December 1999 - syslog-ng - lists.balabit.hu

syslog-ng 1.3.10
by Balazs Scheidler 18 Dec '99

18 Dec '99

Hi, I've released syslog-ng 1.3.10, fixing pipe handling. I've also updated documentation (internal, unix-dgram & unix-stream drivers are fully documented now). -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Problem with Syslog-ng.
by Ben Kressman 18 Dec '99

18 Dec '99

Currently I am running Syslog-ng on just 2 machines, and they swap log files back and forth for security. Problem is, on one machine syslog-ng just stops running, exits silently.. Anyone else seen this? Syslog-ng v 1.3.8 Libol v 1.3.9 Linux 2.2.13 Slackware 7.0mod -Ben

2 1

1.3.9
by Balazs Scheidler 17 Dec '99

17 Dec '99

I've released 1.3.9 and libol 0.2.10 fixing a pipe() bug. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Filter problem
by John Wingenbach 17 Dec '99

17 Dec '99

I have just installed and configure syslog-ng on a couple of solaris boxes. However, I seem to be getting more then I wanted sent out to the ttys. Here is what I have done: source s_all { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; filter f_EmergSanUser { level(emerg) and not facility(user); }; destination d_ttys { usertty("*"); }; log { source(s_all); filter(f_EmergSanUser); destination (d_ttys); }; I am trying to mimic the syslog.conf line: *.emerg;user.none * However, what I am getting is notice level messages on the ttys. -- John C. Wingenbach Broadband Technologies Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

1 0

Memory leak in syslog-ng 1.3.7 & FreeBSD?
by George Madden 16 Dec '99

16 Dec '99

I was running syslog-ng 1.2.3 on FreeBSD 3.2 with no problems. I recompiled 1.3.7 and have been running it for the past couple of days. It appears to have a memory leak. I've been using top to output the processes to a file and I keep seeing the mem stats for syslog-ng grow. The system is a fairly busy logger and I did add the use_dns statement and $HOST parameters. Has anyone else seen this? Here are the lines from top. I output 2 lines every 5 minutes. This is about the last 45 minutes or so: 609 root 2 0 1536K 1220K poll 40:04 10.06% 10.06% syslog-ng 609 root 2 0 1536K 1220K poll 40:29 7.86% 7.86% syslog-ng 609 root 2 0 1536K 1220K poll 40:29 7.62% 7.62% syslog-ng 609 root 32 0 1536K 1220K RUN 40:53 9.52% 9.52% syslog-ng 609 root 2 0 1536K 1220K poll 40:54 9.47% 9.47% syslog-ng 609 root 32 0 1544K 1224K RUN 41:13 7.57% 7.57% syslog-ng 609 root 2 0 1544K 1224K poll 41:13 8.45% 8.45% syslog-ng 609 root 32 0 1560K 1240K RUN 41:34 6.20% 6.20% syslog-ng 609 root 2 0 1560K 1240K poll 41:35 8.89% 8.89% syslog-ng 609 root 30 0 1560K 1240K RUN 41:55 6.40% 6.40% syslog-ng 609 root 2 0 1560K 1240K poll 41:56 6.88% 6.88% syslog-ng 609 root 2 0 1560K 1240K poll 42:12 3.86% 3.86% syslog-ng 609 root 2 0 1560K 1240K poll 42:12 3.76% 3.76% syslog-ng 609 root 2 0 1568K 1248K poll 42:32 5.47% 5.47% syslog-ng 609 root 2 0 1568K 1248K poll 42:32 5.22% 5.22% syslog-ng 609 root 2 0 1580K 1260K poll 42:58 8.20% 8.20% syslog-ng 609 root 2 0 1580K 1260K poll 42:58 8.35% 8.35% syslog-ng 609 root 2 0 1580K 1264K poll 43:20 5.96% 5.96% syslog-ng 609 root 2 0 1580K 1264K poll 43:20 5.81% 5.81% syslog-ng

2 2

syslog-ng and FBSD 3-STABLE
by Lowkrantz, Goran 16 Dec '99

16 Dec '99

All fine, except that src/main.c:39 need to be <sys/wait.h>. Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

2 1

syslog-ng 1.3.8
by Balazs Scheidler 16 Dec '99

16 Dec '99

Hi, I've released syslog-ng 1.3.8 and libol 0.2.9 with a couple of bugfixes. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

syslog-ng: destination connection broken, reopening in 60 seconds
by Brian Johnson 15 Dec '99

15 Dec '99

I set-up syslog-ng last week, it's bee working great, but started giving this message every minute src@in syslog-ng: destination connection broken, reopening in 60 seconds I am running syslog-ng with the following command: supervise /var/supervise/syslog-ng /usr/sbin/syslog-ng -d 2>&1 |logger -t syslog-ng & I did it this way because I wanted to use the supervise utility to make sure it stays running, and to do that I needed to keep syslog-ng from becoming a daemon otherwise supervise will think it crashed and run it again and so I'm using the logger command to pass any error messages back into my logs.. in my syslog-nf.conf file all of my destinations are either files or virtual terminals (eg: /dev/tty1) and so I don't see how the connection to any of those could be broken? it seems to be logging ok otherwise.. any thoughts?? btw - I'm running on Redhat 6.0 ..and my thanks to the authors of the program - this is very helpfull

1 0

syslog-ng 1.3.7/Solaris 2.7
by ger 15 Dec '99

15 Dec '99

Hi, don't know if I'm doing something stupid here, or if I'm missing something, but here goes.. I have been running 1.3.6 successfully on Solaris 2.7 as a central logging solution, but I upgraded to 1.3.7 to check the new DNS functionality, and ran into some name resolution problems. I added the use_dns(yes) and use_fqdn(no) options to the options section of the configuration file, but my logfiles were still being created with <facility>.log.<ip_address> rather than <facility>.log.<hostname>, as had previously been the case with 1.3.6. I also tried removing the long_hostnames option in case it was conflicting with the new DNS code, but to no avail. I used the same version of libol for both, as no changes seem to have been made to the libs (0.2.8., Dec 3). Am I missing something, or has anyone else noticed this behaviour? Maybe something to do with the Solaris 7 resolver? Thanks, Ger. -- Ger Mulcahy, Technical Consultant, Harvard Business School

2 1

Logging console?
by Erich Reitz 09 Dec '99

09 Dec '99

Hi, I would like to know if it is possible/wise to log messages sent to the console? Unattended machines without monitors usually report messages during bootup that I never see since they are exclusively directed to the console. During normal operations I believe there are messages that can be sent exclusively to the console (ie: perl -w warning messages when the perl script process is run/forked from a background process without a controlling terminal) and these messages are never seen/logged. I am wondering if I can set the console up as a source for syslog-ng on these machines without monitors?

2 1