September 2002 - syslog-ng - lists.balabit.hu

use_time_recvd
by Trapp, Michael 27 Sep '02

27 Sep '02

hi bazsi, i was a little bit surprised about the use_time_recvd option. obviously it has no impact on the timestamp of a recieved msg if there is already a timestamp included. i thought that the recvd-timestamp is used anyway ... well, i've attached a patch to fix that. regards michael

1 0

crash version 1.5.20 under stress with tcp
by Puschmann Johannes 26 Sep '02

26 Sep '02

Hi List. I am testing syslog-ng 1.5.20. Its an RH 7.2 kernel 2.4.18 syslog-ng was compiled from source. When you flood the machine with messages over tcp, it crashes Under udp port 514 its looks nice. (20000 messages/min no Problem) see Backtrace and configfile below. Looks like the template makes problems. best regards Johannes gc_mark: Marking object of class 'UNKNOWN' (1) AF_INET client connected from 192.168.129.102, port 1609 io.c: Preparing fd 8 for reading 192.168.129.102... adding as 707 (1 iters). io.c: Preparing fd 9 for writing io.c: Preparing fd 10 for writing Program received signal SIGSEGV, Segmentation fault. 0x080526a0 in expand_macros (cfg=0x6f6c7379, template=0x65742067, template_escape=1830843507, msg=0x61737365) at affile.c:866 866 while (left && (i < template->length)) { (gdb) bt #0 0x080526a0 in expand_macros (cfg=0x6f6c7379, template=0x65742067, template_escape=1830843507, msg=0x61737365) at affile.c:866 #1 0x53207369 in ?? () Cannot access memory at address 0x20736968 ------------------------------------------------------------------- options { dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname(yes); }; source local { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); internal(); }; # *.* @192.168.129.164 filter f_1 { level(debug...emerg); }; #destination d_1 { # udp("192.168.129.164" port(514)); #}; #log { source(local); filter(f_1); destination(d_1); }; # *.info;mail.none;news.none;authpriv.none;cron.none;daemon.none /var/log/messages filter f_2 { not facility(authpriv); }; filter f_3 { not facility(cron); }; filter f_4 { not facility(daemon); }; filter f_5 { level(info...emerg); }; filter f_6 { not facility(mail); }; filter f_7 { not facility(news); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_3); filter(f_4); filter(f_5); filter(f_6); filter(f_7); destination(d_2); }; # authpriv.* /var/log/secure filter f_8 { facility(authpriv) and level(debug...emerg); }; destination d_3 { file("/var/log/secure" create_dirs(yes)); }; log { source(local); filter(f_8); destination(d_3); }; # daemon.* /var/log/daemon filter f_9 { facility(daemon) and level(debug...emerg); }; destination d_4 { file("/var/log/daemon" create_dirs(yes)); }; log { source(local); filter(f_9); destination(d_4); }; # mail.* /var/log/maillog filter f_10 { facility(mail) and level(debug...emerg); }; destination d_5 { file("/var/log/maillog" create_dirs(yes)); }; log { source(local); filter(f_10); destination(d_5); }; # cron.* /var/log/cron filter f_11 { facility(cron) and level(debug...emerg); }; destination d_6 { file("/var/log/cron" create_dirs(yes)); }; log { source(local); filter(f_11); destination(d_6); }; # *.emerg * filter f_12 { level(emerg); }; destination d_7 { usertty("*"); }; log { source(local); filter(f_12); destination(d_7); }; # uucp,news.crit /var/log/spooler filter f_13 { facility(uucp,news) and level(crit...emerg); }; destination d_8 { file("/var/log/spooler" create_dirs(yes)); }; log { source(local); filter(f_13); destination(d_8); }; # local7.* /var/log/boot.log filter f_14 { facility(local7) and level(debug...emerg); }; destination d_9 { file("/var/log/boot.log" create_dirs(yes)); }; log { source(local); filter(f_14); destination(d_9); }; # news.=crit /var/log/news/news.crit filter f_15 { facility(news) and level(crit...emerg); }; destination d_10 { file("/var/log/news/news.crit" create_dirs(yes)); }; log { source(local); filter(f_15); destination(d_10); }; # news.=err /var/log/news/news.err filter f_16 { facility(news) and level(err...emerg); }; destination d_11 { file("/var/log/news/news.err" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_11); }; # news.notice /var/log/news/news.notice filter f_17 { facility(news) and level(notice...emerg); }; destination d_12 { file("/var/log/news/news.notice" create_dirs(yes)); }; log { source(local); filter(f_17); destination(d_12); }; ## Log syslog-ng to mysql database ## destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(local); destination(d_mysql); }; [root@test src]#

1 0

dns_cache problems with v1.5.13
by colm ennis 26 Sep '02

26 Sep '02

hi all, im currently using syslog-ng version 1.5.13. i have experienced problems where negatively cached records were preserved indefinitely. only a full restart would cause these ips to be resolved, even a hup would fail. i've now turned off caching cos we rely on ips being resolved in these log files. impt part of the config attached, thanks, colm -- options { sync(0); log_fifo_size(1000); use_dns(yes); dns_cache(yes); use_fqdn(yes); chain_hostnames(no); };

2 2

Re: [syslog-ng]MYSQL problem
by Michael Earls 25 Sep '02

25 Sep '02

What ver of syslog-ng are u running? The dbName, dbPassword, and dbUsername are stored in the script and that script then takes the input from the mysql.pipe, or from the command line mysql -u root --password=passwd syslog < /tmp/mysql.pipe Look the scripts,, http://www.vermeer.org/syslog/scripts michael >>> cat_roger22(a)hotmail.com 09/24/02 08:13AM >>> Hi *, I didn't understood the posts on the mailing list about the entryes inserted into syslog-db, I've some questions: destination d_mysql { pipe("/var/chroot/syslog-ng/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template_escape(yes)); }; I verified the conf file with "-s" option and it didn't returned any error. The Db works fine and I noticed that other people have the same problem...What is the solution ? ...And... Where is set the DB name variable ?...in a conf file I suppose....but where is that ? I Activated the debug option but the output was : gc_mark: Marking object of class 'UNKNOWN' (1) I see the same output even if I don't use mysql option.... Ciao _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

MYSQL problem
by _/CaT\_ 24 Sep '02

24 Sep '02

Hi *, I didn't understood the posts on the mailing list about the entryes inserted into syslog-db, I've some questions: destination d_mysql { pipe("/var/chroot/syslog-ng/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template_escape(yes)); }; I verified the conf file with "-s" option and it didn't returned any error. The Db works fine and I noticed that other people have the same problem...What is the solution ? ...And... Where is set the DB name variable ?...in a conf file I suppose....but where is that ? I Activated the debug option but the output was : gc_mark: Marking object of class 'UNKNOWN' (1) I see the same output even if I don't use mysql option.... Ciao

1 0

RE: [syslog-ng]syslog-ng on Solaris 9
by Hamilton, Andrew 20 Sep '02

20 Sep '02

Fritz, Make sure you don't have anything else bound to that port. Regular syslog uses it and snmpd will sometimes use it. Try kicking off "syslog-ng -dv" and see what the error is. It may tell you that something is bound there already. Regards, Drew -----Original Message----- From: Fritz Buetikofer [mailto:Fritz.Buetikofer@id.unibe.ch] Sent: Friday, September 20, 2002 8:39 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng on Solaris 9 Dear all I'm currently testing syslog-ng 1.5.20 on a new Solaris 9 server. When starting up the daemon, it does not bind on the UDP port 514, so network syslog packets are not processed. Any idea what I did wrong ? Thanks and best regards, --Fritz. ============= University of Bern Computer Services Dept. Fritz Buetikofer. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng on Solaris 9
by Fritz Buetikofer 20 Sep '02

20 Sep '02

Dear all I'm currently testing syslog-ng 1.5.20 on a new Solaris 9 server. When starting up the daemon, it does not bind on the UDP port 514, so network syslog packets are not processed. Any idea what I did wrong ? Thanks and best regards, --Fritz. ============= University of Bern Computer Services Dept. Fritz Buetikofer.

1 0

register
by Fritz Buetikofer 20 Sep '02

20 Sep '02

register btkfr(a)id.unibe.ch

1 0

RE: [syslog-ng]missing 33% of syslog messages
by Hamilton, Andrew 19 Sep '02

19 Sep '02

Bob, Have you checked to see that the messages are getting to the loghost? On a busy network it is possible to lose a number of packets. With UDP you never know. You could use a network sniffer to find out. Something else you might try is raising sync some. If you are getting a ton of messages you might be getting lost in I/O somewhere. sync(0) writes immediately so you might crank it up a little to get some buffering going. You might have to play around with some of the options to get it to work with your configuration. I believe that stats are where you have the internal source going. It is just a line in the file I think. Regards, Drew -----Original Message----- From: Bob Kupiec [mailto:kupiec@ias.edu] Sent: Thursday, September 19, 2002 12:25 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]missing 33% of syslog messages I'm running syslog-ng 1.4.14 on Linux. This server is a loghost for all my syslog clients. It's got plenty of cpu, memory, disk, and bandwidth. The servers that it's accepting logs from are on the same switch as the loghost. That said, I'm losing about 33% of my syslog messages from each client. I tried 1.5.20 with the slightly worse results. All the clients are UDP, and need to stay that way. There are times when minutes go by without recording anything from the clients. Also, where are the "stats" recorded to? Here is my config: ---------------------------------------------------------------------------- options { sync (0); time_reopen (10); # Increased buffer size to 50*256 (50 hosts). -rjk log_fifo_size (12800); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); stats (600); owner (root); group (syslog); perm (0644); dir_owner (root); dir_group (syslog); dir_perm (0755); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/lo g"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; destination remote { file("/var/log/remote/$HOST/$FACILITY.log" log_fifo_size (12800)); }; source net { udp(); }; log { source(net); destination(remote); }; ---------------------------------------------------------------------------- -- Bob Kupiec Security/Network Administrator Email: kupiec(a)ias.edu Institute for Advanced Study Phone: 609-734-8179 Einstein Drive (A208) Fax: 609-951-4418 Princeton, NJ 08540-4907 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

missing 33% of syslog messages
by Bob Kupiec 19 Sep '02

19 Sep '02

I'm running syslog-ng 1.4.14 on Linux. This server is a loghost for all my syslog clients. It's got plenty of cpu, memory, disk, and bandwidth. The servers that it's accepting logs from are on the same switch as the loghost. That said, I'm losing about 33% of my syslog messages from each client. I tried 1.5.20 with the slightly worse results. All the clients are UDP, and need to stay that way. There are times when minutes go by without recording anything from the clients. Also, where are the "stats" recorded to? Here is my config: ---------------------------------------------------------------------------- options { sync (0); time_reopen (10); # Increased buffer size to 50*256 (50 hosts). -rjk log_fifo_size (12800); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); stats (600); owner (root); group (syslog); perm (0644); dir_owner (root); dir_group (syslog); dir_perm (0755); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/lo g"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; destination remote { file("/var/log/remote/$HOST/$FACILITY.log" log_fifo_size (12800)); }; source net { udp(); }; log { source(net); destination(remote); }; ---------------------------------------------------------------------------- -- Bob Kupiec Security/Network Administrator Email: kupiec(a)ias.edu Institute for Advanced Study Phone: 609-734-8179 Einstein Drive (A208) Fax: 609-951-4418 Princeton, NJ 08540-4907

1 0