June 2003 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]Problem using Flags
by Naman Latif 17 Jun '03

17 Jun '03

Ok. I am using 1.4.17 so probably that is the reason. Regards \\ Naman > -----Original Message----- > From: Achim Gsell [mailto:achim@cybercity.ch] > Sent: Monday, June 16, 2003 11:33 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Problem using Flags > > > On Tuesday 17 June 2003 01:26, Naman Latif wrote: > > > I am trying to use the Flags (Final) option in the log statement. > > However syslog-ng comes up with a parse error. Am I missing > something > > here ? > > > > log { source(s_udp); filter(f_pixpermit); destination(pixpermit); > > flags(final); }; > > Mmh. I think the log definition is OK and "flags(final)" > should work. I use > the flags(final) option in most log definitions. What version > of syslog-ng do > you use? The flags(final) option was introduced in an early > 1.5 version. > > Achim > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/sysl> og-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > >

1 0

Problem with large logfiles
by Vuorilehto Saska 17 Jun '03

17 Jun '03

Hi all, I'm quite new to this list so forgive me if this has been discussed before... Problem is that every time our logfiles grow larger than 2gb (2147483647 to be exact) syslog-ng dies and doesn't start until that specific logfile is renamed... Syslog-ng is version 1.4.16 running on a RedHat 7.3 machine and yes, we have ext3 filesystem in use, which should support files over that. At least we can merge those logfiles to one big file anyway... Any suggestions are welcome... ******* Saska

2 1

syslog-ng down message lost
by Szalai Ferenc 17 Jun '03

17 Jun '03

Hello, I know that there was some discussion the message lost - using syslog-ng with TCP - in this list but they wasn't clear me. The syslog-ng version is 1.6.0rc3. So the log chain is a following: client->server1->server2 The client important config lines: source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination grid_d { tcp("<ip>" port(20000)); }; filter grid_f { program(syslog-ng) or program(condor); }; log { source(s_sys); filter(grid_f); destination(grid_d); }; The server1 inportant config lines: source grid_s { tcp(ip(<ip>) port(20000) keep-alive(yes) max_connections (100)); }; destination grid_to_entry { tcp("<ip>" port(20000)); }; log { source(grid_s); destination(grid_to_entry); }; The server2 important config lines: source grid_s { tcp(ip(<ip>) port(20000) keep-alive(yes) max_connections(30)); }; destination grid_all { file("/var/log/HOSTS/$YEAR/$MONTH/$DAY/all.log" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; log { source(grid_s); destination(grid_all); }; The global options are everyvere: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (no); use_fqdn (on); create_dirs (no); keep_hostname (yes); stats(3600); }; The problem is that sometimes the syslog-ng down message is missing on server2 log file. What is the main reason of this in this case or what modification is required to solve this problem? I hope I was clear. Thank you, Ferenc

2 1

RE: [syslog-ng] Problem with large logfiles
by SmeeB 17 Jun '03

17 Jun '03

heya, try starting the syslog-ng ps with a larger inode limit. regards, ---------------------------- Benjamin Smee ISe Hosting Team - Unix Team Phone: +44-208-8965586 Email: smeeb(AT)cpw.co.uk > -----Original Message----- > From: Vuorilehto Saska [mailto:saska.vuorilehto@lannenpuhelin.fi] > Sent: 17 June 2003 14:34 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Problem with large logfiles > > > Hi all, > > I'm quite new to this list so forgive me if this has been discussed > before... > > Problem is that every time our logfiles grow larger than 2gb > (2147483647 to > be exact) syslog-ng dies and doesn't start until that > specific logfile is > renamed... > > Syslog-ng is version 1.4.16 running on a RedHat 7.3 machine > and yes, we have > ext3 filesystem in use, which should support files over that. > At least we > can merge those logfiles to one big file anyway... > > Any suggestions are welcome... > > ******* > Saska > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > This communication together with any attachments transmitted with it ("this E-Mail") is intended only for the use of the addressee and may contain information which is privileged and confidential. If the reader of this E-Mail is not the intended recipient or the employee or agent responsible for delivering it to the intended recipient you are hereby notified that any use, dissemination, forwarding, printing or copying of this E-Mail is strictly prohibited. Addressees should check this E-mail for viruses. The Company makes no representations as regards the absence of viruses in this E-Mail. If you have received this E-Mail in error please notify our ISe Response Team immediately by telephone on +44 (0)20 8896 5828 or via e-mail at postmaster(a)cpw.co.uk Please then immediately delete, erase or otherwise destroy this E-Mail and any copies of it. Any opinions expressed in this E-Mail are those of the author and do not necessarily constitute the views of the Company. Nothing in this E-Mail shall bind the Company in any contract or obligation. For the purposes of this E-Mail "the Company" means The Carphone Warehouse Group Plc and/or any of its subsidiaries. Please feel free to visit our website: http://www.phonehouse.com The Carphone Warehouse Group Plc (Registered in England No. 3253714) North Acton Business Park, Wales Farm Road, London W3 6RS

1 0

Problem using Flags
by Naman Latif 17 Jun '03

17 Jun '03

Hi, I am trying to use the Flags (Final) option in the log statement. However syslog-ng comes up with a parse error. Am I missing something here ? log { source(s_udp); filter(f_pixpermit); destination(pixpermit); flags(final); }; Regards \\ Naman

3 2

Problem with large logfiles
by Vuorilehto Saska 16 Jun '03

16 Jun '03

Hi all, I'm quite new to this list so forgive me if this has been discussed before... Problem is that every time our logfiles grow larger than 2gb (2147483647 to be exact) syslog-ng dies and doesn't start until that specific logfile is renamed... Syslog-ng is version 1.4.16 running on a RedHat 7.3 machine and yes, we have ext3 filesystem in use, which should support files over that. At least we can merge those logfiles to one big file anyway... Any suggestions are welcome... ******* Saska

1 0

RE: [syslog-ng]Help for Filter(Match) statement
by Naman Latif 14 Jun '03

14 Jun '03

Thanks. Works great. Regards \\ Naman > -----Original Message----- > From: Amodiovalerio Verde [mailto:hypo@rtfm.it] > Sent: Friday, June 13, 2003 12:51 PM > Just escape the "" with \ > > filter test {match("access-group \"101\"");}; > > > Amodiovalerio Verde > amodiovalerio.verde(a)ags-it.com

1 0

Help for Filter(Match) statement
by Naman Latif 13 Jun '03

13 Jun '03

Hi, I am trying to match the whole expression access-group "101" How can define it in the match() statement ? As the presence of " is giving me problems and syslog-ng comes up with the parse error. I was trying Match("(access-group "101")") Regards \\ Naman

2 1

RE: [syslog-ng]Stats stop logging? - Fixed, but noticed another problem
by Glasser, Rob 13 Jun '03

13 Jun '03

Ok, if I figure this out I'll make sure I post it to the group. I'm glad at least that this problem isn't me doing something stupid. Thanks Rob Rob Glasser -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Thursday, June 12, 2003 7:27 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Stats stop logging? - Fixed, but noticed another problem On Thu, Jun 12, 2003 at 04:16:10PM -0700, Glasser, Rob wrote: > > I have no idea how to clear this so it won't show it everything I > restart syslog-ng. Any ideas on the cause of this problem? Some buffer > somewhere is storing this information and I'm not sure where. Dude Rob, if you figure this out you've attained my personal holy grail. I spent a lot of time asking on sunmanager's, reading books at home and bookstores, and asking everyone I know. Here's what I do know: I read about it in a book once how there's a kernel ring buffer used to store kernel messages, and reading from the syslog door will re-read this buffer. I remembered reading a way to turn that off, but I never found that book again. I've had swatch alarms triggered many times because of this replay issue. Please let me know if you solve it. -- Nate Campi http://www.campin.net _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Stats stop logging? - Fixed, but noticed another problem
by Glasser, Rob 13 Jun '03

13 Jun '03

Stupid mistake on my part. Looks like the issue had to do with me running the process as nobody, but nobody couldn't read the syslog-ng.conf file. Since I couldn't write anything out to the console either I decided to stop running syslog-ng as nobody for now. However I've noticed something else, on my Solaris 2.6 systems whenever I HUP or stop and restart syslog-ng it dumps a bunch of old messages from system startup and about filesystems being full into /var/adm/messages. Basically everything that shows up with 'dmesg'. Freaked me out the first time because the date information shows as current time so I was wondering how everything broke all at once. I have no idea how to clear this so it won't show it everything I restart syslog-ng. Any ideas on the cause of this problem? Some buffer somewhere is storing this information and I'm not sure where. Thanks Rob -----Original Message----- From: Glasser, Rob [mailto:rob.glasser@attws.com] Sent: Wednesday, June 11, 2003 5:31 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Stats stop logging? I currently have stats turned on for once an hour. It was running fine until I rotated my log file. I currently have all syslog-ng messages with a match(syslog-ng) filter going to /var/adm/messages. I rotated the logs, and HUP'd the syslog-ng process, it indicated in the new messages file that it was restarted and that is the last message from syslog-ng in that file. syslog-ng is logging other facilities to that file, but not stats, or any other syslog-ng messages for that matter, though I don't know if there would have been any others. Am I missing something or is this a bug? If I completely stop and restart syslog-ng everything starts working again. By the way, I rotate the log file by cat'ing it out to another filename, then cat'ing /dev/null to /var/adm/messages. Thanks Rob Glasser AT&T Wireless WNS Data Operations - Core Services UNIX Systems Administrator

2 1