September 2001 - syslog-ng - lists.balabit.hu

problem solved...
by ved 08 Sep '01

08 Sep '01

err, just found the problem, i have to also stop klogd, and then start syslog-ng before klogd. pretty basic =)

1 0

iptables stops logging on syslog-ng restart
by ved 08 Sep '01

08 Sep '01

if i restart syslog-ng (witch i need to to rotate the logs) it seems that the iptables firewall hits don't get logged anymore.., even if i stop and then restart it it still doesn't logs.. but reboot is fine. it's a strange problem but maybe anyone has had the same situation, tanks. PS: i'm compiling 1.5.10 right now to upgrade the version i have witch is 1.4.13.

1 0

SMP RH7.1
by Christopher_Leonardos＠triumph.com 07 Sep '01

07 Sep '01

I have two DELL 2450 Server's, each with 2 1Ghz Processors, 2GB of RAM, and two pairs of 36GB mirrored drives on a PErc 3/si RAID Controller running RH 7.1 with a SMP Kernel Question: Will I really get any additional performance from the extra processor using SYSLOG-NG? Thanks!! Christopher Leonardos Security Engineer Interliant Inc. 12 Gill Street Woburn, MA 01801 781-756-3761 781-756-3737 FAX christopher_leonardos(a)interliant.com

5 4

syslog-ng: broken pipe
by Ravi Malghan 07 Sep '01

07 Sep '01

Hello: I have installed syslog NG 1.4.11. Every now and then I have to restart the both the server and client syslog-ng b'cos the client doesnot send any messages. The errors I see on the server side look as follows Aug 13 22:45:00 local@iadrse01/iadrse01 syslog-ng[2410]: io.c: do_write: write() failed (errno 32), Broken pipe Aug 13 22:45:00 local@iadrse01/iadrse01 syslog-ng[2410]: Connection broken, reopening in 60 seconds I also see this error in the /var/adm/messages after a while Aug 14 14:09:51 local@iadcor01 syslog-ng[3614]: Error accepting AF_INET connection from: 216.182.213.206:36010, opened connections: 10, max: 10 Has anybody else seen this happening? TIA Ravi

5 20

Re: [syslog-ng]More information on time_reopen, continuous reconnects, and syslog-ng 1.4.12.
by matthew.copeland＠honeywell.com 06 Sep '01

06 Sep '01

I think that part of the problem with this patch is that fd->super.alive doesn't get set to zero. I could be wrong, but I traced through the original code using gdb and then I received your patch. So after trying the patch and finding that it didn't work, I went back and looked at the output of the script file. The first time the socket times out, fd->super.alive gets set to 0 and the second poll doesn't happen. Then, when you go into the for loop if continues back fd->super.alive is zero. If this is the setup to get it to setup the callback for reconnecting later, maybe we should do the POLLERR check when we do the fd->super.alive check, and set fd->super.alive = 0 if we get into that if statement. What do you think? I have included the script output session of my walk through the code using gdb. (compressed this time.) Matthew M. Copeland > > > Index: io.c > > =================================================================== > > RCS file: /var/cvs/libol/src/io.c,v > > retrieving revision 1.25 > > diff -u -r1.25 io.c > > --- io.c 2001/08/26 21:28:18 1.25 > > +++ io.c 2001/09/05 20:39:02 > > @@ -231,7 +231,7 @@ > > if (!fd->super.alive) > > continue; > > > > - if (fds[i].revents & POLLHUP) { > > + if (fds[i].revents & (POLLHUP|POLLERR|POLLNVAL)) { > > if (fd->want_read && fd->read) > > READ_FD(fd); > > else if (fd->want_write && fd->write) > > @@ -246,10 +246,12 @@ > > close_fd(fd, CLOSE_PROTOCOL_FAILURE); > > continue; > > } > > + /* > > if (fds[i].revents & (POLLNVAL | POLLERR)) { > > close_fd(fd, CLOSE_POLL_FAILED); > > continue; > > } > > + */ > > if (fds[i].revents & POLLOUT) > > if (fd->want_write && fd->write) > > WRITE_FD(fd); > > > > > > -- You may be sure that when a man begins to call himself a "realist," he is preparing to do something he is secretly ashamed of doing. -- Sydney Harris

1 0

Thanks!
by Christopher_Leonardos＠triumph.com 06 Sep '01

06 Sep '01

Cool. Thanks for the feedback. The short-term plan is to deploy a syslogd per customer on incrementally higher ports(since the hardware supports specifying the syslog port), or build a CGI frontend in PERL that will parse a single flat file from a single syslogd. The longer term goal is going to be to build a connector to send the data from syslog-ng directly into an Oracle 8i database. Everything is so "cost" sensitive these days, who knows what the final solution will look like. Regards, Christopher Leonardos Security Engineer Interliant Inc. 12 Gill Street Woburn, MA 01801 781-756-3761 781-756-3737 FAX christopher_leonardos(a)interliant.com

1 0

AIX - Broken Connection
by Roman Ernst 05 Sep '01

05 Sep '01

Maybe someone can help me with the following question: After an established syslog-ng connection between 2 AIX boxes I have the problem that if terminating the physical network connection the connection state stays ESTABLISHED... My problem: I want to recognize connection problems at my logging server... when a syslog-ng client can't connect to the logging server anymore the server should send an alert-email. Unfortunately at the server-side there is no log that the connection the the client has been closed/broken,... Is there any possibility to see when the connection between client <-> server is broken??? Thanks a lot in advance! Roman

1 0

Compile error on Solaris 7
by Ripley, Scott 05 Sep '01

05 Sep '01

When trying to compile 1.5.10, I get the following error in make: make[3]: Entering directory `/export/home/root/syslog-ng-1.5.10/src' gcc -DHAVE_CONFIG_H -I. -I/export/home/root/syslog-ng-1.5.10/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c main.c main.c:47: `PATH_SYSCONFDIR' undeclared here (not in a function) configure says everything is fine, and I compiled 1.5.9 without any problems. I also tried defining the variable in the shell. What's odd is if I go to line 47 of main.c, it says: static char cfgfilename[128] = PATH_SYSLOG_NG_CONF; Any suggestions? Scott Ripley DNS Administrator - House Information Resources U.S. House of Representatives 202.226.2833 - mailto:scott.ripley@mail.house.gov <mailto:scott.ripley@mail.house.gov>

1 0

Apologies
by HAYA＠Nationwide.com 05 Sep '01

05 Sep '01

All, I would like to apologize to everyone on the list for the Out of Office responses you received from me last week. A recent upgrade to our mail system reset all of my preferences and the Out of Office agent default setting of respond to Internet mail was implemented. It won't happen again. My thanks to Balazs for heading this off quickly to reduce list overhead. Alex

1 0

Re: [syslog-ng]syslog-ng cannot run in Solaris 2.7
by Sander 05 Sep '01

05 Sep '01

Hi, What hardware are you using and what compiler? I've got syslog-ng running on Solaris8/x86 with no problem. Sander de Boer 2001-09-04 16:51:02, "Shirley Siu (Utako)" <utako(a)sftw.umac.mo> wrote: >Hi, > >Sorry, this may be an already answered question, but I tried to search in >the archives and cannot find a solution. > >I have just installed syslog-ng 1.4.12 in a Solaris 2.7 machine. I started >it and it died quietly without any message. Then I tried the "-d" option, >and use logger to feed a test message (e.g. logger test test), it >immediately cores dump: > >syslog-ng version 1.4.12 starting >io.c: Preparing fd 5 for writing >Segmentation fault (core dumped) > >The conf file is just the syslog-ng.conf.solaris file. > >Can anybody help? > >Thanks. > >Shirley > > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng > >

2 1