June 2000 - syslog-ng - lists.balabit.hu

Broadcast message on syslog-ng HUP
by Lee Melvin 17 Jun '00

17 Jun '00

I've got syslog-ng 1.4.3 running on a Solaris 2.6 host. When I modify the syslog-ng.conf file and HUP the server, I get an (apparent) empty wall from root: Broadcast message from root (???) on syslog Tue Jun 13 17:00:16... Is this a feature or a bug? Is there any way to mask it? I've tried disabling all lines in the syslog-ng.conf file which output to users or ttys to no avail. Thanks! - Lee

2 1

RE: [syslog-ng] Destination systax fail ??
by Hamilton, Andrew Mr. 16 Jun '00

16 Jun '00

Yes, there is a problem the line should read destination remotenet { udp("10.0.0.10" port(514)); }; The port statement goes inside the parentheses since it is a function of udp for a destination. sources are a little different. Hope this helps. Drew > -----Original Message----- > From: Leonardo Marques de Souza [SMTP:leo@conectiva.com.br] > Sent: Wednesday, June 14, 2000 10:19 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Destination systax fail ?? > > > Helo, > > I would like to know what's happen with syslog-ng.conf systax in this > part of confiruration: > > # --------8<------------- > > # Leitura da porta UDP do syslog padrao (514) > # > # Por padrao, ele nao esta ligado na instalacao > # Para inicia-lo, basta descomentar a linha abaixo > > source net { udp(ip("10.0.2.4") port(514)); }; > > # --------------------------- > # Destino dos dados Filtrados > # --------------------------- > > destination remotenet {udp(ip("10.0.0.10") port(514)); }; <-------(this > part have errors ????) > destination console { pipe("/dev/console"); }; > destination messages { file("/var/log/messages"); }; > destination secure { file("/var/log/secure"); }; > destination maillog { file("/var/log/maillog"); }; > destination spooler { file("/var/log/spooler"); }; > destination boot { file("/var/log/boot.log"); }; > > # -------8<------------------ > > [root@patolino syslog-ng-1.4.4]# /usr/sbin/syslog-ng -d -v -f > /etc/syslog-ng/syslog-ng.conf > parse error at 33 > Parse error reading configuration file, exiting. > [root@patolino syslog-ng-1.4.4]# > > (line 33 refers to destination remotenet ...) > > i tryed this syntaxes: > **** > destination remotenet { udp(ip("10.0.0.10") port(514)); }; > destination remotenet { udp(ip(10.0.0.10) port(514)); }; > destination remotenet { udp(ip("10.0.0.10") port(514);); }; > destination remotenet { udp(ip("10.0.0.10"); port(514)); }; > destination remotenet { udp(ip("10.0.0.10"); port(514);); }; > destination remotenet { udp(ip("10.0.0.10")); }; > destination remotenet { tcp(ip("10.0.0.10") port(514)); }; > destination remotenet { udp(ip(10.0.0.10) port(514);); }; > destination rtteste { udp(ip("10.0.0.10") port(514)); }; > destination remote_net { udp(ip("10.0.0.10") port(514) ); }; > ** > > no sucess.. :( > > egcs-1.1.2 > glibc 2.1.3~ 2.1.2 > libol-0.2.17 > syslog-ng-1.4.4 > kernel-2.2.16 > > > Any one can help me?? > who can i increase de Debug?? What i can do to fix that (in source font)? > thanks.. > > PS.: > > This program have any restriction?? Its realy 100% GPL?? > We are thinking to put this program in our distribution here, in Brazil. > I built a RPM package, but i trying to a log of tests in our servers (430 > servers)... > syslog fails to do that :(( > lose data, do not restart veri well, use a lot os CPU... :(( > > i trying syslog-ng to eliminate (or decrese) this problems.. > > Thank's in advanced!! > > > Leonardo Marques de Souza > +--------------------------+ > | Conectiva S/A | > |Curitiba - Parana - Brazil| > | Suporte Interno | > +--------------------------+ > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

subscription detail
by rajesh 16 Jun '00

16 Jun '00

1 0

RE: [syslog-ng] Still Having Troubles..
by Mike Novak 08 Jun '00

08 Jun '00

no syslogd is not running on the client -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, June 08, 2000 11:23 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Still Having Troubles.. > i am running syslog-ng on a central log host or try'en to > i am having problums with the client's conf file.. > > <~~~ Client's Conf file ~~~~~> > > source src { unix-dgram("/var/run/log"); udp(); internal(); }; > > destination loghost { tcp("loghost" ip("10.151.94.24") port(1000)); }; > > log { source(src); destination(loghost); }; > > <~~~~~~~~~~~~~~~~~~> > > with this conf, the machine still logs messages in to > /var/log/messages and /var/log/security > > why? > > Any Direction would be dope! isn't the native syslogd running in addition to syslog-ng? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Still Having Troubles..
by Mike Novak 08 Jun '00

08 Jun '00

hey, i am running syslog-ng on a central log host or try'en to i am having problums with the client's conf file.. <~~~ Client's Conf file ~~~~~> source src { unix-dgram("/var/run/log"); udp(); internal(); }; destination loghost { tcp("loghost" ip("10.151.94.24") port(1000)); }; log { source(src); destination(loghost); }; <~~~~~~~~~~~~~~~~~~> with this conf, the machine still logs messages in to /var/log/messages and /var/log/security why? Any Direction would be dope! Novak

2 1

Problems with TCP connection
by Andriy Anokhin 08 Jun '00

08 Jun '00

Hello ! I am running syslog-ng 1.4.4 on Linux RedHat 6.1. I use one syslog-ng server where I collect all syslog messages from 10 systems with syslog-ng connected with TCP. I have problems with reconnection. Syslog-ng on client systems does not reestablish connection with server if connection is broken for long time ( around 2-3 hours). I need only restart syslog-ng daemon on client system. Does anybody have ideas about it ??? Thank you in advance.

2 1

leak problems
by Balazs Scheidler 08 Jun '00

08 Jun '00

Hi, for those experiencing high memory loads on behalf of syslog-ng, please try the attached patch, and check whether memory usage changes. diff -urN syslog-ng-1.4.4/src/affile.c syslog-ng-1.4.5/src/affile.c --- syslog-ng-1.4.4/src/affile.c Fri Jun 2 20:14:02 2000 +++ syslog-ng-1.4.5/src/affile.c Sat Jun 3 12:24:30 2000 @@ -110,12 +110,6 @@ make_log_reader(0, c), NULL); res = REMEMBER_RESOURCE(cfg->resources, &self->src->super.super); -#if 0 - if (self->flags & AFFILE_PIPE) { - self->src->super.close_callback = - make_driver_reinit_on_close(c, res, 0, cfg); - } -#endif return ST_OK | ST_GOON; } else { diff -urN syslog-ng-1.4.4/src/afinet.c syslog-ng-1.4.5/src/afinet.c --- syslog-ng-1.4.4/src/afinet.c Tue Feb 22 18:50:29 2000 +++ syslog-ng-1.4.5/src/afinet.c Sat Jun 3 15:01:10 2000 @@ -242,8 +242,9 @@ self->super.num_connections = 0; { FOR_OBJECT_QUEUE(p, n) { - CAST_SUBTYPE(log_handler, h, n); - append_log_handler(h, self->super.super.super.next); + CAST_SUBTYPE(afsocket_source_connection, h, n); + h->owner = &self->super; + append_log_handler(&h->super, self->super.super.super.next); self->super.num_connections++; } } @@ -392,6 +393,7 @@ struct persistent_config *persistent) { CAST(afinet_dest, self, c); + struct connect_fd *conn_fd; int fd; self->cfg = cfg; @@ -410,11 +412,13 @@ } if (!self->dest_buf) self->dest_buf = make_pkt_buffer(self->super.super.log_fifo_size); - - if (io_connect(cfg->backend, - fd, - self->super.dest_addr, - make_afsocket_dest_connected(cfg->backend, &self->super))) { + conn_fd = io_connect(cfg->backend, + fd, + self->super.dest_addr, + make_afsocket_dest_connected(cfg->backend, &self->super)); + + if (conn_fd) { + REMEMBER_RESOURCE(cfg->resources, &conn_fd->super.super); return ST_OK | ST_GOON; } else { @@ -430,6 +434,10 @@ CAST(afinet_dest, self, c); struct resource_node *n; + if (!self->cfg->living) { + werror("Connection established for an old configuration, dropping...\n"); + return ST_CLOSE | ST_OK; + } if (self->dest) self->dest->buffer = NULL; if (server) { diff -urN syslog-ng-1.4.4/src/afunix.c syslog-ng-1.4.5/src/afunix.c --- syslog-ng-1.4.4/src/afunix.c Tue Feb 22 18:50:29 2000 +++ syslog-ng-1.4.5/src/afunix.c Sat Jun 3 15:01:15 2000 @@ -201,8 +201,9 @@ self->super.num_connections = 0; { FOR_OBJECT_QUEUE(p, n) { - CAST_SUBTYPE(log_handler, h, n); - append_log_handler(h, self->super.super.super.next); + CAST_SUBTYPE(afsocket_source_connection, h, n); + h->owner = &self->super; + append_log_handler(&h->super, self->super.super.super.next); self->super.num_connections++; } } @@ -357,6 +358,8 @@ make_afsocket_dest_connected(cfg->backend, &self->super)); if (conn_fd) { + REMEMBER_RESOURCE(cfg->resources, &conn_fd->super.super); + return ST_OK | ST_GOON; } else { @@ -375,6 +378,10 @@ CAST(afunix_dest, self, c); struct resource_node *n; + if (!self->cfg->living) { + werror("Connection established for an old configuration, dropping...\n"); + return ST_CLOSE | ST_OK; + } if (self->dest) self->dest->buffer = NULL; if (server) { diff -urN syslog-ng-1.4.4/src/cfgfile.c syslog-ng-1.4.5/src/cfgfile.c --- syslog-ng-1.4.4/src/cfgfile.c Fri Mar 10 12:35:26 2000 +++ syslog-ng-1.4.5/src/cfgfile.c Sat Jun 3 14:30:03 2000 @@ -197,6 +197,7 @@ struct log_dest_group *d; struct log_source_group *s; + self->living = 1; for (s = self->sources; s; s = s->next_source_group) { if (s->super.super.destroy) LOG_HANDLER_DESTROY(s, self, persistent); @@ -228,6 +229,7 @@ self->init = do_init_config; self->destroy = do_destroy_config; self->backend = backend; + self->living = 1; self->sync_freq = 0; self->mark_freq = 1200; /* 20 minutes */ self->chain_hostnames = 1; diff -urN syslog-ng-1.4.4/src/cfgfile.h syslog-ng-1.4.5/src/cfgfile.h --- syslog-ng-1.4.4/src/cfgfile.h Fri Mar 24 11:57:28 2000 +++ syslog-ng-1.4.5/src/cfgfile.h Sat Jun 3 14:00:56 2000 @@ -43,6 +43,7 @@ (destroy method int "struct persistent_config *") (resources object resource_list) (backend object io_backend) + (living simple int) ; global options (chain_hostnames simple UINT32) (keep_hostname simple UINT32) diff -urN syslog-ng-1.4.4/src/cfgfile.h.x syslog-ng-1.4.5/src/cfgfile.h.x --- syslog-ng-1.4.4/src/cfgfile.h.x Fri Mar 24 11:59:45 2000 +++ syslog-ng-1.4.5/src/cfgfile.h.x Sat Jun 3 14:04:46 2000 @@ -6,6 +6,7 @@ int (*(destroy))(struct syslog_config *self, struct persistent_config *); struct resource_list *resources; struct io_backend *backend; + int living; UINT32 chain_hostnames; UINT32 keep_hostname; UINT32 mark_freq; diff -urN syslog-ng-1.4.4/src/main.c syslog-ng-1.4.5/src/main.c --- syslog-ng-1.4.4/src/main.c Fri Mar 10 12:35:27 2000 +++ syslog-ng-1.4.5/src/main.c Sat Jun 3 14:29:55 2000 @@ -28,6 +28,7 @@ #include "afinter.h" #include "format.h" #include "werror.h" +#include "queue.h" #include <sys/types.h> #include <sys/wait.h> @@ -84,7 +85,6 @@ self->backend->newconfig = self->backend->oldconfig; self->backend->oldconfig = NULL; io_callout(&self->backend->super, 0, c); - } break; case 3: @@ -150,8 +150,14 @@ break; if (sighuprecvd && !restarting) { + FOR_QUEUE(&backend->super.callouts, struct ol_queue_node *, n) { + ol_queue_remove(n); + ol_space_free(n); + } + notice("SIGHUP received, restarting syslog-ng\n"); restarting = 1; + backend->newconfig = make_syslog_config(cfgfilename, &backend->super); if (backend->newconfig) { static struct reread_config r = -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 1

Syslog-ng Dies - core dump
by John Wingenbach 07 Jun '00

07 Jun '00

I just installed and configured syslog-ng 1.4.3 on a Solaris 2.6 system. It cores out on startup. It apparently doesn't like part of my configuration. Debug output is: #> /opt/syslog-ng/sbin/syslog-ng -d -v binding fd 5, inetaddr: 0.0.0.0, port: 514 io.c: Preparing fd 5 for reading syslog-ng version 1.4.3 starting Segmentation Fault(coredump) My configuration is (Note below the comments regarding code which if removed allows it to live): source s_all { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; # Level Filters filter f_info { level(info .. emerg); }; filter f_warning { level(warning .. emerg); }; filter f_debug { level(debug .. emerg); }; filter f_crit { level(crit .. emerg); }; filter f_err { level(err .. emerg); }; filter f_emerg { level(emerg); }; # Facility Filters filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon); }; filter f_auth { facility(auth); }; filter f_lpr { facility(lpr); }; filter f_news { facility(news); }; filter f_kern { facility(kern); }; filter f_uucp { facility(uucp); }; filter f_cron { facility(cron); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # Complex Filters filter f_mailerror { filter (f_mail) and filter (f_err); }; filter f_axsyslog { filter (f_info) or filter(f_mailerror); }; ------ It would seem that the following filters used to build a summary syslog cause the problem. ------ filter f_errsanuser { filter (f_err) and not facility(user); }; filter f_kerndebug { filter (f_kern) and filter (f_debug); }; filter f_mailwarning { filter (f_mail) and filter (f_warning); }; filter f_summary { filter (f_errsanuser) or filter (f_kerndebug) or filter (f_daemon) or filter (f_mailwarning); }; destination d_all { file("/var/log/messages"); }; destination d_ttys { usertty("*"); }; destination d_console { file ("/dev/console"); }; destination d_kernfile { file ("/var/log/kern"); }; destination d_syslogfile { file ("/var/log/syslog"); }; destination d_userfile { file ("/var/log/user"); }; destination d_mailfile { file ("/var/log/mail"); }; destination d_mailcritfile { file ("/var/log/mail.crit"); }; destination d_mailwarnfile { file ("/var/log/mail.warning"); }; destination d_daemonfile { file ("/var/log/daemon"); }; destination d_daemonwarningfile { file ("/var/log/daemon.warning"); }; destination d_authfile { file ("/var/log/auth"); }; destination d_lprfile { file ("/var/log/lpr"); }; destination d_newsfile { file ("/var/log/news"); }; destination d_uucpfile { file ("/var/log/uucp"); }; destination d_cronfile { file ("/var/log/cron"); }; destination d_local0file { file ("/var/log/local0"); }; destination d_local1file { file ("/var/log/local1"); }; destination d_local2file { file ("/var/log/local2"); }; destination d_local3file { file ("/var/log/local3"); }; destination d_local4file { file ("/var/log/local4"); }; destination d_local5file { file ("/var/log/local5"); }; destination d_local6file { file ("/var/log/local6"); }; destination d_local7file { file ("/var/log/local7"); }; destination d_axentsyslog { file ("/axent/ita/system/falcon/syslog"); }; destination d_axentmail { file ("/axent/ita/system/falcon/syslog.mdbg"); }; log { source(s_all); filter (f_kern); filter (f_debug); destination (d_kernfile); }; log { source(s_all); filter (f_user); filter (f_debug); destination (d_userfile); }; log { source(s_all); filter (f_mail); filter (f_debug); destination (d_mailfile); }; log { source(s_all); filter (f_mail); filter (f_crit); destination (d_mailcritfile); }; log { source(s_all); filter (f_mail); filter (f_warning); destination (d_mailwarnfile); }; log { source(s_all); filter (f_daemon); filter (f_debug); destination (d_daemonfile); }; log { source(s_all); filter (f_daemon); filter (f_warning); destination (d_daemonwarningfile); }; log { source(s_all); filter (f_auth); filter (f_debug); destination (d_authfile); }; log { source(s_all); filter (f_lpr); filter (f_debug); destination (d_lprfile); }; log { source(s_all); filter (f_news); filter (f_debug); destination (d_newsfile); }; log { source(s_all); filter (f_uucp); filter (f_debug); destination (d_uucpfile); }; log { source(s_all); filter (f_cron); filter (f_debug); destination (d_cronfile); }; log { source(s_all); filter (f_local0); destination (d_local0file); }; log { source(s_all); filter (f_local1); filter (f_debug); destination (d_local1file); }; log { source(s_all); filter (f_local2); destination (d_local2file); }; log { source(s_all); filter (f_local3); destination (d_local3file); }; log { source(s_all); filter (f_local4); filter (f_debug); destination (d_local4file); }; log { source(s_all); filter (f_local5); filter (f_debug); destination (d_local5file); }; log { source(s_all); filter (f_local6); filter (f_debug); destination (d_local6file); }; log { source(s_all); filter (f_local7); filter (f_debug); destination (d_local7file); }; log { source(s_all); filter (f_axsyslog); destination (d_axentsyslog); }; log { source(s_all); filter (f_mail); filter (f_debug); destination (d_axentmail); }; log { source(s_all); filter (f_summary); destination (d_syslogfile); }; -- John C. Wingenbach Pliant Systems, Inc. Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

4 19

bit of an issue with logging
by John 05 Jun '00

05 Jun '00

Hi All, A bit of an issue here. I'm having syslog-ng create directories when a new host starts logging to it, which is all well and good. But, when I look in the servers directory there are some directories with logs in them which surely can't be right! ? ?James ?Oliver ?Rev. "Iona "James "Jane > Jacqueline balloon-kite.co.uk boundary="Boundary-=_pHqghUmeaYlNlfdXfircvsCxgGBw" virgin.net hotmail.com, Is this something I should be worried about? It does worry me!! Any ideas why this is happening? It caused a problem with my newsyslog when it tried to rotate the logs in the > directory causing my disk to get rather full quickly within a few days of not rotating. Cheers, John

2 1

owner and group of create dirs
by Tomohiro Yamauchi 02 Jun '00

02 Jun '00

Hi, My syslog-ng.conf is destination std { file("/var/log/$HOST/$FACILITY.debug/$YEAR$MONTH/$FACILITY.debug$YEAR$MONTH$DAY" owner(admin) group(admin) perm(0600) dir_perm(0700) create_dirs(yes)); }; If /var/log/$HOST/$FACILITY.debug/$YEAR$MONTH is not exist, make that dirs. But that's owner is root:other. I think because daemon's effective user ID is root. I want to change dir's owner. Is this possible? -- Tomohiro Yamauchi handy(a)nid.co.jp

2 3