July 2002 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 11 Jul '02

11 Jul '02

Just add a little more info, if I send the first 10 messages a little bit slower, say delay 10 msec in between, then it doesn't happen. -----Original Message----- From: Antai Ning [mailto:aning@jetnet.ca] Sent: Wednesday, July 10, 2002 1:38 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Strang behaviour of syslog-ng (and my program) Hi Gurus, I got some strange phenomemon with syslog-ng. Here is what I'm doing. I configured syslog-ng to forward certain type of messages to a pipe. (say, ALERT). I wrote a program in perl to read from the pipe and print them out. The perl program first try to open the pipe and it'll block at the open function untill syslog-ng has some messages to write to the pipe. Then the perl program reads using IO::File can_read() function, with a 5 seconds timeout. So the function looks like this: $sel->can_read(5). Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my supprise, the perl program got only 2 of the 10! Then I send another 1 valid message to this syslog-ng after 5 minutes, and I got not only this message, but also the 8 I lost last time! This happens only for the first 10 messages (which includes the opening of the pipe). Everything is fine after the first round. It looks like it's related to the pipe opening and messages get queued somewhere until later messages trigger the queue to flush. So what's really happening inside? And is there a solution? Thanks, Andy

1 0

Strang behaviour of syslog-ng (and my program)
by Antai Ning 10 Jul '02

10 Jul '02

Hi Gurus, I got some strange phenomemon with syslog-ng. Here is what I'm doing. I configured syslog-ng to forward certain type of messages to a pipe. (say, ALERT). I wrote a program in perl to read from the pipe and print them out. The perl program first try to open the pipe and it'll block at the open function untill syslog-ng has some messages to write to the pipe. Then the perl program reads using IO::File can_read() function, with a 5 seconds timeout. So the function looks like this: $sel->can_read(5). Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my supprise, the perl program got only 2 of the 10! Then I send another 1 valid message to this syslog-ng after 5 minutes, and I got not only this message, but also the 8 I lost last time! This happens only for the first 10 messages (which includes the opening of the pipe). Everything is fine after the first round. It looks like it's related to the pipe opening and messages get queued somewhere until later messages trigger the queue to flush. So what's really happening inside? And is there a solution? Thanks, Andy

1 0

RE: [syslog-ng]dns caching
by Torres Gallardo, Diego 09 Jul '02

09 Jul '02

>>id doesn't do one dns lookup for each line? >This was discussed previously on this list; sorry then, but i didn't find any archives of this list > I would suggest that you stick with multilog because dnscache is quite verbose and logging these rather unnecessary messages via syslog-ng of course the loggin messages from dnscache are quite overhelming, surely if i comment out some of this information from the source code of dnscache and recompile there won't be much loss... >would waste lots of cpu cycles (you don't log your apache access-logs via syslog, do you?) right, i don't have an apache server on the router box :)

1 0

dns caching
by Torres Gallardo, Diego 09 Jul '02

09 Jul '02

i've been using syslog-ng for a while, and now that i've setup dnscache (from djb) to use syslog instead of his own loggin method (multilog), i've found a funny thing that fulls my log files. (dnscache pc and syslog-ng hosting pc are different machines, i log through network). 1- when a dnscache-request is made, dnscache issues a message to syslog-ng. 2- syslog-ng writes down to the syslog file the new entry, but it does a dns lookup (because the log entry is coming from a machine on the network). 3- loop forever :) i don't want to use the use_dns(off) option of syslog-ng, because i wan't ips translated. Is there a way that syslog-ng could cache the dns querys, so id doesn't do one dns lookup for each line? _____________________________________ Diego Torres Gallardo Departamento Radar División de Navegación y Vigilancia AENA dtgallardo(a)aena.es (+34) 913215472

1 0

question about syslog-ng to MySQL
by Martin Hess 08 Jul '02

08 Jul '02

Hi all! I'm pretty new here in the hole syslog-ng world; so I have a litte question witch might sounds stupid for you... but any help would be great! I successfuly set up syslog-ng to log into the MySQL database. But now I want to filter the events before they are piped into the database (I don't want the logs from the cron jobs to be logged). Does anybody can tell me how I can achieve this?? Thanks in advance martin, switzerland

2 1

How do I stop "STATS: dropped 0" messages?
by Subodh Nijsure 05 Jul '02

05 Jul '02

Hello, I think I have read the man pages, and I missed how do I stop syslog-ng from generating the "STATS: dropped 0" messages? Is there option in config file I can specify? /Subodh

3 2

pipe() under hpux-11 and timestamp
by Trapp, Michael 05 Jul '02

05 Jul '02

hi, i am running syslog-ng 1.5.18 on hpux 11.00 with the following options: use_time_recvd(yes); use_fqdn(yes); sync(0); use_dns(yes); dns_cache(yes); dns_cache_size(10000); dns_cache_expire(3600); dns_cache_expire_failed(300); keep_hostname(no); chain_hostnames(no); gc_idle_threshold(50); gc_busy_threshold(5000); log_fifo_size(2000); reading from udp() and pipe() as far as i can see the pipe("/dev/log") isn't working correct. with a simple fgets() i can see that the messages are '0' terminated strings, but syslog-ng reads the whole message obviously each message has 4096 bytes and print out several lines filled up with characters from the buffer behind the string termination. i have also configured use_time_recvd(yes) but there are a few messages which don't have the right timestamp or are not in the right order (just a few seconds). in adition the day field of this lines has a leading '0'. has anybody experienced these problems? are there further options to improve the performance, as i can see syslog-ng still miss some packets. thanx michael

2 2

starting syslog-ng
by bert 04 Jul '02

04 Jul '02

Hi, I want to start syslog-ng before the network is running but my configuration script contains (among other destinations) a network reference. Hence syslog-ng is exiting due to an error in the initialisation. Is there a way to deal with this, so syslog-ng is starting and resolve the connection at the time the network starts up. Thanks, Bert

2 1

Long messages truncated in 1.5.x branch on Solaris 8
by Andreas Schulze 03 Jul '02

03 Jul '02

Hello, we are observing a wondrous behavior on our central logservers. We have an local application, that logs to the destinations above. And all messages greater that approx. 975 Bytes are truncated. But the enigma is: If using the local Solaris 'logger' application, all messages greater than 509 Bytes are truncated. But they are truncated on different positions depends on the message size! (Say, if you log 600 Bytes, you get the first 509 and if you try to log 761, you get the first 26.) Hmm ?! We tried out the log_msg_size() feature, available since 1.5.1?. With no luck. Both logservers using Solaris 8, one running syslog-ng 1.5.7, the other 1.5.18. We are using file() and pipe() destinations capable of queueing via log_fifo_size() and capable of formating output via template(..$MSG..\n). Before writing to the destinations, we do a lot of filtering, too. We are using the excellent syslog-ng a long time, but now we stuck inactive. Has anybody a hint for us? Is this a bug in syslog-ng, in Solaris, in our mind? Thanks a lot for any note. -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | | sh# cat>$$.c<<EOT | main(l,a,n,d)char**a;{for(d=atoi(a[1])/10*80-atoi(a[2])/5-596;n="@NK\ | ACLCCGZAAQBEAADAFaISADJABBA^SNLGAQABDAXIMBAACTBATAHDBANZcEMMCCCCAAhE\ | IJFAEAAABAfHJETBdFLDAANEfDNBPHdBcBBBEA_AL H E L L O, W O R L D! " | [l++-3];)for(;n-->64;)putchar(!d+++33^l&1);} | EOT | gcc -o$$ $$.c;clear;./$$ 52 8;rm -f $$*

2 5

Re: [syslog-ng]host x.x.x.111 is the same as x.x.x.11 (filter error?)
by Lubos Vitek 03 Jul '02

03 Jul '02

Thank you very much for your kind reply! It really works as you wrote :-) (with ^...$ RE). Now I have one another question. How can I filter out this kind of log record: datum hostX process some text with "xxxxx" string I want to write it in file for hostX.log, so I wrote filter: filter f_hostX { host("hostX"); }; then I wrote filter for string "xxxxx": filter f_notxxxxx { not match("xxxxx"); }; and then I used it all in log statement: log {... filter f_hostX ; filter f_notxxxxx ; ... } I tried to log something on host hostX with string "xxxxx", and I received it in syslog-ng in file hostX.log. Why ? What am I doing wrong now ? Please sorry if I missunderstand something, but I tried it more times with other combinations of filter, but the "NOT" statement simply does not work ... Thank you in advance for your reply... Bye, Lubos. __________________________________________________ Do You Yahoo!? Sign up for SBC Yahoo! Dial - First Month Free http://sbc.yahoo.com

2 1