October 2001 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]deleting log files - syslog-ng]
by Christian Hammers 26 Oct '01

26 Oct '01

Hello On Fri, Oct 26, 2001 at 12:11:48PM +0200, Thomas Kaehn wrote: > cp /some/where/file.log /some/where/old/file.log.old > cp /dev/null /some/where/file.log > This way, file still exists and file descriptos are not closed. > However, this is not atomic, one might lose logged lines before > file is truncated. Better idea: mv logfile logfile.old kill -WHATEVER syslog-ng This way it would continue writing into the moved file until I restart it which would flush buffers, close the file and then crate a new one. But a fstat() call at each write would be a more elegant solutuion if it doesn't slow down writing too much. > -MNi bye, -christian- -- Christian Hammers WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 ch(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

4 3

deleting log files - syslog-ng
by Thomas Kaehn 26 Oct '01

26 Oct '01

Hello, is it possible that I have to restart syslog-ng, when deleting a log file? I log from different hosts to different files using $HOST in the config-file. If I delete one file of them it is not created until restarting syslog-ng. Is it possible to change this behaviour. Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

3 2

syslog-ng 1.5.12 and use_time_recvd()
by Jon Bidinger 26 Oct '01

26 Oct '01

I'm using syslog-ng as a syslogd replacement for a centralized log server. I'm also monitoring the logs using swatch. One of the options for swatch is to throttle messages that are repeating over a period of time. The problem I'm having is that I have servers over many different timezones logging to the log server. This seems to confuse swatch since it can't tell which machine is in which timezone. After reading the docs for syslog-ng, use_time_recvd()seemed like the perfect option. However, after putting it in my options, the output doesn't change. Am I doing something wrong or is there a problem with this feature? from my /etc/syslog-ng/syslog-ng.conf options { sync(0); time_reopen(10); log_fifo_size(100); use_time_recvd(yes); }; Thanks, - Jon =============================================================== Jon Bidinger Email: jpb(a)fairisaac.com

3 2

syslog-ng crash
by Thomas Kaehn 26 Oct '01

26 Oct '01

Hello, syslog-ng crashes several times per hour. I get the following error message: ol_object_check: Type error! What is the possible cause of this problem? Is there a possibility to fix it? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

2 2

Fw: [syslog-ng]logger, locales and syslog-ng
by todd glassey 26 Oct '01

26 Oct '01

----- Original Message ----- From: "Gregor Binder" <gb(a)rootnexus.net> Sent: Thursday, October 25, 2001 6:56 AM Subject: Re: [syslog-ng]logger, locales and syslog-ng > Thomas Kaehn on Thu, Oct 25, 2001 at 03:04:04PM +0200: > > > Is it possible to configure syslog-ng that it does > > not look at the date of the incoming log packet? > > use_time_recvd(yes) .. see documentation. Bazsi - Can we create a timestamp_recvd(yes) parameter that digitally timestamps, hashes and signs the timestamps with MD5 and SHA-1/2 routines? Todd > > -- > ____ ____ > / _/| - > Gregor Binder <gb(a)(rootnexus.net|sysfive.com)> > | / || _\ \ > \__ Id: 0xE2F31C4B Fp: 8B8A 5CE3 B79B FBF1 5518 8871 0EFB AFA3 E2F3 1C4B > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

5 6

logger, locales and syslog-ng
by Thomas Kaehn 25 Oct '01

25 Oct '01

Hi, when trying to log to different files, by using the following configuration entry, syslog-ng does not handle all date information correctly. destination syslog { file("/var/log/syslog-$YEAR-$MONTH-$DAY" owner("root") group("adm") perm(0640)); }; If the environment-variable LC_ALL is set to de_DE logger produces a german-language output and syslog-ng logs the message to /var/log/syslog-2000-12-31. Is it possible to configure syslog-ng that it does not look at the date of the incoming log packet? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

2 2

RE: [syslog-ng]Syslog-ng overflow issue
by Clausing, James A (Jim), SOBUS 23 Oct '01

23 Oct '01

I've just noticed this problem when there is a \n embedded in the message, too (in 1.5.10). The stock Solaris syslog, keeps the \n and following string in the same log entry, syslog-ng is splitting it into a new entry and then concatenating the next message onto it. ---Jim Solaris syslogd: ---------------- Oct 23 13:28:41 altiga1 32467 10/23/2001 13:28:43.020 SEV=4 IKE/119 RPT=859 a.b.c.d Group [employee] User [e002808]\nPHASE 1 COMPLETED syslog-ng: ---------- Oct 23 12:29:04 altiga2 4851 10/23/2001 12:29:03.800 SEV=4 IKE/119 RPT=90 e.f.g.h Group [employee] User [e008694] Oct 23 12:29:04 altiga2 PHASE1 COMPLETED<149>4853 10/32/2001 12:29:03.800 SEV=5 IKE/25 RPT=262 e.f.g.h Group [employee] User [e008694] Received remote Proxy Host data in ID Payload: Address 192.168.0.191, Protocol 0, Port 0 -----Original Message----- From: todd glassey [mailto:todd.glassey@worldnet.att.net] Sent: Monday, October 15, 2001 6:42 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Syslog-ng overflow issue Or replicate the previous header and open a new line for this message content - which seems like it would be a whole lot more useful... T. ----- Original Message ----- From: "Mike Kelland" <MKelland(a)jetnet.ca> To: <syslog-ng(a)lists.balabit.hu> Sent: Monday, October 15, 2001 1:11 PM Subject: [syslog-ng]Syslog-ng overflow issue > I'm having a problem where if a syslog message is sent to syslog-ng which > exceeds a certain length, the piece of the message which was truncated off > the end is appended to the beginning of the next message sent. Is there a > way to cause syslog-ng to instead simply loose this truncated piece? > > Thanks, > Mike Kelland > > > <<...OLE_Obj...>> > Michael Kelland > Internetworking Applications Engineer > 333 Preston Street, 3rd Floor, > Ottawa, Ontario. K1S 5N4 > Ph. (613) 237-5995, ext 248 > Fax(613) 237-9002 > www.JETNET.ca > mkelland(a)JETNET.ca > > This communication contains confidential information intended solely for the > use of the individual/s and/or entity or entities to whom it was intended to > be addressed. If you are not the intended recipient, be aware that any > disclosure, copying, distribution or use of the contents of this > transmission is prohibited. If you have received this communication in > error, please contact the sender immediately, delete the communication from > your system and do not disclose its contents to any third party or use its > contents. Any opinions expressed are soley those of the author and do not > necessariy represent those of JETNET Internetworking Services Inc. unless > otherwise specifically stated. > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

type error fix
by Balazs Scheidler 23 Oct '01

23 Oct '01

Hi, The patch below hopefully fixes the "Type Error" problems reported in 1.5.12. I'd appreciate feedback whether it really fixes the bug. (if it does, expect a new version shortly) Thanks for the cooperation for those who helped me to track this issue. diff -urN syslog-ng-1.5.12/src/affile.c syslog-ng-1.5.12-fixed/src/affile.c --- syslog-ng-1.5.12/src/affile.c Sat Oct 20 15:03:59 2001 +++ syslog-ng-1.5.12-fixed/src/affile.c Mon Oct 22 21:22:18 2001 @@ -118,7 +118,7 @@ struct resource_node *res; lseek(fd, 0, SEEK_END); - self->src = io_read(make_io_fd(cfg->backend, fd, self->name), + self->src = io_read(make_io_fd(cfg->backend, fd, ol_string_use(self->name)), make_log_reader(0, c), NULL); res = REMEMBER_RESOURCE(cfg->resources, &self->src->super.super); @@ -218,7 +219,7 @@ self->owner->flags & AFFILE_CREATE_DIRS, &fd)) { self->dest = - io_write(make_io_fd(cfg->backend, fd, self->expanded_fname), + io_write(make_io_fd(cfg->backend, fd, ol_string_use(self->expanded_fname)), make_pkt_buffer_ext(self->owner->sync_freq, MAX(self->owner->super.log_fifo_size + 1, self->owner->sync_freq)), -- Bazsi

2 1

asyncronous logging
by Allen Bettilyon 22 Oct '01

22 Oct '01

Hello, I was wondering if syslog-ng supported asyncronous logging. Much like the "-" option of standard syslog: mail.* -/var/log/maillog -- Allen Bettilyon

2 3

Problem after HANGUP signal
by Jerome Poggi 21 Oct '01

21 Oct '01

I use Syslog-NG 1.5.11 on Linux 2.4.10 and when I send HANGUP signal to syslog-ng, I never seen the stats info more. For having it more long time, I must kill and restart syslog-ng. Is it a bug ? Jerome.

3 4