November 2002 - syslog-ng - lists.balabit.hu

File size limit exceeded??
by Nathan 19 Nov '02

19 Nov '02

i keep getting this error every time i try and start syslog-ng the system is redhat linux 2.4.18. any clues on why i'm getting this? thanks. io.c: Preparing fd 3 for reading io.c: listening on fd 4 syslog-ng version 1.4.17 starting gc_mark: Marking object of class 'syslog_backend' (0) gc_mark: Marking object of class 'syslog_config' (1) gc_mark: Marking object of class 'resource_list' (2) gc_mark: Marking object of class 'log_source_group' (2) gc_mark: Marking object of class 'afunix_source' (3) gc_mark: Marking object of class 'listen_fd' (4) gc_mark: Marking object of class 'afsocket_accept_callback' (5) gc_mark: Marking object of class 'io_fd' (5) gc_mark: Marking object of class 'log_reader' (6) gc_mark: Marking object of class 'afsocket_source_connection' (7) gc_mark: Marking object of class 'afinet_source' (8) gc_mark: Marking object of class 'inet_address_info' (9) gc_mark: Marking object of class 'object_queue' (9) gc_mark: Marking object of class 'log_source_group' (9) gc_mark: Marking object of class 'log_center' (10) gc_mark: Marking object of class 'log_connection' (11) gc_mark: Marking object of class 'log_endpoint_info' (12) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_dest_group' (14) gc_mark: Marking object of class 'log_dest_group' (15)gc_mark: Marking object of class 'log_dest_group' (16) gc_mark: Marking object of class 'log_dest_group' (17) gc_mark: Marking object of class 'log_dest_group' (18) gc_mark: Marking object of class 'log_dest_group' (19) gc_mark: Marking object of class 'log_dest_group' (20) gc_mark: Marking object of class 'affile_dest' (21) gc_mark: Marking object of class 'affile_dest' (20) gc_mark: Marking object of class 'affile_dest' (19) gc_mark: Marking object of class 'affile_dest' (18) gc_mark: Marking object of class 'affile_dest' (17) gc_mark: Marking object of class 'affile_dest' (16) gc_mark: Marking object of class 'affile_dest' (15) gc_mark: Marking object of class 'log_connection' (12) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_filter' (15) gc_mark: Marking object of class 'filter_expr_op' (16) gc_mark: Marking object of class 'filter_expr_pri' (17) gc_mark: Marking object of class 'filter_expr_op' (17) gc_mark: Marking object of class 'filter_expr_pri' (18) gc_mark: Marking object of class 'filter_expr_pri' (18)gc_mark: Marking object of class 'log_filter' (16) gc_mark: Marking object of class 'filter_expr_pri' (17) gc_mark: Marking object of class 'log_filter' (17) gc_mark: Marking object of class 'filter_expr_pri' (18) gc_mark: Marking object of class 'log_filter' (18) gc_mark: Marking object of class 'filter_expr_pri' (19) gc_mark: Marking object of class 'log_filter' (19) gc_mark: Marking object of class 'filter_expr_op' (20) gc_mark: Marking object of class 'filter_expr_op' (21) gc_mark: Marking object of class 'filter_expr_pri' (22) gc_mark: Marking object of class 'filter_expr_pri' (22) gc_mark: Marking object of class 'filter_expr_pri' (21) gc_mark: Marking object of class 'log_filter' (20) gc_mark: Marking object of class 'filter_expr_pri' (21) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_connection' (13) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_dest_group' (17) gc_mark: Marking object of class 'afuser_dest' (18) gc_mark: Marking object of class 'log_dest_group' (17) gc_mark: Marking object of class 'afuser_dest' (18) gc_mark: Marking object of class 'log_connection' (14) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_connection' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_connection' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_connection' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'afsocket_source_close_callback' (6) gc_mark: Marking object of class 'unix_address_info' (4) gc_mark: Marking object of class 'object_queue' (4) gc_mark: Marking object of class 'log_source_driver' (4) io.c: Preparing fd 5 for reading io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing io.c: Preparing fd 8 for writing File size limit exceeded

2 4

syslog-ng-1.4.17 crashes
by Heinz Ekker 19 Nov '02

19 Nov '02

Hi! I am using syslog-ng 1.4.17 with libol 0.2.24 on a central log host running RedHat 7.3. It all worked fine so far, until the load on the logging servers got higher and higher, resulting in about 900MB Logs daily. Then, syslog-ng started to die randomly, apparently not connected to any particular load peaks (at least as far as I was able to check), just the normal inferno. After finding and eliminating that d*mn RedHat's 'ulimit -c 0' in the rc-script, I got several core dumps, which, when examined with gdb, all show the following backtrace: (gdb) bt #0 0x400530a1 in kill () from /lib/libc.so.6 #1 0x40052e99 in raise () from /lib/libc.so.6 #2 0x40054364 in abort () from /lib/libc.so.6 #3 0x080529e5 in fatal () #4 0x080530a7 in xalloc () #5 0x080531f7 in ol_string_alloc () #6 0x0805068f in c_format () #7 0x08053501 in do_flush () #8 0x0805162d in write_callback () #9 0x080511d7 in io_iter () #10 0x08049c45 in main_loop () #11 0x08049f81 in main () #12 0x400421c4 in __libc_start_main () from /lib/libc.so.6 As far as I know, malloc only returns NULL, if it was unable to allocate the requested memory. The machine has 1 GB physical RAM and another Gig of Swap space. I'm running the sar data collector, and at all times there were loads of free memory. Swap stays untouched, the machine is not doing much besides syslogging. At loss for any solution, I did a panic upgrade to 1.5.23 with libol 0.3.5 today, when syslog-ng died 3 times within 30 minutes. So far it runs stable, but I'll know more tomorrow. My questions: Is this a bug in the 1.4 series? Can I sleep well while running 1.5 (marked as 'development')? It is imperative for us that no messages, or at least as few as possible, are lost, for dealing with abuse requests and customer inquiries. TIA, -- Heinz Ekker, mailto:heinz.ekker@uta.at Do not meddle in the affairs | UTA Systems Engineering Unix of wizards, for they are | 1220 Wien, Ares Tower Zelle 619 subtle and quick to anger. | Phone: +43 1 9009 4625/Fax -3697

2 5

RE: [syslog-ng]syslog-ng on Redhat 7.1 server
by Hamilton, Andrew 19 Nov '02

19 Nov '02

The configuration files normally reside in this directory. With most of the distributions usually a sample config file ends up in there. 1.4.11 is kind of old though. But here is a sample config file attached you can use. It is only a sample and will need to be modified to suit your environment. Also by default syslog-ng looks for syslog-ng.conf in /etc/syslog-ng. I'm not sure where the rpm would put the contents of the doc directory. Regards, Drew -----Original Message----- From: Madhvi Gokool [mailto:madhvin@yahoo.com] Sent: Tuesday, November 19, 2002 6:31 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng on Redhat 7.1 server hello i have downloaded the rpm for syslog-ng (syslog-ng-1.4.11-1.i386.rpm) and libol(libol-0.2.21-1.i386.rpm). I installed them on my server by using the command rpm -i syslog-ng-1.4.11-1.i386.rpm rpm -i libol-0.2.21-1.i386.rpm the syslog-ng directory is created under the /etc directory. However, the syslog-ng directory does not contain any files. Grateful if someone could help Regards madhvi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng on Redhat 7.1 server
by Madhvi Gokool 19 Nov '02

19 Nov '02

hello i have downloaded the rpm for syslog-ng (syslog-ng-1.4.11-1.i386.rpm) and libol(libol-0.2.21-1.i386.rpm). I installed them on my server by using the command rpm -i syslog-ng-1.4.11-1.i386.rpm rpm -i libol-0.2.21-1.i386.rpm the syslog-ng directory is created under the /etc directory. However, the syslog-ng directory does not contain any files. Grateful if someone could help Regards madhvi

1 0

Locals in Syslog.
by Jon Hofstad 14 Nov '02

14 Nov '02

Hello. I`m working on a project where I need to set up a syslog-environment. I have about 140 servers that needs to send their syslog-info to a centralized syslog-ng server. My challenge is that I need to identify each server with their own local-value. Default, syslog has a limitation in how many locals you can define, isn`t it 8? Has anyone had experience with changing this value to whatever number; e.g 100? Regards Jon Hofstad

2 1

Upgrade problems??
by Abraham, Ajamu 14 Nov '02

14 Nov '02

I updated my freeBSD server running syslog-ng 1.4.12 to syslog-ng 1.5.23. I installed the new libol 0.3.5 prior to the upgrade. It seemed to have installed correctly with no errors. However when I try to start the program I revieve this message: absys# /usr/local/sbin/syslog-ng -v binding fd 3, inetaddr: 0.0.0.0, port: 514 binding fd 5, inetaddr: 0.0.0.0, port: 514 unresolved reference: DEFAULT Error initializing configuration, exiting. I thought this must be related to the options I have chosen in my configuration file. Here is the top section of my syslog-ng.conf file, where I define my options: absys# vi /usr/local/etc/syslog-ng/syslog-ng.conf #syslog-ng configuration. # # what the default options are for files that it writes # options { sync(0); time_reopen(10); log_fifo_size(100); }; ############################################################## # Sources: ############################################################### source src { tcp(); udp(); internal(); }; ### FILTERS ### Please help...thanks in advance! Ajamu Abraham Network Engineer About, Inc. 249 West 17th Street 2nd Floor New York, NY 10011 Direct: 212.204.1525 Cell #: 917.682.2246 "l'argent comptant règne tout autour de moi"

2 1

Re: syslog-ng 2.x
by Balazs Scheidler 13 Nov '02

13 Nov '02

On Wed, Nov 13, 2002 at 05:35:10PM +0100, "Lacruz Gimeno, José" wrote: > Balazs, > > we would like to use syslog-ng on HP-UX boxes, but we've been told it won't > do a good job till version 2, where message padding is handled correctly. We > would like to know if there is an estimated release date for this version. hmm... I've implemented input padding in the latest 1.5.x versions as well, and I had at least one success reports. please give it a try (the option might be undocumented), but it is used this way: source s_hpux { pipe("/dev/log" pad_size(2048)); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

syslog-n limits.
by Luc Mazardo 12 Nov '02

12 Nov '02

hello, I use syslog-ng (syslog-ng-1.4.17) and try to do some benchmarks with it. I've some problems for tuning it. The load average of syslog is more than 10.0 on a bi PIII 860 on a linux box decreasing to 2.0. My test is 50 clients simultaneously (using syslog() system call) with 500 logs per second during 5 minutes. Here is the option i use: options { use_dns(no); long_hostnames(off); sync(100); log_fifo_size(5000); gc_idle_threshold(50);gc_busy_threshold(5000); }; source src { unix-stream("/dev/log" max-connections(100)); internal(); udp(); }; Is there a different parameter to use for not increasing so much the load avg ? Thanks in advance. -- Luc.Mazardo(a)cvf.fr

1 0

TCP Questions
by Jeff McReynolds 12 Nov '02

12 Nov '02

We are in need of a solution to move many different kinds of logs across our network. Traditionally our developers have pretty much just dumped log files where ever which of course is unmanagable after a while. We are currently using NG with Apache and are comfortable with the idea of loosing a log every now and then. What we cannot do is loose logs that our developer's applications are sending to the server. It appeared that a good way to accomplish this would be to use the TCP functionality built into NG. I have had some difficulty getting NG to accept the parameters listed on the docs page for the TCP connection. I even copied them verbatim at one point and still receive a parse error on the destination line in question. So, Two questions I guess: 1.) Can the TCP functionality be used as a fault tolerant solution for our developers logging needs? 2.) Does anyone have any suggestion as to why the following line would fail? destination d_joust { tcp("192.168.30.225" port(1999); localport(999)); }; <------------ Line 22 causing the parse error. filter f_tcp { (level(info) and facility (local7)); } log { source(s_sys); filter(f_tcp); destionation(d_joust); }; parse error at 22 Parse error reading configuration file, exiting. Thanks for any suggestions. -JMc

2 1

Re: syslog-ng and Solaris 8
by Balazs Scheidler 12 Nov '02

12 Nov '02

On Mon, Nov 11, 2002 at 12:45:18PM -0800, Rude Yak wrote: > Hello, Baszi. I'm having some stability issues on Solaris 8 and I'm not > quite sure how to best go about resolving them. Occasionally, I will notice > syslog-ng crashing, most often after receiving a UDP-based message. Running in > debug mode, I see the following: > > bash-2.05a# /apps/syslog-ng/current/sbin/syslog-ng -vdF -f > /apps/syslog-ng/etc/syslog-ng.conf > binding fd 3, inetaddr: 0.0.0.0, port: 514 > io.c: Preparing fd 3 for reading > io.c: connecting using fd 7 > connecting fd 7 to inetaddr 10.130.230.162, port 514 > io.c: connecting using fd 8 > connecting fd 8 to inetaddr 10.120.230.161, port 514 > syslog-ng version 1.5.17 starting > io.c: Preparing fd 8 for writing > io.c: Preparing fd 7 for writing > io.c: Preparing fd 9 for writing > io.c: sockaddr2info(): Unsupported address family 0. > Abort (core dumped) > > I'm building syslog-ng with gcc 3.1 on Solaris 8 with the following setup: > > syslog-ng 1.5.23 > libol 0.3.5 > CFLAGS -m64 -O3 > > > I'm attaching the core dump just in case. In this particular case, syslog-ng > crashes as soon as spamd (from the spamassassin package) connects. The lines > in spamd are something like: > > if ($log_facility ne 'stderr') { > eval { > setlogsock('unix'); > syslog('debug', 'spamd starting'); # required to actually open the socket > }; > > Is there something in my syslog-ng configuration that may be causing issues? no, as it seems solaris doesn't return a sensible address for unix domain socket peers. btw: solaris does not usually use unix domain sockets for log transport, what driver do you use for /dev/log? (usually it is a STREAMS device) this patch should fix it (touch io.c.x after applying): diff -u -r1.31 io.c --- io.c 14 Oct 2002 08:05:38 -0000 1.31 +++ io.c 12 Nov 2002 07:40:01 -0000 @@ -1024,13 +1024,17 @@ struct sockaddr_un *un = (struct sockaddr_un *) addr; return &make_unix_address(c_format("%z", un->sun_path))->super; } + case AF_UNSPEC: + break; #if 0 case AF_INETv6: break; #endif default: - fatal("io.c: sockaddr2info(): Unsupported address family %i.\n", addr->sa_family); + werror("io.c: sockaddr2info(): Unsupported address family %i (addrlen=%i).\n", addr->sa_family, addr_len); + break; } + return NULL; } #if 0 -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0