May 2000 - syslog-ng - lists.balabit.hu

syslog protocol
by Florin Andrei 08 May '00

08 May '00

Suppose i want to write some apps wich can log over net to a syslog server. Not to the local syslog daemon, but directly to the remote daemon. Where can i find some docs on the syslog protocol? -- Florin Andrei mailto:florin@linuxstart.com http://members.linuxstart.com/~florin/ tel: +40-93-261162

1 0

Re: [syslog-ng] performance
by Balazs Scheidler 08 May '00

08 May '00

> How syslog-ng deals with high-volume logging? The old syslogd is very bad > in this respect; if you feed it with lots of logs, the system slows down > horribly. > So, how does syslog-ng behaves in such cases? I don't have exact numbers, and I know a couple of places where CPU usage could be improved in syslog-ng. Nevertheless syslog-ng is used at least at one site where there's more than 2gigs of logs a day. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

List of supported macros?
by ger 05 May '00

05 May '00

Hi, are the macros listed in affile.c the only ones that will be supported, or will support be introduced for others, such as $HOUR, $MIN, etc, for better granularity in creating directory structures? Thanks, Ger.

1 0

CISCO
by Ilya Krel 05 May '00

05 May '00

can syslog-ng accept logs from cisco routers?

3 2

RE: [syslog-ng] Syslog-ng Dies - core dump
by Ohrberg, Mick 02 May '00

02 May '00

I have heard that 105181-20 might not be the ultimate patch. One thing to try is to rollback -20 and apply -19. I've heard from sources within SUN that -20 is known to have a few bugs. The nature of these bugs - I don't know. Just my $.02 /Mick Well.. It was a good shot.. but. I updated the system to the latest recommended patch set. Now I have 105181-20 as well as 105181-15. Still getting nice core dump. :-( Un L'Unique wrote: John Wingenbach wrote: > > I just installed and configured syslog-ng 1.4.3 on a Solaris 2.6 system. It cores out on startup. It apparently doesn't like part of my configuration. Debug output is: > > #> /opt/syslog-ng/sbin/syslog-ng -d -v > binding fd 5, inetaddr: 0.0.0.0, port: 514 > io.c: Preparing fd 5 for reading > syslog-ng version 1.4.3 starting > Segmentation Fault(coredump) > > My configuration is (Note below the comments regarding code which if removed allows it to live): Your patch kernel may be too low, I remember some similar probleme when starting syslog-ng for the first time. Pre 105181-15 core dump and 15-17 make system crash. I have no probleme since -19. S.R. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng <http://lists.balabit.hu/mailman/listinfo/syslog-ng> -- John C. Wingenbach Pliant Systems, Inc. Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

1 0

Pre-processing ability?
by Dotson, Mike G 02 May '00

02 May '00

Hey, I'm fairly new to syslog-ng (got it today as a matter of fact). The config file is very easy to configure and get going (hat's off to you guys) even with sparse documentation (up and running in under 2 hours including compile time). I do, however, need to know if there is any pre-processing ability with m4 or cpp, etc. I plan on rolling syslog-ng to our enterprise and would like one syslog-ng.conf file on all our hosts. In order to do this I need to parse off the platform type to set the source since we're primarily a sun shop but do have other platforms we support (sco, hp, linux and sun). Is there any way of doing this with builtin functionality? I also forsee the need to have some sort of pre-processing based on whether it's a loghost, etc. Any plans on adding this or is it already there and I have to dig deeper into the documentation, etc. Thanks... Mike Dotson System Analyst Email: dotson.mike(a)emeryworld.com

2 1