyslog-2Dng&d=DwMFaQ&c=j5qhuXVFDG9qAPVzJdE5nsirLGtagR5tRVwNBd9MNeo&r=BBDIJ7y03FqO0tp_wGoZn961RS3d3lkq0jHFc3Knid4&m=uVtE5BY0NtoZSHcV7M9rVxkmtCUx34u93UPnbMDlgco&s=qEw0ZLUxEifTpc9_6CVz8tXvfTCvtmcMX3nvPyriky8&e=" target="_blank">
http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.balabit.com_wiki_syslog-2Dng-2Dfaq&d=DwMFaQ&c=j5qhuXVFDG9qAPVzJdE5nsirLGtagR5tRVwNBd9MNeo&r=BBDIJ7y03FqO0tp_wGoZn961RS3d3lkq0jHFc3Knid4&m=uVtE5BY0NtoZSHcV7M9rVxkmtCUx34u93UPnbMDlgco&s=1ihsxbF1hC0FOjy9_eIGny6fXBoHYk5XPxzJxAB9-Gg&e=" target="_blank">
http://www.balabit.com/wiki/syslog-ng-faq</a><o:p></o:p></p>
</blockquote>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="color:red">Caution: This email originated outside of Altice USA. Please do not click links or attachments unless you recognize the sender and know the content is
safe.</span></b><span style="color:red"><o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:10.0pt;color:red"><o:p> </o:p></span></p>
</div>
</div>
</body>
</html>