March 2001 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]1.4.11 fixes SIGHUP problems?
by John_Delisle＠ceridian.ca 18 Apr '01

18 Apr '01

I'm not sure thats a bug, it may be a feature actually. If you look at /var/log/messages, theres an entry saying the new config is bad, and syslog-ng will continue running with the old config. This prevents lost syslog messages. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 jon(a)dumbo.pobox.com Sent by: To: syslog-ng(a)lists.balabit.hu syslog-ng-admin@lists. cc: balabit.hu Subject: Re: [syslog-ng]1.4.11 fixes SIGHUP problems? 2001/03/12 11:21 AM Please respond to syslog-ng i noticed one problem. if the configuration file is broken to the point syslog-ng will not start, HUP does not notice this ie. if you forget a semicolon somewhere kill -HUP syslog-ng-pid works w/o erros but kill syslog-ng-pid and syslog-ng dies... y On Fri, Mar 09, 2001 at 10:01:08AM +0100, Balazs Scheidler wrote: | Hi, | | I was wondering whether the 1.4.11 release did really fix the SIGHUP | problems many of you encountered? Some feedback would be useful. | | TIA, | -- | Bazsi | PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 | | _______________________________________________ | syslog-ng maillist - syslog-ng(a)lists.balabit.hu | https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

6 7

Re: syslog-g and bsdi
by Balazs Scheidler 11 Apr '01

11 Apr '01

> I was wondering if anyone has a compatible function to replace strptime. > this is a function that is not included in BSDI (4.0+ a least) > if no one has coded a replacement, i would be willing to add another patch > to fix it. > otherwise, you should take off "this has been compiled for bsdi" on the I was wondering if you tried compiling syslog-ng 1.5 which included such a compatibility strptime() function. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

Syslog Logging Delay
by Brian E. Seppanen 06 Apr '01

06 Apr '01

Here it stops again at approx 10:44 a.m. EST. Again UDP:514 is 65550. Packets are still coming. No logging. Tried logging via logger and no messages. 10:53 a.m. EST it starts again. vmstat doesn't indicate much disk activity blocking either in or out either before or after. After it picks up again the messages I logged via logger are logged. Utilization on the box is pretty steady. Swap neither grows, nor diminishes. Memory is used for the most part, maybe about 10MB free. Lots of shared memory. Graphs show loopback at 10:45 is quite active comparitively. This is from a dump of an rrdtool database monitoring loopback utilization. This doesn't correlate to other times when I've seen the problem though, specifically when it stopped logging at 10:10 p.m. EST. Normall readings for the graph are around 2.e+01.  <row><v> 2.8297444075e+01 </v><v> 2.8297444075e+01 </v></row>  <row><v> 5.7677917503e+01 </v><v> 5.7677917503e+01 </v></row>  <row><v> 9.0888004719e+01 </v><v> 9.0888004719e+01 </v></row> POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN, revents=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 6000) = 1 recvfrom(5, "<133>559901: 4w3d: %UBR7200-5-MA"..., 1024, 0, {sin_family=AF_INET, sin_port=htons(49364), sin_addr=inet_addr("24.247.48.35")}}, [16]) = 163 time(NULL) = 985880402 time(NULL) = 985880402 time(NULL) = 985880402 time(NULL) = 985880402 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 1 write(7, "Mar 29 10:40:02 24.247.48.35 559"..., 188) = 188 time(NULL) = 985880402 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 17, 4000) = 1 read(3, I don't know. Nothing to correlate it to stopping at 10:10:00 p.m. EST last night though... I'm just not seeing anything that sticks out to indicate where a problem might be. Can someone who is running a central logging server indicate how they have configured syslog-ng, as far as log_fifo_size, garbage collection options, number of objects alive at any one time after running for a while, sync options? I would appreciate it, greatly. Thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

3 12

AIX error
by Kathia Juca 02 Apr '01

02 Apr '01

Hi I'm running syslog-ng 1.4.11 on AIX . I intend log 80 machines to one hosts using syslog-ng. But, I use one server for compile. I need install in 80 machines . What syslog-ng and libol packages ??. Can'I transfer code after compile ?? I tried transfer and error message was : # /usr/local/sbin/syslog-ng Could not load program /usr/local/sbin/syslog-ng Symbol io_callout_set_drop in syslog-ng is undefined Symbol io_callout_flush in syslog-ng is undefined Error was: Exec format error What's right procedure for this ?? Thanks Kathia Juca Universidade Federal de Santa Catarina Florianopolis - Santa Catarina - Brazil

2 1

RE: [syslog-ng]Feature Request
by Andrew Fort 01 Apr '01

01 Apr '01

> Next thing to ask for is a feature request that would make our use of > syslog infintely more flexible: a string formatter module. Take this > hypothetical syslog-ng.conf entry as an example: the 1.5 development releases allow you to specify what fields to go the output for some destinations. i've attached a previous post of mine with the field list inside, and quoting Balazs' original feature announcement. you may be able to use this in conjunction with other facilities, a log watcher, the program destination, whatever, to achieve your goal. -afort

5 9

Syslog-ng and a log checker
by Dennis Kruyt 01 Apr '01

01 Apr '01

Hi, I'm logging from about 20 machines to a log server and i want to use a program that checks the log files. So wich program works good with syslog-ng??? Dennis,

2 1

Syslog-NG Performance
by Scott, Joshua 30 Mar '01

30 Mar '01

I plan on using 1 server with Syslog-ng to maintain all of the log files for my firewalls. I want to make sure I don't overload this server. This server is a PIII 800Mhz with 512MB ram. At this point the amount of data I'll be sending to syslog-ng will be approx 2GB daily. Can anyone tell me how what experiences they've had with this type of scenario? Is there a limit to the amount of devices syslog-ng can handle? > Joshua Scott > Security Systems Analyst > Jacobs Engineering Group > IS - Network Services > 1111 South Arroyo Parkway > Pasadena, California, 91105 > Office: (626) 568-7024 > Mobile: (866) 810-5234 > Fax: (626) 578-6967 >

2 1

RE: [syslog-ng]syslog-ng 1.5.5 compilation trouble
by Ohrberg, Mick 30 Mar '01

30 Mar '01

Bazsi, That did it! With one exception. I had to add #ifndef INADDR_NONE #define INADDR_NONE ((unsigned long) -1) #endif to nscache.c, but after that, it compiled like a champ! (Sorry, don't know how to make patches... :-/ ) Thanks!! > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Friday, March 30, 2001 9:09 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]syslog-ng 1.5.5 compilation trouble > > > On Fri, Mar 30, 2001 at 08:13:59AM -0600, Ohrberg, Mick wrote: > > Hmm, Maybe I'm just messing up horribly on this wonderful > Friday morning. I > > can't compile syslog-ng 1.5.5! > > > > ... > > checking whether to enable Sun STREAMS support... yes > > checking whether to enable Sun door support... yes > > checking libol version >= 0.2.22... ./configure: !: not found > > ok > > updating cache ./config.cache > > ... > > > > Woah there! I DO have libol 0.2.22 installed! I found a > problem in my > > configure... Anyone else run into this problem? Instead of doing > > > > if ! test -x ... > > > > I changed it to > > > > if [ ! -x ... ]; do > > ops... bash eats the first construct, but it doesn't seem to > be portable. > > nscache.h seems to be missing from the dist. The patch below fixes the > problem above, and adds nscache.h: > > diff -urN syslog-ng-1.5.5/configure syslog-ng-1.5.5a/configure > --- syslog-ng-1.5.5/configure Fri Mar 30 14:12:39 2001 > +++ syslog-ng-1.5.5a/configure Fri Mar 30 17:03:02 2001 > @@ -700,7 +700,7 @@ > > PACKAGE=syslog-ng > > -VERSION="1.5.5" > +VERSION="1.5.5a" > > if test "`cd $srcdir && pwd`" != "`pwd`" && test -f > $srcdir/config.status; then > { echo "configure: error: source directory already > configured; run "make distclean" there first" 1>&2; exit 1; } > @@ -2670,7 +2670,7 @@ > echo "configure:2671: checking libol version >= > $LIBOL_REQ_MAJOR.$LIBOL_REQ_MINOR.$LIBOL_REQ_PATCH" >&5 > > if test "$with_libol" = ""; then > - if ! test -x `which libol-config` ; then > + if test ! -x `which libol-config` ; then > { echo "configure: error: libol-config not > found, either install libol or supply its location with > --with-libol" 1>&2; exit 1; } > fi > LIBOL_VERSION=`libol-config --version` > @@ -2678,7 +2678,7 @@ > LIBOL_LIBS=`libol-config --static-libs` > MAKE_CLASS="make_class" > else > - if ! test -x $with_libol/libol-config; then > + if test ! -x $with_libol/libol-config; then > { echo "configure: error: libol-config not > found in the specified location" 1>&2; exit 1; } > fi > LIBOL_VERSION=`$with_libol/libol-config --version` > diff -urN syslog-ng-1.5.5/configure.in syslog-ng-1.5.5a/configure.in > --- syslog-ng-1.5.5/configure.in Fri Mar 30 14:12:37 2001 > +++ syslog-ng-1.5.5a/configure.in Fri Mar 30 17:02:31 2001 > @@ -1,8 +1,8 @@ > -dnl $Id: configure.in,v 1.32 2001/02/25 12:01:38 bazsi Exp $ > +dnl $Id: configure.in,v 1.33 2001/03/30 15:02:31 bazsi Exp $ > dnl Process this file with autoconf to produce a configure script. > AC_INIT(src/affile.c) > > -AM_INIT_AUTOMAKE(syslog-ng, "1.5.5") > +AM_INIT_AUTOMAKE(syslog-ng, "1.5.5a") > LIBOL_REQ_MAJOR=0 > LIBOL_REQ_MINOR=2 > LIBOL_REQ_PATCH=22 > @@ -148,7 +148,7 @@ > AC_MSG_CHECKING(libol version >= > $LIBOL_REQ_MAJOR.$LIBOL_REQ_MINOR.$LIBOL_REQ_PATCH) > > if test "$with_libol" = ""; then > - if ! test -x `which libol-config` ; then > + if test ! -x `which libol-config` ; then > AC_ERROR([libol-config not found, either > install libol or supply its location with --with-libol]) > fi > LIBOL_VERSION=`libol-config --version` > @@ -156,7 +156,7 @@ > LIBOL_LIBS=`libol-config --static-libs` > MAKE_CLASS="make_class" > else > - if ! test -x $with_libol/libol-config; then > + if test ! -x $with_libol/libol-config; then > AC_ERROR(libol-config not found in the > specified location) > fi > LIBOL_VERSION=`$with_libol/libol-config --version` > diff -urN syslog-ng-1.5.5/doc/sgml/syslog-ng.sgml > syslog-ng-1.5.5a/doc/sgml/syslog-ng.sgml > --- syslog-ng-1.5.5/doc/sgml/syslog-ng.sgml Fri Mar 30 14:41:01 2001 > +++ syslog-ng-1.5.5a/doc/sgml/syslog-ng.sgml Fri Mar 30 15:08:27 2001 > @@ -1074,7 +1074,7 @@ > as commands to the SQL server. > </entry> > <entry> > - a format conforming to default logfile format. > + yes > </entry> > </row> > </tbody> > diff -urN syslog-ng-1.5.5/doc/sgml/syslog-ng.txt > syslog-ng-1.5.5a/doc/sgml/syslog-ng.txt > --- syslog-ng-1.5.5/doc/sgml/syslog-ng.txt Fri Mar 30 14:41:50 2001 > +++ syslog-ng-1.5.5a/doc/sgml/syslog-ng.txt Fri Mar 30 17:03:37 2001 > @@ -553,8 +553,7 @@ > template_escape() yes or no Turns on escaping ' and " in templated > output files. It is useful for generating SQL statements > and quoting > string contents so that parts of your log message don't get > - interpreted as commands to the SQL server. a format conforming to > - default logfile format. > + interpreted as commands to the SQL server. yes > > _________________________________________________________________ > > pipe() > diff -urN syslog-ng-1.5.5/src/Makefile.am > syslog-ng-1.5.5a/src/Makefile.am > --- syslog-ng-1.5.5/src/Makefile.am Sun Feb 25 13:00:22 2001 > +++ syslog-ng-1.5.5a/src/Makefile.am Fri Mar 30 17:02:31 2001 > @@ -1,5 +1,5 @@ > ## Run automake to produce Makefile.in > -## $Id: Makefile.am,v 1.43 2001/02/24 12:38:02 bazsi Exp $ > +## $Id: Makefile.am,v 1.44 2001/03/30 15:02:31 bazsi Exp $ > > YFLAGS = @YFLAGS@ > MAKE_CLASS = @MAKE_CLASS@ > @@ -21,7 +21,8 @@ > afstreams.h \ > afprogram.h \ > utils.h \ > - syslog-names.h > + syslog-names.h \ > + nscache.h > > dist_x_files = \ > cfgfile.h.x \ > diff -urN syslog-ng-1.5.5/src/Makefile.in > syslog-ng-1.5.5a/src/Makefile.in > --- syslog-ng-1.5.5/src/Makefile.in Fri Mar 30 14:41:41 2001 > +++ syslog-ng-1.5.5a/src/Makefile.in Fri Mar 30 17:03:22 2001 > @@ -71,7 +71,7 @@ > > SUBDIRS = . tests > > -dist_h_files = syslog-ng.h cfgfile.h > sources.h center.h filters.h destinations.h > log.h afinter.h affile.h afsocket.h > afuser.h afstreams.h afprogram.h utils.h > syslog-names.h > +dist_h_files = syslog-ng.h cfgfile.h > sources.h center.h filters.h destinations.h > log.h afinter.h affile.h afsocket.h > afuser.h afstreams.h afprogram.h utils.h > syslog-names.h nscache.h > > > dist_x_files = cfgfile.h.x destinations.h.x > log.h.x sources.c.x sources.h.x cfgfile.h.x > center.h.x center.c.x afsocket.h.x afsocket.c.x > afunix.c.x afinet.c.x affile.c.x afuser.c.x > afstreams.c.x afprogram.c.x filters.h.x > filters.c.x main.c.x > diff -urN syslog-ng-1.5.5/src/nscache.h syslog-ng-1.5.5a/src/nscache.h > --- syslog-ng-1.5.5/src/nscache.h Thu Jan 1 01:00:00 1970 > +++ syslog-ng-1.5.5a/src/nscache.h Mon Mar 19 15:13:47 2001 > @@ -0,0 +1,24 @@ > +#ifndef __NSCACHE_H > +#define __NSCACHE_H > + > +#include <config.h> > + > +#if WITH_DEBUG > +#define NSCACHE_DEBUG > +#endif > + > +#include <netinet/in.h> > + > +struct nscache; > + > +struct nscache * nscache_new(int size, int expire, int > expire_failed); > +void nscache_free(struct nscache *); > +char * nscache_lookup(struct nscache *, struct in_addr); > + > +#ifdef NSCACHE_DEBUG > +void nscache_dump(struct nscache *); > +#else > +#define nscache_dump(cache) {} > +#endif > + > +#endif > diff -urN syslog-ng-1.5.5/syslog-ng.spec > syslog-ng-1.5.5a/syslog-ng.spec > --- syslog-ng-1.5.5/syslog-ng.spec Fri Mar 30 14:15:52 2001 > +++ syslog-ng-1.5.5a/syslog-ng.spec Fri Mar 30 17:03:07 2001 > @@ -1,5 +1,5 @@ > %define name syslog-ng > -%define version 1.5.5 > +%define version 1.5.5a > %define release 0 > %define prefix /usr > > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD > 804E C82C 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

syslog-ng 1.5.5 compilation trouble
by Ohrberg, Mick 30 Mar '01

30 Mar '01

Hmm, Maybe I'm just messing up horribly on this wonderful Friday morning. I can't compile syslog-ng 1.5.5! ... checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking libol version >= 0.2.22... ./configure: !: not found ok updating cache ./config.cache ... Woah there! I DO have libol 0.2.22 installed! I found a problem in my configure... Anyone else run into this problem? Instead of doing if ! test -x ... I changed it to if [ ! -x ... ]; do in a few select places. That gets the configure through. I still can't compile though. # make Making all in src make all-recursive Making all in . make: Fatal error: Don't know how to make target `nscache.h' Current working directory /root/Projects/syslog-ng-1.5.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /root/Projects/syslog-ng-1.5.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /root/Projects/syslog-ng-1.5.5/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Am I just being really stupid? *scratches head* Let me know if anyone have this problem and if there's a patch to fix it. :) Thanks all! Regards, -- Mick Öhrberg Open Systems Administrator, UMB Bank na [NYSE:UMBF] Ph: (816)860-1064 Fax: (816)860-3934 PGP: http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0xD98D5C7B

2 1

RE: [syslog-ng]syslog-ng 1.5.5 and libol 0.2.22 released
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 30 Mar '01

30 Mar '01

Bazsi, I would be willing to spend some time updating the docs. It really needs to be done. Any info you wanted to pass on to make the job simpler would be helpful. Drew > -----Original Message----- > From: Balazs Scheidler [SMTP:bazsi@balabit.hu] > Sent: Friday, March 30, 2001 3:14 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]syslog-ng 1.5.5 and libol 0.2.22 released > > Hi, > > I've released syslog-ng 1.5.5 and the corresponding libol 0.2.22 with the > following changes: > > News for the 1.5.5 release > Fri, 30 Mar 2001 14:23:55 +0200 > > * Fixed a bug in -HUP handling (implemented a cleaner solution, > though less tested than in 1.4.11). > * Added DNS cache implemented by Gael Roualland. > * Added klogctl program to control kernel logging level on Linux > (to make it easier to set up a completely klogd-less logging) > * Template support for output files. > * Documentation somewhat updated. > > > some of these functions were implemented in 1.5.3 but that version didn't > have a NEWS entry, that's why I added it here. Somebody requested that > syslog-ng should make it possible to escape templated output files, it's > now > possible with the template-escape() option. I've updated the docs, though > my > changes touch only the surface. > > Any help for updating the documentation is welcome. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1

1 0