January 2000 - syslog-ng - lists.balabit.hu

Syslog-ng fails with more than one program destination
by George Madden 15 Feb '00

15 Feb '00

I was testing with 1.3.13 and found it fails with a kill -HUP when more than one "program" destination is used. Syslog-ng never restarts and starts using all the cpu. I tested this on both Redhat 6.1 and FreeBSD 3.3. When I remove all but one program destination, it works fine. It also works fine under syslog-ng 1.2.3. I assume I can have more than one program destination but maybe not. Here is the debug output. It never closes the fd and the cpu goes to about 97% binding fd 3, inetaddr: 0.0.0.0, port: 514 io.c: Preparing fd 3 for reading io.c: listening on fd 4 io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing io.c: Preparing fd 8 for writing syslog-ng version 1.3.13 starting io.c: Preparing fd 5 for writing Garbage collecting while idle... Objects alive: 68, garbage collected: 4 Garbage collecting while idle... Objects alive: 68, garbage collected: 14 Garbage collecting while idle... Objects alive: 68, garbage collected: 28 Garbage collecting while idle... Objects alive: 68, garbage collected: 37 SIGHUP received, restarting syslog-ng Marking fd 3 for closing. Marking fd 5 for closing. Marking fd 8 for closing. Here are the files from the Redhat system: syslog-ng.conf ## options { long_hostnames(off); sync(0); log_fifo_size(10); }; source src { unix-stream("/dev/log"); internal(); }; source net { udp(); }; # destination all { file ("/var/log/all" sync(0)); }; destination net { file ("/var/log/net" sync(100)); }; # destination authenfail {program ("/etc/scripts/authenfail.sh"); }; destination authendeny {program ("/etc/scripts/authendeny.sh"); }; destination poolmess {program ("/etc/scripts/poolmess.sh"); }; # filter f_authen { match ("PIX-6-10900"); }; filter f_authenfail { match ("PIX-6-109006"); }; filter f_authendeny { match ("PIX-6-109009"); }; filter f_poolfail { match ("laddr 10.10.01.254"); }; # log { source(src); destination(all); }; log { source(net); destination(net); }; # log { source(net); filter(f_authenfail); destination(authenfail); }; log { source(net); filter(f_authendeny); destination(authendeny); }; log { source(net); filter(f_poolfail); destination(poolmess); }; Here are the scripts: authendeny.sh #!/bin/sh while read LINE; do echo $LINE | mail -s "Athentication Denied" root done authenfail.sh #!/bin/sh while read LINE; do # use awk to get the second field with a ' as a delimiter NAME=`echo $LINE | awk -F\' '{print $2}'` echo $NAME echo $LINE | mail -s "Athentication Failed for $NAME" root done poolmess.sh #!/bin/sh while read LINE; do echo $LINE | mail -s "Possible pool overload" pixadmin done

2 6

syslog-ng 1.3.13 & libol 0.2.13 released
by Balazs Scheidler 17 Jan '00

17 Jan '00

Hi, I've released the latest development version of syslog-ng & libol. This release hopefully fixes some bugs, so if you had problems earlier, you should grab this release. I've also updated the documentation, though it's still not finished. http://www.balabit.hu/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

Re: [jkane@pobox.com: [syslog-ng] Solaris Streams support]
by Balazs Scheidler 13 Jan '00

13 Jan '00

On Thu, Jan 13, 2000 at 10:22:32AM -0700, John Arthur Kane wrote: > Hmm, the mailing list seems to be dead. > > Could you take a look at the message below. The 1.3.12 release solves > all of my problems in 1.3.5, EXCEPT now it cannot accept local syslog > entries on Solaris 2.6. > > Thanks it's not dead, I've been busy recently. STREAMS support is not gone, you should check out the config.log file. STREAMS support is enabled if you have sys/strlog.h and stropts.h, door support is added, if you have -ldoor available, and it contains a door_create() function. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Lost connections not reopened
by Andreas Zymny 13 Jan '00

13 Jan '00

I have the same problems as Gary Carroll on FreeBSD 3.x and 4.0-CURRENT with syslog-ng 1.3.12 and 1.2.8. I compiled an installed the latest stable from syslog-ng, while the 1.3.x doesn't run stable on my machines, but the 1.2.8 has the same problem. Lost connections are not automatically reopened, and all log entries are lost. Why are all log entries are lost? Is it possible to store all log entries in an file or an stream, so they can sent when the connection is reopened? Best regards, Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

1 0

Solaris Streams support
by John Arthur Kane 11 Jan '00

11 Jan '00

Well, I have been gone for a month and I just grabbed 1.3.12 (upgrading from 1.3.5). However, when I try to run it, it complains: sun-streams support not compiled in (STREAM=/dev/log) Error initializing configuration, exiting. I can't find an option to turn on sun-streams, it appeared to be the default in 1.3.5. The lines in the conf file that cause this are: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; Thanks!

1 0

Solaris Streams support
by John Arthur Kane 11 Jan '00

11 Jan '00

[hmm, may be a duplicate, but I did not see it come through the list] Well, I have been gone for a month and I just grabbed 1.3.12 (upgrading from 1.3.5). However, when I try to run it, it complains: sun-streams support not compiled in (STREAM=/dev/log) Error initializing configuration, exiting. I can't find an option to turn on sun-streams, it appeared to be the default in 1.3.5. The lines in the conf file that cause this are: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; Thanks!

1 0

Error Message
by Andreas Zymny 10 Jan '00

10 Jan '00

This Error-Message I found in my syslog logfile: assertion "i < nfds" failed: file "io.c", line 172 There is an other problem in the "io.c" source. On my computer, the syslog-nd often dies with a message in the syslog logfile: Jan 6 11:09:10 syslog-ng[6929]: io.c: do_write: write() failed (errno 32), Broken pipe Jan 7 15:20:14 syslog-ng[11521]: io.c: do_write: write() failed (errno 32), Broken pipe Jan 7 16:46:57 syslog-ng[13775]: io.c: do_write: write() failed (errno 32), Broken pipe Jan 10 11:35:00 syslog-ng[19065]: io.c: do_write: write() failed (errno 32), Broken pipe Only an "kill -9" can kill the syslog-ng, and I can't reproduce this error. On both server (my machine an the log server) is FreeBSD installed (3.3 on my machine, 4.0 on the Server). Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

1 0

Lost tcp connections not reopened
by Gary Carroll 06 Jan '00

06 Jan '00

Hi, this is a problem with syslog-ng.1.3.12 on Solaris.... System 1 forwards using tcp to System 2, both using syslog-ng. System 2 syslog-ng is hupped (kill -HUP `cat syslog-ng.pid`) and reinitializes as normal. System 1 loses tcp connection and writes internal message "Connection broken, reopening in 60 seconds". BUT the connection is not reopened and the forwarded data is lost until System 1 syslog-ng is hupped. Then everything is OK again. It would be really nice if the connection were reopened automatically. Thanks, Gary Carroll

1 0

Re: syslog-ng digest, Vol 1 #132 - 2 msgs
by Andreas Zymny 05 Jan '00

05 Jan '00

On Wed, 5 Jan 2000 syslog-ng-admin(a)venus.terrasoft.hu wrote: > When replying, please edit your Subject line so it is more specific than > "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Filter operator "not" does not work (Andreas Zymny) > 2. Re: Filter operator "not" does not work (Balazs Scheidler) > > --__--__-- > > Message: 1 > Date: Tue, 4 Jan 2000 17:56:59 +0000 (GMT) > From: Andreas Zymny <anzy(a)du.gtn.com> > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Filter operator "not" does not work > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, > > I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" > operator for the filters doesn't work in the 1.3.11 version. > > bash-2.03# /usr/sbin/syslogd > parse error at 13 > Parse error reading configuration file, exiting. > > Andreas Zymny (Technik) > [a.zymny(a)dpn.de] > -- > DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 > Bismarckstr. 120 fax: +49 203 3093 112 > D-47057 Duisburg http://www.dpn.de > > > --__--__-- > > Message: 2 > Date: Tue, 4 Jan 2000 18:10:52 +0100 > From: Balazs Scheidler <bazsi(a)balabit.hu> > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re: [syslog-ng] Filter operator "not" does not work > Reply-To: syslog-ng(a)lists.balabit.hu > > On Tue, Jan 04, 2000 at 05:56:59PM +0000, Andreas Zymny wrote: > > Hi, > > > > I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" > > operator for the filters doesn't work in the 1.3.11 version. > > > > bash-2.03# /usr/sbin/syslogd > > parse error at 13 > > Parse error reading configuration file, exiting. > > Version 1.3.11 had a major problem in the parser, which I have fixed in the > just released 1.3.12. Please test this release too. I think, there is still a problem in the parser, while this line doesn't work: filter f_all { host("install1") not match("sshd"); }; When the "not" is exchanged with by "and" or "or", all works fine. Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

2 1

Re: syslog-ng digest, Vol 1 #132 - 2 msgs
by Andreas Zymny 05 Jan '00

05 Jan '00

On Wed, 5 Jan 2000 syslog-ng-admin(a)venus.terrasoft.hu wrote: > When replying, please edit your Subject line so it is more specific than > "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Filter operator "not" does not work (Andreas Zymny) > 2. Re: Filter operator "not" does not work (Balazs Scheidler) > > --__--__-- > > Message: 1 > Date: Tue, 4 Jan 2000 17:56:59 +0000 (GMT) > From: Andreas Zymny <anzy(a)du.gtn.com> > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Filter operator "not" does not work > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, > > I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" > operator for the filters doesn't work in the 1.3.11 version. > > bash-2.03# /usr/sbin/syslogd > parse error at 13 > Parse error reading configuration file, exiting. > > Andreas Zymny (Technik) > [a.zymny(a)dpn.de] > -- > DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 > Bismarckstr. 120 fax: +49 203 3093 112 > D-47057 Duisburg http://www.dpn.de > > > --__--__-- > > Message: 2 > Date: Tue, 4 Jan 2000 18:10:52 +0100 > From: Balazs Scheidler <bazsi(a)balabit.hu> > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re: [syslog-ng] Filter operator "not" does not work > Reply-To: syslog-ng(a)lists.balabit.hu > > On Tue, Jan 04, 2000 at 05:56:59PM +0000, Andreas Zymny wrote: > > Hi, > > > > I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" > > operator for the filters doesn't work in the 1.3.11 version. > > > > bash-2.03# /usr/sbin/syslogd > > parse error at 13 > > Parse error reading configuration file, exiting. > > Version 1.3.11 had a major problem in the parser, which I have fixed in the > just released 1.3.12. Please test this release too. Fine, I will get the new version, and test it. Yesterday, I send your syslog-ng a "kill -HUP" to initiate the reload of the configuration file (with the "not" operator). The syslog-ng doesn't shutdown the process, and doesn't told me, that there is an configuration error. He was still using the older - and correct - configuration file. Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

1 0