April 2002 - syslog-ng - lists.balabit.hu

Syslog-ng Reliability
by Victor 15 Apr '02

15 Apr '02

Well, I got syslog-ng setup and running. Runs great. I have to say, this is a realy nice way of doing logging. Major kudos to developers. a few questions: 1. How reliable is network server operation of Syslog-ng under heavy load? I am running remote servers using tcp() and anticipate a lot of throughput. Will syslog-ng not drop stuff like syslogd does? 2. log_fifo_size(100) is this in bytes or kbytes or what? Is this a memory buffer before a write is done? 3. I didn't find the documentation in the man page for variables like $YEAR, $MONTH, $HOST, etc. Where is the list of these? 4. Any idea when compress(on) function will be implemented?

2 1

Installing Syslog-NG
by Victor 13 Apr '02

13 Apr '02

Hi, I have a linux system and I want to try to install Syslog-ng to stream apache logs from one box to a central box (since regular syslog is not reliable) How do I install syslog-ng on a new system? It seems to be running syslogd and klogd. Do I just shutdown syslogd only? Or both? Or does syslogd-ng run alongside the two? Could you also post an example of a config file that mimics the /var/log/maillog,kernlog, etc type of logging in a syslog-ng server config setup? Thanks for any help. P.S. Is there perhaps a howto dealing with installation of Syslog-ng on a running system? Thanks

1 0

RE: [syslog-ng]syslog-ng 1.5.16 released
by Clausing, James A (Jim), SOLCM 12 Apr '02

12 Apr '02

It was solaris 8, configure options don't really matter (in my case, I didn't use any, just ./configure), the problem is that going from 1.5.15 to 1.5.16, the make_log_info function now takes 3 arguments rather than 2 and this call only had 2. I'm using gcc-2.95.3 (same problem with 3.0.4). The compiler complained about mismatch in number of arguments. ---Jim -----Original Message----- From: Ed Ravin [mailto:eravin@panix.com] Sent: Friday, April 12, 2002 2:51 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng 1.5.16 released "Clausing, James A (Jim), SOLCM" writes: > > syslog-ng 1.5.16 didn't build for me without the following patch. I'm not > sure what the prefix should be so I just used NULL. And what operating system and platform are you running? What were your arguments to ./configure? > --- syslog-ng-1.5.16/src/afstreams.c Sun Jul 8 17:04:21 2001 > +++ syslog-ng-1.5.16-patched/src/afstreams.c Fri Apr 12 18:09:01 2002 > @@ -145,7 +145,7 @@ > > length = eol - bol; > if (length) { > - li = make_log_info(length, bol); > + li = make_log_info(length, bol, NULL); > li->pri = pri; > HANDLE_LOG(self->pipe, li); > } _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]syslog-ng 1.5.16 released
by Clausing, James A (Jim), SOLCM 12 Apr '02

12 Apr '02

syslog-ng 1.5.16 didn't build for me without the following patch. I'm not sure what the prefix should be so I just used NULL. --- syslog-ng-1.5.16/src/afstreams.c Sun Jul 8 17:04:21 2001 +++ syslog-ng-1.5.16-patched/src/afstreams.c Fri Apr 12 18:09:01 2002 @@ -145,7 +145,7 @@ length = eol - bol; if (length) { - li = make_log_info(length, bol); + li = make_log_info(length, bol, NULL); li->pri = pri; HANDLE_LOG(self->pipe, li); } -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, April 12, 2002 6:34 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.5.16 released Hi, I have released syslog-ng 1.5.16 with the following NEWS entry: News for the 1.5.16 release Fri, 12 Apr 2002 09:42:28 +0200 Changes: * added log_prefix support for file sources (for adding 'kernel: ' prefix to messages from /proc/kmsg) * fixed the internal DNS cache, so now it really works * fixed localip() and localport() directives for afinet destinations (they erroneously changed the destination address) * Detect O_LARGEFILE on the system and use it if available * Never close fds 0, 1, 2 and, use /dev/null for 0 and 1, and keep 2 open for messages during reinitialization * Added UNIXTIME, R_UNIXTIME, S_UNIXTIME macros to templates and filenames * Fixed TCP wrapper support. Our webserver is currently down, but as soon as it comes back up, I'll upload this release to the usual place: http://www.balabit.hu/en/downloads/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 2

syslog-ng-1.5.15 with tcp-wrapper support
by Stefan M. Brandl 12 Apr '02

12 Apr '02

Hi, I tried to compile syslog-ng-1.5.15 with tcp-wrapper support but had no success. First I had to patch afinet.c with the patch mentioned in http://lists.balabit.hu/pipermail/syslog-ng/2002-February/002962.html But when compiling I get: make[3]: Entering directory `/root/syslog-ng-1.5.15/src' make_class <afinet.c >afinet.c.xT Warning: use of macro doesn't match definition (syntax-rules '() ((let-and (expr) clause clauses ...) (and expr (let-and clause clauses ...))) ((let-and (name expr) clause clauses ...) (let ((name expr)) (and name (let-and clause clauses ...)))) ((let-and expr) expr)) Error: attempt to call a non-procedure ('syntax-error '(#{Name let-and} ((pair? expr)) (op-matches (match # #)) (arg-matches (match # #)) (append op-matches arg-matches)) '#{Procedure 2489 (unnamed in make-name-generator in names)} '#{Procedure 2486 (unnamed in make-keyword-comparator in names)}) make[3]: *** [afinet.c.x] Error 1 make[3]: Leaving directory `/root/syslog-ng-1.5.15/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.5.15/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/root/syslog-ng-1.5.15/src' make: *** [all-recursive] Error 1 Is this a know problem or am I missing something? Regards Stefan

3 2

Re: [syslog-ng]syslog-ng-1.5.15 with tcp-wrapper support
by Stefan M. Brandl 12 Apr '02

12 Apr '02

Ed Ravin eravin(a)panix.com wrote: > This is a bug of some kind in make_class, which comes with the lib-ol > package (and is probably installed in your /usr/local/bin). A kind soul > on the syslog-ng list turned in this patch to fix make_class (you'll > want to edit by hand or apply with "patch -l" since I'm screwing up > the whitespace by posting it this way). > > --- /usr/local/bad/make_class Wed Feb 6 15:59:34 2002 > +++ ./make_class Wed Mar 6 12:10:32 2002 > @@ -19,7 +19,7 @@ > ;; FIXME: Turn this into a scheme48 module > > (define-syntax let-and > - (syntax-rules '() > + (syntax-rules () > ((let-and (expr) clause clauses ...) > (and expr (let-and clause clauses ...))) > ((let-and (name expr) clause clauses ...) Great, this works. Thanks Stefan

1 0

Newbie: System inter-process communication ?
by Jacques.Riopel＠equant.com 11 Apr '02

11 Apr '02

Hi all. Using syslog-ng version 1.4.15. I'm trying to set up a network of machines all running syslog-ng in a testbed. Some machines run Solaris 5.8, others are Sun-Cobalts runing a flavor of Linux. I have successfully compiled when necessary and replaced all the syslogd with syslog-ng on my 4 test machines. Now the hard part is making them all talk to each other, and discovering how to set them to use different ports and TCP vs UDP in some cases. I have the following questions so far: Question 1: Is it possible to specify the upd port to listen on, ie something like "source s_udp { udp (666); };" and then instruct the syslog-ng on the sending machine to use that UDP port as a destination? When I tried the above, I got a parsing error when starting up syslog-ng. My whole test scenario is to have one machine called "A1" at the top level "A", that will listen on port 514 for syslog messages using a TCP connection from machine "B1" at level "B". Machine "B1" is a syslog consolidator, that passes syslog messages to A1 over TCP(514) and receives syslogs from other machines "C1", "C2" on level "C". I want to try to configure machine "C1" to output to machine "B1" using UDP(514), and at the same time have machine "C2" forward its syslogs to machine "B1" using TCP(514). It's possible to have many machines at level "C" all writing to machine "B1"'s port TCP(514), right? For the bonus point, can someone help me with the pertinent syntax for source, destination and log statements for my 4 machines? My job depends on me making this work... 8-) (If someone can replace my generic code below with exact code that will be parsed OK...) Machine A1 (10.5.11.9 - Solaris 5.8) source s_tcp { }; destination d_jnr { usertty("jnriopel"); }; log { source (s_tcp); destination (d_jnr); }; Machine B1 (10.5.10.4 - Linux) source s_tcp { frommachineC2}; source s_udp { frommachineC1}; destination d_tcp { tomachineA1 }; log { source (s_tcp, s_udp); destination (d_tcp); }; Machine C1 (10.5.2.8 - Linux) source src {unix stream }; destination d_udptoB1 { udp (machineB1 }; log { source (src); destination (d_udptoB1); }; Machine C2 (10.5.2.16 - Linux) source src {unix stream }; destination d_TCPtoB1 { tcp (machineB1 }; log { source (src); destination (d_TCPtoB1); }; Question 2: PMI, but I understand from my IP theory that I can send messages to another machine using UDP whether that machine is listening or not and not get errors, whereas is I want to talk using TCP, the machine I am talking to needs to have a listen set up first, ie I need to have syslog-ng running on A1 before I can start it on B1 otherwise B1 will complain about not being able to set up the connection, right? Will messages get lost or queued while waiting for A1 to start listening? Question 3: What is the syntax of the source and destination statements for two machines using syslog-ng and wanting to communicate over TCP port 666, say? (As in my link between A1 and B1 above except for the non-standard port number.) Jacques

2 1

program destination, not respawning programs ?
by Thomas Ackermann 11 Apr '02

11 Apr '02

hy! i'm using syslog-ng to send remote log messages over an stunnel to a log server. everything's running quite fine, besides one little problem i have.. i'm starting the stunnel with program("/usr/sbin/stunnel -r 192.168.3.125:6543 -c"); when the stunnel is killed or quits because of a bad connection, syslog-ng doesn't even bother 'bout trying to restart it. is that a wanted behaviour and, or, is there a way to gat syslog-ng to respawn processes called with program() ? thx, thomas

1 0

Re: [syslog-ng]hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 11 Apr '02

11 Apr '02

Hmm OK, how should I set the permissions of the file? Thanks, Bret Balazs Scheidler <bazsi(a)balabit.hu> 11/04/2002 03:26 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/IT/CHRT/ST Group) Subject: Re: [syslog-ng]hosts... today's stupid question :} On Thu, Apr 11, 2002 at 08:18:51AM +0800, bretwatson(a)charteredsemi.com wrote: > Hi Bazsi, > but it is listed as a valid macro and digging through the code it is > actually there as in the macroexpansion proc... > > does that mean not all macro identifiers are currently being expanded? > Which ones are valid? > > destination host { file("/usr/log1/$HOST/$YEAR$MONTH$DAY" owner(root) group(logusers) perm(0640) dir_perm(0755)); }; ^^^^ macros are not reserved words, I meant the name of your destination. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Re: [syslog-ng]hosts... today's stupid question :}
by bretwatson＠charteredsemi.com 11 Apr '02

11 Apr '02

Hi Bazsi, but it is listed as a valid macro and digging through the code it is actually there as in the macroexpansion proc... does that mean not all macro identifiers are currently being expanded? Which ones are valid? Cheers Bret Balazs Scheidler <bazsi(a)balabit.hu> 10/04/2002 05:26 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/IT/CHRT/ST Group) Subject: Re: [syslog-ng]hosts... today's stupid question :} On Wed, Apr 10, 2002 at 08:22:26AM +0800, bretwatson(a)charteredsemi.com wrote: > > Hi All, > a stupid question most probably, > I'd like to build a generic destination for my default filter so that any > new hosts get dropped into their own directory > > something like > destination host { file("/usr/log1/$HOST/$YEAR$MONTH$DAY" owner(root) > group(logusers) perm(0640) dir_perm(0755)); }; > > But syslog-ng doesn't seem to like it and complains of syntax errors all > the time.. host is a reserved word, don't use it for identifiers. the best bet is to prefix identifiers with the purpose, e.g. d_host for destination f_host for filters and so on. It will not collide with reserved words then. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

2 1