October 2001 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]Disabling stats for syslog-ng
by Nicholas Berry 09 Oct '01

09 Oct '01

I was able to compile after defining PATH_SYSCONFDIR. This was not auto-generated when running ./configure, will this be fixed in the future or should I jot this down for future reference? -Nick -----Original Message----- From: Balazs Scheidler Sent: Tue 10/9/2001 2:31 AM To: syslog-ng(a)lists.balabit.hu Cc: Subject: Re: [syslog-ng]Disabling stats for syslog-ng On Thu, Oct 04, 2001 at 09:59:11AM -0700, Nicholas Berry wrote: > I have the GNU gcc 2.95.3, make, automake, autoconf, and libol 0.2.24 > > Here is the error I get after "./configure > --with-libol=/tmp/libol-0.2.24 && make" > gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.10/src -I. -g -O2 -Wall > -I/tmp/libol-0.2.24/src -D_GNU_SOURCE -c main.c > main.c:47: `PATH_SYSCONFDIR' undeclared here (not in a function) > main.c:47: parse error before string constant > main.c: In function `usage': > main.c:318: parse error before `PATH_SYSCONFDIR' > main.c: In function `main': > main.c:396: warning: passing arg 2 of `resolve_user_group' from > incompatible pointer type > main.c:396: warning: passing arg 3 of `resolve_user_group' from > incompatible pointer type > main.c:400: warning: passing arg 2 of `resolve_group' from incompatible > pointer type > *** Error code 1 > make: Fatal error: Command failed for target `main.o' is PATH_SYSCONFDIR defined in your config.h? (it is in mine) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Encrypted messages
by Forrest Aldrich 09 Oct '01

09 Oct '01

Where are the plans of implementing encrypted messaging/logging?

5 14

RE: [syslog-ng]Disabling stats for syslog-ng
by Nicholas Berry 09 Oct '01

09 Oct '01

I have the GNU gcc 2.95.3, make, automake, autoconf, and libol 0.2.24 Here is the error I get after "./configure --with-libol=/tmp/libol-0.2.24 && make" gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.10/src -I. -g -O2 -Wall -I/tmp/libol-0.2.24/src -D_GNU_SOURCE -c main.c main.c:47: `PATH_SYSCONFDIR' undeclared here (not in a function) main.c:47: parse error before string constant main.c: In function `usage': main.c:318: parse error before `PATH_SYSCONFDIR' main.c: In function `main': main.c:396: warning: passing arg 2 of `resolve_user_group' from incompatible pointer type main.c:396: warning: passing arg 3 of `resolve_user_group' from incompatible pointer type main.c:400: warning: passing arg 2 of `resolve_group' from incompatible pointer type *** Error code 1 make: Fatal error: Command failed for target `main.o' _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048 -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, October 04, 2001 9:26 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Disabling stats for syslog-ng On Thu, Oct 04, 2001 at 08:56:55AM -0700, Nicholas Berry wrote: > I could not get 1.5.10 to compile under Solaris 8. > > Is there a patch released to fix this? And what was the problem? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

filtering programs and subprograms
by Baltasar Cevc 06 Oct '01

06 Oct '01

Hi, everybody! I'm using Syslog-NG on a Linux server - as I like the great set of features it supports. Now I wonder if there is any possibility to filter the program name and the next field (e.g. "kernel" and is "IN="). I need this in order to separate the packet filter logs from the other kernel stuff. Thanx for help in advance. bye.baltasar ::: B A L T A S A R C E V C mailto: baltasar(a)cevc-topp.de Tel.: +49 89 99020515

2 1

Help on fine tunning/bottlenecks
by Huelbe Arizon Garcia 05 Oct '01

05 Oct '01

Hello, [First of all, I would like to apologize for the long message...] In our company, we have lots of Network Access Servers (aka NAS) which we would like to have syslog. We tried to use the original syslog packed with Linux and we found it was 'dropping' a lot of information. Then, we changed to syslog-ng a few months ago. The results are much better, but the logs are still incomplete. It seems to have some 'bottleneck': when I put an equipment sending logs both to my main syslog server (which runs syslog-ng and receives syslog from all NAS) and other box running only common syslog (receiving external syslog only from this equipment), this second Linux box gets much more information than the first one (almost twice more events/lines). Well, I would like to ask for some tips to find the bottleneck or some configuration fine-tunning. I'll appreciate all comments. Here is my scenario: Main log server: Linux 2.2.14-5.0 Intel Pentium II 450Mhz 64 Mbytes RAM hda: QUANTUM FIREBALL CR6.4A, 6149MB w/418kB Cache (System disk) IDE hdc: QUANTUM FIREBALLlct15 30, 28629MB w/418kB Cache (Log files disk) IDE The syslog-senders (NAS): There are about 70 NAS, each sending up to 15Mbytes/day (about 115.000 lines) of syslog messages. When the log file is cut/rotated (at midnight sharp), the log file has about 600Mbytes The syslog-ng Version 1.5.9 Options configured: options { long_hostnames(off); use_dns(no); log_fifo_size(10000); gc_busy_threshold(10000); gc_idle_threshold(500); }; After running syslog for 20 hours, 'top' shows: 9:35pm up 175 days, 14:48, 1 user, load average: 0.38, 2.28, 2.59 29 processes: 28 sleeping, 1 running, 0 zombie, 0 stopped CPU states: 3.3% user, 1.3% system, 0.0% nice, 95.2% idle Mem: 64104K av, 58496K used, 5608K free, 9852K shrd, 4800K buff Swap: 265032K av, 4304K used, 260728K free 42520K cached PID USER PRI NI SIZE RSS SHARE STAT LIB %CPU %MEM TIME COMMAND 21337 root 20 0 512 472 176 S 0 3.5 0.7 108:16 syslog-ng (The load average is a little higher than normal as I ran grep/wc commands to check some statistics in this mail) Regards, Huelbe Garcia.

1 0

RE: [syslog-ng]Disabling stats for syslog-ng
by Nicholas Berry 04 Oct '01

04 Oct '01

I could not get 1.5.10 to compile under Solaris 8. Is there a patch released to fix this? _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048 -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, October 04, 2001 3:58 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Disabling stats for syslog-ng On Wed, Oct 03, 2001 at 09:25:00AM -0700, Nicholas Berry wrote: > My log is flooded with messages like the one listed below: Oct 3 > 16:22:04 local@smf-syslog syslog-ng[364]: STATS: dropped 0 > > Can I disable this? upgrade to 1.5.10 -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Documentation
by Ohrberg, Mick 04 Oct '01

04 Oct '01

Hi all, Is there any new, fully updated documentation (or a will to create such) for syslog-ng? I think that some well-written documentation would alleviate a lot of the questions that have been raised here. I also believe that a FAQ of some sort would be helpful. *plink of $.02* /Mick

2 1

Disabling stats for syslog-ng
by Nicholas Berry 04 Oct '01

04 Oct '01

My log is flooded with messages like the one listed below: Oct 3 16:22:04 local@smf-syslog syslog-ng[364]: STATS: dropped 0 Can I disable this? Is there documentation that outlines _all_ available parameters for the various directives (options, file, log, etc)? _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048

2 1

Computer name
by Laurent 04 Oct '01

04 Oct '01

Hello, Is some one can tell me how can i have ip adresse instead of the computer's name in log files ? Thanks -- Best regards, Laurent mailto:lau@ovh.net

2 1

TCP/IP connection - server SIGHUP problem
by Roman Ernst 03 Oct '01

03 Oct '01

First of all: thanks for your help with my little TCP/IP connection-drop-determination-problem. Of course the idea using a monitoring software would solve the problem, but I think many people don't have / use such a tool... So... it should be possible to catch such an error by other means... Somebody wrote that i could figure out via "netstat -an | grep tcp ...." whether connection is okay or not. Unfortenately when plugging out the network cable AIX does not recognize this, i.e. with netstat -an the connection seems to be still available. Only the client tries to close the connection when he tries to send a log message and can't reach the log server (after TCP timeout...). So... the client isn't the problem. But the server never tries to send a package to the client... so he will never recognize whether the client is available or not. Maybe it would be useful to introduce some sort of TCP heartbeat (server sends some packages to the client every xxx minutes) . This way the server take care of unreachable clients and logs such problems... If I'm totally wrong with my opinion please let me know... Okay... another problem: Sending a SIGHUP to the syslog-ng client results in restarting syslog-ng on the client, dropping connection to server, reconnecting to the server and initializing the new configuration (=> that's what the server log says...) => is it really necessary to drop the connection? Sending a SIGHUP to the syslog-ng server results in restarting the syslog-ng on the server and initializing the new configuration (that's what the server log says...) => So far so good... now the problem. If the client tries to send messages to the server the following happens (CLIENT and SERVER LOG) AF_INET client connected from 10.x.x.1, port xxxxx (SERVER LOG) io.c: do_write: write () failed (errno 32), Broken pipe (CLIENT + SERVER LOG) pkt_buffer::do_flush(): Error flushing data (CLIENT + SERVER LOG) Connection broken to AF_INET 10.x.x.2, reopening in 10 seconds (CLIENT + SERVER LOG) AND: one log message is missing afterwards... Okay... that's it. Maybe someone can help me. Thanks in advance! Best regards Roman Ernst

2 1