August 2001 - syslog-ng - lists.balabit.hu

syslog-ng 1.5.9
by Balazs Scheidler 28 Aug '01

28 Aug '01

Hi, We have released syslog-ng 1.5.9, now officially with the following changes: * finalized log statement processing flags * updated documentation * changed syslog-ng buffering, so writing log messages is buffered (sync(10) now means that ten messages are grouped and written with a single write() syscall) * implemented fsync() option to force an fsync(fd) to logfiles after each write * implemented quick&dirty stats reporting (this is not final, now reports number of dropped messages for the last minutes) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]syslog-ng 1.5.9
by Nijs, Daniel 27 Aug '01

27 Aug '01

I have 1.5.9 running without any issues. How do I replace my DEFAULT logpath though? I am aware of the flags (I am using them), but not sure how to implement a "catch all" rule. Could you post an example please? Thanks Best regards, Dan -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Saturday, August 25, 2001 9:23 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.5.9 Hi, I managed to make some free time to hack a bit on syslog-ng. The results are available at http://www.balabit.hu/~bazsi/syslog-ng-1.5.9.tar.gz . I published this release there, because I didn't have too much time to test it now, and it changes a couple of things. I verified each new functionality at least once, and it seems to work, but it doesn't warrant anything of course. The summary of changes: * finalized the new log processing, and log statement flags (the one instead of the kludgy DEFAULT filter) This changes configuration file format from 1.5.8, which changed it from 1.5.7. This one should be final. * updated the documentation to include reference information on nearly everything (even about the new log flags). If anything is missing, please let me know. I know its English is still not the best, proofreaders welcome. I'd be grateful, if some of you could test this release. ps: the lost messages feature is not yet implemented, it's the next on the top of my todo list. ps/2: the .tar.gz is not signed. I sign this mail, so it assigns at least some trust to the file as well. (since I'm announcing it), paranoids are directed to the diffs between 1.5.8 and 1.5.9 :) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

syslog-ng 1.5.9
by Balazs Scheidler 25 Aug '01

25 Aug '01

Hi, I managed to make some free time to hack a bit on syslog-ng. The results are available at http://www.balabit.hu/~bazsi/syslog-ng-1.5.9.tar.gz . I published this release there, because I didn't have too much time to test it now, and it changes a couple of things. I verified each new functionality at least once, and it seems to work, but it doesn't warrant anything of course. The summary of changes: * finalized the new log processing, and log statement flags (the one instead of the kludgy DEFAULT filter) This changes configuration file format from 1.5.8, which changed it from 1.5.7. This one should be final. * updated the documentation to include reference information on nearly everything (even about the new log flags). If anything is missing, please let me know. I know its English is still not the best, proofreaders welcome. I'd be grateful, if some of you could test this release. ps: the lost messages feature is not yet implemented, it's the next on the top of my todo list. ps/2: the .tar.gz is not signed. I sign this mail, so it assigns at least some trust to the file as well. (since I'm announcing it), paranoids are directed to the diffs between 1.5.8 and 1.5.9 :) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

log rotation
by Joseph K Gainey 24 Aug '01

24 Aug '01

syslog-ng allows me to to complex filtering and logging, because of this I get several different log files instead of one huge monolithic syslog. Is there anyway to have syslog-ng automatically rotate the logs base on size and/or time? Joe

3 2

annoying double-hostname in logfile
by Michael Renner 24 Aug '01

24 Aug '01

hi! i replaced syslogd on our master logserver with syslog-ng, because syslogd wasn't able to handle all the incoming syslog messages (receive queue was permanent around 65500 bytes, dropped 50-90% of the incoming messages). syslog-ng now works like a charm, there's only one cosmetic flaw: every hostname in the logfile is twice, seperated by a slash, like: Aug 24 15:50:34 baby.inode.at/baby.inode.at 2961721: 13w6d: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1:13, changed state to up the sending sysloggers are syslogds, ciscos, zyxels, etc. so (at least IMHO) its not a config setting on the remote syslogger how can i prevent syslogd from double-printing the hostnames? relevant syslog-ng.conf snippet is here: --- options { sync (0); log_fifo_size (1000); use_fqdn (yes); }; --- greetz Michael Renner Inode Internet - Junior System Engineer

2 1

Re: syslog-ng config problem
by Balazs Scheidler 24 Aug '01

24 Aug '01

On Fri, Aug 24, 2001 at 02:53:43PM +0200, Jean-charles wrote: > hello, > > as said i your documentation > i tried the DEFAULT filter > but i can an error : > > [root@zeus syslog-ng]# /etc/init.d/syslog-ng start > Starting system logging: syslog-ngunresolved reference: DEFAULT > Error initializing configuration, exiting. > > > ii syslog-ng 1.5.8-2 Next generation logging daemon 1.5.x changed DEFAULT semantics, which is undocumented. A summary of the new functions were posted on the syslog-ng mailing list. Check the archives. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]Customizing the timestap format
by Andrew Fort 24 Aug '01

24 Aug '01

Hi Erwan, http://marc.theaimsgroup.com/?l=syslog-ng&m=97991394300231&w=2 describes the functionality (available in syslog-ng 1.5.x development releases) you desire. >From: Erwan Conq [mailto:erwan.conq@nextenso.com] >Subject: [syslog-ng]Customizing the timestap format > >Hello, > >I'm pretty new using Syslog-ng. I'm wondering if it's possible >to modify >the format of the time stamp reported in the logs. >Who shall I do it ?

1 0

RE: [syslog-ng]Customizing the timestap format
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 24 Aug '01

24 Aug '01

In the 1.5.x line there is a template feature that will allow you to do some customization of your log output. You'll have to look through the previous posts or the code to get syntax. I don't think the docs have been updated to give a lot of info on it yet so you may have to fool around with it. If you do get to using it post some specific questions if you have problems and someone here will help you out. Please keep in mind that 1.5.x line is an alpha line and the syntax can change at anytime without much warning. If you watch the list though Bazsi is pretty good about giving a heads up on major changes like that. Regards, Drew -----Original Message----- From: Erwan Conq [mailto:erwan.conq@nextenso.com] Sent: Friday, August 24, 2001 11:34 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Customizing the timestap format Hello, I'm pretty new using Syslog-ng. I'm wondering if it's possible to modify the format of the time stamp reported in the logs. Who shall I do it ?

1 0

Customizing the timestap format
by Erwan Conq 24 Aug '01

24 Aug '01

Hello, I'm pretty new using Syslog-ng. I'm wondering if it's possible to modify the format of the time stamp reported in the logs. Who shall I do it ?

1 0

RE: Re[2]: [syslog-ng]Full pipe as destination
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 23 Aug '01

23 Aug '01

I agree with Herr Apelt. The need for immediate notification needs to be weighed against the traffic coming out of an already overburdened service. A separate process listening for such things coming from the internal source should be sufficient to catch the necessary information. What you don't want to do is send a stream of data from the internal source when you are already dropping messages. A statistical notification every 12 or 24 hours is great but there definitely would need to be some sort of immediate notification so action can be taken to correct any problems. I think using the internal channel would allow for the least amount of development work and still give a desired result. Regards, Drew -----Original Message----- From: Volker Apelt [mailto:volker_apelt@yahoo.de] Sent: Thursday, August 23, 2001 12:57 PM To: syslog-ng(a)lists.balabit.hu Subject: Re[2]: [syslog-ng]Full pipe as destination On Thu, 23 Aug 2001 10:44:50 +0200 Andreas Schulze <andreas.schulze(a)mediaways.net> wrote: > Dear Bazsi, > Brad Arlt schrieb: > > > logs are silently dropped in this case. I was thinking of implementing some > > > kind of automatic statistics message to report log losses, but that would > > > race against normal log traffic. do you have a better idea. > > statistics are a very good idea and for many syslog-ng users its > important to know as most as possible about messages dropped > (for which destination, etc.), messages transfered by source ond/or > destination and something more. > > I think the discussions about possible log destinations hasn't the real > impact in this context. > > as you say its important that we prevent the daemon from stucks > in-active with its internal statistics stuff. > the real problem here is, to implement the output method of the stat. > informations. > but answer the following question: "is it really mandatory to realize > a continuous output of statistical informations?" > I think not. > > decide to which logging destination the stats should be send. > I think the internal() log source is a better choice than brad's "oh > shit!" file, because we keep save the flexibility of syslog-ng's rule-based flow > control. but a separate log is ok. > > but don't send the stats continuously to internal(). do this e.g. at > midnight for the last 24h. realize a command line switch to disable this feature. Sending it to the internal() queue, with serverity=alert or crit, sounds good. To me, it is important to get the notification about dropped messages immediately, because it requires some reaction. Maybe with a 'maximum notifications per minute' brake to avoid race conditions or as "minimal notification time distance" implemented as a time stamp when the last emergency message was emitted. -- Volker Apelt Group of Prof. Dr. Ch. Griesinger Dipl. Chem. Johann Wolfgang Goethe Universitat +49 6172 31126 Frankfurt am Main, Germany va .@. org.chemie.uni-frankfurt.de (remove the dots, please) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0