October 2001 - syslog-ng - lists.balabit.hu

Syslog-ng overflow issue
by Mike Kelland 15 Oct '01

15 Oct '01

I'm having a problem where if a syslog message is sent to syslog-ng which exceeds a certain length, the piece of the message which was truncated off the end is appended to the beginning of the next message sent. Is there a way to cause syslog-ng to instead simply loose this truncated piece? Thanks, Mike Kelland <<...OLE_Obj...>> Michael Kelland Internetworking Applications Engineer 333 Preston Street, 3rd Floor, Ottawa, Ontario. K1S 5N4 Ph. (613) 237-5995, ext 248 Fax(613) 237-9002 www.JETNET.ca mkelland(a)JETNET.ca This communication contains confidential information intended solely for the use of the individual/s and/or entity or entities to whom it was intended to be addressed. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this transmission is prohibited. If you have received this communication in error, please contact the sender immediately, delete the communication from your system and do not disclose its contents to any third party or use its contents. Any opinions expressed are soley those of the author and do not necessariy represent those of JETNET Internetworking Services Inc. unless otherwise specifically stated.

2 1

problems with receiving messages from other host
by Michael Wahlbrink 15 Oct '01

15 Oct '01

hi, I'm trying to install a linux loghost (running syslog-ng) which should collect the log-messages of the other linuxboxes in our dmz. The problem is that if on the other pcs also the syslog-ng is running the loghost seems not to receive any messages fom the other pcs. On one box I've tried to install the 'original' syslog and I received the messages .......... So here are the important Parts of my config files: the loghost: options { long_hostnames(on); sync(0); create_dirs(yes); }; ##################################################################### # Direct all local messages to the source s_local ##################################################################### source s_local { unix-stream("/dev/log"); internal(); }; ##################################################################### # Accept all messages from dmz.testlan.propack-data.de # and direct them to the source s_net_dmz.bw ##################################################################### source s_net_dmz.testlan { udp(ip(123.45.67.89) port(514)); }; ##################################################################### # Print all messages from swan (local) on tty10 ##################################################################### destination d_console10 { file("/dev/tty10"); }; log { source(s_local); destination(d_console10); }; ##################################################################### # Log all messages to /var/log/messages ##################################################################### destination messages { file("/var/log/messages" owner(root) group(root) perm(0640) dir_perm(0755)); }; log { source(s_local); source(s_net_dmz.testlan); destination(messages); }; the other host: ##################################################################### # define options for syslog ##################################################################### options { long_hostnames(on); sync(0); }; ##################################################################### # define the source pipe for all local messages ##################################################################### source src { unix-stream("/dev/log"); internal(); }; ##################################################################### # print all messages on tty10 ##################################################################### destination console { file("/dev/tty10"); }; log { source(src); destination(console); }; ##################################################################### # send all messages to the loghost loghost.testlan.propack-data.de ##################################################################### destination loghost { udp("123.45.67.89" port(514)); }; log { source(src); destination(loghost); }; I hope you can help me with my problem ;-) and sorry for my bad english thanx micha

1 0

Outputting UTC time strings?
by Rory Toma 13 Oct '01

13 Oct '01

For the life of me, I can't seem to find out where msg->date gets set. I changed destinations.c to only use "%s" in strftime, but it only affects the startup syslog message, not the other messages. Where do I make the change to use UTC time instead of the time string that it currently uses? -- Rory Toma rory(a)colinburns.com Game Master http://www.colinburns.com Colin Burns Games

1 0

filter problem: level()
by Michael D. (Mick) Bauer 11 Oct '01

11 Oct '01

Hi, all. I've got a puzzling problem (to me ;-) with the level() function in my syslog-ng.conf file. I'm using a filter whose sole criterion is level(debug .. alert); as a sort of "catch-all" filter. But if I send syslog-ng eight messages, each with a different priority (i.e., one of each level), only the ones with levels "crit," "alert," and "emerg" get logged. But wait! Those "emerg" messages shouldn't be making it past the filter! What *on earth* is going on here? (Could it be some sort of weirdness between logger & syslog-ng?) Here's my config file, etc.: # begin syslog-ng.conf options { long_hostnames(off); sync(0); }; source src { unix-dgram("/dev/log"); internal(); }; destination d_local { file("/var/log/messages"); }; filter f_mick { level(debug .. alert); }; log { source(src); filter(f_mick); destination(d_local); }; # end syslog-ng.conf # begin bash-commands (logger) to test above config curious-george:/etc/init.d# for i in {debug,info,notice,warning,err,crit,alert, emerg} >do >logger -p auth.$i "Priority level $i" >echo "Priority level $i" >done Priority level debug Priority level info Priority level notice Priority level warning Priority level err Priority level crit Priority level alert Priority level emerg # end bash-commands & output # begin excerpt from /var/log/messages Sep 5 00:13:04 curious-george darthelm: Priority level crit Sep 5 00:13:04 curious-george darthelm: Priority level alert Sep 5 00:13:04 curious-george darthelm: Priority level emerg # end excerpt TIA, Mick /=============================\ | Michael D.(Mick) Bauer | | Network Security Consultant | | St. Paul, Minnesota (USA) | | mick<at>visi.com | \=============================/

2 2

Macro Substitution
by Jeremy Shaffner 11 Oct '01

11 Oct '01

Howdy, I'm currently using a template to output logs to a pipe for importing into a DB. Is it possible to isolate a portion of the $MSG macro using regexps? Such that it equates to: echo $MSG | sed 's/denied ip $1.1.1.1$ -> $2.2.2.2$/\1 \2/' I'm trying to put the IPs in their own column in the table. Thanks, -- -Jeremy

2 3

syslog-ng.conf.RedHat
by James Riordan 11 Oct '01

11 Oct '01

Howdy- I think that there might be an inconsistency between the behavior determined by syslog.conf and that by syslog-ng.conf.RedHat (from syslog-ng-1.4.12.tar.gz and syslog-ng-1.5.9.tar.gz). The stock syslog.conf file sends a message to /var/log/messages if it is of level info or higher unless it comes from facility mail, authpriv, or cron: # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages whereas, if I understand it correctly, the relevant lines from syslog-ng.conf.RedHat destination d_mesg { file("/var/log/messages"); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; send a message to /var/log/messages if it is exactly of level info, or if it comes from facility mail or authpriv. I am not sure about the the internals of filter evaluation (is it lazy?) so as to write the fastest rule but filter f_filter2 { not level(debug) and not (facility(mail) or facility(authpriv) or facility(cron)); }; seems to work. Also, thanks for such a nice package. Regards, james -- Dr. James Riordan email: rij(a)zurich.ibm.com IBM Research notes: James Riordan/Zurich/IBM Säumerstrasse 4 Tel +41 (0) 1 724 89 81 CH-8803 Rüschlikon, Switzerland Fax +41 (0) 1 724 89 53

1 0

Fields defined in the logs
by Denis Doublet 10 Oct '01

10 Oct '01

> Hello, > > Using syslog-ng 1.5.9 on Solaris 7 and Solaris 8, > I would like to see logs containing the facility, level.... > I can't find how to add these fields to logs. > > Best Regards > > Denis

1 0

RE: [syslog-ng]Mystic crashes of 1.5.10
by Nicholas Berry 10 Oct '01

10 Oct '01

I too am having the same issue with crashing under Solaris 8 with syslog-ng 1.5.10, but my crashes happen several hours between each other. _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048 -----Original Message----- From: Andreas Schulze [mailto:Andreas.Schulze@mediaWays.NET] Sent: Wednesday, October 10, 2001 6:01 AM To: syslog-ng list Subject: [syslog-ng]Mystic crashes of 1.5.10 Hello Bazsi, thanks a lot for the stats() feature in the new version. But unfortunately 1.5.10 crashes a few minutes after starting. We are running your software on SUN Solaris 8 boxes. I read about a similiar problem with Linux boxes some weeks ago in this list. For your convenience the backtrace is attached. The calling deps between #17 and #1 can differ in each core. But it crashed _always_ in __sigprocmask () from /usr/lib/libthread.so.1 And it crashed _always_ by receiving SIGKILL. Seems a little bit mystic for me, because I don't know why and who's sending the SIGKILL. Coredumps by SIGSEGV are more familiar to me :) Thx. for a fast fix --Andreas > root@host [/root] >>gdb /usr/sbin/syslog-ng.1.5.10 core > GNU gdb 5.0 > Copyright 2000 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and > you are welcome to change it and/or distribute copies of it under > certain conditions. Type "show copying" to see the conditions. There > is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "sparc-sun-solaris2.8"... > > Core was generated by `/usr/sbin/syslog-ng.1.5.10 -v -f > /etc/syslog-ng/syslog-ng.conf'. Program terminated with signal 9, > Killed. Reading symbols from /usr/lib/libpthread.so.1...done. Loaded > symbols for /usr/lib/libpthread.so.1 Reading symbols from > /usr/lib/libdoor.so.1...done. Loaded symbols for /usr/lib/libdoor.so.1 > Reading symbols from /usr/lib/libl.so.1...done. > Loaded symbols for /usr/lib/libl.so.1 > Reading symbols from /usr/lib/libsocket.so.1...done. > Loaded symbols for /usr/lib/libsocket.so.1 > Reading symbols from /usr/lib/libnsl.so.1...done. > Loaded symbols for /usr/lib/libnsl.so.1 > Reading symbols from /usr/lib/libxnet.so.1...done. > Loaded symbols for /usr/lib/libxnet.so.1 > Reading symbols from /usr/lib/libc.so.1...done. > Loaded symbols for /usr/lib/libc.so.1 > Reading symbols from /usr/lib/libdl.so.1...done. > Loaded symbols for /usr/lib/libdl.so.1 > Reading symbols from /usr/lib/libmp.so.2...done. > Loaded symbols for /usr/lib/libmp.so.2 > Reading symbols from /usr/platform/SUNW,UltraSPARC-IIi-cEngine/lib/libc_psr.so.1...done. > Loaded symbols for /usr/platform/SUNW,UltraSPARC-IIi-cEngine/lib/libc_psr.so.1 > Reading symbols from /usr/lib/libthread.so.1...done. > Loaded symbols for /usr/lib/libthread.so.1 > #0 0xff0d9a04 in __sigprocmask () from /usr/lib/libthread.so.1 > (gdb) bt > #0 0xff0d9a04 in __sigprocmask () from /usr/lib/libthread.so.1 > #1 0xff0ce460 in _resetsig () from /usr/lib/libthread.so.1 > #2 0xff0cdc00 in _sigon () from /usr/lib/libthread.so.1 > #3 0xff0d0c14 in _thrp_kill () from /usr/lib/libthread.so.1 > #4 0xff14afe8 in raise () from /usr/lib/libc.so.1 > #5 0xff1357c4 in abort () from /usr/lib/libc.so.1 > #6 0x29324 in do_object_queue_mark () > #7 0x29d50 in ol_object_check () > #8 0x1f70c in do_handle_dest_writer (c=0x9ffc0, msg=0x60314) at affile.c:247 > #9 0x20c90 in do_handle_affile_log (c=0x4a7d0, msg=0x60314) at affile.c:738 > #10 0x1866c in do_handle_log (c=0x4a8d8, msg=0x60314) at destinations.c:103 > #11 0x17374 in do_distribute_log (c=0x47020, msg=0x60314) at center.c:149 > #12 0x169a8 in do_add_source_name (c=0x4a748, logmsg=0x60314) at sources.c:238 > #13 0x225e0 in do_handle_afinet_line (c=0x470c0, msg=0x60314) at afinet.c:107 > #14 0x160bc in do_handle_line (self=0x47108, length=110, > data=0x47120 "<189>121625: Oct 10 14:30:57 MESZ: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:1, changed state to upolding time expiredired0 secondsws-gtso-de15) 2/6 (1)..net) 2/48 (1)..", addr=0xffbef518, addrlen=16) > at sources.c:67 > #15 0x162f4 in do_read_line (h=0x470a0, read=0xffbef6b8) at sources.c:105 > #16 0x27bc4 in read_callback () > #17 0x27870 in io_iter () > #18 0x153ac in main_loop (backend=0x42eb0) at main.c:174 > #19 0x15e8c in main (argc=4, argv=0xffbefb2c) at main.c:469 > (gdb) q > root@host [/root] >> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Feature request for stats() in 1.5.10
by Andreas Schulze 10 Oct '01

10 Oct '01

Hello Bazsi, thanks a lot for the stats() feature in the new version. Is it possible to break down the stats() output to the destination layer? I.e. generate stats() output per destination. It would be very useful, if it's possible to find out the destination that makes the 'dropping' problem. > STATS: dropped 234 on destination 'd_dest_1' > STATS: dropped 0 on destination 'd_dest_a' > STATS: dropped 34 on destination 'd_dest_x' > ... Thx. --Andreas

1 0

Mystic crashes of 1.5.10
by Andreas Schulze 10 Oct '01

10 Oct '01

Hello Bazsi, thanks a lot for the stats() feature in the new version. But unfortunately 1.5.10 crashes a few minutes after starting. We are running your software on SUN Solaris 8 boxes. I read about a similiar problem with Linux boxes some weeks ago in this list. For your convenience the backtrace is attached. The calling deps between #17 and #1 can differ in each core. But it crashed _always_ in __sigprocmask () from /usr/lib/libthread.so.1 And it crashed _always_ by receiving SIGKILL. Seems a little bit mystic for me, because I don't know why and who's sending the SIGKILL. Coredumps by SIGSEGV are more familiar to me :) Thx. for a fast fix --Andreas > root@host [/root] >>gdb /usr/sbin/syslog-ng.1.5.10 core > GNU gdb 5.0 > Copyright 2000 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and you are > welcome to change it and/or distribute copies of it under certain conditions. > Type "show copying" to see the conditions. > There is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "sparc-sun-solaris2.8"... > > Core was generated by `/usr/sbin/syslog-ng.1.5.10 -v -f /etc/syslog-ng/syslog-ng.conf'. > Program terminated with signal 9, Killed. > Reading symbols from /usr/lib/libpthread.so.1...done. > Loaded symbols for /usr/lib/libpthread.so.1 > Reading symbols from /usr/lib/libdoor.so.1...done. > Loaded symbols for /usr/lib/libdoor.so.1 > Reading symbols from /usr/lib/libl.so.1...done. > Loaded symbols for /usr/lib/libl.so.1 > Reading symbols from /usr/lib/libsocket.so.1...done. > Loaded symbols for /usr/lib/libsocket.so.1 > Reading symbols from /usr/lib/libnsl.so.1...done. > Loaded symbols for /usr/lib/libnsl.so.1 > Reading symbols from /usr/lib/libxnet.so.1...done. > Loaded symbols for /usr/lib/libxnet.so.1 > Reading symbols from /usr/lib/libc.so.1...done. > Loaded symbols for /usr/lib/libc.so.1 > Reading symbols from /usr/lib/libdl.so.1...done. > Loaded symbols for /usr/lib/libdl.so.1 > Reading symbols from /usr/lib/libmp.so.2...done. > Loaded symbols for /usr/lib/libmp.so.2 > Reading symbols from /usr/platform/SUNW,UltraSPARC-IIi-cEngine/lib/libc_psr.so.1...done. > Loaded symbols for /usr/platform/SUNW,UltraSPARC-IIi-cEngine/lib/libc_psr.so.1 > Reading symbols from /usr/lib/libthread.so.1...done. > Loaded symbols for /usr/lib/libthread.so.1 > #0 0xff0d9a04 in __sigprocmask () from /usr/lib/libthread.so.1 > (gdb) bt > #0 0xff0d9a04 in __sigprocmask () from /usr/lib/libthread.so.1 > #1 0xff0ce460 in _resetsig () from /usr/lib/libthread.so.1 > #2 0xff0cdc00 in _sigon () from /usr/lib/libthread.so.1 > #3 0xff0d0c14 in _thrp_kill () from /usr/lib/libthread.so.1 > #4 0xff14afe8 in raise () from /usr/lib/libc.so.1 > #5 0xff1357c4 in abort () from /usr/lib/libc.so.1 > #6 0x29324 in do_object_queue_mark () > #7 0x29d50 in ol_object_check () > #8 0x1f70c in do_handle_dest_writer (c=0x9ffc0, msg=0x60314) at affile.c:247 > #9 0x20c90 in do_handle_affile_log (c=0x4a7d0, msg=0x60314) at affile.c:738 > #10 0x1866c in do_handle_log (c=0x4a8d8, msg=0x60314) at destinations.c:103 > #11 0x17374 in do_distribute_log (c=0x47020, msg=0x60314) at center.c:149 > #12 0x169a8 in do_add_source_name (c=0x4a748, logmsg=0x60314) at sources.c:238 > #13 0x225e0 in do_handle_afinet_line (c=0x470c0, msg=0x60314) at afinet.c:107 > #14 0x160bc in do_handle_line (self=0x47108, length=110, > data=0x47120 "<189>121625: Oct 10 14:30:57 MESZ: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:1, changed state to upolding time expiredired0 secondsws-gtso-de15) 2/6 (1)..net) 2/48 (1)..", addr=0xffbef518, addrlen=16) > at sources.c:67 > #15 0x162f4 in do_read_line (h=0x470a0, read=0xffbef6b8) at sources.c:105 > #16 0x27bc4 in read_callback () > #17 0x27870 in io_iter () > #18 0x153ac in main_loop (backend=0x42eb0) at main.c:174 > #19 0x15e8c in main (argc=4, argv=0xffbefb2c) at main.c:469 > (gdb) q > root@host [/root] >>

1 0