October 2000 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]PTR lookups; leak/crash fixes
by Ohrberg, Mick 07 Nov '00

07 Nov '00

[snip] > But now there is a bunch of extra CPU usage (syslog-ng has accumulated 600 > minutes of CPU time after running for just one day; this is a 333Mhz machine and > there are only a couple dozen logging hosts, most of which comes relayed > through other syslog-ngs anyways). [snip] I keep thinking I'm doing something wrong... I have syslog-ng running on a SUN Ultra 10, and it's been running for 192 days, and I have 700 minutes time and 4.5M size... Of course, I only log from 6 other boxes to it for now. :) Consider this a success story :) I have used syslog-ng to split up incoming logs per facility and priority, so that if I see a message in the crit file, I can go to the corresponding facility file and see if there were any more message. This functionality has come in very handy a few times. :) /Mick

7 23

new destination-file with group zzz
by Wolfgang Koessler 03 Nov '00

03 Nov '00

hello, I have some problems with the group of new destination-files of syslog-ng-1.3.13: my logrotate creats immediately after rotation the new log file: ~~~~~~~~~~~ /var/log/ns/f/newfile.log{ daily notifempty create 640 root zzz postrotate /usr/bin/killall -HUP syslog-ng endscript } ~~~~~~~~~~~ When syslog-ng writes in newfile.log, the group changes to "root". Can I specify in the sylog-ng.conf the group-affilation of the destination-file? Apart from this problem syslog-ng works fine! Thanks! wok ~~~ Wolfgang Kössler ZID Universität Innsbruck http://infoA.uibk.ac.at/c102/

2 1

syslog-ng dying on hup - solved
by nija＠magicaldesk.com 01 Nov '00

01 Nov '00

Hello all, I solved the the problem and I thought I would share the solution with everyone. The problem was that by logging using $program, occasionally a $program was blank. Syslog-ng would then try to write the entry to the log file. And since $program was blank, the log file was the current directory! I simply added to the filter 'goodprograms' and all was solved. Below is the full config file. Cheers, Nija # Configuration file for server side syslog-ng ################################################ #################################### # Global options used by syslog-ng #################################### options { time_reopen ( 0 ); sync ( 0 ); chain_hostnames ( no ); use_dns ( yes ); use_fqdn ( yes ); }; ########################################### # Global Source statments for the program ########################################### source src { sun-streams ( "/dev/log" door( "/etc/.syslog_door" )); internal ( ); tcp ( max-connections( 1000 ) ); udp ( ); }; filter goodprograms { not program ("[0-9][0-9]*") or not program (""); }; destination all_messages { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/all-messages" create_dirs ( yes ) dir_perm ( 755 ) perm ( 755 ) );}; destination all_messages2 { pipe ( "/var/adm/nco" );}; destination all_program { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/$PROGRAM" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_facility { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/$FACILITY" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_priority { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/$PRIORITY" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_host { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$HOST/messages" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_only_program { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/program/$PROGRAM" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_only_priority { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/priority/$PRIORITY" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_only_facility { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/facility/$FACILITY" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination all_fac_pri { file ( "/var/log/syslog-ng/$YEAR/$MONTH/$DAY/facility/$FACILITY.$PRIORITY" create_dirs ( yes ) dir_perm ( 0755 ) perm ( 0755 ) );}; destination check_all1 { file ( "/var/log/syslog-ng/all-entries/$HOST" create_dirs ( yes ) );}; destination check_all2 { file ( "/var/log/syslog-ng/all-entries/$HOST.$PROGRAM" );}; destination check_all3 { file ( "/var/log/syslog-ng/all-entries/$HOST.$FACILITY" );}; destination check_all4 { file ( "/var/log/syslog-ng/all-entries/$PROGRAM" );}; destination check_all5 { file ( "/var/log/syslog-ng/all-entries/$FACILITY" );}; log { source( src ); destination( all_messages );}; log { source( src ); destination( all_messages2 );}; log { source( src ); filter ( goodprograms ); destination( all_program );}; log { source( src ); filter ( goodprograms ); destination( all_facility );}; log { source( src ); filter ( goodprograms ); destination( all_priority );}; log { source( src ); destination( all_host );}; log { source( src ); filter ( goodprograms ); destination( all_only_program );}; log { source( src ); filter ( goodprograms ); destination( all_only_priority );}; log { source( src ); filter ( goodprograms ); destination( all_only_facility );}; log { source( src ); filter ( goodprograms ); destination( all_fac_pri );}; log { source( src ); filter ( goodprograms ); destination( check_all1 );}; log { source( src ); filter ( goodprograms ); destination( check_all2 );}; log { source( src ); filter ( goodprograms ); destination( check_all3 );}; log { source( src ); filter ( goodprograms ); destination( check_all4 );}; log { source( src ); filter ( goodprograms ); destination( check_all5 );}; _____________________________________________________________ Global Virtual Desktop Get your free Desktop at http://www.magicaldesk.com

3 2

syslog-ng dying on hup - not solved :(
by nija＠magicaldesk.com 31 Oct '00

31 Oct '00

Hello all, Syslog-ng is still dying on hup. I can not make it consistent. Here is a snipet from syslog-ng's log file. Oct 31 20:41:47 xxx-xxx-xxx-xxx syslog-ng[21918]: syslog-ng version 1.4.7 starting Oct 31 20:42:10 xxx-xxx-xxx-xxx syslog-ng[21918]: SIGHUP received, restarting syslog-ng Oct 31 20:42:24 xxx-xxx-xxx-xxx syslog-ng[21956]: syslog-ng version 1.4.7 starting Oct 31 20:42:29 xxx-xxx-xxx-xxx syslog-ng[21956]: AF_INET client connected from xxx.xxx.xxx.xxx, port 1028 Oct 31 20:43:29 xxx-xxx-xxx-xxx syslog-ng[21956]: SIGHUP received, restarting syslog-ng Oct 31 20:43:29 xxx-xxx-xxx-xxx syslog-ng[21956]: new configuration initialized Oct 31 20:43:38 xxx-xxx-xxx-xxx syslog-ng[21956]: SIGHUP received, restarting syslog-ng Oct 31 20:43:38 xxx-xxx-xxx-xxx syslog-ng[21956]: new configuration initialized Oct 31 20:45:22 xxx-xxx-xxx-xxx syslog-ng[21956]: SIGHUP received, restarting syslog-ng Oct 31 20:45:22 xxx-xxx-xxx-xxx syslog-ng[21956]: new configuration initialized You can see where I have hupped syslog-ng. the SIGHUP shows that. If it is not followed by the message saying 'new cong' initialized then it died. I have tried hupping several ways, manually with -HUP, manually with -1, with a script. About 1 out of every 3 times it dies. I can hup it 10 times in a row with no problems and sometimes it dies every other time. Any help would be greatly appreciated. I did not include my conf file because I have sent it out plenty of times. :) Thank you for the help, Nija _____________________________________________________________ Global Virtual Desktop Get your free Desktop at http://www.magicaldesk.com

1 0

RE: [syslog-ng]/var/adm/messages
by Russell Street 30 Oct '00

30 Oct '00

Sun changed the door in the 5.8 release. On 5.8 there is a symlink from /etc/.syslog_door to /var/run/syslog_door, so the old path will still work. HOWEVER: /var/run is a swap-based file system. It gets re-created from scratch when the OS boots and the door does not exist until the syslog process creates it. If you point syslog-ng at the old place it will fail to create the door in /var/run; it does not create the door at the "end" of the symlink. The syslog client library code in libc is trying to use /var/run/syslog_door and will fail to log messages. It then tends to sleep for 5 seconds after failing to open the door and dumps the messages onto the console. At least that is my experience. Russell -----Original Message----- From: Ohrberg, Mick [mailto:Mick.Ohrberg@umb.com] Sent: Thursday, 26 October 2000 9:56 a.m. To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]/var/adm/messages > I use this source on the 5.6 systems [snip] > sun-streams("/dev/log" door("/etc/.syslog_door") ); [snip] > and this one on 5.8 systems [snip] > sun-streams("/dev/log" door("/var/run/syslog_door") ); What's the difference between these two files? I use /etc/.syslog_door on my 5.8 system. /Mick _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Solaris
by kleyson.rios 27 Oct '00

27 Oct '00

My syslog-ng still continues not to order logs for the archives :( My syslog-ng.conf : options { sync(0); log_fifo_size(10); }; source src { internal(); sun-streams("/dev/log" door("/etc/.syslog_door")); }; __________________________________________________________________________ Todo brasileiro tem direito a um e-mail grátis http://www.bol.com.br

2 1

RE: [syslog-ng]Solaris+match problem
by Hamilton, Andrew Mr. 27 Oct '00

27 Oct '00

I have been busy so it took me a while to test this. Unfortunately I couldn't duplicate your problem. I'm using the same version of syslog-ng and libol that you are. Only difference is I'm running on Solaris 2.7. I will keep trying a few other things. > -----Original Message----- > From: Wendell Turner [SMTP:wt@mail.bytheedge.com] > Sent: Friday, October 27, 2000 8:43 AM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: RE: [syslog-ng]Solaris+match problem > > > Here it is, but it doesn't seem to help a lot. > > open("/export/home/wt/adsi/utils/umon/lin.conf", O_RDONLY) = 3 > brk(0x00039E98) = 0 > brk(0x0003DE98) = 0 > ioctl(3, TCGETA, 0xEFFFEB6C) Err#25 ENOTTY > fstat64(3, 0xEFFFE578) = 0 > brk(0x0003DE98) = 0 > brk(0x0003FE98) = 0 > ioctl(3, TCGETA, 0xEFFFE504) Err#25 ENOTTY > read(3, "\n s o u r c e s r c ".., 8192) = 182 > read(3, 0x0003C7A4, 8192) = 0 > Incurred fault #6, FLTBOUNDS %pc = 0xEF5FB868 > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > Received signal #11, SIGSEGV [caught] > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > sigprocmask(SIG_SETMASK, 0xEF567CE8, 0x00000000) = 0 > sigaction(SIGSEGV, 0xEFFFDE70, 0x00000000) = 0 > setcontext(0xEFFFE030) > Incurred fault #6, FLTBOUNDS %pc = 0xEF5FB868 > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > Received signal #11, SIGSEGV [default] > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > *** process killed *** > > > > Can you do a truss and post the output? That may help. > > > > > However, I'm having trouble running it on Solaris with a config > > > file with a 'match' in it. > > > > > > On my Linux machine, it starts just fine: > > > > > > #uname -a > > > Linux piedmont 2.2.16-3 #6 Sun Oct 22 19:47:27 PDT 2000 i686 > > > > > > # ./syslog-ng --debug --verbose --cfgfile=lin.conf > > > binding fd 3, inetaddr: 0.0.0.0, port: 8514 > > > io.c: Preparing fd 3 for reading > > > syslog-ng version 1.4.7 starting > > > > > > > > > However, that same config file does not run on my Solaris machine: > > > > > > > uname -a > > > SunOS catalina 5.6 Generic_105181-15 sun4u sparc SUNW,Ultra-5_10 > > > > > > > ../src/syslog-ng --debug --verbose --cfgfile=lin.conf > > > Segmentation Fault (core dumped) > > > > > > The config file is: > > > > > > source src { udp( ip("0.0.0.0") port (8514) ); internal(); }; > > > filter f_ftpd { match("ftp"); }; > > > destination cons { file("out.log"); }; > > > log { source(src); destination(cons); }; > > > > > > If I comment out the match filter, syslog-ng on the Solaris machine > > > starts ok. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Solaris+match problem
by Hamilton, Andrew Mr. 27 Oct '00

27 Oct '00

You're right not much help. I run it on Solaris 5.7 and don't have any problems let me do some testing...I will see if I can come up with something if someone else doesn't help you in the meantime... > -----Original Message----- > From: Wendell Turner [SMTP:wt@mail.bytheedge.com] > Sent: Friday, October 27, 2000 8:43 AM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: RE: [syslog-ng]Solaris+match problem > > > Here it is, but it doesn't seem to help a lot. > > open("/export/home/wt/adsi/utils/umon/lin.conf", O_RDONLY) = 3 > brk(0x00039E98) = 0 > brk(0x0003DE98) = 0 > ioctl(3, TCGETA, 0xEFFFEB6C) Err#25 ENOTTY > fstat64(3, 0xEFFFE578) = 0 > brk(0x0003DE98) = 0 > brk(0x0003FE98) = 0 > ioctl(3, TCGETA, 0xEFFFE504) Err#25 ENOTTY > read(3, "\n s o u r c e s r c ".., 8192) = 182 > read(3, 0x0003C7A4, 8192) = 0 > Incurred fault #6, FLTBOUNDS %pc = 0xEF5FB868 > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > Received signal #11, SIGSEGV [caught] > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > sigprocmask(SIG_SETMASK, 0xEF567CE8, 0x00000000) = 0 > sigaction(SIGSEGV, 0xEFFFDE70, 0x00000000) = 0 > setcontext(0xEFFFE030) > Incurred fault #6, FLTBOUNDS %pc = 0xEF5FB868 > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > Received signal #11, SIGSEGV [default] > siginfo: SIGSEGV SEGV_MAPERR addr=0x0F046850 > *** process killed *** > > > > Can you do a truss and post the output? That may help. > > > > > However, I'm having trouble running it on Solaris with a config > > > file with a 'match' in it. > > > > > > On my Linux machine, it starts just fine: > > > > > > #uname -a > > > Linux piedmont 2.2.16-3 #6 Sun Oct 22 19:47:27 PDT 2000 i686 > > > > > > # ./syslog-ng --debug --verbose --cfgfile=lin.conf > > > binding fd 3, inetaddr: 0.0.0.0, port: 8514 > > > io.c: Preparing fd 3 for reading > > > syslog-ng version 1.4.7 starting > > > > > > > > > However, that same config file does not run on my Solaris machine: > > > > > > > uname -a > > > SunOS catalina 5.6 Generic_105181-15 sun4u sparc SUNW,Ultra-5_10 > > > > > > > ../src/syslog-ng --debug --verbose --cfgfile=lin.conf > > > Segmentation Fault (core dumped) > > > > > > The config file is: > > > > > > source src { udp( ip("0.0.0.0") port (8514) ); internal(); }; > > > filter f_ftpd { match("ftp"); }; > > > destination cons { file("out.log"); }; > > > log { source(src); destination(cons); }; > > > > > > If I comment out the match filter, syslog-ng on the Solaris machine > > > starts ok. > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Solaris+match problem
by Hamilton, Andrew Mr. 27 Oct '00

27 Oct '00

Can you do a truss and post the output? That may help. > -----Original Message----- > From: Wendell Turner [SMTP:wt@mail.bytheedge.com] > Sent: Friday, October 27, 2000 7:30 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Solaris+match problem > > Sirs, > > I have just discovered syslog-ng and it seems to be just what I > was looking for. Thank you, Mr. Scheidler. > > However, I'm having trouble running it on Solaris with a config > file with a 'match' in it. > > On my Linux machine, it starts just fine: > > #uname -a > Linux piedmont 2.2.16-3 #6 Sun Oct 22 19:47:27 PDT 2000 i686 > > # ./syslog-ng --debug --verbose --cfgfile=lin.conf > binding fd 3, inetaddr: 0.0.0.0, port: 8514 > io.c: Preparing fd 3 for reading > syslog-ng version 1.4.7 starting > > > However, that same config file does not run on my Solaris machine: > > > uname -a > SunOS catalina 5.6 Generic_105181-15 sun4u sparc SUNW,Ultra-5_10 > > > ../src/syslog-ng --debug --verbose --cfgfile=lin.conf > Segmentation Fault (core dumped) > > The config file is: > > source src { udp( ip("0.0.0.0") port (8514) ); internal(); }; > filter f_ftpd { match("ftp"); }; > destination cons { file("out.log"); }; > log { source(src); destination(cons); }; > > If I comment out the match filter, syslog-ng on the Solaris machine > starts ok. > > Any suggestions or help? Is there other information I could provide > to help track down the problem? > > Thank you, > > Wendell Turner > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Solaris+match problem
by Wendell Turner 27 Oct '00

27 Oct '00

Sirs, I have just discovered syslog-ng and it seems to be just what I was looking for. Thank you, Mr. Scheidler. However, I'm having trouble running it on Solaris with a config file with a 'match' in it. On my Linux machine, it starts just fine: #uname -a Linux piedmont 2.2.16-3 #6 Sun Oct 22 19:47:27 PDT 2000 i686 # ./syslog-ng --debug --verbose --cfgfile=lin.conf binding fd 3, inetaddr: 0.0.0.0, port: 8514 io.c: Preparing fd 3 for reading syslog-ng version 1.4.7 starting However, that same config file does not run on my Solaris machine: > uname -a SunOS catalina 5.6 Generic_105181-15 sun4u sparc SUNW,Ultra-5_10 > ../src/syslog-ng --debug --verbose --cfgfile=lin.conf Segmentation Fault (core dumped) The config file is: source src { udp( ip("0.0.0.0") port (8514) ); internal(); }; filter f_ftpd { match("ftp"); }; destination cons { file("out.log"); }; log { source(src); destination(cons); }; If I comment out the match filter, syslog-ng on the Solaris machine starts ok. Any suggestions or help? Is there other information I could provide to help track down the problem? Thank you, Wendell Turner

1 0