June 2000 - syslog-ng - lists.balabit.hu

new destination-file with group zzz
by Wolfgang Koessler 03 Nov '00

03 Nov '00

hello, I have some problems with the group of new destination-files of syslog-ng-1.3.13: my logrotate creats immediately after rotation the new log file: ~~~~~~~~~~~ /var/log/ns/f/newfile.log{ daily notifempty create 640 root zzz postrotate /usr/bin/killall -HUP syslog-ng endscript } ~~~~~~~~~~~ When syslog-ng writes in newfile.log, the group changes to "root". Can I specify in the sylog-ng.conf the group-affilation of the destination-file? Apart from this problem syslog-ng works fine! Thanks! wok ~~~ Wolfgang Kössler ZID Universität Innsbruck http://infoA.uibk.ac.at/c102/

2 1

Re: syslog-ng memory leak patch
by Balazs Scheidler 07 Jul '00

07 Jul '00

On Mon, Jun 26, 2000 at 08:42:34AM -0400, Scott McDermott wrote: > I noticed your post on the syslog-ng archives concerning memory leaks in > the software. I was wondering if you had met any success reports with > this patch. I just discovered my DMZ loghost has a 70MB syslog-ng image > in core after running only a couple of weeks; there is most *definitely* > a memory leak. I was going to track it down myself, but thought I would > check the list archives first...indeed, your patch was posted. > > Before I implement the patch, I was wondering if you've had success > running some syslog-ngs for more than a week, with at least half a dozen > hosts logging to it, and kept the memory image within reasonable limits, > with this patch. If it's not a complete leak preventer, I'd just as > soon do a full audit of the source, since I simply must use syslog-ng in > production. Either that, or we could split the work or something... That patch fixed some leak bugs, but as it seems not all of them. I'm now trying to reproduce the problem. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

RPM spec file?
by Chris Geddings 29 Jun '00

29 Jun '00

Would anyone have any spec files to build an rpm for syslog-ng? Thanks, Chris

2 1

RE: [syslog-ng] RPM spec file?
by Ohrberg, Mick 29 Jun '00

29 Jun '00

...and has anyone thought about building a Solaris pkg? :) : -----Original Message----- : From: Chris Geddings [mailto:cegeddin@colltech.com] : Sent: Thursday, June 29, 2000 9:53 AM : To: syslog-ng(a)lists.balabit.hu : Subject: [syslog-ng] RPM spec file? : : : Would anyone have any spec files to build an rpm for syslog-ng? : : Thanks, : Chris : : _______________________________________________ : syslog-ng maillist - syslog-ng(a)lists.balabit.hu : http://lists.balabit.hu/mailman/listinfo/syslog-ng :

1 0

logging via tcp connection
by will＠korson-mcgregor.com 29 Jun '00

29 Jun '00

I'm trying to set up a Linux Firewall to log to a central log box. Both are running syslog-ng 1.4.4 on Debian 2.2. -----------snip from logbox syslog-ng.conf-------- source firewall { tcp(ip(0.0.0.0) port(1999)); }; -----------end snip from logbox syslog-ng.conf---- syslog-ng starts just fine with no errors. # netstat -an |grep 1999 tcp 0 0 0.0.0.0:1999 0.0.0.0:* LISTEN Seems to be up and running fine. -----------snip from firewall syslog-ng.conf--------- destination logbox { tcp("10.0.0.87" port(1999)); }; -----------snip from firewall syslog-ng.conf--------- # syslog-ng -d -v binding fd 3, unixaddr: /dev/log io.c: listening on fd 3 io.c: connecting using fd 4 connecting fd 4 to inetaddr 10.0.0.87, port 1999 Error creating AF_INET socket (Operation now in progress) Error initializing configuration, exiting. Thats not good # strace -s 64 -f -F -vv syslog-ng -d -v --snip---- socket(PF_INET, SOCK_STREAM, IPPROTO_TCP) = 4 fcntl(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 fcntl(4, F_SETFD, FD_CLOEXEC) = 0 write(2, "io.c: connecting using fd 4\n", 28io.c: connecting using fd 4) = 28 write(2, "connecting fd 4 to inetaddr 10.0.0.87, port 1999\n", 49connecting fd 4 to inetaddr 10.0.0.87, port 1999) = 49 connect(4, {sin_family=AF_INET, sin_port=htons(1999), sin_addr=inet_addr("10.0.0.87")}}, 16) = -1 EINPROGRESS (Operation now in progress) close(4) = 0 write(2, "Error creating AF_INET socket (Operation now in progress)\n", 58Error creating AF_INET socket (Operation now in progress)) = 58 write(2, "Error initializing configuration, exiting.\n", 43Error initializing configuration, exiting.) = 43 _exit(2) = ? Even worse.. it seems that the connection is not even given time to connect successfully but is closed immediatly. I'm not a good socket hacker or I'd try to fix it myself. Is it possible that I have some config value wrong or am using a known buggy version? Help would be most appreciated! Will Cordis

3 2

massive memory leak
by Scott McDermott 28 Jun '00

28 Jun '00

I was wondering if anyone else has had the experience of checking out processes on their DMZ log forwarder after a couple of weeks of running syslog-ng (~5 machines logging to it, one file destination, one TCP remote), only to find its VSZ to be approaching 80MB :) Obviously some kind of significant memory leak. According to the list archives, another poster put up a patch but he has not responded to my inquiries; I'm wondering if anyone else has patches or has used the patch posted not too long ago...or at least, perhaps someone could confirm that they also must restart the syslog-ng process daily to combat memory leakage.

3 5

junk with syslog-ng 1.4.4 on HP-UX 10.20
by Massimo Loschi 28 Jun '00

28 Jun '00

Hi! I'm using syslog-ng 1.4.4 on HP-UX 10.20 host, with a file as destination, and source log device source slocal { pipe("/dev/log"); internal(); }; (I haven't the /dev/log.un UNIX domain socket, and I don't know how create it!) It appears that the kernel send to /dev/log additional binary data with each real log messages: for example: head junk.log | od -c 0000000 J u n 2 7 1 3 : 0 5 : 0 5 0000020 s e b b e n e { \n J u n 2 7 0000040 1 3 : 0 5 : 0 5 s e b b e n 0000060 e 270 \n J u n 2 7 1 3 : 0 5 0000100 : 0 5 s e b b e n e { \n J u 0000120 n 2 7 1 3 : 0 5 : 0 5 s e 0000140 b b e n e 270 \n J u n 2 7 1 0000160 3 : 0 5 : 0 5 s e b b e n e 0000200 300 \t 367 [ 300 \t 240 203 \n J u n 2 7 0000220 1 3 : 0 5 : 0 5 s e b b e n e 0000240 { 001 P ( { 003 267 350 \n J u n 2 7 0000260 1 3 : 0 5 : 0 5 s e b b e n 0000300 e 001 { 003 265 330 300 005 f , @ \n J u n 0000320 2 7 1 3 : 0 5 : 0 5 s e b 0000340 b e n e 4 250 \n J u n 2 7 1 0000360 3 : 0 5 : 0 5 s e b b e n e 0000400 { \n J u n 2 7 1 3 : 0 5 : 0 0000420 5 s e b b e n e 270 \n I read in the list that there is already a workaround support for a very similar problem on HP-UX, but it appears not to works for my problem. Does someone encountered and resolved this problem?!? Thanks in advance! Massimmo ------------------------------------------------------------------------------ Massimo Loschi E-mail: m.loschi(a)nextra.it Network & Core Systems NEXTRA S.p.A. WWW: http://www.nextra.it Via Isonzo, 55/2 Tel: +39 51 6139211 40033 Casalecchio di Reno Fax: +39 51 6114455 Bologna - ITALY ------------------------------------------------------------------------------

1 0

RE: [syslog-ng] Program Directive (EOF?)
by Ohrberg, Mick 28 Jun '00

28 Jun '00

Ithas been addressed earlier. What you need to do is write a 'wrapper' script that reads from stdin and appends its own EOF. That way you will get the Ctrl-D that syslog doesn't give you. : -----Original Message----- : From: Don Armstrong [mailto:don@donarmstrong.com] : Sent: Sunday, June 25, 2000 5:02 PM : To: syslog-ng(a)lists.balabit.hu : Subject: [syslog-ng] Program Directive (EOF?) : : : Is there any way that we could add a feature to the program directive : to have it send an EOF after a specified number of messages? Or : something similar? : : I'm trying to set up qpage to page me when certain messages are : logged, but because there is no EOF sent (I think that's correct) the : qpage just sits there waiting for the message to end. [Same thing : with sendmail]. : : I guess I could just bite the bullet an write an go-between parser to : do it, but it seems that this sort of functionality would be good for : syslog-ng to have. : : Don Armstrong : : [I apologize if this has been addressed earlier... non-searchable : archives are difficult to glean answers from ;-)] : : -------------------------------------------------------------- : Don Armstrong | ".naidnE elttiL etaH I" : UC Riverside | : don(a)donarmstrong.com | http://www.donarmstrong.com : -------------------------------------------------------------- : do "finger -l don(a)pellam.ucr.edu" for pgp key : Unsigned, Unencrypted e-mails will not be trusted. : Get PGP: http://www.pgp.com : -------------------------------------------------------------- : : : _______________________________________________ : syslog-ng maillist - syslog-ng(a)lists.balabit.hu : http://lists.balabit.hu/mailman/listinfo/syslog-ng :

2 1

Program Directive (EOF?)
by Don Armstrong 25 Jun '00

25 Jun '00

Is there any way that we could add a feature to the program directive to have it send an EOF after a specified number of messages? Or something similar? I'm trying to set up qpage to page me when certain messages are logged, but because there is no EOF sent (I think that's correct) the qpage just sits there waiting for the message to end. [Same thing with sendmail]. I guess I could just bite the bullet an write an go-between parser to do it, but it seems that this sort of functionality would be good for syslog-ng to have. Don Armstrong [I apologize if this has been addressed earlier... non-searchable archives are difficult to glean answers from ;-)] -------------------------------------------------------------- Don Armstrong | ".naidnE elttiL etaH I" UC Riverside | don(a)donarmstrong.com | http://www.donarmstrong.com -------------------------------------------------------------- do "finger -l don(a)pellam.ucr.edu" for pgp key Unsigned, Unencrypted e-mails will not be trusted. Get PGP: http://www.pgp.com --------------------------------------------------------------

1 0

Syslog NG version 1.42 not allowing remote hosts to log
by Thomas Munn 20 Jun '00

20 Jun '00

All: I have configured and installed syslog-ng version 1.42. It is logging fine for localhost, but it doesn't accept remote connections. I am attaching my syslog-ng.conf. Basically a re-write of the sample config file, with a couple of host entries. I can use normal syslog to log to the host. (E.G. the packets are arriving on port 514, udp). # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; source net { udp(ip(0.0.0.0) port(514)); }; # kern facility OK destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; destination host1 { file ("/var/log/ns2"); }; #destination loghost { udp("loghost" port(999)); }; destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_host1 { host("192.22.2.250"); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source (src); filter (f_host1); destination (host1); }; log { source(src); destination(console_all); };

1 0