March 2003 - syslog-ng - lists.balabit.hu

TCP reconnections randomly failing
by Xavier de Labouret 19 Mar '03

19 Mar '03

Hello, We are using syslog-ng with a central loghost. Our applications run on remote servers, all their syslog logs being forwarded to the central loghost with TCP forwarding. However, we are facing a problem now with TCP reconnections. Sometimes, we have to restart the syslog-ng daemon on our central loghost. And when this happens, some clients fail to reconnect to the loghost. The failing client syslog-ng complains about being unable to reconnect, tries a variable number of reattempts, and then gives up. On the server side, nothing is logged on these failed attempts. We have no clue on why this fails on some servers and not on the others. The maximum number of TCP connections on our loghost is set to 100, and this number is never approached, by far. To have the TCP connection come back again with the remote server, we must restart the client syslog-ng daemon. Here are our logs on the client daemon: -----------------8<--------------------- Mar 10 09:41:43 java-as02 syslog-ng[23311]: io.c: do_write: write() failed (errno 32), Broken pipe Mar 10 09:41:43 java-as02 syslog-ng[23311]: Connection broken, reopening in 1 seconds Mar 10 09:41:45 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:46 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:47 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:49 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:50 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:51 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:52 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:53 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds ----------------->8--------------------- We can see 8 reconnection attempts, and then no more message. Last precision: we are running syslog-ng 1.4.16 on Debian/Linux platforms. Here are my questions: - could there be a weakness in the TCP reconnection procedure of syslog-ng 1.4.16? - we don't think this comes from our network equipments. Maybe we could get more traces of the syslog-ng behaviour in these cases. How could we do it (options/tools)? - can we toggle some parameters now to make this less probably happen (augmenting the reconnection delay...)? - or maybe we should use syslog-ng 1.5.25? Thank you in advance, Xavier de Labouret

2 1

Syslog-NG on Mac OSX?
by Blaise St-Laurent 19 Mar '03

19 Mar '03

So i picked up a powerbook recently, and i was looking around in the init files, and noticed it's using the syslogd from the BSD system (which of course, is what i expected). I've been thinking of moving it over to syslog-ng but i noticed something quite strange... syslogd's startup script first deletes the /dev/log entry, and then starts up the daemon, which to me means that the syslogd daemon creates the dev entry itself. Am I correct in assuming this? If i want to install syslog-ng onto my mac, how do i emulate this functionality? has anyone done this yet? Blaise St-Laurent Senior Security Architect 613-266-4258 ____________________________________________________________________ Okiok Data http://www.okiok.com (450) 681-1681 Solutions de sécurité d'entreprise et d'affaires électroniques Enterprise and e-business security solutions This e-mail message (including attachments, if any) is intended for the use of the individual or entity to which it is addressed and may contain information that is privileged, proprietary, confidential and exempt from disclosure. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender and erase this e-mail message immediately. Le présent message électronique (y compris les pièces qui y sont annexées, le cas échéant) s'adresse au destinataire indiqué et peut contenir des renseignements de caractère privé ou confidentiel. Si vous n'êtes pas le destinataire de ce document, nous vous signalons qu'il est strictement interdit de le diffuser, de le distribuer ou de le reproduire. Si ce message vous a été transmis par erreur, veuillez en informer l'expéditeur et le supprimer immédiatement.

1 0

File Permissions Not Being Set
by Collin Lichtenberger 19 Mar '03

19 Mar '03

Could anyone be able to give me an idea of what is going on with my system. I am running Redhat 8.0 with syslog-ng 1.4.17. I use it to watch network devices. The devices log to syslog-ng running on my RH8 box. Syslog-ng runs and creates log files like it should except the permission on the files are always the default 600. Even though my config file looks like this: /etc/syslog-ng/syslog-ng.conf - ... destination d_snmptrapd { file("/var/log/snmptrapd" perm(0644) ); }; destination d_radiusd { file("/var/log/radiusd"); }; destination d_nethost { file("/var/log/net/$HOST/$YEAR$MONTH$DAY" owner(apache) group(apache) perm(0644) dir_perm(0755)create_dirs(yes) ); }; destination d_nethost_clump { file("/var/log/net/netdevice" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes) ); # Special ... log { source(s_src); filter(f_snmptrapd); destination(d_snmptrapd); }; log { source(s_src); filter(f_radiusd); destination(d_radiusd); }; log { source(s_src); filter(f_all); destination(d_all); }; # # Network Logging # log { source(s_net); destination(d_nethost); }; log { source(s_net); destination(d_nethost_clump); };}; - Even though I have the permissions set as something else it still creates files with 600 permission instead of 644 like it's instructed. (This is for any file it creates.) Though syslog-ng will create the file in the correct directories. I am thoroughly confused and would appreciate any help. Thank You. Thanks, COLLIN

2 1

Syslog-NG & MySQL.....
by Matthias Krawutschke 19 Mar '03

19 Mar '03

Sander, i have read your email, that you are running an SYSLOG - Server on Solaris 8 with MySQL. Can you tell me please, how does it works or can you send me your files? I must create these environment too here in my office. Kind regards and thank you for advance ..... Matthias Krawutschke

1 0

help
by toohs 19 Mar '03

19 Mar '03

Please unsubscribe me. thank you. regards, han soon

1 0

RE: [syslog-ng]TCP reconnections randomly failing
by Hamilton, Andrew 18 Mar '03

18 Mar '03

You should at the very least move to the most recent 1.5.* line. The 1.6.* line though still a release candidate is very stable and I would recommend it. There are some bugs in the 1.4.* line that were corrected in later releases. Regards, Drew -----Original Message----- From: Xavier de Labouret [mailto:Xavier.de_Labouret@cvf.fr] Sent: Tuesday, March 18, 2003 5:50 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]TCP reconnections randomly failing Hello, We are using syslog-ng with a central loghost. Our applications run on remote servers, all their syslog logs being forwarded to the central loghost with TCP forwarding. However, we are facing a problem now with TCP reconnections. Sometimes, we have to restart the syslog-ng daemon on our central loghost. And when this happens, some clients fail to reconnect to the loghost. The failing client syslog-ng complains about being unable to reconnect, tries a variable number of reattempts, and then gives up. On the server side, nothing is logged on these failed attempts. We have no clue on why this fails on some servers and not on the others. The maximum number of TCP connections on our loghost is set to 100, and this number is never approached, by far. To have the TCP connection come back again with the remote server, we must restart the client syslog-ng daemon. Here are our logs on the client daemon: -----------------8<--------------------- Mar 10 09:41:43 java-as02 syslog-ng[23311]: io.c: do_write: write() failed (errno 32), Broken pipe Mar 10 09:41:43 java-as02 syslog-ng[23311]: Connection broken, reopening in 1 seconds Mar 10 09:41:45 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:46 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:47 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:49 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:50 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:51 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:52 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:53 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds ----------------->8--------------------- We can see 8 reconnection attempts, and then no more message. Last precision: we are running syslog-ng 1.4.16 on Debian/Linux platforms. Here are my questions: - could there be a weakness in the TCP reconnection procedure of syslog-ng 1.4.16? - we don't think this comes from our network equipments. Maybe we could get more traces of the syslog-ng behaviour in these cases. How could we do it (options/tools)? - can we toggle some parameters now to make this less probably happen (augmenting the reconnection delay...)? - or maybe we should use syslog-ng 1.5.25? Thank you in advance, Xavier de Labouret _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

TCP reconnections randomly failing
by Xavier de Labouret 18 Mar '03

18 Mar '03

Hello, We are using syslog-ng with a central loghost. Our applications run on remote servers, all their syslog logs being forwarded to the central loghost with TCP forwarding. However, we are facing a problem now with TCP reconnections. Sometimes, we have to restart the syslog-ng daemon on our central loghost. And when this happens, some clients fail to reconnect to the loghost. The failing client syslog-ng complains about being unable to reconnect, tries a variable number of reattempts, and then gives up. On the server side, nothing is logged on these failed attempts. We have no clue on why this fails on some servers and not on the others. The maximum number of TCP connections on our loghost is set to 100, and this number is never approached, by far. To have the TCP connection come back again with the remote server, we must restart the client syslog-ng daemon. Here are our logs on the client daemon: -----------------8<--------------------- Mar 10 09:41:43 java-as02 syslog-ng[23311]: io.c: do_write: write() failed (errno 32), Broken pipe Mar 10 09:41:43 java-as02 syslog-ng[23311]: Connection broken, reopening in 1 seconds Mar 10 09:41:45 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:46 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:47 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:49 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:50 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:51 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:52 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:53 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds ----------------->8--------------------- We can see 8 reconnection attempts, and then no more message. Last precision: we are running syslog-ng 1.4.16 on Debian/Linux platforms. Here are my questions: - could there be a weakness in the TCP reconnection procedure of syslog-ng 1.4.16? - we don't think this comes from our network equipments. Maybe we could get more traces of the syslog-ng behaviour in these cases. How could we do it (options/tools)? - can we toggle some parameters now to make this less probably happen (augmenting the reconnection delay...)? - or maybe we should use syslog-ng 1.5.25? Thank you in advance, Xavier de Labouret

1 0

syslog-ng dies on reload
by Florian Heissenhuber 17 Mar '03

17 Mar '03

Hi, I'm using syslog-ng on our central syslog server and it works really great. However I've found the following problem as I added a new filter rule: I've added a filter rule that filters specific error messages and sends these error messages to a shell script that generates a SNMP traps. The relavant configuration lines look as follows: destination snmpsend { program("/data/scripts/pix_snmp_send.ksh "); }; filter f_SNMPTRAP1 { match('PIX-1-10100[1-5]|PIX-1-102001'); }; log { source(net); filter(f_SNMPTRAP1); destination(snmpsend); }; If I send a reload signal to syslog-ng (kill -HUP) the first time, everything is OK. Syslog-ng reloads its configuration and the following messages is found in /var/log/messages: Mar 17 11:15:47 pixsysl01 syslog-ng[11020]: new configuration initialized Mar 17 11:15:46 pixsysl01 syslog-ng[11020]: SIGHUP received, restarting syslog-ng If I send a reload signal to syslog-ng (kill -HUP) the next time, syslog-ng dies with the following message: Mar 17 11:17:36 pixsysl01 syslog-ng[11020]: new configuration initialized Mar 17 11:17:35 pixsysl01 syslog-ng[11020]: SIGHUP received, restarting syslog-ng Mar 17 11:17:36 pixsysl01 syslog-ng[11020]: syslog-ng version 1.5.26 going down Since I'm using logrotate for automatic log rotation, syslog-ng is reloaded more than once a day (and dies with the second reload). Any idea what's wrong? I've already tried version 1.6rc1, but it has the same effect! Regards, Florian -- Florian Heissenhuber

1 0

Destination driver and variables
by Casimir Leonard 16 Mar '03

16 Mar '03

Hello, For begining, for me syslog-ng is the best syslog dameon. I have a question about a option for the destination driver. It's possible to have the variable HOST (equal at the dns name) but i would like to know if it's possible to have in 2 different variables the dns name and the IP address of the transmitter. (ex : HOST=www.balabit.com and IP=212.92.18.33) Thank's in advance for the response. Bye Damien FONTAINE - France --------------------------------- Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Testez le nouveau Yahoo! Mail

1 0

How to disable logging to the console?
by Alexander von Hedenstroem 16 Mar '03

16 Mar '03

Hello! I am using syslog-ng 1.5.15 for a couple of days now on my Debian (woody/stable) system, but have some problems configuring it properly. I switched to syslog-ng because I've read that it is able to filter messages. I'd like to use it to filter the iptables stuff away from my console. Fortunately, I'm not the first with this problem, so I found some help in the archives and in newsgroups, leading me to the following setup: First, I modified the standard source for reading kernel messages (I tried this with file instead of pipe, too -- which one is preferred?): source src { unix-dgram("/dev/log"); pipe("/proc/kmsg"); internal(); }; Then I added some filters and destinations; f_netfilter recognizes iptables stuff by a custom log-prefix, while netfilter2 looks for common strings a message (i tried this because there are some log messages from iptables which seem not to be produced by my iptables script, however...): destination netfilter { file("/var/log/netfilter.log" owner("root") group("adm") perm(0640)); }; filter f_netfilter { match("netfilter: "); }; filter f_netfilter2 { match(".* (IN|OUT|SRC|DST|LEN|MAC|PROTO|WINDOW|TTL|TOS)=.*"); }; filter f_apic { match("APIC error on CPU"); }; Finally, I added some log paths: log { source(src); filter(f_netfilter); destination(netfilter); flags(final); }; log { source(src); filter(f_netfilter2); destination(netfilter); flags(final); }; log { source(src); filter(f_apic); destination(kern); flags(final); }; (My syslog-ng.conf lists first the sources, then destinations, filters, and finally logs. It's not mixed. I understood it this way that the order is only important for log statements. I hope this is correct.) After a reboot (I had problems with restarting it), there are messages directed to the netfilter log, and the messages log is kept clean too, but my console is still flooded! I commented out ALL the log paths of syslog-ng.conf and rebootet which results in empty log files but still console logging. Then I tried klogd -c 0 (which should stop klogd from logging to the console if it is not extremely important) as well as stopping klogd completely which has no visible effect either. So here's my question: Where are those console messages from? Is it possible to log them through syslog-ng and finally stop logging to the console? I really tried to help myself, so please excuse if this question was asked earlier -- I didn't found it! Thanks for your help!!! Alexander von Hedenstroem.

4 4