March 2002 - syslog-ng - lists.balabit.hu

Re: big packets
by Balazs Scheidler 19 Mar '02

19 Mar '02

On Tue, Mar 05, 2002 at 05:15:11PM +0100, p(a)netoides.com wrote: > Hello syslog-ng developers. > > We are using your wonderful syslog-ng to receive > some big message chunks. We noticed that syslog-ng drops > bytes above 1Kb when using UDP. So, we changed to > TCP and, to our surprise, we found that syslog-ng > splits messages in chunks of 1Kb (approx). > > Is it possible to configure syslog-ng so that > each tcp message goes to only one line? > If this is not possible, what about modifing > syslog-ng to add this capability? > We can contribute development effort. after applying the following patch, you can change the maximum line length of syslog-ng by changing the MAX_LOG_LINE constant in syslog-ng.h (currently 2048 bytes) Index: sources.c =================================================================== RCS file: /var/cvs/syslog-ng/src/sources.c,v retrieving revision 1.30 diff -u -r1.30 sources.c --- sources.c 2002/02/28 13:05:37 1.30 +++ sources.c 2002/03/05 18:38:35 @@ -49,7 +49,7 @@ (vars (dgram simple UINT32) (pos simple UINT32) - (buffer array UINT8 MAX_LINE) + (buffer array UINT8 MAX_LOG_LINE) (next object log_handler))) */ @@ -81,11 +81,11 @@ size_t salen = sizeof(sabuf); if (!closure->dgram) { - n = A_READ(read, MAX_LINE - closure->pos, closure->buffer + closure->pos); + n = A_READ(read, MAX_LOG_LINE - closure->pos, closure->buffer + closure->pos); salen = 0; } else - n = A_RECV(read, MAX_LINE - closure->pos, closure->buffer + closure->pos, (abstract_addr *) &sabuf, &salen); + n = A_RECV(read, MAX_LOG_LINE - closure->pos, closure->buffer + closure->pos, (abstract_addr *) &sabuf, &salen); switch(n) { case 0: -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

6 10

Re: [syslog-ng]DNS caching
by Michael Renner 19 Mar '02

19 Mar '02

At 12:04 19.03.2002 +1000, you wrote: >Other recent discussions have talked about using djb's dnscache or nscd to >do this instead and questioned the wisdom of using caching internal to >syslog-ng. Should I not be using this feature? Does it, in fact, work at >all? It seems that this function is currently in development (or even deprecated, no changes were made from 1.5.14 to 1.5.15, it isn't documented at all, nobody even bothered to mention it when I asked a similiar question) and not working at the moment (hits to dnscache haven't decreased after activating it, i'm currently using 1.5.14 too). I for my part prefer dnscache over nscd because dnscache is much more transparent in its workings (no "weird" or "_very_ old cached" responses, very detailed logs). As for the internal dns cache, i don't think that it's that complicated at all, because the main part of dns caching, the resolver, is already implemented and working fine; adding a cache with fixed expiry times isn't that much additional work (at least it doesn't seem so to me, correct me if i'm wrong). The only problem I can think of are DNS records which have a TTL lower than the cache expiry time; the dns cache should ignore the ttl fields because here it gets way too complicated for a syslogger :). best regards, -- Renner Michael Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

1 0

Default template?
by Gert Menke 15 Mar '02

15 Mar '02

Hi! Is there a possibility to define a default template, so that I don't have to set my favorite template for every destination explicitly? Thanks in advance! Greetings Gert

1 0

load balanced syslog-ng
by Nicholas Berry 14 Mar '02

14 Mar '02

I'm running syslog-ng 1.5.13 (w/libol-0.3.1) under Solaris 8 and have two servers load balanced by two Foundry ServerIrons. This has been a rock solid solution for load balancing syslog reporting, but about once every few days both load balancers report a loss of port 514/udp. After checking syslog-ng for each syslog server, the daemon is still running and nothing was reported in syslog messages. Any ideas? Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com

1 0

no kernel facility
by Stephan Uhlmann 14 Mar '02

14 Mar '02

Hello. It seems that syslog-ng doesn't receive syslog messages of the "kern" facility. I have the following configuration (in reality a bit bigger but the other stuff is mostly configuration for receiving log messages from other hosts, it shouldn't affect this problem): --------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source src { unix-stream("/dev/log"); internal(); }; destination han_messages { file("/var/log/messages"); }; log { source(src); destination(han_messages); }; --------- I don't think that there are no kernel messages generated by the system. Also with normal syslog I get the following messages when killing/starting klogd: Mar 14 13:11:59 han kernel: klogd 1.3-3, log source = /proc/kmsg started. Mar 14 13:11:59 han kernel: Inspecting /boot/System.map-2.2.16-SMP Mar 14 13:11:59 han kernel: Loaded 9539 symbols from /boot/System.map-2.2.16-SMP. Mar 14 13:11:59 han kernel: Symbols match kernel version 2.2.16. Mar 14 13:11:59 han kernel: Loaded 290 symbols from 7 modules. Mar 14 13:12:03 han kernel: Kernel logging (proc) stopped. Mar 14 13:12:03 han kernel: Kernel log daemon terminating. With syslog-ng I don't get these messages. So I suspect that there is a problem with syslog-ng getting the messages from klogd. I updated to version 1.4.14 and the problem still exists. Any hint appreciated :-) Thank you, Stephan

4 6

Question
by Roscoe 13 Mar '02

13 Mar '02

Been playing with syslog-ng for a few days and have a question: I have set up a unix-stream src and only get messages (ususaly several hundred) on when syslog-ng starts up. Have set sync (0). Any suggestions?

1 0

Extra info padded when syslog-ng forwards syslog messages
by lukechung 12 Mar '02

12 Mar '02

Hi There, Is there a way for syslog-ng to forward syslog messages to another machine, without padding the additional information? (e.g. Feb 23 02:55:23 [203.208.161.105.28.128] 33: Feb 23 02:52:53.167 Singapo: %SYS-5-CONFIG_I: Configured from console by console) The [203.208.161.105.28.128] is the additional info padded. I have tried setting the option chain_hostnames=no, but to no effect. I would really appreciate it if you can shed some light on this matter. Thank you very much, Luke

1 0

RE: [syslog-ng]use_time_recvd(no) not working?
by Nicholas Berry 08 Mar '02

08 Mar '02

I have emailed a problem I've had a couple times, but I was playing around with the template() feature and found a little more preciously what the problem may be. With template() defined as template("$DATE $HOST $MSG\n"), this is the output I receive: Mar 8 16:32:29 smf-jumpstart AÂ Ã¡ AÂ Ã¡<149>Mar 8 16:32:29 sudo: [ID 850335 local2.notice] nberry : TTY=pts/1 ; PWD=/export/home/nberry ; USER=root ; COM MAND=/usr/ucb/whoami With template() defined as template("$MSG\n"), this is the output I receive: <149>Mar 8 16:40:15 sudo: [ID 850335 local2.notice] nberry : TTY=pts/1 ; PWD=/export/home/nberry ; USER=root ; COMMAND=/usr/ucb/whoami The examples were from a Solaris 8 host using its default syslog daemon, but I have similar issues on *all* other syslog reporting devices (routers, modem banks, etc.) One thing that seems to be consistent between all syslog reporting devices is <X>. Is this some sort of reference that syslogd uses? Can I filter this out? Or will it cause a problem? Also, in the first example " AÂ Ã¡ AÂ Ã¡" is another commonality between hosts. What is the default template() used? I've seen reference to use of "$DATE_RECVD" as an acceptable macro, but I don't see this listed in the documentation. Is there a document set with these new available macros? Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, March 08, 2002 12:37 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]use_time_recvd(no) not working? > a) do you have any tips on tracking down the problem with the broken > pam-timestamps? > b) is the use_time_recvd() option broken/non-existant in 1.5.14 ? it exists, but only affects macro expansion. the timestamp in the message itself is never touched unless you use template output files like this: destination d_file { file("/var/log/messages" template("$DATE_RECVD $HOST $MSG\n")); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

use_time_recvd(no) not working?
by Michael Renner 08 Mar '02

08 Mar '02

Hi! I've got a server (syslog-ng 1.5.14) with a innacurate system time (off by a minute) which logs to my master server (also syslog-ng 1.5.14). The option use_time_recvd(no) is in the masters config but the last changed time of the current logfile and the timestamps in the logfile are those of the senders server. Shouldn't the master syslog-ng strip all timestamp information from the logmessage and insert its own? I noticed this (obviously mis)behaviour because the PAM-stuff on the inaccurate server went mad and sends syslog entries with (nearly) correct time but the date is set to 2001-12-31; all other services log with correct timestamps. Here are some messages which cause the broken log-dates --- snip --- Mär 7 18:12:49 backup su: FAILED SU (to root) robe on /dev/pts/0 Mär 7 18:12:53 backup su: (to root) robe on /dev/pts/0 Mär 7 18:12:53 backup PAM-unix2[10112]: session started for user root, service su --- snap --- modify times of the two opened logfiles on the sending host (format is $HOST/$YEAR-$MONTH-$DAY): -rw------- 1 root root 3193 Mar 7 18:12 2001-12-31 -rw------- 1 root root 196130 Mar 7 19:17 2002-03-07 and here on the master server: -rw------- 1 root root 1814 Mar 7 18:13 2001-12-31 -rw------- 1 root root 39016 Mar 7 19:18 2002-03-07 a) do you have any tips on tracking down the problem with the broken pam-timestamps? b) is the use_time_recvd() option broken/non-existant in 1.5.14 ? mfg -- Renner Michael Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

2 2

logrotate and killall -HUP syslog-ng
by Jerome Peducasse 06 Mar '02

06 Mar '02

Hello, I am testing syslog-ng 1.4.14 and 1.5.15 on Redhat 6.2 with SOCK_DGRAM. In both version, each times I send SIGHUP to syslog-ng, syslog-ng lost kernel packet. I can execute "/etc/rc.d/init.d/syslog-ng restart" instead of "killall -HUP syslog-ng" in logrotate configuration file but this solution requires restart syslog-ng deamon for each logfile rotated :-( Thx. -- Jerome Peducasse

2 2