June 2003 - syslog-ng - lists.balabit.hu

Calibration of the syslog-ng server
by Loubet Jean-Michel 12 Jun '03

12 Jun '03

Hi, I want to collect about 1500 hosts. I've estimated that it represents about 8 000 000 messages (1 Gb) daily. My syslog-ng server, which will be dedicated to this, will run on solaris 8. Have you got any idea about needed cpu number and memory ? Thanks for your answers. JM Loubet

3 2

local2.debug logging incorrectly
by Keith Olmstead 12 Jun '03

12 Jun '03

Hello, Can someone help me out with this one. I am trying to log local2.debug pop logs to a central log server to a file called poplog. It is not logging to poplog but instead messages in the same dir. Here is what I have in my syslog-ng.conf. options { keep_hostname(no); long_hostnames(off); sync(1); log_fifo_size(1024); create_dirs(yes); use_dns(no); }; source src_local { unix-stream("/dev/log"); internal(); }; source src_network { udp(); }; <snip> destination messages.network { file("/opt1/log/hosts/$HOST/$YEAR/$MONTH/$DAY/messages" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; destination poplog.network { file("/opt1/log/hosts/$HOST/$YEAR/$MONTH/$DAY/poplog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; <snip> filter f_messages { not facility(authpriv, mail, cron) and level(info, notice, warn, crit, err, alert, emerg); }; filter f_pop { facility(local2) and level(debug); }; <snip> log { source(src_network); source(src_local); filter(f_messages); destination(messages.network); }; log { source(src_network); filter(f_pop); destination(poplog.network); }; I thought that it might be reading the file from the top down, so I moved the pop filter before the messages filter, did not help. Also added local2 to the facility in messages filter and it stop logging to messages, but also stoped logging all together. Thanks, Keith

1 0

Stats stop logging?
by Glasser, Rob 12 Jun '03

12 Jun '03

I currently have stats turned on for once an hour. It was running fine until I rotated my log file. I currently have all syslog-ng messages with a match(syslog-ng) filter going to /var/adm/messages. I rotated the logs, and HUP'd the syslog-ng process, it indicated in the new messages file that it was restarted and that is the last message from syslog-ng in that file. syslog-ng is logging other facilities to that file, but not stats, or any other syslog-ng messages for that matter, though I don't know if there would have been any others. Am I missing something or is this a bug? If I completely stop and restart syslog-ng everything starts working again. By the way, I rotate the log file by cat'ing it out to another filename, then cat'ing /dev/null to /var/adm/messages. Thanks Rob Glasser AT&T Wireless WNS Data Operations - Core Services UNIX Systems Administrator desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net

1 0

Re: [syslog-ng]logs viewer
by Michael Earls 12 Jun '03

12 Jun '03

Also check out www.vermeer.org/syslog demo http://vw.vermeer.org/ >>> mlist(a)sanderscorner.com 06/11/03 06:17PM >>> Hi, If you're logging to a database I have a simple web viewer for it. You do need a webserver and perl for it though. Sander > Hi there, > I am looking for a tool that can manage my syslog-ng files . > where can't find a tool that allow me to view my logs files through a > browser, well organized . > thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: [syslog-ng]logs viewer
by mlist 12 Jun '03

12 Jun '03

Hi, If you're logging to a database I have a simple web viewer for it. You do need a webserver and perl for it though. Sander > Hi there, > I am looking for a tool that can manage my syslog-ng files . > where can't find a tool that allow me to view my logs files through a > browser, well organized . > thanks

1 0

Enterasys SSR syslog message date format.
by Ted_Rule＠flextech.co.uk 11 Jun '03

11 Jun '03

We noticed that the syslog traffic from our Enterasys SSR routers violates protocol slightly in its date format. Jun 07 09:56:46 ssrA %STP-I-PORT_STATUS, Port status change detected: et.2.3 - Port Down Jun 07 09:56:51 ssrA %STP-I-PORT_STATUS, Port status change detected: et.2.3 - Port Up Jun 07 09:59:10 ssrA %STP-I-PORT_STATUS, Port status change detected: et.2.3 - Port Down Jun 07 09:59:11 ssrA %STP-I-PORT_STATUS, Port status change detected: et.2.3 - Port Up i.e. it uses a leading zero on the day of month field where RFC3164 requires a leading space. It's hardly earth shattering, but it would be nice to make the field consistent for these routers. I've asked the manufacturer to fix their code, but in the meantime are there any good ways to fix this in syslog-ng - ( other than a global use_time_recvd() yes flag )? I'm currently still on a 1.5.24 syslog-ng code by the way, though more than will to go to 1.6 if need be. If no option is currently available to munge fix this, could someone give me some pointers as to where in the code I might be able to patch in a host-specific fixup? Since I would imagine a few other products also have slightly wonky date formats, is there some merit in adding some dateformat fixup code in future - maybe the development releases already address this issue? Thanks, Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

logs viewer
by Moktar KONE 11 Jun '03

11 Jun '03

Hi there, I am looking for a tool that can manage my syslog-ng files . where can't find a tool that allow me to view my logs files through a browser, well organized . thanks

1 0

AW: [syslog-ng]DNS Problem?
by Unger, Christian 11 Jun '03

11 Jun '03

May you using, Windows 2000 ADS integraded DNS Servers. Then you should look into you logfiles of the Windows box. The 2000 DNS Server dies some time on havy load. MS knows that problem and so the DNS kommt with a autorestart funktion. But you can get a dns time out during the restart. Or your ADS is in combination with Exchange 2000, so the DNS (DC Server) has some time havy load during the LDAP querys from Exchange. The DNS Respons now needs extremly long. If you have this you should need 3 DS in the primary Exchange 2000 Site and split the Exchange querys over the tree global catalog Server. Thas my 2000 knowlage ;) I hope it helps someone. -----Ursprüngliche Nachricht----- Von: Glasser, Rob [mailto:rob.glasser@attws.com] Gesendet: Mittwoch, 11. Juni 2003 00:50 An: syslog-ng(a)lists.balabit.hu Betreff: RE: [syslog-ng]DNS Problem? These are internal systems located in the same datacenter although not necessarily on the same network. reverse lookups work, in fact for any system that has a problem, it's usually only one message out of hundreds for the day that has the problem, all other messages from those systems resolve fine. Rob Glasser desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net -----Original Message----- From: Nicholas Bernstein [mailto:nick@docmagic.com] Sent: Tuesday, June 10, 2003 3:47 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]DNS Problem? First off, what hosts are they failing to resolve? If they are hosts from somewhere out on the internet, they might not have an in-addr.arpa address associated with the ip, and may not be reverse lookup-able. Have you tried to verify that the systems can look up the ip? E.G. 'host a.b.c.d '? On Tue, 2003-06-10 at 15:40, Glasser, Rob wrote: > I'm having some name lookup weirdness and not sure of the cause. > Thought I'd post the scenario to the group before I start tweaking my > configuration to see if it can be fixed. > > First off, I'm running syslog-ng 1.6.0rc3, and on the systems I'm > having problems, they are Sun Netra systems, dual procs, 2GB of > memory, running Solaris 8. My options look like this: > > log_fifo_size(2048); > time_reopen(10); > use_fqdn(yes); > keep_hostname(no); > use_dns(yes); > dns_cache(yes); > long_hostnames(off); > > I have 2 servers with this configuration acting as centralized > loghosts for a datacenter. They are identical boxes, running > identical syslog-ng configurations, on the same VLAN as the DNS > servers they point to. > > Both of these boxes will periodically fail to lookup a name? and log > an entry under it's IP address instead of it's fully qualified host > name. There appears to be no pattern what so ever to it, and the log > entries that get logged by IP are different on each syslog-ng server. > The load on these systems is pretty minimal. The number of messages > logged by IP address is averaging about 10 a day out of about 13000 > messages being logged. > > To make things even more interesting, I have a similar setup in > another datacenter, but they are older smaller systems, only Ultra > 1's, single proc, with only 128 MB of memory, running Solaris 2.6, > acting as centralized servers for about 3 times the number of > servers. The syslog-ng version and configuration is identical. On > these systems I can not find any entries logged by IP address, > everything appears to be working fine. > > Any ideas what might be causing this? My gut reaction is to blame it > on the DNS boxes since the problem is only happening in one data > center and not another, but wanted to see if anyone else has already > been down this road first. > > Thanks > > Rob Glasser > AT&T Wireless > UNIX Systems Administrator > -- +---------------------------------------------------------------+ | Nicholas Bernstein | nick(a)docmagic.com | | UNIX Systems Administrator | http://www.docmagic.com | | Document Systems Inc. | | | gpg: F706 8C4E 78FA DDDD 53A0 019F D983 FE28 2002 D1F3 | +---------------------------------------------------------------+ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]DNS Problem?
by Glasser, Rob 11 Jun '03

11 Jun '03

These are internal systems located in the same datacenter although not necessarily on the same network. reverse lookups work, in fact for any system that has a problem, it's usually only one message out of hundreds for the day that has the problem, all other messages from those systems resolve fine. Rob Glasser desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net -----Original Message----- From: Nicholas Bernstein [mailto:nick@docmagic.com] Sent: Tuesday, June 10, 2003 3:47 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]DNS Problem? First off, what hosts are they failing to resolve? If they are hosts from somewhere out on the internet, they might not have an in-addr.arpa address associated with the ip, and may not be reverse lookup-able. Have you tried to verify that the systems can look up the ip? E.G. 'host a.b.c.d '? On Tue, 2003-06-10 at 15:40, Glasser, Rob wrote: > I'm having some name lookup weirdness and not sure of the cause. > Thought I'd post the scenario to the group before I start tweaking my > configuration to see if it can be fixed. > > First off, I'm running syslog-ng 1.6.0rc3, and on the systems I'm > having problems, they are Sun Netra systems, dual procs, 2GB of > memory, running Solaris 8. My options look like this: > > log_fifo_size(2048); > time_reopen(10); > use_fqdn(yes); > keep_hostname(no); > use_dns(yes); > dns_cache(yes); > long_hostnames(off); > > I have 2 servers with this configuration acting as centralized > loghosts for a datacenter. They are identical boxes, running > identical syslog-ng configurations, on the same VLAN as the DNS > servers they point to. > > Both of these boxes will periodically fail to lookup a name? and log > an entry under it's IP address instead of it's fully qualified host > name. There appears to be no pattern what so ever to it, and the log > entries that get logged by IP are different on each syslog-ng server. > The load on these systems is pretty minimal. The number of messages > logged by IP address is averaging about 10 a day out of about 13000 > messages being logged. > > To make things even more interesting, I have a similar setup in > another datacenter, but they are older smaller systems, only Ultra > 1's, single proc, with only 128 MB of memory, running Solaris 2.6, > acting as centralized servers for about 3 times the number of > servers. The syslog-ng version and configuration is identical. On > these systems I can not find any entries logged by IP address, > everything appears to be working fine. > > Any ideas what might be causing this? My gut reaction is to blame it > on the DNS boxes since the problem is only happening in one data > center and not another, but wanted to see if anyone else has already > been down this road first. > > Thanks > > Rob Glasser > AT&T Wireless > UNIX Systems Administrator > -- +---------------------------------------------------------------+ | Nicholas Bernstein | nick(a)docmagic.com | | UNIX Systems Administrator | http://www.docmagic.com | | Document Systems Inc. | | | gpg: F706 8C4E 78FA DDDD 53A0 019F D983 FE28 2002 D1F3 | +---------------------------------------------------------------+ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

DNS Problem?
by Glasser, Rob 11 Jun '03

11 Jun '03

I'm having some name lookup weirdness and not sure of the cause. Thought I'd post the scenario to the group before I start tweaking my configuration to see if it can be fixed. First off, I'm running syslog-ng 1.6.0rc3, and on the systems I'm having problems, they are Sun Netra systems, dual procs, 2GB of memory, running Solaris 8. My options look like this: log_fifo_size(2048); time_reopen(10); use_fqdn(yes); keep_hostname(no); use_dns(yes); dns_cache(yes); long_hostnames(off); I have 2 servers with this configuration acting as centralized loghosts for a datacenter. They are identical boxes, running identical syslog-ng configurations, on the same VLAN as the DNS servers they point to. Both of these boxes will periodically fail to lookup a name? and log an entry under it's IP address instead of it's fully qualified host name. There appears to be no pattern what so ever to it, and the log entries that get logged by IP are different on each syslog-ng server. The load on these systems is pretty minimal. The number of messages logged by IP address is averaging about 10 a day out of about 13000 messages being logged. To make things even more interesting, I have a similar setup in another datacenter, but they are older smaller systems, only Ultra 1's, single proc, with only 128 MB of memory, running Solaris 2.6, acting as centralized servers for about 3 times the number of servers. The syslog-ng version and configuration is identical. On these systems I can not find any entries logged by IP address, everything appears to be working fine. Any ideas what might be causing this? My gut reaction is to blame it on the DNS boxes since the problem is only happening in one data center and not another, but wanted to see if anyone else has already been down this road first. Thanks Rob Glasser AT&T Wireless UNIX Systems Administrator

2 1