March 2000 - syslog-ng - lists.balabit.hu

no kernel messages
by Martin Krejcirik 09 Mar '00

09 Mar '00

I'm new to syslog-ng, maybe this question was asked before, but I do not get logged any messages from kernel (packet logger for example). Tried both 1.2.4 and 1.4.0. For some reason logger -p kern.info works. Klogd is running. If I stop it, kernel logs to console. config file: # Global Options options { sync(0); }; # Source dirvers source src_int { internal(); }; source src { unix-stream("/dev/log"); }; # log everything to a console tty destination d_tty { file("/dev/tty12"); }; log { source("src"); source("src_int"); destination("d_tty"); }; _____________________________ Martin Krejcirik <mk(a)krej.cz>

2 1

RE: syslog-ng digest, Vol 1 (Cu)166 - 5 msgs
by Nick Hindley 09 Mar '00

09 Mar '00

This message has been automatically generated. I am out of the office from 6 March 2000 for approximately two weeks. To contact me before my return, please resend your message to nick.hindley(a)ukgateway.net

1 0

RE: [syslog-ng] syslog-ng & forwarding
by Hamilton, Andrew Mr. 08 Mar '00

08 Mar '00

> > I am using syslog-ng 1.4.0rc3 at this time (I do have 1.4.0 but haven't > > implemented it yet), on Solaris 7 from a Sun SPARC machine. I am trying > to > > forward my logs from one machine through another and log them on a third > > machine. There is a reason I do this and it is necessary that I do it > this > > way. However, my question is this: > > I assume your logs are transferred to a loghost behind a chain of > firewalls. [Hamilton, Andrew] Yes they are. > > > How do I keep it from putting the middle machine's hostname on it? > > > > I assumed that chain_hostnames(no) option would do it but it doesn't > work > > the way I would have expected. When I used chain_hostnames(no) I got > > something like: > > > > "Mar 8 08:35:41 mhost host hamilton: Testing..." > > Why is there 3 names? there should be only "mhost hamilton: testing..." [Hamilton, Andrew] The final destination is using regular syslogd which it won't when I am done testing. > > > > > When I used chain_hostnames(yes) I got something like: > > > > "Mar 8 08:38:17 mhost host/host hamilton: Testing..." > > > > Any ideas? Or is this just not possible? > > Are all your hosts using syslog-ng, or some of them use the native > syslogd? [Hamilton, Andrew] Yes the last one is using syslogd until I get done testing. They will all use syslog-ng when I am done. > > The proper behaviour is: > > 1) chain_hostnames(off) > the hostname the message was received from is put in the hostname part > of > the message (if it contained one it is replaced) so on your inner > loghost > you'll find the name of your last hop. > 2) chain_hostnames(on) > hostnames are chained, which means that on each hop the hostname the > message was received from is appended to the chain. The first hostname > is > the originator. So a hostname like this: > bzorp/bzorp/balabit > > [Hamilton, Andrew] That is the behavior I expected but didn't quite get. It just didn't dawn on me that the syslogd would add another hostname. > means, that the message was generated on bzorp, was received from bzorp > to > balabit, and it was received from balabit at its final destination. > > A keep_hostname() option would be a useful addition, but it's not > implemented yet. > [Hamilton, Andrew] That would be useful and thanks for the prompt response. Drew

1 0

syslog-ng & forwarding
by Hamilton, Andrew Mr. 08 Mar '00

08 Mar '00

I am using syslog-ng 1.4.0rc3 at this time (I do have 1.4.0 but haven't implemented it yet), on Solaris 7 from a Sun SPARC machine. I am trying to forward my logs from one machine through another and log them on a third machine. There is a reason I do this and it is necessary that I do it this way. However, my question is this: How do I keep it from putting the middle machine's hostname on it? I assumed that chain_hostnames(no) option would do it but it doesn't work the way I would have expected. When I used chain_hostnames(no) I got something like: "Mar 8 08:35:41 mhost host hamilton: Testing..." When I used chain_hostnames(yes) I got something like: "Mar 8 08:38:17 mhost host/host hamilton: Testing..." Any ideas? Or is this just not possible? Andrew Hamilton mailto:hamiltona@hq.5sigcmd.army.mil

2 1

RE: syslog-ng digest, Vol 1 (Cu)165 - 9 msgs
by Nick Hindley 08 Mar '00

08 Mar '00

This message has been automatically generated. I am out of the office from 6 March 2000 for approximately two weeks. To contact me before my return, please resend your message to nick.hindley(a)ukgateway.net

1 0

Can I use destinate to all user?
by Tomohiro Yamauchi 07 Mar '00

07 Mar '00

Hi, I am running syslog-ng 1.4.0rc3 on Solaris7 (SPARC). Solaris's syslog can use '*' action. e.g. kern.emerg * This means "Kernel emergency messages are forwarded to all logged-in users." I want to use the same action. Please tell me how to do it. -- Tomohiro Yamauchi handy(a)nid.co.jp

3 4

Re: [syslog-ng] syslog-ng dropping log messages forwarded w/TCP
by Jeffrey W. Baker 07 Mar '00

07 Mar '00

You wrote: >Probably the speed of your network is less than required. How fast are >you >sending those messages? syslog-ng can do with quite high loads (2G logs >a >day), but it still cannot widen your network bandwidth. Note that log >connections in syslog-ng (e.g. a log statement) is not flowcontrolled. >This >means that messages are continously read even if they have not yet been >flushed to the destination. The reason behind this is to prevent >syslog-ng >to become the bottleneck. > I don't think we have been quite clear on the nature of the problem. We are sending messages at a very high rate over a named pipe to the local syslog-ng, and these messages are being forwarded via tcp to a remote machine, and also are logged in a local file. Our network is switched 100 Mbps, and the machines at each end are 450 MHz and 600 MHz Intel Pentium III with 3Com 3c905B NICs. It seems unlikely that our network is the problem. The exact sequence of events is that our program is started which makes 100000 log entries in a tight loop. After the program exits, the local log file has all 100000 entries, but the remote log file has only about 25000 entries. No amount of waiting increases the number of entries in the remote log. The entries in the remote log are not sequentially numbered. For example, they skip from 95432 to 96109. The intervening log entries are simply dropped. This is why we believe the problem is in syslog-ng. At any rate it is possible that James has found the problem. Apparently the return value of write is not being corretly interpreted when zero bytes were written. Perhaps James will have a patch soonish. Regards and thanks for your software, Jeffrey Baker >I may add an option to log statements to stop reading from the source if >the >destination fifo is full. This is however not trivial, since several >sources >can log to the same destination. I plan something like this: > >log { source(src); options(flow_control(yes)); destination(dst); };

3 2

RE: syslog-ng digest, Vol 1 (Cu)164 - 4 msgs
by Nick Hindley 07 Mar '00

07 Mar '00

This message has been automatically generated. I am out of the office from 6 March 2000 for approximately two weeks. To contact me before my return, please resend your message to nick.hindley(a)ukgateway.net

1 0

missing syslog-ng.conf
by Sebastian Sanchez 06 Mar '00

06 Mar '00

Hi list: I' ve just compiled syslog-ng in a Linux box running RedHat 6.0. Everything worked fine, except for one thing: there is no /etc/syslog-ng directory and no syslog-ng.conf file. Where can I find a sample configuration file ? Thank you very much. Sebastian Sanchez Security Operator se_sanchez(a)crm.com.ar

4 3

pipe cleanup
by Balazs Scheidler 04 Mar '00

04 Mar '00

Hi, I've began working on 1.5.0 and cleaned up pipe support. Thanks for the idea about O_RDWR pipes for "Klaus Groenhoej" <kgr(a)kmd.dk>. No need to check for spuriously closed pipes now. I've backported the patch to 1.4.0 and is available attached to this mail. This adds no additional functionality, and 1.4.0 should be o.k. as well, so I don't release 1.4.1 immediately, rather I wait for feedback on 1.4.0. Index: affile.c =================================================================== RCS file: /home/bazsi/cvs/syslog-ng/src/affile.c,v retrieving revision 1.30 diff -u -r1.30 affile.c --- affile.c 2000/03/03 14:43:20 1.30 +++ affile.c 2000/03/04 19:56:34 @@ -179,7 +179,6 @@ (vars (owner object affile_dest) (dest object io_fd) - (dest_buf object abstract_buffer) (reap simple "struct callout *") (expanded_fname string) (prev object affile_dest_writer) @@ -190,42 +189,30 @@ do_init_dest_writer(struct log_handler *c, struct syslog_config *cfg, struct persistent_config *persistent) { CAST(affile_dest_writer, self, c); - int fd; + int fd, flags; - if (self->dest) - self->dest->buffer = NULL; - if (!self->dest_buf) - self->dest_buf = make_pkt_buffer_ext(self->owner->sync_freq, - MAX(self->owner->super.log_fifo_size + 1, - self->owner->sync_freq)); - self->dest = NULL; - if (do_open_file(self->expanded_fname, O_WRONLY | O_CREAT | O_APPEND | O_NOCTTY | O_NONBLOCK, self->owner->perm, self->owner->flags & AFFILE_CREATE_DIRS, self->owner->dir_perm, &fd)) { - struct resource_node *res; + if (self->owner->flags & AFFILE_PIPE) + flags = O_RDWR | O_NOCTTY | O_NONBLOCK; + else + flags = O_WRONLY | O_CREAT | O_APPEND |O_NOCTTY | O_NONBLOCK; + if (do_open_file(self->expanded_fname, flags, self->owner->perm, self->owner->flags & AFFILE_CREATE_DIRS, self->owner->dir_perm, &fd)) { chown(self->expanded_fname->data, self->owner->uid, self->owner->gid); - self->dest = io_write(make_io_fd(cfg->backend, fd), - self->dest_buf, - NULL); - res = REMEMBER_RESOURCE(cfg->resources, &self->dest->super.super); - self->dest->super.close_callback = - make_driver_reinit_on_close(c, res, cfg->time_reopen, cfg); + self->dest = + io_write(make_io_fd(cfg->backend, fd), + make_pkt_buffer_ext(self->owner->sync_freq, + MAX(self->owner->super.log_fifo_size + 1, + self->owner->sync_freq)), + NULL); + REMEMBER_RESOURCE(cfg->resources, &self->dest->super.super); if ((self->owner->flags & AFFILE_NO_EXPAND) == 0) self->reap = io_callout(cfg->backend, TIME_REAP_DEST, make_affile_dest_reaper(self)); /* self->attempts = 0; */ } else { - if (errno == ENXIO) { - /* opening the write side of the fifo failed */ - /* self->attempts++; */ - io_callout(cfg->backend, cfg->time_reopen, make_driver_reinit(c, cfg)); - if ((self->owner->flags & AFFILE_NO_EXPAND) == 0) - self->reap = io_callout(cfg->backend, TIME_REAP_DEST, make_affile_dest_reaper(self)); - } - else { - werror("Cannot open file %S for writing (%z)\n", self->expanded_fname, strerror(errno)); - return ST_FAIL | ST_QUIT; - } + werror("Cannot open file %S for writing (%z)\n", self->expanded_fname, strerror(errno)); + return ST_FAIL | ST_QUIT; } return ST_OK | ST_GOON; @@ -235,8 +222,8 @@ { CAST(affile_dest_writer, self, c); - if (self->dest_buf) { - A_WRITE_STRING(&self->dest_buf->super, c_format("%S %S %S\n", msg->date, msg->host, msg->msg)); + if (self->dest) { + A_WRITE_STRING(&self->dest->buffer->super, c_format("%S %S %S\n", msg->date, msg->host, msg->msg)); if (self->reap) io_callout_set_timeout(self->reap, TIME_REAP_DEST); } -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0