July 2002 - syslog-ng - lists.balabit.hu

syslog-ng 1.4.x troubles : 2nd post
by archi2k＠altern.org 01 Aug '02

01 Aug '02

Please CC me, I'm not subscribed to the list. Okay, to try to isolate the problem shown on my previous post, here is what I did : <snip /etc/init.d/syslog-ng> case "$1" in start) echo -n "Starting system logging: syslog-ng" #start-stop-daemon --start --quiet --exec /usr/local/sbin/syslog-ng strace -f syslog-ng > /var/log/syslog-ng.strace 2>&1 & echo -n " klogd" start-stop-daemon --start --quiet --exec /sbin/klogd -- $KLOGD echo "." ;; </snip> And guess what : when I run syslog-ng thru strace it works!! @#[|%!! Ie when I boot the box syslog-ng is not blocked any more. I finally found a way to make it actually work by not using start-stop-daemon : <snip> #start-stop-daemon --start --quiet --exec /usr/local/sbin/syslog-ng #strace -f syslog-ng > /var/log/syslog-ng.strace 2>&1 & /usr/local/sbin/syslog-ng </snip> simpler! But why?!? ciao

3 3

syslog-ng 1.4.x troubles
by archi2k＠altern.org 31 Jul '02

31 Jul '02

Please CC me, I'm not subscribed to the list. I have a very annoying problem with 1.4.x (not tried 1.5.x). I run syslog-ng on several boxes from a long time. All these boxes are debian potato or woody. syslog-ng 1.4.x compiled by hand. Here is the pb : Sometimes, syslog-ng stops logging. When this happens, some of the services running on the box stop working. If I issue a netstat on the box, here is what I got : Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node Path unix 0 [ ACC ] STREAM LISTENING 115 /tmp/mysql.sock unix 0 [ ACC ] STREAM LISTENING 57 /dev/log unix 1 [ ] STREAM CONNECTED 128 @0000000b unix 1 [ ] STREAM CONNECTED 228 @0000000f unix 1 [ ] STREAM CONNECTED 176 @0000000e unix 1 [ ] STREAM CONNECTED 60 @00000001 unix 1 [ ] STREAM CONNECTED 78 @00000004 unix 1 [ ] STREAM CONNECTED 87 @00000005 unix 1 [ ] STREAM CONNECTED 92 @00000007 unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 0 [ ] STREAM CONNECTING 0 /dev/log unix 1 [ ] STREAM CONNECTED 62 /dev/log As you can see, lots of /dev/log sock in the "CONNECTING" state. Sometimes, I have 100 like this ;o) Processes like stunnel then refuse to work. I have to kill -9 syslog-ng and then restart it. For some boxes I have to do that manually each time I boot the box. Any clue? Here is, for one of my boxes, its syslog-ng.conf. # syslog-ng configuration file. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log" max-connections(210)); internal(); file("/proc/kmsg"); }; destination authlog { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/authlog"); }; destination daemon { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/daemon"); }; destination kern { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/kernel"); }; destination maillog { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/maillog"); }; destination messages { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/messages"); }; destination secure { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/secure"); }; destination wtmp { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/wtmp"); }; destination cron { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/cron"); }; destination ftp { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/ftp"); }; destination errors { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/errors"); usertty("root"); }; destination alert { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/alert"); usertty("root"); }; destination notice { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/notice"); }; destination emergency { file("/var/log/$HOST/$YEAR/$MONTH/$DAY/emergency"); usertty(*); }; filter f_kern { facility(kern); }; filter f_syslog { facility(syslog); }; filter f_user { facility(user); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_xferlog { facility(ftp); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_kernel { facility(kern); }; filter f_debug { level(debug); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_alert { level(alert); }; filter f_emerg { level(emerg); }; filter f_err { level(err); }; #log { source(s_sys); destination(d_amethyste_file); }; log { source(s_sys); filter(f_kern); filter(f_debug); destination(messages); }; log { source(s_sys); filter(f_user); filter(f_info); destination(messages); }; log { source(s_sys); filter(f_syslog); filter(f_info); destination(messages); }; log { source(s_sys); filter(f_auth); filter(f_info); destination(authlog); }; log { source(s_sys); filter(f_authpriv); filter(f_debug); destination(secure); }; log { source(s_sys); filter(f_cron); filter(f_info); destination(cron); }; log { source(s_sys); filter(f_daemon); filter(f_info); destination(daemon); }; log { source(s_sys); filter(f_xferlog); filter(f_info); destination(ftp); }; log { source(s_sys); filter(f_mail); filter(f_info); destination(maillog); }; log { source(s_sys); filter(f_kern); destination(kern); }; log { source(s_sys); filter(f_err); destination(errors); }; log { source(s_sys); filter(f_alert); destination(alert); }; log { source(s_sys); filter(f_notice); destination(notice); }; log { source(s_sys); filter(f_auth); filter(f_debug); destination(alert); }; log { source(s_sys); filter(f_emerg); destination(emergency); }; Cheers, a2k

1 0

FW: UNSTABLE syslog-ng 1.4.15 + redhat-7.3
by _/CaT\_ 31 Jul '02

31 Jul '02

After Core's dump problem I've got another with FREE-BSD 4.6, I'm still waiting for an helping hand ;). I tried to install syslog-ng 1.4.15 on a redhat-7.3 system but it's Unstable without CORE Dump File. The attachment is the debug's backtrace with installed packets and configuration files... Another question, the last, what is the most STABLE version of REDHAT or FreeBDS I'd use?? Thnks. _/CaT\_ PS: If I succeed in my syslog-server Mission when you'll come to Rome (Caput Mundi), I 'll offer you the real pizza with a real red wine to "ZOZZONE's" --- gcc version 2.96 20000731 (Red Hat Linux 7.3 2.96-110) flex version 2.5.4 (rpm flex-2.5.4a-23) bison (GNU Bison) 1.35 (rpm bison-1.35-1) yacc 1.9 (rpm byacc-1.9-19) scsh-0.6.2 libol-0.2.23 syslog-ng-1.4.15 --- GNU gdb Red Hat Linux (5.2-2) Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"... (gdb) run -v Starting program: /usr/local/sbin/syslog-ng -v binding fd 5, inetaddr: 0.0.0.0, port: 514 Program received signal SIGTERM, Terminated. 0x420b4ae7 in pause () from /lib/i686/libc.so.6 (gdb) bt #0 0x420b4ae7 in pause () from /lib/i686/libc.so.6 #1 0x08049d0d in go_background () #2 0x08049e93 in main () #3 0x42017499 in __libc_start_main () from /lib/i686/libc.so.6 ---- ######################################################################## ## options { long_hostnames(off); keep_hostname(no); sync(0); use_dns(no); log_fifo_size(1000); gc_idle_threshold(100); gc_busy_threshold(3000); }; ######################################################################## ## source src { internal(); udp(ip(0.0.0.0) port(514)); }; ######################################################################## ### ###Destination #Sorting degl'hosts # destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(mspns) perm(0644) dir_perm(0700) create_dirs(yes)); }; # destination all { file("/var/log/all.log" owner(root) group(mspns) perm(0644)); }; # destination send_trap_prova { program("/usr/local/script/syslogtrapper_test"); }; # ######################################################################## #### ####Filtering # filter f_prova { host ("10.11.5.37") and not match ("message repeated"); }; # ######################################################################## ##### ###Logging # log { source(src); destination(hosts); }; # log { source(src); destination(all); }; # log { source(src); filter(f_prova); destination(send_trap_prova); }; # ######################################################################## ##### # /usr/local/script/syslogtrapper_test # #!/bin/bash while read line do snmptrap -c xxxxxx! 10.11.8.14 .1.3.6.1.4.1.2620.1.1.0 10.11.5.48 6 2 '' .1.3.6.1.4.1.2620.1.1.6 s "prova invio trap V1: $line" done exit

2 6

RE: [syslog-ng]Installing on a non-compiler system
by Lightfoot.Michael 31 Jul '02

31 Jul '02

I should go and eat more often. After returning from a delightfully relaxing lunch (baked vegetables and mug of Soya flat white) and digesting another 4 or 5 pages of Herodotus (Xerxes is just about to attack Greece), I reread my message and realised all I had to do was creat a symlink from /export/home to /usr/local/src and it would all work. I'm still not sure what to do if the DMZ systems don't have make. > # make install > Making install in src > Making install in . > make: Fatal error: Don't know how to make target > `/usr/local/src/syslog-ng-1.4.15/configure.in' > Current working directory /export/home/syslog-ng-1.4.15/src > *** Error code 1 > make: Fatal error: Command failed for target > `install-recursive' Current working directory > /export/home/syslog-ng-1.4.15/src > *** Error code 1 > make: Fatal error: Command failed for target `install-recursive' m. NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries.

2 1

can't log to remote host -- error message in syslog
by Adam Tworkowski 30 Jul '02

30 Jul '02

Hi, I've been having issues logging to a remote server on another segment. I have no issue with logging from machines that are on the same segment as the logging server. I am getting the following error in the error log. Can someone interpret this for me. Thanks. src@hostname syslog-ng[12920]: Error connecting to remote host IF_INET(loghost:514), reattempting in 60 seconds

2 1

RE: [syslog-ng]Installing on a non-compiler system
by Nicholas Berry 30 Jul '02

30 Jul '02

You could build syslog-ng in a Solaris pkg format, but I'm not sure how much of a problem you would have installing the package on your Solaris 2.6 system (might not have a problem if you're up-to-date with the recommended patch cluster). Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. nberry(a)ragingwire.com -----Original Message----- From: Lightfoot.Michael [mailto:Lightfoot.Michael@comcare.gov.au] Sent: Monday, July 29, 2002 8:02 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Installing on a non-compiler system I have built syslog-ng on a development server (Solaris 9) and now wish to install it on another system which doesn't have development tools (it is a fairly standard Solaris 9 installation.) I will also be installing a Solaris 2.6 build on systems in our DMZ which have been hardened and have very little other than the OS. The problem I have struck is that after copying the built source to the target server, "make install" fails with the following error: # make install Making install in src Making install in . make: Fatal error: Don't know how to make target `/usr/local/src/syslog-ng-1.4.15/configure.in' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Any ideas on how I get around this easily? NFS is one option, but will not be for the DMZ systems (and is not used in production on any systems here.) I suppose I could install it on the development server using a filesystem diff before and after trick I have used in the past, but again there are problems doing this with the Solaris 2.6 build (which has to be done on a production server as I don't have a Solaris 2.6 dev machine any more.) Michael Lightfoot Unix Consultant ISG Host Systems Comcare +61 2 62750680 NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Installing on a non-compiler system
by Lightfoot.Michael 30 Jul '02

30 Jul '02

I have built syslog-ng on a development server (Solaris 9) and now wish to install it on another system which doesn't have development tools (it is a fairly standard Solaris 9 installation.) I will also be installing a Solaris 2.6 build on systems in our DMZ which have been hardened and have very little other than the OS. The problem I have struck is that after copying the built source to the target server, "make install" fails with the following error: # make install Making install in src Making install in . make: Fatal error: Don't know how to make target `/usr/local/src/syslog-ng-1.4.15/configure.in' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Current working directory /export/home/syslog-ng-1.4.15/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Any ideas on how I get around this easily? NFS is one option, but will not be for the DMZ systems (and is not used in production on any systems here.) I suppose I could install it on the development server using a filesystem diff before and after trick I have used in the past, but again there are problems doing this with the Solaris 2.6 build (which has to be done on a production server as I don't have a Solaris 2.6 dev machine any more.) Michael Lightfoot Unix Consultant ISG Host Systems Comcare +61 2 62750680 NOTICE: This e-mail message and attachments may contain confidential information. If you are not the intended recipient you should not use or disclose any information in the message or attachments. If received in error, please notify the sender by return email immediately. Comcare does not waive any confidentiality or privilege. Comcare's Canberra and Melbourne offices have moved to new premises. We hope this notice makes it easier for you to update your records. New street addresses: Canberra office Level 1 14 Moore street CANBERRA CITY ACT 2601 Melbourne Office Level 2 121 William Street MELBOURNE VIC 3001 Claims Fax Number 03 9620 4721 Please call Comcare on 1300 366 979 if you have any queries.

1 0

Re: [syslog-ng]Re: problem with truncated kernel logs
by Ron Braley 29 Jul '02

29 Jul '02

No, it's still a problem. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 07/29/02 11:32AM >>> On Mon, Jul 29, 2002 at 09:48:30AM -0500, Ron Braley wrote: > Bazsi > > Sorry - I forgot to change the subject line! > > No, klogd isn't running in addition to syslog-ng. Just to be sure, I > checked processes, which did show klogd -2 and then shut down the > syslog-ng service. I then checked processes and saw klogd was no longer > running. > > Thanks in advance for your expert advise! hmm. I don't really understand whether your problem is solved, or not? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: problem with truncated kernel logs
by Ron Braley 29 Jul '02

29 Jul '02

Bazsi Sorry - I forgot to change the subject line! No, klogd isn't running in addition to syslog-ng. Just to be sure, I checked processes, which did show klogd -2 and then shut down the syslog-ng service. I then checked processes and saw klogd was no longer running. Thanks in advance for your expert advise! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 07/29/02 03:03AM >>> On Fri, Jul 26, 2002 at 03:11:10PM -0500, Ron Braley wrote: > Hi bazi. > > We're having a problem with syslog-ng 1.5. It appears to be truncating > our iptables firewall logs. > > The following shows good logs as viewed through dmesg, and actual log > entries as processed by syslog-ng: > > *** Good (dmesg): > IPTABLES TCP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:08:00:20:a7:53:e9:08:00 > SRC=134.129.212.23 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00 TTL=64 > ID=64525 DF > PROTO=TCP SPT=36788 DPT=53 WINDOW=24820 RES=0x00 SYN URGP=0 > > IPTABLES UDP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 > SRC=134.129.214.80 DST=134.129.212.30 LEN=239 TOS=0x00 PREC=0x00 > TTL=127 ID=21813 > PROTO=UDP SPT=138 DPT=138 LEN=219 > > *** Bad (syslog [/var/log/kern]): > Jul 25 16:16:12 smack IPTABLES TCP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:a0:c9:a9:b2:6c:08:00 > SRC=134.129.212.33 DST=134.129.212.30 LEN=60 TOS=0x00 > PREC=0x03NDOW=5840 > > Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:05:01:fECP1389 > > Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= > MAC=00:03:47:4e:32:44:00:05:01:fb3::0 > SRC=134.12920.134 DST=134.129.212.0 LEN=78 TOS=0x00 > PREC=0xTTL=1272ROTO=UDP SPT=137 DPT=137N=58 Please start a new thread if you send something unrelated to current threads. wrt your problem, are you sure you are not running klogd in addition to syslog-ng? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] 1.5.19 patch for hostname and hpux pipe
by Ron Braley 29 Jul '02

29 Jul '02

Hi bazi. We're having a problem with syslog-ng 1.5. It appears to be truncating our iptables firewall logs. The following shows good logs as viewed through dmesg, and actual log entries as processed by syslog-ng: *** Good (dmesg): IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:08:00:20:a7:53:e9:08:00 SRC=134.129.212.23 DST=134.129.212.30 LEN=48 TOS=0x00 PREC=0x00 TTL=64 ID=64525 DF PROTO=TCP SPT=36788 DPT=53 WINDOW=24820 RES=0x00 SYN URGP=0 IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb:e3:fc:08:00 SRC=134.129.214.80 DST=134.129.212.30 LEN=239 TOS=0x00 PREC=0x00 TTL=127 ID=21813 PROTO=UDP SPT=138 DPT=138 LEN=219 *** Bad (syslog [/var/log/kern]): Jul 25 16:16:12 smack IPTABLES TCP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:a0:c9:a9:b2:6c:08:00 SRC=134.129.212.33 DST=134.129.212.30 LEN=60 TOS=0x00 PREC=0x03NDOW=5840 Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fECP1389 Jul 25 16:16:13 smack IPTABLES UDP-IN: IN=eth1 OUT= MAC=00:03:47:4e:32:44:00:05:01:fb3::0 SRC=134.12920.134 DST=134.129.212.0 LEN=78 TOS=0x00 PREC=0xTTL=1272ROTO=UDP SPT=137 DPT=137N=58 Can you help, please? Thanks! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax)

2 1