January 2003 - syslog-ng - lists.balabit.hu

UDP syslog not being logged by syslog-ng
by Moxey, Joel, CND Tech Dev, VF UK 29 Jan '03

29 Jan '03

Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel

1 0

syslog-ng 1.5.25 released
by Balazs Scheidler 29 Jan '03

29 Jan '03

Hi, I have released syslog-ng 1.5.25, available at the usual places: http://www.balabit.hu/en/downloads/syslog-ng/ Here's the NEWS file entry: News for the 1.5.25 release Mon, 20 Jan 2003 16:34:03 +0100 * The previous kernel bug workaround in libol fixed the issue for the 2.4.20rc? kernels only, the current workaround should also work for 2.4.20 final as well. * Added bad_hostname() feature where the administrator can specify a regular expression to match bad hostnames, works around bad programs such as ctld which uses a space within its program name. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

5 19

RE: [syslog-ng]Ayuda....
by Hamilton, Andrew 28 Jan '03

28 Jan '03

You should probably post your configuration but I think you have a log statement that references a source called net that is not defined as a source. Regards, Drew -----Original Message----- From: rlobo [mailto:rlobo@ula.ve] Sent: Tuesday, January 28, 2003 2:02 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Ayuda.... Buenos dias y disculpen la molestia... necesito la ayuda de ustedes, estoy compilando el syslog -ng version 1.5.23 y el php-syslog-ng-1.2, ya tengo montado los requerimientos para este paquete... El problema es que cuando hago un start al syslog-ng me refleja este erro en el archivo de configuracion del syslog-ng.conf unresolved reference: net Error initializing configuration, exiting. Nota: Ya probe colocando la mi red donde dice net, tambien coloque la ip de la maquina en donde estoy compilando el paquete... Si no soy muy explicativo por favor me lo dicen.... Muchas Gracias.... _/ _/ _/ _/ Richard J. Lobo U. _/ _/ _/ _/ _/ T.S.U. en Informatica _/ _/ _/ _/_/_/ Tecnico de Red. _/_/_/ _/_/_/ _/ _/ Facultad de Ciencias y Rectorado Merida - Venezuela Telf: +58-274-2402437 *** RedULA *** rlobo(a)ula.ve Celular 0414 - 7485627 ------------------------------------------------------------------ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]logs getting stomped on
by Hamilton, Andrew 28 Jan '03

28 Jan '03

I would have to agree with Bazsi. I've been running syslog-ng on Solaris 8 for a long while now and this never happened to me. It would pretty much have to be something on your system that is causing it. Regards, Drew -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, January 28, 2003 2:46 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]logs getting stomped on On Mon, Jan 27, 2003 at 11:10:48PM -0500, Brian Landers wrote: > > This happened to me when I had the files on a filesystem that > > had a 2GB file size limit and I hit the 2GB limit. > > Unfortunately, I'm reasonably sure this isn't the issue, unless > syslog-ng itself has problems with large files. This is on > Solaris 8, and the filesystem is mounted with the largefiles > option: > > /system on /dev/md/dsk/d50 > read/write/setuid/intr/largefiles/logging/onerror=panic/dev=1540032 on > Wed Aug 14 07:38:02 2002 > > Same thing happened again tonight, around the same time. At > about 22:30, the log mysteriously was truncated and restarted. > Arggh!!! I think it should be something outside syslog-ng as I have never heard syslog-ng doing something like this (and I was listening carefully ;) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng]logs getting stomped on
by Brian Landers 28 Jan '03

28 Jan '03

> This happened to me when I had the files on a filesystem that > had a 2GB file size limit and I hit the 2GB limit. Unfortunately, I'm reasonably sure this isn't the issue, unless syslog-ng itself has problems with large files. This is on Solaris 8, and the filesystem is mounted with the largefiles option: /system on /dev/md/dsk/d50 read/write/setuid/intr/largefiles/logging/onerror=panic/dev=1540032 on Wed Aug 14 07:38:02 2002 Same thing happened again tonight, around the same time. At about 22:30, the log mysteriously was truncated and restarted. Arggh!!! -- Brian Landers | packetslave(a)sapient.com Network System Exorcist | vox://404/439.4117 Sapient Information Technology | aim://Bluecoat93 CCNA, SCSA, EIEIO | yim://brian_landers "Trust your family to have a Bottomless Pit, Malfoy," said Harry darkly. "Other people have shrubbery in the garden. You have a Bottomless Pit."

2 1

Ayuda....
by rlobo 28 Jan '03

28 Jan '03

Buenos dias y disculpen la molestia... necesito la ayuda de ustedes, estoy compilando el syslog -ng version 1.5.23 y el php-syslog-ng-1.2, ya tengo montado los requerimientos para este paquete... El problema es que cuando hago un start al syslog-ng me refleja este erro en el archivo de configuracion del syslog-ng.conf unresolved reference: net Error initializing configuration, exiting. Nota: Ya probe colocando la mi red donde dice net, tambien coloque la ip de la maquina en donde estoy compilando el paquete... Si no soy muy explicativo por favor me lo dicen.... Muchas Gracias.... _/ _/ _/ _/ Richard J. Lobo U. _/ _/ _/ _/ _/ T.S.U. en Informatica _/ _/ _/ _/_/_/ Tecnico de Red. _/_/_/ _/_/_/ _/ _/ Facultad de Ciencias y Rectorado Merida - Venezuela Telf: +58-274-2402437 *** RedULA *** rlobo(a)ula.ve Celular 0414 - 7485627 ------------------------------------------------------------------

1 0

Re: syslog-ng misinterpreting messages from Enterasys Routers ( check_hostname )
by Ted_Rule＠flextech.co.uk 27 Jan '03

27 Jan '03

Thanks for the tip, Bazsi.... A new niggling comments, I'm afraid... check_hostname has been available since July 2002, but the only reference to it in the tar.gz is in the Changelog. There's no corresponding reference in the documentation trees, nor the FAQ. The same is true of bad_hostname of course, but that only been available recently. The code loop which performs the check_hostname check seems to contain a redundant colon check... We have: while ( ..... && *src != ':' ... ) { if ( .... || *src == ':' || ... ) {{_hostname The if clause is never true since the while test precludes it.... In effect the check_hostname option is performing hostname matches /^[A-Za-z0-9-_@:/]+$/ I can see why the "/" is needed to guard against declaring a chained-hostname as bad, but I can't quite see the logic behind the '@' inclusion. Could someone explain, please? Since my initial configuration errored on my Enterasys routers, ( effectively because the "hostname" field terminated in a "," instead of ":" or "[" ) the check_hostname() option obviously defaults to "no". Given how few good hostnames don't match /^[A-Za-z0-9-_@:/]+$/, it might be worthwhile making check_hostname() default to 'yes', or at least heavily recommending enabling the check in the FAQ. I'm guessing the check_hostname() option is a global only.. Under really odd circs, I guess some people might want it as a per-source option as well? so that a global yes can be overridden on some sources. Given that 1.5.25 now has a bad_hostname() option, how's about future releases having a good_hostname() option so that check_hostname(yes) === good_hostname( "^[A-Za-z0-9-_@:/]+$"). A hostname match then only succeeds if it passes both the good_hostname() and bad_hostname() checks, and moving the character set match for check_hostname() out to the configuration file would allow for more accurate site-specific hostname checking. Ted ............ check_hostname code loop in src/log.c /* It's a regular ol' message. */ else { /* If we haven't already found the original hostname, look for it now. */ char hostname_buf[256]; int dst; oldsrc = src; oldleft = left; dst = 0; while (left && *src != ' ' && *src != ':' && *src != '[' && dst < sizeof(hostname_buf) - 1) { if (lm->flags & LF_CHECK_HOSTNAME && !((*src >= 'A' && *src <= 'Z') || (*src >= 'a' && *src <= 'z') || (*src >= '0' && *src <= '9') || *src == '-' || *src == '_' || *src == '.' || *src == ':' || *src == '@' || *src == '/')) { break; } hostname_buf[dst++] = *src; src++; left--; } ............... =================================================================== On Thu, Jan 23, 2003 at 11:21:24AM +0000, Ted_Rule(a)flextech.co.uk wrote: > > > Having finally bitten the bullet and installed syslog-ng ( libol-0.3.6 / > syslog-ng-1.5.24 ), > I've only come across one problem... syslog messages from our Enterasys Routers > are being > corrupted. All Unix and Cisco messages appear Ok. > [snip] > > I note the version 1.5.25 has a bad_hostname() option. Is it possible that this > may be used to alleviate this issue, or is some other workround > needed? I'm guessing "keep_hostname(no)" might fix it, but would that > potentially lead to other problems? Is there a summary of the algorithm > which syslog-ng uses to determine whether the message contains a hostname? There are two ways to overcome your problem: 1) check_hostname() is a global option that disallows '%' in hostnames, turn it on in your global options() section 2) use bad_hostname() -- ================================================================= ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Re: [syslog-ng]syslog-ng 1.5.25 released
by Ted_Rule＠flextech.co.uk 27 Jan '03

27 Jan '03

From "Stevens'" great Unix Network Programming bible .... "Traditionally , System V has returned the error EAGAIN for a non-blocking I/O operation that cannot be satisfied while Berkeley-derived implementations have returned the error EWOULDBLOCK. To confuse things even more, Posix.1 specifies that EAGAIN is used while Posix.1g specifes that EWOULDBLOCK is used. Fortunately, most current systems ( including SysV and 4.4BSD ) define these two error codes to be the same ( check <sys/errno.h ), so it doesn't matter which one we use. In this text we use EWOULDBLOCK, as specified by Posix.1g" Dontcha just lurrv so many standards.... Ted Balazs Scheidler <bazsi(a)balabit.hu> on 24/01/2003 09:03:25 Please respond to syslog-ng(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu cc: (bcc: Ted Rule/160GPS/Flextech/UK) Subject: Re: [syslog-ng]syslog-ng 1.5.25 released On Thu, Jan 23, 2003 at 07:12:53PM +0100, Roberto Nibali wrote: > >>Would you care to explain to me this fix, please? As I read it, it only > >>kicks in in case write(2) returns with a 0. But this 0 doesn't mean 0 > >>bytes have been written, but something else. I'm a bit confused. Keep in > >>mind that I haven't read your code all too well yet ;). > > > >check fd_write in libol/src/io.c, which handles EINTR and EAGAIN and > >returns 0 > >instead of -1 for those reasons. > > I see, thanks for the pointer (I'm surprised EWOULDBLOCK is portable > enough). Syslog-ng has been running on a couple of Unixes and nobody complained about EWOULDBLOCK. I think it is defined as EAGAIN on most platforms. > > Additional question: Have you or anyone else done any tests with O_SYNC or > mounting the log partition with noatime? I'm asking because I'm trying to > isolate a performance issue on a central loghost. O_SYNC would certainly increase your load. noatime could help though. Checking the output of vmstat (disk i/o, swap i/o, system and user cpu time spent) usually helps locating performance issues. > > >thanks for the report. > > I should also like to ask you about the status of the template() patch [1] > done by one of my team mates. He's not working on this project anymore and > I've taken over. If I get around to fix your concerns mentioned in [2], > would you still consider it for inclusion into 1.6.0? yes. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Re: [syslog-ng]logs getting stomped on
by Michael Rogan 27 Jan '03

27 Jan '03

Brian, This happened to me when I had the files on a filesystem that had a 2GB file size limit and I hit the 2GB limit. Michael -------------------------- Sent from my BlackBerry Wireless Handheld (www.BlackBerry.net) -----Original Message----- From: Brian Landers <packetslave(a)sapient.com> To: syslog-ng(a)lists.balabit.hu <syslog-ng(a)lists.balabit.hu> Sent: Sun Jan 26 22:56:47 2003 Subject: [syslog-ng]logs getting stomped on I have 3 remote servers, logging to a central syslog-ng server over a reverse SSH tunnel, i.e the central server SSH's to the remote hosts, then opens a tunnel back. All servers are running 1.5.25 on Solaris 8. My problem is this, every night around 10 or 10:30pm, the log file gets overwritten, meaning it suddenly goes from starting at 00:00:01 to starting at 22:28:05 or whatever, and all the log entries prior to that are lost. There are no log rotation or other processes that would be causing this that I can find, syslog-ng appears to just mysteriously decide to start over at the begnning. Help! Relevant configs are below. --- central server --- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); use_time_recvd(yes); }; source net { udp(); tcp( keep-alive(yes) ); }; destination inboundlog { file("/system/inbound_mail/logs/$YEAR-$MONTH-$DAY.log"); }; log { source(net); destination(inboundlog); }; --- remote server --- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination loghost { tcp( "127.0.0.1" port(51400) ); }; log { source(local); destination(loghost); }; -- Brian Landers | packetslave(a)sapient.com Network System Exorcist | vox://404/439.4117 Sapient Information Technology | aim://Bluecoat93 CCNA, SCSA, EIEIO | yim://brian_landers "I know," said Harry. "We can all hang out. Go to the beach. Watch Malfoy not get tan." _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

logs getting stomped on
by Brian Landers 27 Jan '03

27 Jan '03

I have 3 remote servers, logging to a central syslog-ng server over a reverse SSH tunnel, i.e the central server SSH's to the remote hosts, then opens a tunnel back. All servers are running 1.5.25 on Solaris 8. My problem is this, every night around 10 or 10:30pm, the log file gets overwritten, meaning it suddenly goes from starting at 00:00:01 to starting at 22:28:05 or whatever, and all the log entries prior to that are lost. There are no log rotation or other processes that would be causing this that I can find, syslog-ng appears to just mysteriously decide to start over at the begnning. Help! Relevant configs are below. --- central server --- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); use_time_recvd(yes); }; source net { udp(); tcp( keep-alive(yes) ); }; destination inboundlog { file("/system/inbound_mail/logs/$YEAR-$MONTH-$DAY.log"); }; log { source(net); destination(inboundlog); }; --- remote server --- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination loghost { tcp( "127.0.0.1" port(51400) ); }; log { source(local); destination(loghost); }; -- Brian Landers | packetslave(a)sapient.com Network System Exorcist | vox://404/439.4117 Sapient Information Technology | aim://Bluecoat93 CCNA, SCSA, EIEIO | yim://brian_landers "I know," said Harry. "We can all hang out. Go to the beach. Watch Malfoy not get tan."

1 0