August 2001 - syslog-ng - lists.balabit.hu

syslog-ng: broken pipe
by Ravi Malghan 07 Sep '01

07 Sep '01

Hello: I have installed syslog NG 1.4.11. Every now and then I have to restart the both the server and client syslog-ng b'cos the client doesnot send any messages. The errors I see on the server side look as follows Aug 13 22:45:00 local@iadrse01/iadrse01 syslog-ng[2410]: io.c: do_write: write() failed (errno 32), Broken pipe Aug 13 22:45:00 local@iadrse01/iadrse01 syslog-ng[2410]: Connection broken, reopening in 60 seconds I also see this error in the /var/adm/messages after a while Aug 14 14:09:51 local@iadcor01 syslog-ng[3614]: Error accepting AF_INET connection from: 216.182.213.206:36010, opened connections: 10, max: 10 Has anybody else seen this happening? TIA Ravi

5 20

making on alpha running osf1-40f
by GMS SB 30 Aug '01

30 Aug '01

Hello, Is there anybody who has a Makefile for alpha/osf1-40f I don't seem to be able to get a reliable working syslog-ng. I'm running syslog 1.4.x and 1.5.x on an compaq ds-20 and on a es-40 I've been using the native cc and gcc 2.95.3. With cc i used the -misalign switch (on both syslog and libol). When i run my stresstest, the core grows to about 120 M and then stops logging. It keeps running and give it's verbose messages. I've been seeing messages that kill -HUP worked/ was fixed, but it works like a quit. Also i ran it with -vd and made it core. Garbage collection output seems alright. It contains parts of messages and a lot of "127." and "127.0.0.1". Also the expression @..@ gives a lot of hits. The gcc version seems to work, but it complains a lot about unaligned traps, hence the -misalign switch with cc. Nobody trusts it because of that. It grew 0.03 M overnight, but the stresstest stopped. I'm about to let it core now and will report what i find. I am losing credit for syslog here so please give me some hints at this adres or at syslog-ng(a)onecht.net. tia

1 0

RE: [syslog-ng]logs get filled by "STATS: dropped 0" ?
by Andrew Fort 30 Aug '01

30 Aug '01

Ved, Balazs posted this message about the logging every second in the 1.5.9 dev release. As 1.5.9 is a development version, some things are unfinished, but the link below should point you in the right direction to changing the frequency of the STATS: messages :). I would imagine this will be made into a configuration knob when either balazs or someone else gets time to add the patch.. http://marc.theaimsgroup.com/?l=syslog-ng&m=99898987009711&w=2 -----Original Message----- From: ved [mailto:ved@netmadeira.com] Sent: Thursday, 30 August 2001 8:02 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]logs get filled by "STATS: dropped 0" ? I'm looking to change from my normal syslogd to syslog-ng but when i start it, it writes this message: syslog-ng[13668]: STATS: dropped 0 every second... so my logs increase in size very rapidly, how can i stop this or what is causing it?

1 0

logs get filled by "STATS: dropped 0" ?
by ved 29 Aug '01

29 Aug '01

I'm looking to change from my normal syslogd to syslog-ng but when i start it, it writes this message: syslog-ng[13668]: STATS: dropped 0 every second... so my logs increase in size very rapidly, how can i stop this or what is causing it?

1 0

Getting AIX systems to log to a Solaris host
by ampeterson 29 Aug '01

29 Aug '01

I am trying to get all of our AIX systems to log all of their system messages to a Solaris system. I have syslog-ng complied on both the Solaris and AIX platforms. I have syslog-ng working just fine on Solaris, however, I am having problems getting AIX to log to a Solaris system. Is anyone familiar with how to configure the syslog-ng.conf file on the Solaris side and on the AIX side so AIX will log it's system messages to Solaris (and yes I have already configured the odm to pass system messages to syslog on AIX)? Here is a short, simple version of the syslog-ng.conf file that I have setup on the Solaris side: > # Global options > options { sync(0); time_reopen(10); log_fifo_size(100); }; > # Sources > source all { tcp(ip("0.0.0.0") port(10514)); udp(ip("0.0.0.0") port(514)); > internal(); sun-streams("/dev/log" door("/etc/.syslog_door")); }; > # > # Destinations > destination auth-log { file("/var/log/syslog-ng/auth-log"); }; > # > # filters > filter f_auth { facility(auth) and level(notice); }; > # > # Logs > # Loghost > log { source(all); filter(f_auth); destination(auth-log); }; I have tried to add the unix-dgram / unix-stream segment in to accept calls from AIX, but it doesn't work: > #Sources > source all { unix-dgram("/dev/log"); tcp(ip("0.0.0.0") port(10514)); > udp(ip("0.0.0.0") port(514)); internal(); sun-streams("/dev/log" > door("/etc/.syslog_door")); }; and also > #Sources > source all { unix-stream("/dev/log"); tcp(ip("0.0.0.0") port(10514)); > udp(ip("0.0.0.0") port(514)); internal(); sun-streams("/dev/log" > door("/etc/.syslog_door")); }; I've have also tried a more generic approach for both Solaris and AIX, but it doesn't work: > #Sources > source all { unix-stream("/dev/log"); internal(); }; After I added the unix-dgram and unix-stream segment on the first example and started syslog-ng, my device file /dev/log on Solaris and the /etc/.syslog_door file were replaced with incorrect files. I looked through the discussion threads, and I haven't been able to find any discussion concerning this matter. I apologize in advance if I missed this discussion thread. Thank you for your help! Anna Maria Peterson Micron Technology, Inc. Unix System Manager Mail Stop 964 8000 S. Federal Way Boise, Idaho 83707 (208) 363-2196

1 0

RE: [syslog-ng]Alexander T Hay/Nationwide/NWIE is out of the offi ce.
by Ohrberg, Mick 29 Aug '01

29 Aug '01

...or put a filter on the mailing list blocking ANYTHING that contains the words 'out of office' or any permutation thereof. /Mick -----Original Message----- From: Michael Renner [mailto:robe@amd.co.at] Sent: Wednesday, August 29, 2001 11:13 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Alexander T Hay/Nationwide/NWIE is out of the office. On Wed, 29 Aug 2001 HAYA(a)Nationwide.com wrote: > I will be out of the office starting 08/29/2001 and will not return until > 09/04/2001. > > I am out of the office for the remainder of this week. If you need > assistance of a technical nature please contact Sean Amon at 249-5489. All > other questions can be directed to Patsy Short at 677-6350. > could somebody please nuke this stu^H^H^Hnice person from the mailinglist? thanks greetz michael _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

4 3

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

3 2

RE: [syslog-ng]iptables & syslog-ng
by Nijs, Daniel 29 Aug '01

29 Aug '01

is there anything I can change on my redhat box to alter this behavior? -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Wednesday, August 29, 2001 10:33 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]iptables & syslog-ng On Wed, Aug 29, 2001 at 08:53:26AM -0400, Nijs, Daniel wrote: > Hi Michael > > That did indeed fix the problem, are you running 1.5.9? Now I have to write > rules for two src's which could cause more overhead, so I would like to know > if this is a bug of some sort, or normal behavior. Thanks for your help, > this really works well. redhat klogd is using unix-dgram sockets while the libc can send both unix-stream and unix-dgram. If you are using unix-stream only the libc will be able to log. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

RE: [syslog-ng]iptables & syslog-ng
by Nijs, Daniel 29 Aug '01

29 Aug '01

Hi Michael That did indeed fix the problem, are you running 1.5.9? Now I have to write rules for two src's which could cause more overhead, so I would like to know if this is a bug of some sort, or normal behavior. Thanks for your help, this really works well. Best regards, Daniel -----Original Message----- From: Michael Renner [mailto:robe@amd.co.at] Sent: Tuesday, August 28, 2001 4:10 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Re: [syslog-ng]iptables & syslog-ng On Tue, 28 Aug 2001, Nijs, Daniel wrote: > Hello, > > I just set up an iptables based firewall on my syslog-ng host machine > (redhat 7.1), but ran into a small problem. When I run syslogd+klogd, I can > see iptables generating the logfiles. When I disable the standard syslog > daemon, and run syslog-ng+klogd, I do not see the data I am looking for, it > is almost like iptables isn't logging at all, but it has to, since it works > with the normal syslogd. I setup a generic rule, and a fallback, so > everything should work. When using the "logger" tool, and generating a fake > entry, everything seems ok, so I assume this is an issue between kernel > logging and syslog-ng. I am running 1.5.9 (not the official release). Any > help would be appreciated. Thanks Hi Daniel! It sounds like you have problems with your kernel-logs... do you receive any kernel messages at all? i dumped klogd at all and using the following syslog-ng-directive as source for my kernel messages: --- source srck { pipe("/proc/kmsg"); }; --- It works w/o a flaw for me and makes the klogd obsolete, another application which can't break :) greetz michael Michael Renner Inode Internet - Junior System Engineer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

1 0