December 1999 - syslog-ng - lists.balabit.hu

TCP problems patch
by Balazs Scheidler 29 Dec '99

29 Dec '99

Hi, I tried to fix the TCP related bugs reported by many people. There are two patches, one against libol0.2.10, and one against syslog-ng1.3.10, please test if these fix the encountered problems, or not. diff -urN libol-0.2.10/src/io.c libol-0.2.11/src/io.c --- libol-0.2.10/src/io.c Thu Dec 16 18:15:39 1999 +++ libol-0.2.11/src/io.c Mon Dec 27 23:53:38 1999 @@ -232,16 +232,16 @@ WRITE_FD(fd); else { verbose("io_iter(): POLLHUP on inactive fd!\n"); - closekill_fd(fd, CLOSE_EOF); + close_fd(fd, CLOSE_EOF); } continue; } if (fds[i].revents & POLLPRI) { - closekill_fd(fd, CLOSE_PROTOCOL_FAILURE); + close_fd(fd, CLOSE_PROTOCOL_FAILURE); continue; } if (fds[i].revents & (POLLNVAL | POLLERR)) - closekill_fd(fd, CLOSE_POLL_FAILED); + close_fd(fd, CLOSE_POLL_FAILED); if (fds[i].revents & POLLOUT) if (fd->want_write && fd->write) WRITE_FD(fd); @@ -270,7 +270,7 @@ } } if (!nfds && !nco) { - verbose("io_iter(): no waiting fds and no callouts! exiting...\n"); + werror("No listening fds and no pending events, exiting...\n"); return 0; } return 1; @@ -486,7 +486,7 @@ res = BUF_FLUSH(self->buffer, &w.super); if (ST_CLOSEDP(res)) { - closekill_fd(fd, ST_FAILUREP(res) ? CLOSE_PROTOCOL_FAILURE : CLOSE_EOF); + close_fd(fd, ST_FAILUREP(res) ? CLOSE_PROTOCOL_FAILURE : CLOSE_EOF); } } diff -urN libol-0.2.10/src/pkt_buffer.c libol-0.2.11/src/pkt_buffer.c --- libol-0.2.10/src/pkt_buffer.c Thu Dec 16 18:12:21 1999 +++ libol-0.2.11/src/pkt_buffer.c Mon Dec 27 23:49:20 1999 @@ -109,8 +109,8 @@ } } else { - werror("pkt_buffer::do_flush(): Error flushing data\n"); - return ST_FAIL | ST_CLOSE; + verbose("pkt_buffer::do_flush(): Error flushing data\n"); + return ST_CLOSE; } } return ST_OK | ST_GOON; this against syslog-ng: diff -urN syslog-ng-1.3.10/src/log.c syslog-ng-1.3.11/src/log.c --- syslog-ng-1.3.10/src/log.c Mon Nov 22 19:26:16 1999 +++ syslog-ng-1.3.11/src/log.c Mon Dec 27 23:45:02 1999 @@ -116,9 +116,15 @@ src = oldsrc; left = oldleft; } + + while (left && *src == ' ') { + src++; /* skip whitespace */ + left--; + } oldsrc = src; oldleft = left; + while (left && *src != ':' && *src != '[') { src++; left--; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Preserving the Source device attributes while forwarding messages
by Ofer_Aaronson＠amat.com 29 Dec '99

29 Dec '99

Hello , I'm a new member of this list and trying to forward messages by invoking a logger command : The following is an example of a message received at the NMS system . Source Message temp00r1 %LINK-3-UPDOWN: Interface BRI1/3:1, changed state to down It would automatically invoke a logger command : % logger -p local7.notice -t temp00r1 %LINK-3-UPDOWN: Interface BRI1/3:1, changed state to down This command is run on hostname: Host-A The syslog-ng.conf file on Host-A looks like : options { long_hostname(off); }; destination temp00r1{ udp("Host-B" port(514)); }; filter temp00r1 { program("temp00r1"); }; log ( source(local); filter(temp00r1); destination(temp00r1); }; The above 'logger' command is received at "Host-B" host the follows : Date IP Host Facility Priority Message Time Address Name Source Source ------------------------------------------------------------------------------------------------------------------------ 12/22/99 2:19 Host-A's IP Host-A LOCAL7 NOTICE Dec 22 2:18:37 Host-A temp00r1: %LINK-3-UPDOWN: Interface BRI1/3:1, changed state to down The desired received message would be : 12/22/99 2:19 temp00r1's IP temp00r1 LOCAL7 NOTICE Dec 22 2:18:37 temp00r1 %LINK-3-UPDOWN: Interface BRI1/3:1, changed state to down Is there anyway to make syslog-ng initiate the Trap as like it is the original device . Any idea / help would be highly appreciated . Thanks , Ofer Aaronson --------------- Network Management Architecture Manager Global Network Services Applied Materials Inc. mailto://Ofer_Aaronson@amat.com/

2 1

using syslog-ng for syslog forwarding
by Markus Warg 29 Dec '99

29 Dec '99

Hi all, has anybody tried the following: redirect logging to a single log host (simple so far) with tcp. Use syslog-ng both for the log host and the log clients. What happens if the connection between client and host times out? Does syslog-ng store messages until it can successfully connect to the log host again or are those messages lost? Sorry if this was discussed before, but I could not find it in my current mailing list archive. regards, Markus -- DPN Verbund-Zentrale http://www.dpn.de/ fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg Deutsches Provider Network Markus.Warg(a)dpn.de

4 5

Feature request =)
by Nigel Bovey 22 Dec '99

22 Dec '99

Now that the $HOST thing is working great, how about a new feature for making directories if they don't exist. Eg, I'll be switching a large number of machines to point towards the new syslog host, and instead of having to go through and create the directories for each host, it'd be nice for the program to auto create them if needed. Obviously, this should be configurable. Its no biggie, but just thought it'd be a nice feature =) --- Nigel Bovey IHUG Network Operations Team

2 2

use_dns problem
by Nigel Bovey 22 Dec '99

22 Dec '99

With 1.3.10 if you have use_dns(no) it still looks things up in the hosts file. Other than that, its working great. --- Nigel Bovey IHUG Network Operations Team

1 0

syslog-ng 1.3.10.. kern coming up user.
by John Wingenbach 21 Dec '99

21 Dec '99

I have configured my local client and my loghost to use syslog-ng v 1.3.10. The client is setup to send all syslog messages to the loghost and the loghost then breaks them apart mainly by facility. What I am seeing is that when I issue a "logger -p kern.notice testing kern.notice" it shows up locally as a user message. Here is the client config file: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/var/log/messages"); }; filter kernfilter { facility(kern); }; filter f_user { facility(user); }; destination loghost { udp("sysloguser" port(514)); }; destination ttys { usertty("*"); }; destination kern { file ("/var/log/kern"); }; destination user { file ("/var/log/user"); }; log { source(local); destination(all); }; log { source(local); destination(loghost); }; log { source(local); filter(kernfilter); destination(kern); }; log { source(local); filter(f_user); destination(user); }; -- John C. Wingenbach Broadband Technologies Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

3 2

Re: syslog-ng performance question
by Balazs Scheidler 21 Dec '99

21 Dec '99

> About how many messages per second do you think syslog-ng can process? > > I know it depends on a lot of factors, but have you done any testing? Sending messages in an infinite loop from shell script causes no problem. Even if several scripts are running at the same time. However if this is done from within a compiled C program, it may lose messages if non-connection-oriented messages are used (udp, and unix-dgram). Sending messages from C meant about 3000 accepted messages per second. (e.g. messages which were actually written to the logfile), while the C program sent about 25000 messages per second. Lost messages are caused by garbage collection. While it runs, syslog-ng doesn't fetch messages from the kernel queue. You can set the number of allocated objects when the gc runs with the gc_threshold option. The larger this value is, the longer the gc phase will run (of course if it's larger it runs less times). So syslog-ng can work with at most 3000 messages per second if used with connectionless protocols. Connection oriented protocols will block the sending process while the message is sent. Messages are not lost, but overall system performance decreases because of logging. I measured this on my Celeron 300A running at 450Mhz (100Mhz FSB, 128k full-speed cache, 64MB 100Mhz SDRAM) with a threshold value of 1000. I think threshold should be set to largest burst you are counting for. 3000 messages / second means about 300000 bytes log info per second, 18megs in a minute, 1 gigs in an hour, and 24 gigs in a day. (using an estimate of 100 bytes per message) I may try to add more options to finetune gc phase in the future. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng 1.3.10
by George Madden 20 Dec '99

20 Dec '99

I just downloaded the latest version of syslog-ng (1.3.10) and libol-0.2.10. I having a problem when sending a kill -HUP to it on both RedHat 6.1 and FreeBSD 3.2R. It won't restart. The CPU load goes up and it won't take a kill. I have to do a kill -9 to stop the process. Has anyone else had any problems?

1 0

Filters not working at all?
by John Wingenbach 20 Dec '99

20 Dec '99

I have syslog-ng V 1.3.8 installed on Solaris 2.6 system. I can't seem to get the range specification for filters to work properly (e.g. level(debug..emerg))). Instead only a single level is stored in the file. Here is my current syslog config file: source s_all { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; filter f_warning { level(warning..emerg); }; filter f_debug { level(debug..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_emerg { level(emerg); }; filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon); }; filter f_auth { facility(auth); }; filter f_lpr { facility(lpr); }; filter f_news { facility(news); }; filter f_kern { facility(kern); }; filter f_uucp { facility(uucp); }; filter f_cron { facility(cron); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_SanUser { not facility(user); }; destination d_all { file("/var/log/messages"); }; destination d_ttys { usertty("*"); }; destination d_console { file ("/dev/console"); }; destination d_kernfile { file ("/var/log/kern"); }; destination d_syslogfile { file ("/var/log/syslog"); }; destination d_userfile { file ("/var/log/user"); }; destination d_mailfile { file ("/var/log/mail"); }; destination d_mailcritfile { file ("/var/log/mail.crit"); }; destination d_mailwarnfile { file ("/var/log/mail.warning"); }; destination d_daemonfile { file ("/var/log/daemon"); }; destination d_authfile { file ("/var/log/auth"); }; destination d_lprfile { file ("/var/log/lpr"); }; destination d_newsfile { file ("/var/log/news"); }; destination d_uucpfile { file ("/var/log/uucp"); }; destination d_cronfile { file ("/var/log/cron"); }; destination d_local0file { file ("/var/log/local0"); }; destination d_local1file { file ("/var/log/local1"); }; destination d_local2file { file ("/var/log/local2"); }; destination d_local3file { file ("/var/log/local3"); }; destination d_local4file { file ("/var/log/local4"); }; destination d_local5file { file ("/var/log/local5"); }; destination d_local6file { file ("/var/log/local6"); }; destination d_local7file { file ("/var/log/local7"); }; log { source(s_all); filter(f_emerg); filter(f_SanUser); destination (d_ttys); }; #log { source(s_all); # filter (f_kernnotice); filter (f_authnotice); # destination (d_console); }; #log { source(s_all); # filter(f_ErrSanUser); filter (f_kerndebug); filter (f_daemonnotice); filter (f_mail); # destination (d_syslogfile); # }; log { source(s_all); filter (f_kern); filter (f_debug); destination (d_kernfile); }; log { source(s_all); filter (f_user); filter (f_debug); destination (d_userfile); }; log { source(s_all); filter (f_mail); filter (f_debug); destination (d_mailfile); }; log { source(s_all); filter (f_mail); filter (f_crit); destination (d_mailcritfile); }; log { source(s_all); filter (f_mail); filter (f_warning); destination (d_mailwarnfile); }; log { source(s_all); filter (f_daemon); filter (f_debug); destination (d_daemonfile); }; log { source(s_all); filter (f_auth); filter (f_debug); destination (d_authfile); }; log { source(s_all); filter (f_lpr); filter (f_debug); destination (d_lprfile); }; log { source(s_all); filter (f_news); filter (f_debug); destination (d_newsfile); }; log { source(s_all); filter (f_uucp); filter (f_debug); destination (d_uucpfile); }; log { source(s_all); filter (f_cron); filter (f_debug); destination (d_cronfile); }; log { source(s_all); filter (f_local0); destination (d_local0file); }; log { source(s_all); filter (f_local1); filter (f_debug); destination (d_local1file); }; log { source(s_all); filter (f_local2); destination (d_local2file); }; log { source(s_all); filter (f_local3); destination (d_local3file); }; log { source(s_all); filter (f_local4); filter (f_debug); destination (d_local4file); }; log { source(s_all); filter (f_local5); filter (f_debug); destination (d_local5file); }; log { source(s_all); filter (f_local6); filter (f_debug); destination (d_local6file); }; log { source(s_all); filter (f_local7); filter (f_debug); destination (d_local7file); }; -- John C. Wingenbach Broadband Technologies Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

3 2

Re: syslog-ng-1.2.3 compile problem on HP-UX 10.20
by Balazs Scheidler 19 Dec '99

19 Dec '99

On Sun, Dec 19, 1999 at 04:14:35PM +0100, Ralf Hildebrandt wrote: > Hi! > > Just a single error keeps me from building syslog-ng: > > make[1]: Entering directory /mnt/disk4/gnu/syslog-ng-1.2.3/src' > gcc -DHAVE_CONFIG_H -I. -I/users2/gnu/syslog-ng-1.2.3/src -I. -O2 -Wall > -I/users2/local/include/libol -c afstreams.c > afstreams.c: In function do_kill_door': > afstreams.c:60: warning: implicit declaration of function door_revoke' > afstreams.c: In function do_stream_read': > afstreams.c:106: structure has no member named pri' > afstreams.c: In function do_init_afstreams_source': > afstreams.c:209: I_CONSLOG' undeclared (first use in this function) > afstreams.c:209: (Each undeclared identifier is reported only once > afstreams.c:209: for each function it appears in.) > afstreams.c:246: too few arguments to function close_fd' > afstreams.c:206: warning: unused variable st' > afstreams.c: At top level: > afstreams.c:65: warning: make_door_fd' defined but not used > make[1]: *** [afstreams.o] Error 1 > make[1]: Leaving directory /mnt/disk4/gnu/syslog-ng-1.2.3/src' > make: *** [all-recursive] Error 1 > HP-UX doesn't have doors and STREAMS, it seems that the configure script doesn't detect this correctly. Try to set HAVE_SYS_STRLOG_H and HAVE_STROPTS_H to 0 in config.h and rebuild. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0