May 2000 - syslog-ng - lists.balabit.hu

Problems with kernel logging
by Brian K. Mohr 18 May '00

18 May '00

Greetings: Sorry if this rehashes old territory--I've seen this issue addressed in the list archives. Unfortunately, I've reached an impasse. I'm currently running syslog-ng on a test system, with all logs being sent to a single file so that I can monitor what syslog-ng is (or isn't) doing. As far as I can tell, all facilities are being logged except for 'kern.*'. I'm running it on Red Hat 6.2 (intel) as a drop-in replacement for syslogd (it is started prior to klogd, version 1.3-3). As suggested in a prior posting on this topic, I've run 'strace -f' on klogd with both syslogd and syslog-ng (and ipchains logging all denied packets so there should be plenty of logging to kern.info) with the following result: ===syslogd sample=== read(0, "<6>Packet log: input DENY eth0 P"..., 4095) = 121 time([958581388]) = 958581388 write(1, "<6>May 17 12:36:28 kernel: Packe"..., 146) = 146 ===syslog-ng sample=== read(0, "<6>Packet log: input DENY eth0 P"..., 4095) = 114 connect(1, {sin_family=AF_UNIX, path="/dev/log"}, 10) = -1 EPROTOTYPE (Protocol wrong type for socket) time([958581560]) = 958581560 write(1, "<6>May 17 12:39:20 kernel: Packe"..., 139) = -1 ENOTCONN (Transport endpoint is not connected) It would appear that klogd is _trying_ to log to /dev/log, but fails when syslog-ng is running. I do see kernel messages sent from remote hosts (still running syslogd) in the destination file, just not for the local host. source local { unix-stream("/dev/log"); internal(); }; # no kern.* source net { udp(ip(0.0.0.0) port(514)); }; # kern facility OK Any suggestions? Thanks in advance! --Brian -- Brian Mohr email: bkmohr(a)princeton.edu Systems Administrator phone: (609) 258-2618 Atmospheric and Oceanic Sciences fax: (609) 258-2850 Princeton University

3 4

Re: syslog-ng on BSDI 2.1
by Balazs Scheidler 17 May '00

17 May '00

> For assorted reasons we're using a BSDI 2.1 system and I would like to > install syslog-ng on it. I have got 1.4.3 working with the exception of > kernel logging. It turns out that there is also a special device "/dev/klog" > which you can read the kernel syslog messages from, but when I add it with > a file("/dev/klog") in a source statement, the messages are not flagged > as LOG_KERN but instead defaulting to LOG_USER. > > I presume it's because bsdi 2.1 doesn't put <nnn> at the front of these > messages. The behaviour of /dev/klog does not appear to be documented, > and I don't have source around. My guess is that it's encoding the pri > in some other way. Any ideas? You could use another source for kernel messages: source s_kernel { file("/dev/klog"); }; destination d_kernel { file("/var/log/kern.log"); }; log { source(s_kernel); destination(d_kernel); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 3

syslog protocol
by John 12 May '00

12 May '00

Hi, The way I went about finding a bit more information out was to write a small perl program that listened on port 514 and printed out anything that was forwarded to it. Basically, I believe the format is something like: <number>then the message here blah blah.... Looks like syslog uses the number to work out what the log message is. Below is a small list of a few: 38 auth.info 32 auth.none 34 auth.crit 33 auth.alert 39 auth.debug 37 auth.notice 35 auth.err 32 auth.emerg 36 auth.warn 32 auth.panic 35 auth.error 78 cron.info 72 cron.none So, write a perl script to send the information to the log server. Mail me if you want the full list of numbers. I probably have a perl script lying around some where too. Cheers, John

3 3

RE: [syslog-ng] syslog-ng on AIX 4.x
by John A. Parker 09 May '00

09 May '00

Mick, I'm not sure what doesn't work for you. I haven't actually tried "kill -HUP ...", but I use "kill -1 ..." (equivalent to HUP) all the time and the syslog-ng daemon refreshes as I would have expected. John At 02:02 PM 05/08/2000 -0500, you wrote: >Another thing that threw me off was the fact that >a kill -HUP didn't seem to do what it's supposed to... --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

1 0

RE: [syslog-ng] performance
by Hamilton, Andrew Mr. 09 May '00

09 May '00

I get at least 2 gigs per day and have no obvious performance problems. I also use that same machine to run one of our network monitoring tools and have seen no performance problems associated with either one. It is a Sun Ultra 30. Drew > -----Original Message----- > From: Balazs Scheidler [SMTP:bazsi@balabit.hu] > Sent: Monday, May 08, 2000 2:37 PM > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re: [syslog-ng] performance > > > How syslog-ng deals with high-volume logging? The old syslogd is > very bad > > in this respect; if you feed it with lots of logs, the system slows down > > horribly. > > So, how does syslog-ng behaves in such cases? > > I don't have exact numbers, and I know a couple of places where CPU usage > could be improved in syslog-ng. Nevertheless syslog-ng is used at least at > one site where there's more than 2gigs of logs a day. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng] syslog-ng on AIX 4.x
by Ohrberg, Mick 08 May '00

08 May '00

John, Since I posted this message, I got it running as well. I was just being silly, I guess. Of course the 'door' doesn't work on AIX, and neither did socket, but dgram did it. Another thing that threw me off was the fact that a kill -HUP didn't seem to do what it's supposed to... Thanks! -----Original Message----- From: John A. Parker [mailto:jap54@cornell.edu] Sent: Monday, May 08, 2000 10:58 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng on AIX 4.x Mick, I have syslog-ng running on AIX 4.3.3 and it seems to be working fine. John >Dear syslog-ng users, > >Is there anyone out there who has successfully installed and used syslog-ng >on an AIX machine? I use it in Solaris 2.6, and it works great! As a >Solaris-user, I really don't know where to look for the syslog-equivalent in >AIX. Syslog-ng compiles great under AIX, but using the logger doesn't give >me the expected result... > >Anyone? > >Thanks in advance! > >-- >Mick Öhrberg >EMTS System Administrator, UMB >(816)860-1064 --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

1 0

performance
by Florin Andrei 08 May '00

08 May '00

How syslog-ng deals with high-volume logging? The old syslogd is very bad in this respect; if you feed it with lots of logs, the system slows down horribly. So, how does syslog-ng behaves in such cases? -- Florin Andrei mailto:florin@linuxstart.com http://members.linuxstart.com/~florin/ tel: +40-93-261162

5 6

Unaligned trap errors on Alpha-Linux
by Ger 08 May '00

08 May '00

Hi, I'm seeing a high number of unaligned trap errors on Redhat 6.2 on an Alpha. Kernel is 2.2.14-6.0, and I'm running syslog-ng-1.4.3 with libol-0.2.16. The errors look like the following: May 8 13:02:35 zathras syslog-ng(972): unaligned trap at 000000012000fed0: 0000 00012012bb1c 29 10 May 8 13:02:35 zathras syslog-ng(972): unaligned trap at 000000012000fe80: 0000 00012012bb34 29 1 Anyone got any ideas? Thanks, Ger.

1 0

syslog-ng on AIX 4.x
by John A. Parker 08 May '00

08 May '00

Mick, I have syslog-ng running on AIX 4.3.3 and it seems to be working fine. John >Dear syslog-ng users, > >Is there anyone out there who has successfully installed and used syslog-ng >on an AIX machine? I use it in Solaris 2.6, and it works great! As a >Solaris-user, I really don't know where to look for the syslog-equivalent in >AIX. Syslog-ng compiles great under AIX, but using the logger doesn't give >me the expected result... > >Anyone? > >Thanks in advance! > >-- >Mick Öhrberg >EMTS System Administrator, UMB >(816)860-1064 --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

2 1

mysql patch
by Florin Andrei 08 May '00

08 May '00

I remember that someone said that there is a mysql patch for syslog-ng. Anyone knows its status? -- Florin Andrei mailto:florin@linuxstart.com http://members.linuxstart.com/~florin/ tel: +40-93-261162

2 2