October 2001 - syslog-ng - lists.balabit.hu

no logging after HUP (1.5.13)
by Arnold Pulleman 05 Jan '02

05 Jan '02

Because of the template feature I want to use syslog-ng 1.5 on a FreeBSD 4.2 and 4.3 platform. While testing 1.5.13 I found a problem when sending a hangup signal to syslog-ng. The restart message is shown but nothing follows until syslog-ng is stopped and started again. My question is how to solve this problem? The following output of the messages file appeared: Oct 30 11:06:49 humble syslog-ng[5018]: syslog-ng version 1.5.13 starting Oct 30 11:08:56 humble su: BAD SU user to root on /dev/ttyp7 Oct 30 11:09:28 humble su: user to root on /dev/ttyp7 Oct 30 11:16:49 humble syslog-ng[5018]: STATS: dropped 0 Oct 30 11:25:09 humble su: BAD SU user to root on /dev/ttyp7 Oct 30 11:26:05 humble su: user to root on /dev/ttyp3 Oct 30 11:26:49 humble syslog-ng[5018]: STATS: dropped 0 Oct 30 11:27:00 humble syslog-ng[5018]: SIGHUP received, restarting syslog-ng Oct 30 11:35:36 humble syslog-ng[5109]: syslog-ng version 1.5.13 starting Oct 30 11:35:49 humble syslog-ng[5109]: SIGHUP received, restarting syslog-ng

4 6

help
by Nocentino, Anthony 02 Jan '02

02 Jan '02

how do i config syslog-ng to start up automatically on boot

2 1

patch for adding tcp wrappers to syslog-ng?
by Ed Ravin 20 Nov '01

20 Nov '01

I just patched my copy of syslog-ng-1.5.10 to use tcp wrappers - I want to strictly control who is allowed to talk to my log server, and since we do everything else at my shop with TCP wrappers, it seemed sensible to add it in. I am running NetBSD 1.5.2, which provides the tcp wrappers code as part of the base OS. The only other change needed was to add "-lwrap" to the link flags. Is there interest in this feature? The patch below is only for incoming TCP connections - I don't see the point of putting it in for udp, as the packets are trivially spoofable. I haven't had much time to review the syslog-ng code, so I suspect this is not the best way to apply the patch: on second thought, it seems it might belong in libol. -- Ed --- afinet.c 2001/10/27 01:57:51 1.1 +++ afinet.c 2001/10/27 03:29:11 @@ -28,6 +28,13 @@ #include "cfgfile.h" #include "pkt_buffer.h" +#ifndef WE_DONT_WANT_TCP_WRAPPERS +#include "tcpd.h" +int allow_severity; +int deny_severity; +#endif + + #include <errno.h> #include <string.h> #include <assert.h> @@ -210,6 +217,23 @@ CAST(afinet_source, self, c); struct afsocket_source_connection *conn; UINT32 res; + + +#ifndef WE_DONT_WANT_TCP_WRAPPERS + { + struct request_info req; + + request_init(&req, RQ_DAEMON, "syslog-ng", RQ_FILE, client->super.fd, 0); + fromhost(&req); + if (hosts_access(&req) == 0) + { + CAST(inet_address_info, inet_addr, client_addr); + notice("connection from %S:%i refused by hosts_access()\n", inet_addr->ip, inet_addr->port); + close_fd(&client->super, 0); + return ST_OK | ST_GOON; + } + } +#endif if (c->num_connections >= c->max_connections) { CAST(inet_address_info, inet_addr, client_addr);

2 2

$HOST Variable in syslog-ng.conf
by Mike Kelland 30 Oct '01

30 Oct '01

When syslog-ng recieves a tcp syslog from another host, it tags the front of the message with '127.0.0.1/127.0.0.1/' before the host ip that the message actually came from. It also makes the host variable for that message '127.0.0.1' instead of the host the message actually came from. So if I'm logging all messages from syslog-ng to a file called $HOST.txt, all of my tcp syslog messages (ie messages coming from another syslog-ng) are logged to 127.0.0.1.txt . Does anyone know of a workaround to this problem? Thanks, Mike

1 0

syslog-ng's matching vs a perl-regex match
by Seth Vidal 30 Oct '01

30 Oct '01

Hi all, I am using syslog-ng version 1.4.12 on red hat linux 7.1. I have been doing some matches to get certain events out of my logs and have certain programs react to them. I was wondering if it would be faster to pipe ALL output to a perl script and have it do its own regex matching. I'm not sure how fast syslog-ng's matching is and if I take a performance hit by using it. thanks -sv

3 2

Chroot syslog-ng
by Jerome Poggi 29 Oct '01

29 Oct '01

Did somebody have any experiences of chroot syslog-ng on Linux or other operating system ? Thanks, -- Jerome POGGI Jerome.Poggi(a)hsc.fr Herve Schauer Consultants -=- Consultant en sécurité informatique http://www.hsc.fr/ Tel : +33 141 409 700

2 1

Linelength problems..
by Robert Glad 29 Oct '01

29 Oct '01

Hello all, I have a problem with syslog-ng that is quite strange. We have been running syslog-ng for a while now, it has worked fine but today i noticed one thing that is not that good at all. It seems like when loglines get too long, syslog-ng just truncates them. I looked around in the sources and found a define in syslog-ng.h, MAX_LOG_LINE. I boosted it up to 4096, recompiled, deployed the new binary but the problem remains.. Any ideas? Regards.. Robert

2 1

Syslog-ng's memory footprint growing constantly on DEC alpha
by Wim-Jan Hilgenbos 29 Oct '01

29 Oct '01

Hi, I have quite a lot of trouble with syslog-ng. More specific with the memory footage. It grows within a day to a size of over 130M after which it stops logging except for its own internal messages and then a short time later it dies. I have tried all kinds of combinations of compilers/compiler options. motivated in part by the unaligned messages and the former emails on this list. I'm able to get rid of the analigned access messages by using the native compiler, but I can't get a stable memory-size. My idea is that log messages are only partially freed. When I look at the core I see a lot of 'tails of logmessages' varying in length from 2 to 15 chars. The whole application becomes more stable and grows slower when I use the '-taso' option of the native compiler, which directs the loader to load the modules in 31-bit address space. Debug output shows a stable number of Objects in memory, around 290. I've used serveral versions: 1.4.8, 1.4.12, 1.4.13, 1.5.7, 1.5.10, 1.5.11 and probably some more (I'm not at my workstation now ;-< We use Compaq True64. The message load of the appl. we're develloping is rather high so we use syslog-ng exclusively for that application. We don't use NIS+. Does anyone have any solutions? Thnx in advance. Wim-Jan Hilgenbos

2 2

Syslog-ng Log Files
by Denis Doublet 29 Oct '01

29 Oct '01

Hi, With syslog-ng, is there anyway to take the facility, level,date,hostname in the log message ? We log in a fifo file, and without facility end level, the message log can't be sorted, every messages have the same form. We tried many syntaxes, like destination probe_netcool { pipe("/var/adm/netcool_pipe"); "$LEVEL" }; or destination probe_netcool { pipe("/var/adm/netcool_pipe"); '$LEVEL' }; and many others, but every syntax we tried generated a "Syntax error reading config file, using old configuration" message. I must avoid syntax like : destination probe_netcool { file("/var/adm/$HOST.log"); }; because only one fifo can be scanned (question of licences..) Thank you Denis

1 0

solaris 8 x86 errors
by Nate Campi 26 Oct '01

26 Oct '01

I'm running syslog-ng 1.4.14 on a solaris 8 x86 box, logging over TCP to another syslog-ng loghost. I'm getting this error sporadically: pkt_buffer::do_flush(): Error flushing data Is this anything to worry about? All I see on this is a patch from 1999: http://lists.balabit.hu/pipermail/syslog-ng/1999-December/000376.html -- Nate Campi <nate(a)campin.net> www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 A mathematician is an engine for converting coffee into theorems.

2 2