April 2001 - syslog-ng - lists.balabit.hu

error connecting to hosts
by Mariusz Bogumil 09 Apr '01

09 Apr '01

My syslog-ng generates me a lot of errors: Error connecting to remote host ( xxx.xxx.xxx.xxx) reatempting in 60 seconds Everything to be OK - only these starnge arrors. All generated massages are handled. I send then to remote host via TCP. I use Sol.2.6 Any suggestions??? Regards marbo

1 0

Re: [syslog-ng]perm and dir_perm not working?
by John_Delisle＠ceridian.ca 06 Apr '01

06 Apr '01

I should mention I've tried this running syslog-ng 1.4.10, 1.4.11, 1.5.5a. On linux kernel 2.4.1, gcc 2.95.2, glibc 2.2. Any help would be greatly appreciated!! John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 |--------+--------------------------------> | | John_Delisle(a)ceridian.| | | ca | | | Sent by: | | | syslog-ng-admin(a)lists.| | | balabit.hu | | | | | | | | | 2001/04/06 10:49 AM | | | Please respond to | | | syslog-ng | | | | |--------+--------------------------------> >-----------------------------------------------------------------------------------------------------------| | | | To: syslog-ng(a)lists.balabit.hu | | cc: | | Subject: [syslog-ng]perm and dir_perm not working? | >-----------------------------------------------------------------------------------------------------------| Hi all, I've been trying without any luck to have syslog-ng create dirs with 755 and files with 644 permissions. I've used the following line: destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) create_dirs(yes) dir_perm(0755)); }; But they are created with the permissions from my umask (022). ie files are 600, not 644. Is this a known issue? Is there a workaround? Any ideas?? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

perm and dir_perm not working?
by John_Delisle＠ceridian.ca 06 Apr '01

06 Apr '01

Hi all, I've been trying without any luck to have syslog-ng create dirs with 755 and files with 644 permissions. I've used the following line: destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) create_dirs(yes) dir_perm(0755)); }; But they are created with the permissions from my umask (022). ie files are 600, not 644. Is this a known issue? Is there a workaround? Any ideas?? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

2 1

Syslog Logging Delay
by Brian E. Seppanen 06 Apr '01

06 Apr '01

Here it stops again at approx 10:44 a.m. EST. Again UDP:514 is 65550. Packets are still coming. No logging. Tried logging via logger and no messages. 10:53 a.m. EST it starts again. vmstat doesn't indicate much disk activity blocking either in or out either before or after. After it picks up again the messages I logged via logger are logged. Utilization on the box is pretty steady. Swap neither grows, nor diminishes. Memory is used for the most part, maybe about 10MB free. Lots of shared memory. Graphs show loopback at 10:45 is quite active comparitively. This is from a dump of an rrdtool database monitoring loopback utilization. This doesn't correlate to other times when I've seen the problem though, specifically when it stopped logging at 10:10 p.m. EST. Normall readings for the graph are around 2.e+01.  <row><v> 2.8297444075e+01 </v><v> 2.8297444075e+01 </v></row>  <row><v> 5.7677917503e+01 </v><v> 5.7677917503e+01 </v></row>  <row><v> 9.0888004719e+01 </v><v> 9.0888004719e+01 </v></row> POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN, revents=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 6000) = 1 recvfrom(5, "<133>559901: 4w3d: %UBR7200-5-MA"..., 1024, 0, {sin_family=AF_INET, sin_port=htons(49364), sin_addr=inet_addr("24.247.48.35")}}, [16]) = 163 time(NULL) = 985880402 time(NULL) = 985880402 time(NULL) = 985880402 time(NULL) = 985880402 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 1 write(7, "Mar 29 10:40:02 24.247.48.35 559"..., 188) = 188 time(NULL) = 985880402 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 17, 4000) = 1 read(3, I don't know. Nothing to correlate it to stopping at 10:10:00 p.m. EST last night though... I'm just not seeing anything that sticks out to indicate where a problem might be. Can someone who is running a central logging server indicate how they have configured syslog-ng, as far as log_fifo_size, garbage collection options, number of objects alive at any one time after running for a while, sync options? I would appreciate it, greatly. Thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

3 12

RE: [syslog-ng]Cisco Logging
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 06 Apr '01

06 Apr '01

Richard, syslog-ng does a considerably better job at filtering than does syslogd. This can cause you problems if you are not looking at it correctly. syslogd will log up to a priority for a facility in the syslog.conf. syslog-ng will log only that facility given in the syslog-ng.conf. Cisco devices log at the info level by default. So only if you are getting something from the Cisco devices at the debug level. If you want the same behavior as in syslogd you need to set your filter to "priority(info..debug)". Regards, Drew > -----Original Message----- > From: Shaw, Richard W [SMTP:Richard.W.Shaw@team.telstra.com] > Sent: Friday, April 06, 2001 9:50 AM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: [syslog-ng]Cisco Logging > > Hi Guys > > I've just found syslog-ng and am testing/comparing it to our current > syslogd > so I can match the logging then push everything to a syslog server. > > My problem is that I'm getting no logs for Cisco devices, I don't even get > anything in the sys.log file(see below): > > syslogd.conf file : > local7.debug /var/log/cisco.log > > syslog-ng.conf file: > source src { > udp(); > tcp(); > sun-streams("/dev/log" door("/etc/.syslog_door")); > internal(); > }; > destination d_mail { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/mail.log" > create_dirs(yes) > ); }; > destination d_cisco { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/cisco.log" > create_dirs(ye > s)); }; > destination d_sshd { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sshd.log" > create_dirs(yes > )); }; > destination d_tac { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/tacplus.log" > create_dirs(y > es)); }; > > destination d_sys { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sys.log" > create_dirs(yes)) > ; }; > > filter f_mail { facility(mail); }; > filter f_cisco { facility(local7) and priority(debug); }; > filter f_sshd { match("sshd"); }; > filter f_tac { facility(local6); }; > > log { source(src); filter(f_mail); destination(d_mail); }; > log { source(src); filter(f_cisco); destination(d_cisco); }; > log { source(src); filter(f_sshd); destination(d_sshd); }; > log { source(src); filter(f_tac); destination(d_tac); }; > > > log { source(src); destination(d_sys); }; > > > Thanks in advance for any help > > Regards > Richard Shaw > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Cisco Logging
by Shaw, Richard W 06 Apr '01

06 Apr '01

Hi Guys I've just found syslog-ng and am testing/comparing it to our current syslogd so I can match the logging then push everything to a syslog server. My problem is that I'm getting no logs for Cisco devices, I don't even get anything in the sys.log file(see below): syslogd.conf file : local7.debug /var/log/cisco.log syslog-ng.conf file: source src { udp(); tcp(); sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination d_mail { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/mail.log" create_dirs(yes) ); }; destination d_cisco { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/cisco.log" create_dirs(ye s)); }; destination d_sshd { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sshd.log" create_dirs(yes )); }; destination d_tac { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/tacplus.log" create_dirs(y es)); }; destination d_sys { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sys.log" create_dirs(yes)) ; }; filter f_mail { facility(mail); }; filter f_cisco { facility(local7) and priority(debug); }; filter f_sshd { match("sshd"); }; filter f_tac { facility(local6); }; log { source(src); filter(f_mail); destination(d_mail); }; log { source(src); filter(f_cisco); destination(d_cisco); }; log { source(src); filter(f_sshd); destination(d_sshd); }; log { source(src); filter(f_tac); destination(d_tac); }; log { source(src); destination(d_sys); }; Thanks in advance for any help Regards Richard Shaw

1 0

perm() and dir_perm()
by John_Delisle＠ceridian.ca 04 Apr '01

04 Apr '01

Hi everyone! I'm having issues getting perm() and dirperm() working. Here is my destination line: destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) create_dirs(yes) dir_perm(0755)); }; The files are created with 600, and dirs with 700. Any ideas? My umask is 022. I've tried adjusting the above values (I added 22 to them) and it didn't make a difference. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

1 0

RE: [syslog-ng]odd problem
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 03 Apr '01

03 Apr '01

I'm not 100% certain but I don't think that will work. syslog-ng picks the first log statement and logs the message to that. After that it considers the message logged and will log nothing to the next log statement. What I am curious about is why the multiple destination thing didn't work. I use it often and it works for me just fine. I am using 1.4.7 in production but I have been testing the 1.5 series and will go to production with it soon. Both seem to do this just fine. What is the error you are getting from the multiple destination configuration? Regards, Drew > -----Original Message----- > From: Chad C. Walstrom [SMTP:chewie@wookimus.net] > Sent: Monday, April 02, 2001 11:19 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]odd problem > > On Mon, Apr 02, 2001 at 04:38:30PM -0400, jon(a)dumbo.pobox.com wrote: > > syslog-ng-1.4.11/ > > libol-0.2.21/ > > > > i guess i'll try upgrading.... > > > > how does one log to multiple destinations without putting everything > into the same > > destination XXX {} container? > > > > i've tried seperate destinations > > ie... > > destination x { tcp(208.210.124.50 port(514)); } > > destinayion y { > file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" > dir_perm(0755) perm(0644)) } > > > > and then in the log directive > > log { > > source(src); > > destination(x); > > destination(y); > > } > > > > but that gives me errors > > Try: > log{ source(src); destination(x); }; > log{ source(src); destination(y); }; > > -- > Chad Walstrom <chewie(a)wookimus.net> | a.k.a. ^chewie > http://www.wookimus.net/ | s.k.a. gunnarr > Key fingerprint = B4AB D627 9CBD 687E 7A31 1950 0CC7 0B18 206C 5AFD >

2 1

Solaris 7 TCP Destination Error syslog-ng 1.4.11
by David C Niemi 02 Apr '01

02 Apr '01

I am trying to forward logs to another box from a Solaris 7 (SPARC) machine. The error I get is puzzling: sinetva99{SUPERUSER:25}/tmp# syslog-ng -d -f syslog-remote.conf io.c: Preparing fd 3 for reading io.c: connecting using fd 4 Error creating AF_INET socket (Operation now in progress) Error initializing configuration, exiting. Solaris' man page for connect defines EINPROGRESS quite cryptically: EINPROGRESS The socket is non-blocking and the connection can- not be completed immediately. It is possible to select(3C) for completion by selecting the socket for writing. However, this is only possible if the socket STREAMS module is the topmost module on the protocol stack with a write service procedure. This will be the normal case. So it sounds vaguely like the socket needs to be blocking, but I don't see any option in syslog-ng for accomplishing this. The relevant part of my .conf file: source src { file("/dev/log"); internal(); }; destination remote { tcp(208.214.21.133 port(514) ); }; log { source(src); destination(remote); }; I've managed to use virtually the same configuration to forward successfully under TCP using a Linux source. I also find that sending to localhost works fine under Solaris, but I get the error whenever I try a remote TCP destination from Solaris. "truss" does not return anything terribly interesting. --------------------------------------------------------- David C. Niemi (Reston, Virginia, USA) niemi(a)tuxers.net Know the difference between the color of the wine and the color of the glass. (Jalaluddin Rumi) ---------------------------------------------------------

2 2

AIX error
by Kathia Juca 02 Apr '01

02 Apr '01

Hi I'm running syslog-ng 1.4.11 on AIX . I intend log 80 machines to one hosts using syslog-ng. But, I use one server for compile. I need install in 80 machines . What syslog-ng and libol packages ??. Can'I transfer code after compile ?? I tried transfer and error message was : # /usr/local/sbin/syslog-ng Could not load program /usr/local/sbin/syslog-ng Symbol io_callout_set_drop in syslog-ng is undefined Symbol io_callout_flush in syslog-ng is undefined Error was: Exec format error What's right procedure for this ?? Thanks Kathia Juca Universidade Federal de Santa Catarina Florianopolis - Santa Catarina - Brazil

2 1