April 2001 - syslog-ng - lists.balabit.hu

syslog-ng problem description(again)
by Bencsath Boldizsar 13 Apr '01

13 Apr '01

So the exact problem was the following, who missed it: syslog-ng doesn't start if a unix socket soruce exists in the config file ( source src { unix-stream("/dev/log"); internal(); file("/proc/kmsg"); }; ) strace: [pid 14144] unlink("/dev/log") = -1 ENOENT (No such file or directory) [pid 14144] bind(4, {sin_family=AF_UNIX, path=" /dev/log"}, 110) = -1 EPERM (Operation not permitted) (Apr 12 19:02:24 db rsbac_adf_request_rc(): rsbac_get_attr() returned error -1017! Apr 12 19:02:24 db rsbac_adf_request(): request READ_WRITE_OPEN, caller_pid 15361, caller_prog_name syslog-ng, caller_uid 0, target-type IPC, tid ???-ID 134521299, attr sockaddr, value 3437575888, result NOT_GRANTED by RC) Two problems: why has the bind command 110 bytes path attribute, why not only "/dev/log". But: However why does rsbac stops at such ipc requests. workaround: delete unix-stream from the syslog-ng config file. problem on: 2.4.3+rsbac 1.2.1 pre 1 , 1.1.1, no problem on emergency kernel (I'm not really sure cause at one boot it said there is some problem but after that it worked) with: syslog-ng (potato,unstable) in debian, and syslog-ng 1.4.11 and 1.5.5a from source boldi

2 3

reopening of udp connections
by klaas.vangend＠philips.com 13 Apr '01

13 Apr '01

Hi, We use syslog-ng to log messages from our Linux PC to one or more Windows NT PCs running a propriatary tool to display and maintain log and statistics information of a Linux app. Approx every second a log message is sent using UDP. Unfortunately, if the NT log application is not running, the NT box returns an ICMP message, stating that the chosen UDP port number is not listened to. Then syslog-ng pauses sending UDP logs, and retries after 60 seconds. It also logs a message stating that the UDP connection was broken. (which isn't true because UDP doesn't create connections) If succesfull, it then sends all (?) accumulated log messages at once. If our NT app starts immediately after syslog-ng paused, we don't receive any logging for 59 seconds... This is unwanted behaviour for our system. I know that I can have syslog-ng retry more often, but I don't want retries. Every UDP packet should "just disappear" if not delivered, and every packet should be sent anyway, thus having "below second" responsetime. (This is what happens if NT didn't return those darn ICMP messages). How should I proceed? -- Groetjes, Klaas --------------------------------------------------------------------- Philips CryptoWorks 040-2722600 klaas.vangend(a)philips.com Sioux Technische Software Ontwikkeling BV 040-2677100 klaas.van.gend(a)sioux.nl

2 1

Re: question
by Balazs Scheidler 13 Apr '01

13 Apr '01

On Thu, Apr 12, 2001 at 04:03:08PM -0400, Andrew Ryder wrote: > Any planned support for injection into mysql logs? you could use the tamplate feature in 1.5.5 and pipes: destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO log (date, host) VALUES ('$YEAR-$MONTH-$DAY', '$HOST')\n") template-escape(yes) }; and run mysql client reading sql from the pipe: mysql -h <host> LOG < /tmp/mysql.pipe of course the pipe should be located some protected directory with appropriate permissions. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

log statement parsing
by John_Delisle＠ceridian.ca 12 Apr '01

12 Apr '01

Hi guys, Anyone know how syslog-ng handles the log statements when you have two log statements that would apply? I think this will make more sense after looking at the example. source s_src { unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514));}; destination d_messages { file("/var/log/messages"); }; destination d_test { file("/var/log/test"); }; filter f_test { host("testhost"); }; filter f_local7 { facility(local7); }; log { source(s_src); filter(f_test); filter(f_local7); destination(d_test); }; log { source(s_src); filter(f_local7); destination(d_messages); }; Would messages sent from host "testhost" with facility local7 go to just the first or both logs? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

2 1

Logrotate problems
by Simeon Johnston 12 Apr '01

12 Apr '01

I am trying to rotate the logs but am having problems with logrotate. This may not be a problem with syslog-ng. This is the command used. /var/log/logfile { postrotate /usr/bin/killall -HUP `cat /var/run/syslog-ng.pid` endscript } The problem with this is that the syslog-ng.pid file seems to be generated in whatever directory you started syslog-ng from instead of /var/run/*. Is this a configuration problem of the system? If a system problem how do I go about fixing it ( if this is not too far off topic )? Is there a simpler way to send an HUP signal? I am using Redhat-6.2 on an ALPHA with syslog-ng 1.4.11. Thanks, sim

2 3

Re: [syslog-ng]umask/perm (was: Re: One last try...)
by John_Delisle＠ceridian.ca 12 Apr '01

12 Apr '01

I take it that means it doesn't work yet? I'm not complaining, I love syslog-ng, but that should be in the release notes! =) John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 |--------+--------------------------------> | | Balazs Scheidler | | | <bazsi(a)balabit.hu> | | | Sent by: | | | syslog-ng-admin(a)lists.| | | balabit.hu | | | | | | | | | 2001/04/12 08:30 AM | | | Please respond to | | | syslog-ng | | | | |--------+--------------------------------> >-----------------------------------------------------------------------------------------------------------| | | | To: syslog-ng(a)lists.balabit.hu | | cc: | | Subject: Re: [syslog-ng]umask/perm (was: Re: One last try...) | >-----------------------------------------------------------------------------------------------------------| > > destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) > > create_dirs(yes) dir_perm(0755)); }; > > > > When it creates them instead of being 755 and 644, they are 700 and 600. > > > > Can anyone help? Is this a known issue? Has anyone got it working > > correctly? How is syslog-ng changing the perms, maybe I'm missing some > > system call or something! I'm open to suggestions/tips!! > > has explicit setting of modes ((f)chmod() vs. open() with mode_t) made > it into the source yet? nope. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

1 0

umask/perm (was: Re: One last try...)
by Gregor Binder 12 Apr '01

12 Apr '01

John_Delisle(a)ceridian.ca on Tue, Apr 10, 2001 at 03:09:51PM -0500: Hi everybody, > destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) > create_dirs(yes) dir_perm(0755)); }; > > When it creates them instead of being 755 and 644, they are 700 and 600. > > Can anyone help? Is this a known issue? Has anyone got it working > correctly? How is syslog-ng changing the perms, maybe I'm missing some > system call or something! I'm open to suggestions/tips!! has explicit setting of modes ((f)chmod() vs. open() with mode_t) made it into the source yet? Regards, -- Gregor Binder <gregor.binder(a)sysfive.com> http://sysfive.com/ sysfive.com GmbH UNIX. Networking. Security. Applications. PGP id: 0x20C6DA55 fp: 18AB 2DD0 F8FA D710 1EDC A97A B128 01C0 20C6 DA55

2 1

Re: syslog-g and bsdi
by Balazs Scheidler 11 Apr '01

11 Apr '01

> I was wondering if anyone has a compatible function to replace strptime. > this is a function that is not included in BSDI (4.0+ a least) > if no one has coded a replacement, i would be willing to add another patch > to fix it. > otherwise, you should take off "this has been compiled for bsdi" on the I was wondering if you tried compiling syslog-ng 1.5 which included such a compatibility strptime() function. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

Linux boxes periodically stop logging?
by James Snow 10 Apr '01

10 Apr '01

I apologize for the lack of technical detail in this post, but, for the moment I'm just trying to ascertain if I or my syslog-ng config are on drugs. Basically, I have a mixed array of Linux (RedHat 6.2 & 7) and FreeBSD (4.2-S) machines on which I'm running syslog-ng and logging to a central host. (FreeBSD 4.2-S) The problem is that the Linux boxes periodically stop logging. If I send the daemon a HUP, it comes back to life and data starts flowing again, but any log messages that would have appeared while the daemon was hosed are gone. Has anyone experienced anything like this before? Thanks in advance, -Snow

4 4

odd problem
by jon＠dumbo.pobox.com 10 Apr '01

10 Apr '01

i noticed yesterday that syslog-ng won't log to anything in a destination() section if one of them fails. we have a remote logging machine colocated somewhere...here is its config(just the useful stuff) destination macrogenerateddaily { tcp(208.210.124.50 port(514)); file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" dir_per m(0755) perm(0644)); }; destination macrogeneratedhourly { tcp(208.210.124.50 port(514)); file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY.$HOUR" d ir_perm(0755) perm(0644)); }; now....we lost internet connectivity (so the tcp link failed) unfortunately, it also stopped logging to the disk. does it log to destinations, then just die as soon as one fails?

4 6