July 2002 - syslog-ng - lists.balabit.hu

remote logging problem syslog-ng logging between routable public networks (?)
by Adam Tworkowski 16 Jul '02

16 Jul '02

Hi, I've searched high and low and I can't find the answer to the following scenario: I would like to be able to use a remote logging host across the internet (I reckognize that security concerns of not using a VPN). I *am* able to do syslog-ng to syslog-ng remote logging on the same network segment. There is no issue here. I cannot log across a LAN extension or across the internet at large. I've tried UDP and TCP. I've even successfully sniffed packets on the remote log server that were sent across the internet. Is there an issue with bridges, routers or ARP and syslog-ng? As far as I can tell, the only difference between the various hosts I am trying to log from is geographic location and network location. Same OS. Same versions, same syslog-ng.conf. I am using Debian 3.0 with syslog-ng 1.5.18. Thanks in advance. Adam Tworkowski

3 2

(no subject)
by gino latino 16 Jul '02

16 Jul '02

HI *, there was someone who tried syslog-ng 1.4.15 undev FreeBSD 4.6-RELEASE???? I tried and the result was unsuccesfull.... This is the configuration: ########################################################################## options { long_hostnames(off); keep_hostname(no); sync(0); use_dns(no); log_fifo_size(1000); gc_idle_threshold(100); gc_busy_threshold(3000); }; ########################################################################## source src { unix-dgram("/var/run/log"); internal(); udp(ip(0.0.0.0) port(514)); }; ########################################################################### ###Destination #Sorting degl'hosts # destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; # destination all { file("/var/log/all.log" owner(root) group(root) perm(0640)); }; # destination send_trap_prova { program("/home/bigjim/send_trap_prova"); }; # ############################################################################ ####Filtering # filter f_prova { host ("10.11.5.37") and not match ("message repeated"); }; # ############################################################################# ###Logging # log { source(src); destination(hosts); }; # log { source(src); destination(all); }; # log { source(src); filter(f_prova); destination(send_trap_prova); }; # ############################################################################# The attachment is the core dump file. Thnz Cheers ___________________________________ There is no 'patch' for stupidity _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com

3 6

logfile save problem (again ;)
by Buerger, Manfred 16 Jul '02

16 Jul '02

hello, I have allready posted my syslog-ng problem to this mailinglist on friday; now, I hope I can make things more clear: I am using Suse8.0 with syslog-ng to monitor enterasys ans cabletron network equipment (switches, routers.... ); and have some problems with the configuration: in my syslog-ng.conf: destination local7 { file("/var/log/syslog-ng/$HOST/local7.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; because of this configuration a system message like: "Jul 15 13:56:28 %STP-I-PORT_STATUS,/10.146.12.16 Port status change detected: et.3.6 - Port Up" should be stored in "/var/log/syslog-ng/10.146.12.16/local7.log" but it´s stored in: "/var/log/syslog-ng/%STP-I-PORT_STATUS,/local7.log". what can i do?? Please help me!!! Thanks in advance manfred

2 1

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 15 Jul '02

15 Jul '02

Hi Bazsi, Thanks for your reply first of all! And sorry for the second email in HTML secondly. This one should be ok (I tested :-). Ok, let's go to the point. I've never used strace but I'll try it. Yes, my program is using buffer and actually that's the first thing I checked. But I'm pretty sure it's not there. This is somewhat related to pipe openning. If I make sure syslog-ng opens the pipe before my program, then everything is OK. The code in my program is something like this: . . initializing . . while(1) { open pipe #block here until syslog-ng open the pipe while(1) { select on the pipe #block here until the pipe is ready for read or timeout (5 sec) next if timeout last if other side close the pipe #jump out the loop and try to open pipe again read and process the message #normal } } Bazsi, you see anything wrong here? Thanks, Andy -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, July 15, 2002 10:59 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Strang behaviour of syslog-ng (and my program) On Mon, Jul 15, 2002 at 10:32:08AM -0400, Antai Ning wrote: > Hi Gents, > > I'm posting the question again because I really need an answer for it, > > Thanks a lot, can you check whether strace shows anything insane? are you using buffering in your perl program? syslog-ng uses a read/write pipe, and writes messages as soon as the pipe becomes writable. if the pipe is not writable (as indicated by poll), messages are buffered in a fifo, whose size is controlled by log_fifo_size(). -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Sorry, this is a test. Just ignore it.
by Antai Ning 15 Jul '02

15 Jul '02

Sorry guys, try to see if I'm still in HTML...

1 0

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 15 Jul '02

15 Jul '02

1 0

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 15 Jul '02

15 Jul '02

2 1

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 15 Jul '02

15 Jul '02

Hi Gents, I'm posting the question again because I really need an answer for it, Thanks a lot, Andy -----Original Message----- From: Antai Ning [mailto:aning@jetnet.ca] Sent: Wednesday, July 10, 2002 1:38 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Strang behaviour of syslog-ng (and my program) Hi Gurus, I got some strange phenomemon with syslog-ng. Here is what I'm doing. I configured syslog-ng to forward certain type of messages to a pipe. (say, ALERT). I wrote a program in perl to read from the pipe and print them out. The perl program first try to open the pipe and it'll block at the open function untill syslog-ng has some messages to write to the pipe. Then the perl program reads using IO::File can_read() function, with a 5 seconds timeout. So the function looks like this: $sel->can_read(5). Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my supprise, the perl program got only 2 of the 10! Then I send another 1 valid message to this syslog-ng after 5 minutes, and I got not only this message, but also the 8 I lost last time! This happens only for the first 10 messages (which includes the opening of the pipe). Everything is fine after the first round. It looks like it's related to the pipe opening and messages get queued somewhere until later messages trigger the queue to flush. So what's really happening inside? And is there a solution? Thanks, Andy Cofiguration: syslog-ng 1.4.11 on Redhat linux 7.2. And here is the syslog-ng globla option look like. (Sorry I can't post all the configuration because of obvious reasons :) ) But there is no options set for specific source, destionation or filter. options { use_dns (no); # Don't perform DNS lookups use_fqdn (no); # Don't use full hostname create_dirs (yes); # Create any necessary dirs for files use_time_recvd (yes); # Use our time, not the remote device time log_fifo_size(10000); # Queue 10000 msgs on a blocked dest sync(0); # Flush the queues as fast as possible # Tweak the sync parameter if the disks are # going wild and thrashing the machine chain_hostnames(on); # Chain hostname/IP information in log line }; source s_UDP { udp( ip(192.168.1.1) port(514) ); };

2 1

RE: [syslog-ng]Message aggregation
by Kevin Welch 15 Jul '02

15 Jul '02

I would have to agree with that accessment, it would definately make my perl scripts more complicated. I guess that given the choice I would prefer the detail over the summarization. Probably should have spent a bit more time thinking about why exactly I wanted that feature. Thanks for the response. -- Kevin -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Monday, July 15, 2002 6:33 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Message aggregation On Tue, Jul 09, 2002 at 07:02:19PM -0400, Kevin Welch wrote: > I know this issue has been discussed before, but I never saw an answer other > than 'syslog-ng doesnt do that'. > > Perhaps someone could provide insight as to why syslog-ng doesnt aggregate > messages received? Is this on a feature list for future releases? > > Thanks for your time. It might be implemented once I have time, though IMHO message aggregation makes log analysis more difficult, especially if you have multiple cascaded log relays. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Message aggregation
by Kevin Welch 15 Jul '02

15 Jul '02

I know this issue has been discussed before, but I never saw an answer other than 'syslog-ng doesnt do that'. Perhaps someone could provide insight as to why syslog-ng doesnt aggregate messages received? Is this on a feature list for future releases? Thanks for your time. -- Kevin

2 1