February 2003 - syslog-ng - lists.balabit.hu

syslog-ng hanging bringing machine in trouble
by Peter Bieringer 13 Feb '03

13 Feb '03

Hi, I have here a big problem on one of my machine and it looks like that it is caused by syslog-ng. It has similar problems like already written here: http://lists.balabit.hu/pipermail/syslog-ng/2003-January/004432.html Machine: Red Hat Linux 7.3 with all updates Running kernel: currently 2.4.18-18.7.x extended with Openwall patch 128 MByte memory syslog-ng: 1.5.26 (but also happen with latest 1.4.x) pam is using a local running LDAP server. >From time to time (let say distance 2-3 weeks or even 8 hours) syslog suddenly stops logging like this evening: Feb 11 19:10:44 gromit syslog-ng[17700]: STATS: dropped 0 Feb 11 19:20:44 gromit syslog-ng[17700]: STATS: dropped 0 Feb 11 19:30:45 gromit syslog-ng[17700]: STATS: dropped 0 <-- Feb 11 20:00:47 gromit syslog-ng[6771]: syslog-ng version 1.5.26 starting Feb 11 20:00:48 gromit syslog-ng: syslog-ng startup succeeded Feb 11 20:00:48 gromit syslog-ng: klogd startup succeeded Feb 11 20:00:53 gromit ldap: slapd startup succeeded I've detected this about 20 min later with following reproducable: System load increases over 1 (normally, machine has no load) "ps -ax" hangs after displaying some processes, "top" will sometimes start, sometimes hang Last times I saw also some CROND entries by "ps -ax", one with stat "D". syslog-ng configuration is nothing special, destinations are files (divided by yyyymm), sources are source s_local { internal(); unix-stream("/dev/log" keep-alive(yes) max-connections(100)); unix-stream("/var/spool/postfix/dev/log" keep-alive(yes) max-connections(100)); file("/proc/kmsg"); }; options { use_dns(no); use_fqdn(no); use_time_recvd(no); chain_hostnames(no); mark(0); sync(0); }; Last week I've disabled postfix's LDAP usage completly to check whether it's a LDAP problem here. In former cases (postfix with LDAP lookups) postfix will hang completly, a TCP connects, but no HELO string was displayed. So the big question: 1) is this a syslog-ng related problem? 2) is this a LDAP problem? I've already increased threads. I don't believe it's a DNS problem because on machine itself a caching DNS server is running. One note: machine is IPv6 enabled. I hope someone could point me to some solutions or proper debugging methods. Machine is semiproductive since end of September (with syslog-ng), but since the beginning such troubles occur. BTW: is this ok, that if syslog-ng restarts, crond don't log anymore until restarted? Thank you very very much, Peter -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto: pb at bieringer dot de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/

6 19

syslog-ng restart: postfix/nqmgr logline missing on next received e-mail
by Peter Bieringer 13 Feb '03

13 Feb '03

Hi again, during yesterdays problem my postfix statistics reporting tool (pflogstats) reported about incomplete logging in 4 cases. In all 4 cases I have syslog-ng restarted before. Example: Feb 12 22:22:54 syslog-ng[1871]: syslog-ng version 1.5.26 going down Feb 12 22:22:54 syslog-ng[5317]: syslog-ng version 1.5.26 starting Feb 12 22:22:54 syslog-ng: syslog-ng startup succeeded Feb 12 22:23:01 crond: crond shutdown succeeded <- already learnt :-( Feb 12 22:23:02 crond: crond startup succeeded Missing nqmgr: Feb 12 22:29:58 (7 minutes later, first received e-mail after syslog-ng restart) postfix/smtpd[5507]: C12F31386E: client=outgoing3... postfix/cleanup[5521]: C12F31386E: message-id=<20030212180349.... postfix/smtpd[5507]: disconnect from outgoing3... postfix/pipe[5525]: C12F31386E: to=<pbieringer@... Normally (e.g. next delivered e-mail): Feb 12 22:29:59 postfix/cleanup[5521]: 3AEAD1386F: message-id=<20030212180... postfix/pipe[5525]: C12F31386E: to=<pbieringer@aer... postfix/nqmgr[19977]: 3AEAD1386F: from=<bugtraq-r.... <--!!!!! postfix/smtp[5530]: 3AEAD1386F: to=<pbieringer(a)aerasec.de>,... Where is the nqmgr log line lost in first event? Is this a well-known issue (feature or bug)? If yes, how can this be fixed? Pls. don't tell me that I have to restart every service after I restart syslog-ng (already known: crond, now postfix, which one is still missing?). This would be a very unnice "feature". If bug is in a common used glibc-version, then imho a workaround by syslog-ng would be required. I don't like to loose loglines, you sure not, too. Does this also happen if old syslogd would be used? Don't believe so. It's all very strange...looks like I have to switch back to syslog, loosing all the nice features :-( Peter, wondering -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto: pb at bieringer dot de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/

4 8

Betr.: Re: [syslog-ng]How to distribute Syslog-ng?
by EDL.Essed＠belastingdienst.nl 13 Feb '03

13 Feb '03

Balazs, It worked, after changing all Makefiles to read DESTDIR = /tmp/staging (Couldn't get "make DESTDIR=/tmp/staging install" to work, see below). Thanks, Esteban. $ make DESTDIR=/tmp/staging install No suffix list. Making install in src Making install in . /bin/sh /home/essee05/src/syslog-ng-1.5.26/mkinstalldirs /usr/local/sbin mkdir /usr/local/sbin mkdir: cannot access /usr/local: Permission denied *** Error exit code 2 Stop. *** Error exit code 1 Stop. *** Error exit code 1 Stop. *** Error exit code 1 Stop. ___________________________________________ Esteban Essed B/CICT, Sector Continuiteit MPS/Midrange WBC-F305 Tel: (055 - 528) 3654 ___________________________________________ wok, n.: Something to thwow at a wabbit. ___________________________________________ |---------+--------------------------------> | | "Balazs Scheidler" | | | <bazsi(a)balabit.hu> | | | Verzonden door: | | | syslog-ng-admin@lists| | | .balabit.hu | | | | | | | | | 13-02-2003 12:40 | | | Antwoord a.u.b. aan | | | syslog-ng | | | | |---------+--------------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | Aan: syslog-ng(a)lists.balabit.hu | | cc: | |Onderwerp: Re: [syslog-ng]How to distribute Syslog-ng? | >-------------------------------------------------------------------------------------------------------------------------------| On Thu, Feb 13, 2003 at 11:27:57AM +0100, EDL.Essed(a)belastingdienst.nl wrote: > Hi, > > I want to build Syslog-ng on one machine but use it on another. > > Is it enough if I copy the binary syslog-ng and the configfile > syslog-ng.conf? > Or do I need more? > > I want to do this for AIX and for HP-UX machines. try using the DESTDIR feature of the makefile distributed with syslog-ng: make DESTDIR=/tmp/staging install this copies binary files using /tmp/staging directory as root. you only need to tar and untar its contents on the destination host. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

1 0

How to distribute Syslog-ng?
by EDL.Essed＠belastingdienst.nl 13 Feb '03

13 Feb '03

Hi, I want to build Syslog-ng on one machine but use it on another. Is it enough if I copy the binary syslog-ng and the configfile syslog-ng.conf? Or do I need more? I want to do this for AIX and for HP-UX machines. Thanks for any help, Esteban Essed. ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

3 2

Re: [syslog-ng]Re: syslog-ng
by Ted_Rule＠flextech.co.uk 13 Feb '03

13 Feb '03

Could this be worked round in general with a kill -HUP syslog-ng at the end of the "ifup" script for those instances where syslog-ng starts before networking itself? I would imagine this should ensure syslog-ng is "notified" of the "change of state" of the machine, causing it to refresh its IP sockets. In addition a daily HUP to rotate logs should also effectively heal the problem within 24 hours? Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

DTSESSION messages in syslog file
by daniel＠waku-2.com 13 Feb '03

13 Feb '03

Hi I have received the messeges below in my syslog.log file. Feb 12 11:24:39 hpd002 DTSESSION: pamauthenticate status=0 Feb 12 11:24:39 hpd002 DTSESSION: pam_acct_status status=0 Does this mean there is a problem with my computer? If so, please let me know the problem. Also please tell me what exactly must have happened for the messege to be displayed in syslog.log file. My OS is HP-UX 11.i Thanks in advance Daniel Ojwang

1 0

Re: syslog-ng
by seberino＠spawar.navy.mil 13 Feb '03

13 Feb '03

Roberto Thanks. Are you saying if you start syslog-ng before networking and iptables that syslog-ng won't start??? So basically you must start it AFTER filtered network up or else apply your patch? Is that right? chris On Wed, Feb 12, 2003 at 10:10:39AM +0100, Roberto Nibali wrote: > Hello Seberino, > > > I saw your name on the syslog-ng mailing list > > I saw your name on a lot of mailinglists lately, IIRC :) > > > and was hoping I could humbly ask you a newbie question about it > > I'm only on the list since January this year but I've been working with > syslog-ng for about 2 years now, so I might be able to help you. > > > if you don't mind. I read manual and could not find > > this question answered... > > The manual is rather sparse with words and assumes that the reader is already > very familiar with other daemons and Unix processing. > > > Can I just start syslog-ng daemon from /etc/rc.d/rc.local > > (in Linux) like this... > > I'm not so sure what Linux distribution you use but I can hardly imagine that > you start daemons from ../rc.local. There must be a /etc/rc.d/init.d/syslog-ng > and then some softlinks from your runlevel dir to /etc/rc.d/init.d/syslog-ng > > > /usr/local/sbin/syslog-ng & > > There is no need to send it in the background since it is a daemon. It will > fork() and then the calling process will _exit(). > > > i.e. 1. Do I need any switches on command line? > > I do not know your node's requirements and I also do not know your architectural > approach to logging so it's kind of difficult to make accurate suggestions. What > you could do is invoke syslog-ng with --help as option and read through those: > > # ./syslog-ng --help > Usage: syslog-ng [options] > Accept and manage system log messages > > Options: > -s, --syntax-only Only read and parse config file > -d, --debug Turn on debugging messages > -v, --verbose Be a bit more verbose > -F, --foreground Don't fork into background > -f <fname>, --cfgfile=<fname> Set config file name, > default=/etc/syslog-ng/syslog-ng.conf > -V, --version Display version number (syslog-ng 1.5.26) > -p <fname>, --pidfile=<fname> Set pid file name, > default=/var/run/syslog-ng.pid > -C <dir>, --chroot=<dir> Chroot to directory > -u <user>, --user=<user> Switch to user > -g <group>, --group=<group> Switch to group > # > > Feel free to submit any of those to your syslog-ng start command line :) > > > 2. Is there any danger in not starting logging > > sooner in boot process?? > > From you email I cannot see exactly at which point you start the syslog-ng but > I recommend you to start it early enough or you might loose some important > messages. There is a problem with starting it early and having strict packet > filter rules and interface link state down. It's a feature in syslog-ng that it > will not restart in that case. I've done a simplistic but very useful (for our > purposes) patch: > > --- syslog-ng-1.5.26-template/src/afinet.c Wed Feb 5 16:04:56 2003 > +++ syslog-ng-1.5.26-template-tA/src/afinet.c Thu Feb 6 13:52:33 2003 > @@ -491,7 +491,11 @@ > return ST_OK | ST_GOON; > } > else { > +#if 0 > if (errno == ECONNREFUSED) { > +#else > + if ( 1 ) { > +#endif > io_callout(self->cfg->backend, > self->cfg->time_reopen, > make_driver_reinit(&self->super.super.super, self->cfg)); > > So if you get your question answered may I humbly ask you to send this to Nate > Campi <mailto:nate@campin.net> for a possible inclusion into the FAQ? He might > add it or might not, depending on how generous he is towards newbie questions :) > > HTH and best regards, > Roberto Nibali, ratz > -- > echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-9973 Fax: Email: seberino(a)spawar.navy.mil _______________________________________

2 1

Re: syslog-ng
by seberino＠spawar.navy.mil 12 Feb '03

12 Feb '03

I'm not that worried about missing stuff if syslog-ng started late since I don't reboot that often. Regardless, do you just start it with /path/syslog-ng & ??? ...or... are there necessary command line switches you us that are a good idea??? chris On Tue, Feb 11, 2003 at 09:27:35PM -0500, Michael Rogan wrote: > Chris, > > That works but you may find some things don't get logged because it wasn't started earlier. > > You can create a script and put it in /etc/init.d/syslog-ng (check the syslog one on how to write start and stop scripts, basically just change syslog to syslog-ng). > > Put a comment near the top like > # chkconfig: 2345 20 80 > # description: Syslog-ng for logging > > When you run > chkconfig --add syslog-ng > > The comment tells it to put it in the init startups 2,3,4,5 and at level 20 (near the beginning of the boot process) and 80 at stop (near the end of the shutdown). > > You may want to do a > chkconfig --del syslog > to stop syslog from starting. > > Michael > > BTW: Do you guys get to use our devices there yet? Being in information systems to the Navy I would guess you would have seen them. > > Michael J. Rogan > BlackBerry Engineering Supervisor > Research In Motion > www.rim.net > www.blackberry.net > > > > -------------------------- > Sent from my BlackBerry Wireless Handheld (www.BlackBerry.net) > > > -----Original Message----- > From: seberino(a)spawar.navy.mil <seberino(a)spawar.navy.mil> > To: Michael Rogan <mrogan(a)rim.net> > Sent: Tue Feb 11 20:04:43 2003 > Subject: syslog-ng > > Michael > > I saw your name on the syslog-ng mailing list > and was hoping I could humbly ask you a newbie question about it > if you don't mind. I read manual and could not find > this question answered... > > Can I just start syslog-ng daemon from /etc/rc.d/rc.local > (in Linux) like this... > > > /usr/local/sbin/syslog-ng & > > > i.e. 1. Do I need any switches on command line? > 2. Is there any danger in not starting logging > sooner in boot process?? > > Thanks! > > Chris > > -- > _______________________________________ > > Dr. Christian Seberino > SPAWAR Systems Center San Diego > Code 2872 > San Diego, CA 92152-6147 > U.S.A. > > Phone: (619) 553-9973 > Fax: > Email: seberino(a)spawar.navy.mil > _______________________________________ -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-9973 Fax: Email: seberino(a)spawar.navy.mil _______________________________________

1 0

[PATCH] missing rm for distclean target in libol-0.3.9
by Roberto Nibali 11 Feb '03

11 Feb '03

Hello, Following patchlet adds the removal of utils/make_class when a make distclean is invoked. I've tramped over it when I wanted to enhance libol and syslog-ng a bit: --- libol-0.3.9/utils/Makefile.in 2003-01-31 11:08:43.000000000 +0100 +++ libol-0.3.9-ratz/utils/Makefile.in 2003-02-11 18:07:49.000000000 +0100 @@ -172,7 +172,7 @@ clean-generic: distclean-generic: - -rm -f Makefile $(CONFIG_CLEAN_FILES) + -rm -f Makefile $(CONFIG_CLEAN_FILES) $(SCRIPTS) -rm -f config.cache config.log stamp-h stamp-h[0-9]* maintainer-clean-generic: Another problem is that libol-0.3.9 is shipped with two files which will get deleted after a distclean making the diff of the two vanilla trees (libol-working, libol-orig) a little pain. Would you consider removing the following two files from the source tree for 0.3.10, please? o libol.spec o src/olconfig.h The same issues arise with the syslog-ng vanilla tree. I hope I am not missing something trivial here. Another question: I'm currently having a lot of problems with different GNU automake releases installed on my development server. I reckon you know what I mean (the LIBOBJ -> AC_LIBOBJ mess introduced in 1.5x). Have you already made any plans on moving to newer GNU automake tools? Regards, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq'|dc

1 0

Modification to slowly start destination programs
by Keith Resar 11 Feb '03

11 Feb '03

In my current syslog-ng setup there are many destination programs. When syslog-ng restarts these all load at once, causing the system to grind to a halt. As a solution, I'd like syslog-ng to spawn these programs more slowly, perhaps one every few seconds. After a quick glance through the source it wasn't obvious to me where I should make this modification. Any hints on what part of the source destination programs are executed? Thanks, Keith Resar. --

3 4