February 2001 - syslog-ng - lists.balabit.hu

syslogging with perl
by Bernd Jucknischke 14 Feb '01

14 Feb '01

Hi all! I've just been facing a strange problem. Attached you'll find a perl script. I've been running this script on different machines with different results (the path to perl has been adapted, of course): machinetype logging daemon OS Perl result pc syslogd Debian unstable 5.6 doesn't work Sun syslogd Solaris 2.6 5.004_4 works Sun syslog-ng Solaris 2.6 5.004_4 doesn't work Did anybody ever experience problems like that? I'd say it's perl related, but I'm not sure; any hint or advice is appreciated. TIA, Bernd

2 3

Re: [syslog-ng]Trying to send log over network
by Simeon Johnston 14 Feb '01

14 Feb '01

Same problem sim Don Armstrong wrote: > On Tue, 13 Feb 2001, Simeon Johnston wrote: > > I am trying to send logs over our network but am having trouble with the > > rules. I have set up a host to accept the logs and I am trying to set > > up the sender. This is the destination rule so far. > > > > destination d_bg { tcp(ip(192.168.1.19) port(514)); }; > > This should be > > destination d_bg {tcp(ip(192.168.1.19); port 514););}; > > Don Armstrong > > --------------------------------------------------- > UC Riverside | .naidnE elttil atah I > Residential Computing | > http://resnet.ucr.edu | http://www.donarmstrong.com > ---------------------------------------------------

2 1

Re: [syslog-ng]syslog-ng performance problem
by Balazs Scheidler 13 Feb '01

13 Feb '01

> I think the server has enough CPU and memory resources (Pentium III 650 > with 1Gb RAM) to handle the logs incoming from the web servers as it > works fine at the beginning without loosing messages and the performace > decreases progressively instead of from the beginning. I think I could > solve the problem with the appropiate gc_idle_threshold() and > gc_busy_threshold() settings (now I using the default values), but I'm > not sure if it would be the solution and in this case I don't know how > to calculate the right values for these para meters. > > Any advice? What about first upgrading to 1.4.10 ? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]syslog-ng performance problem
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Feb '01

13 Feb '01

You need to upgrade to a new version. This was a well known problem on some of the earlier 1.4 versions of syslog-ng for some OS's. Subsequent releases have cleared this up. Look at http://www.balabit.hu/en/products/syslog-ng/ That is the syslog-ng home page. Regards Drew > -----Original Message----- > From: Santiago Gomez Cano [SMTP:santiago.gomez@tiscalinet.es] > Sent: Tuesday, February 13, 2001 12:16 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]syslog-ng performance problem > > Hi > > I'm using the syslog-ng 1.40rc3-3 deb package running on a Debian > GNU/Linux box collectin logs from 3 different web serves. > > When starting the syslgog-ng daemon it begins using a reasonable CPU > amount (about 2 or 4%), sleeping most of the time and running when > someone access our web pages and the logging server receives logs from > the web servers. The CPU usage increases to 5 or 6% after one hour > running and keeps on growing up to saturate the server with a 99.99% CPU > usage about two or three ours after the start. > > I think the server has enough CPU and memory resources (Pentium III 650 > with 1Gb RAM) to handle the logs incoming from the web servers as it > works fine at the beginning without loosing messages and the performace > decreases progressively instead of from the beginning. I think I could > solve the problem with the appropiate gc_idle_threshold() and > gc_busy_threshold() settings (now I using the default values), but I'm > not sure if it would be the solution and in this case I don't know how > to calculate the right values for these para meters. > > Any advice? > > -- > Santiago Gomez Cano > Systems Administrator / Administrador de Sistemas > santiago.gomez(a)tiscali.es > Tiscali Telecomunicaciones, S.A. > www.tiscali.es > T. +34 918370546 > T. +34 699459573 > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslog-ng performance problem
by Santiago Gómez Cano 13 Feb '01

13 Feb '01

Hi I'm using the syslog-ng 1.40rc3-3 deb package running on a Debian GNU/Linux box collectin logs from 3 different web serves. When starting the syslgog-ng daemon it begins using a reasonable CPU amount (about 2 or 4%), sleeping most of the time and running when someone access our web pages and the logging server receives logs from the web servers. The CPU usage increases to 5 or 6% after one hour running and keeps on growing up to saturate the server with a 99.99% CPU usage about two or three ours after the start. I think the server has enough CPU and memory resources (Pentium III 650 with 1Gb RAM) to handle the logs incoming from the web servers as it works fine at the beginning without loosing messages and the performace decreases progressively instead of from the beginning. I think I could solve the problem with the appropiate gc_idle_threshold() and gc_busy_threshold() settings (now I using the default values), but I'm not sure if it would be the solution and in this case I don't know how to calculate the right values for these para meters. Any advice? -- Santiago Gómez Cano Systems Administrator / Administrador de Sistemas santiago.gomez(a)tiscali.es Tiscali Telecomunicaciones, S.A. www.tiscali.es T. +34 918370546 T. +34 699459573

1 0

strange logfile appearance
by Wiktor Wodecki 06 Feb '01

06 Feb '01

ello, I'm in the test-phase of my loggingserver. and syslog-ng started to create a logfile I don't understand why it did that. This is my conf, it's a fairly easy setup. (striped other unimportant stuff) options { long_hostnames(yes); sync(0); time_reap(10); use_time_recvd(yes); use_dns(yes); use_fqdn(yes); create_dirs(yes); log_fifo_size(10000); chain_hostnames(yes); }; source oldserver { udp(ip(xxx.xxx.xxx.xxx) port(514)); }; destination blackhole { file("/var/log/frontier/$YEAR$MONTH/$HOST"); }; destination blackhole_auth { file("/var/log/frontier/$YEAR$MONTH/$HOST-auth"); }; destination blackhole_crit { file("/var/log/frontier/$YEAR$MONTH/$HOST-crit"); }; destination blackhole_emerg { file("/var/log/frontier/$YEAR$MONTH/$HOST-emerg"); }; destination blackhole_err { file("/var/log/frontier/$YEAR$MONTH/$HOST-err"); }; destination blackhole_messages { file("/var/log/frontier/$YEAR$MONTH/$HOST-messages"); }; destination blackhole_warn { file("/var/log/frontier/$YEAR$MONTH/$HOST-warn"); } log { source(oldserver); destination(blackhole); }; log { source(oldserver); filter(f_auth); destination(blackhole_auth); }; log { source(oldserver); filter(f_crit); destination(blackhole_crit); }; log { source(oldserver); filter(f_emerg); destination(blackhole_emerg); }; log { source(oldserver); filter(f_err); destination(blackhole_err); }; log { source(oldserver); filter(f_messages); destination(blackhole_messages); }; log { source(oldserver); filter(f_warn); destination(blackhole_warn); }; The syslog-ng ran for the last 10 days without problems, however today I discovered three new logfiles. -rw------- 1 root root 119 Feb 1 10:43 last -rw------- 1 root root 60 Feb 1 05:45 last-messages -rw------- 1 root root 60 Feb 1 05:45 last-warn erwin:/var/log/frontier/200102# cat last Feb 1 05:45:23 last/ns2.xxx.net message repeated 2 times Feb 1 10:43:27 last/ns2.xxx.net message repeated 1 time erwin:/var/log/frontier/200102# cat last-messages Feb 1 05:45:23 last/ns2.xxx.net message repeated 2 times erwin:/var/log/frontier/200102# cat last-warn Feb 1 05:45:23 last/ns2.xxx.net message repeated 2 times The box the logs came from is a sparc10 with solaris5.8. The orginal logfile statements were: Feb 1 05:45:23 sparky last message repeated 2 times ... Feb 1 10:47:50 sparky last message repeated 1 time There are plenty of other "last message repeated..." lines in sparky's logfile, so I don't see a reason *why* those both got logged seperately. The first logentry repeated a warn-message, the other one a notice-message. Can anyone give me a hint please? The version I use is 1.4.10 on linux. (syslog-ng doesn't run yet on the sparc10. I export the logs via the goold old "*.crit,*.warn,etc,etc. @hostname way") -- Regards, Wiktor Wodecki, Unix Administration | Wapme-Systems AG Tel.: +49-211-748450 | Muensterstrasse 248 Fax: +49-211-74845176 | 40470 Duesseldorf E-Mail: wodecki(a)wapme-systems.de | http://www.wapme-systems.de

1 1

Core
by Brian E. Seppanen 01 Feb '01

01 Feb '01

Syslog-ng dumped on the 29th, and running gdb --core=core gives the following. What's signal 6? Any ideas appreciated. Core was generated by `syslog-ng -f /usr/local/etc/syslog-ng.conf -p /var/run/syslog-ng.pid'. Program terminated with signal 6, Aborted. #0 0x40068dd1 in ?? () This is on a redhat 7.0 box. Syslog-ng 1.4.10. Thanks... Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

2 1