February 2002 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]syslog-ng mysteriously exits
by John Coke 08 Feb '02

08 Feb '02

Are you referring to the SIGHUP bugs(s)? -----Original Message----- From: Ed Ravin [mailto:eravin@panix.com] Sent: Friday, February 08, 2002 12:40 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng mysteriously exits John Coke writes: > getpid() = 3616 > time(NULL) = 1013148201 > rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 > getpid() = 3616 > kill(3616, SIGABRT) = 0 > --- SIGABRT (Aborted) --- > > I have not been able to find a clear picture of what causes SIGABRT. This is self-inflicted - note that the process looks up its own process ID number (getpid()), diddles the signal mask (I'm guessing it's to enable SIGABRT), then kills itself. syslog-ng has probably detected something very wrong, and is trying to leave you a core dump so you can figure out what happened. So my next question is - where's the core dump? It should show up in the current directory of the daemon. Use "lsof" while the daemon is running to see what directory it is in, and check there. Or do a global find and hunt it down. Also, have you tried upgrading to the latest syslog-ng (1.5.14 or so)? Except for one small bug :-) it's worked pretty well for me. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 2

How to stop logging message
by Subodh Nijsure 08 Feb '02

08 Feb '02

Hello, Does syslog ng have functionality that would allow me to stop logging of message once a message is logged? i.e. say I have rule that says log all "ftp" messages to /var/log/ftpd.log I want logging of that message to stop and not get logged into my "catchall" destination. if anybody has syntax/config file sample for this please let me know. Thanks. /Subodh Nijsure

1 0

RE: [syslog-ng]syslog-ng mysteriously exits
by John Coke 08 Feb '02

08 Feb '02

Thanks to Ed for the help, here's the tail of the strace: socket(PF_UNIX, SOCK_STREAM, 0) = 7 connect(7, {sin_family=AF_UNIX, path=" /var/ru n/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) close(7) = 0 open("/etc/hosts", O_RDONLY) = 7 fcntl64(7, F_GETFD) = 0 fcntl64(7, F_SETFD, FD_CLOEXEC) = 0 fstat64(7, {st_mode=S_IFREG|0644, st_size=3633, ...}) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40017000 read(7, "# Do not remove the following li"..., 4096) = 3633 close(7) = 0 munmap(0x40017000, 4096) = 0 time(NULL) = 1013148201 getpid() = 3616 time(NULL) = 1013148201 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 getpid() = 3616 kill(3616, SIGABRT) = 0 --- SIGABRT (Aborted) --- I have not been able to find a clear picture of what causes SIGABRT. Has someone run across this before? Would the inclusion of my config be of any use? Thanks. -John -----Original Message----- From: Ed Ravin [mailto:eravin@panix.com] Sent: Wednesday, February 06, 2002 11:02 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng mysteriously exits John Coke writes: > Syslog-ng-1.4.14 on a redhat 7.2 server is mysteriously crashing/exiting and > I am having trouble tracing the problem. There is no core and when I run > the service in debug, it does not exit. It normally exits within 2 or three > hours. What can I do next to try and find the problem? Have you tried attaching to it with strace? That will slow it down, but it won't change any code paths like the -d option does. Do something like "strace -o outputfile -p <syslog-ng-process" and see what's in "outputfile" after syslog-ng exits (if it indeed does exit). If you don't have the disk space, you could kill the strace process every hour or so and restart it - the daemon being traced shouldn't notice anything. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

RE: [syslog-ng]Possible overflow?
by Nicholas Berry 08 Feb '02

08 Feb '02

I didn't see if any mailed in a resolution to this problem, I'm still having it. I'm running Solaris 8 (SPARC) w/syslog-ng-1.5.13 and libol-0.3.1. Also, when I run more or less on one of the log files, I occassionally get the error "file may be a binary, continue?" >I too get high ASCII characters, but on a regular basis across multiple systems. > I have about 20 hosts logging to two syslog-ng systems. I see this anywhere from > a Foundry routers, to Solaris 8, and Lucent Maxes: > ..smf-jumpstart A<A0><E1>$<30>Dec 1.. > ..smf-modem-01 ^B^D^E<B4><134>ASCEND: slot 2.. > ..smf-dist-01 ^B^D^E<B4><14>smf-dist-01, Interface... Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Nicholas Berry Sent: Friday, December 21, 2001 9:20 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Possible overflow? I too get high ASCII characters, but on a regular basis across multiple systems. I have about 20 hosts logging to two syslog-ng systems. I see this anywhere from a Foundry routers, to Solaris 8, and Lucent Maxes: ..smf-jumpstart A<A0><E1>$<30>Dec 1.. ..smf-modem-01 ^B^D^E<B4><134>ASCEND: slot 2.. ..smf-dist-01 ^B^D^E<B4><14>smf-dist-01, Interface... Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Thomas Kaehn [mailto:tk@westend.com] Sent: Friday, December 21, 2001 3:04 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Possible overflow? Hi, in some logs I discovered an ascii character with the value 181 instead of a newline: ... D4-RIPE|<181>Dec 20 19:02 ... Unfortunately I can't reproduce this error. But maybe it's a known error? It occured when logging whole mails to syslog. Does anyone know a possible cause? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Re: [syslog-ng]syslog-ng doesn't properly close file sources?
by Balazs Scheidler 07 Feb '02

07 Feb '02

On Tue, Feb 05, 2002 at 07:58:18PM -0500, Ed Ravin wrote: > Sorry to be a pest, but did you ever get a chance to look at this? > It's still happening in 1.5.14 on NetBSD 1.5.2. A new backtrace > is below. > > I am willing to try and fix it myself, but it would really help if > you could point me in the right direction. I see in main.c that a > HUP triggers io_callout(...) which goes to libol - is the problem > there or is it just a matter of setting up the right callback stuff > for flush or close in affile.c? I've checked it out by then, and it did close the file source, but after reinitializing the configuration. It works on Linux, but doesn't on NetBSD as it seems. I patched my tree on my notebook to close the fd earlier, but I forgot to include it in 1.5.14. Here's the patch: diff -u -r1.45 affile.c --- affile.c 2002/02/05 15:49:05 1.45 +++ affile.c 2002/02/06 15:03:44 @@ -106,6 +106,7 @@ (name affile_source) (super log_source_driver) (vars + (res pointer "struct resource_node") (flags . UINT32) (src object io_fd) (name string))) @@ -122,13 +123,11 @@ else flags = O_RDONLY | O_NOCTTY | O_NONBLOCK; if (do_open_file(self->name, flags, -1, -1, -1, -1, -1, -1, 0, &fd)) { - struct resource_node *res; - lseek(fd, 0, SEEK_END); self->src = io_read(make_io_fd(cfg->backend, fd, ol_string_use(self->name)), make_log_reader(0, c), NULL); - res = REMEMBER_RESOURCE(cfg->resources, &self->src->super.super); + self->res = REMEMBER_RESOURCE(cfg->resources, &self->src->super.super); return ST_OK | ST_GOON; } else { @@ -144,12 +143,20 @@ HANDLE_LOG(self->super.super.next, log); } +static void do_destroy_affile_source(struct log_handler *c, struct syslog_config *cfg, struct persistent_config *persist) +{ + CAST(affile_source, self, c); + if (self->res) + KILL_RESOURCE_NODE(cfg->resources, self->res); +} + struct log_source_driver *make_affile_source(const char *name, int flags) { NEW(affile_source, self); self->super.super.super.init = do_init_affile_source; self->super.super.super.handler = do_affile_handle_line; + self->super.super.super.destroy = do_destroy_affile_source; self->name = c_format_cstring("%z", name); self->flags = flags; return &self->super; you'll need scsh to rebuild the sources. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 3

syslog-ng mysteriously exits
by John Coke 07 Feb '02

07 Feb '02

Syslog-ng-1.4.14 on a redhat 7.2 server is mysteriously crashing/exiting and I am having trouble tracing the problem. There is no core and when I run the service in debug, it does not exit. It normally exits within 2 or three hours. What can I do next to try and find the problem? Regards, -John

2 1

File mask.
by Scott A. McIntyre 06 Feb '02

06 Feb '02

Hi, Somewhere in the process of upgrading from 1.5.3 to 1.15.14 the process by which the umask is used somehow changed. Whenever I HUP syslog-ng now, the files opened for writing are set to 600, when I want/need 644. I see that there's a permissions option for unix streams, but what about files? I don't see anything obvious in the source, but maybe I'm just looking in the wrong place. Thanks for any pointers! Scott

2 1

syslog-ng 1.5.14 released
by Balazs Scheidler 06 Feb '02

06 Feb '02

Hi, syslog-ng 1.5.14 was released with the following NEWS entry: News for the 1.5.14 release Tue, 5 Feb 2002 11:35:52 +0100 New features: * tcp wrapper support * added several new macros in filename expansion * support for simple log rotation (remove_if_older) It can be downloaded from http://www.balabit.hu/en/downloads/syslog-ng -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

3 5

log rotation feature - patch
by klaas.vangend＠philips.com 05 Feb '02

05 Feb '02

Gentlemen, As stated last friday, I'd like enhance syslog-ng with some features in order to get rid of some log rotation scripts: "For some of our systems, we log to a centralised system, but also store the logs locally. These local logs only need limited availability, say a week or so. The file() destination currently is already able to use the target $WEEKDAYS, but in that case, logs from both Jan 17 and Jan 24 are logged in messages.Thu.log Therefore, I'd like to add a new option remove_if_older(X) which removes a logfile with a timestamp older than X days prior to writing the new message to that file. (default should be 0 (=never), which means that for a disabled feauture only one C 'if' statement additional overhead is caused)" I've finished implementing the above feature, which is attached as a patch. I patched against 1.4.14, the latest stable version, and it probably will work for the unstable tree, too. The patch compiles and is verified to work for SuSE Linux 6.4 (Linux 2.2.19 kernel, gcc 2.95.2, libc 2.1.3 ). I hope everybody thinks it's a nice feature and that this patch is soon added to a new stable syslog-ng release... (Please, Balazs???) Groetjes, Klaas van Gend

2 1

first day of month bug?
by Alex Howansky 04 Feb '02

04 Feb '02

(libol-0.2.23, syslog-ng 1.4.14) In my configuration, I have a destination defined like this: destination d_app { file("/var/log/app/$YEAR$MONTH$DAY"); }; This is a wonderful feature, as it gives me a sort of "automatic rotation" of logfiles. However, there seems to be a bug that occurs on the first of every month. If I look in the /var/log/app directory, I'll see files like: 20010201 20020101 20020102 20020103 [...] 20020129 20020130 20020131 20020201 20020202 Note that first file, stamped with 2001 instead of 2002. It actually contains entries that should have gone into 20020201. The entries in 20010201 all occur within the first hour of the day. It's as if the value of $YEAR is off by one during the first hour of the first day of a month. I tried searching the archives, no luck. Is this a know issue? Should I go to the 1.5 branch? -- Alex Howansky Wankwood Associates http://www.wankwood.com/

2 1