July 2003 - syslog-ng - lists.balabit.hu

List of Valid Source Addresess
by Daniel.N.Sferas＠us.hsbc.Com 10 Jul '03

10 Jul '03

Greetings, I would like to be able to validate that incoming syslog messages from the network are from "Well known" sources. Is there a way for syslog-ng to parse the source address against a flat file of IP addresses or patterns? I hesitate to use a match string in the syslog-ng.conf file as the filter would be very large. I am using 1.6.0rc3. Thanks in advance for any tips. Dan Sferas ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************

2 1

The syslog-ng process dies
by Madhvi Gokool 10 Jul '03

10 Jul '03

Hello I have noticed this problem twice now- I start syslog-ng manually from a script with the following command : - syslog-ng -f /etc/syslog-ng.conf Syslog messages get logged in their respective files/directories. However, some time during the night, the syslog-ng process dies by itself - The command ps -aux |grep syslog-ng yields no process ID and the log files show nothing. Syslog-ng version is 1.5.9 Is this a bug ?? Regards Madhvi

3 5

Dropped messages and UDP buffer sizes
by Clemson, Chris 10 Jul '03

10 Jul '03

Hello! We are trying to use syslog-ng to log messages from several servers. We get quite a few "dropped" messages from syslog-ng saying between 70 and 290 are being dropped each time. According to the list, it sounds like we need to increase out UDP receive buffer size. We are running suse 8.2 on a Pentium II 266 and a SCSI HD. The machine had 64mb in it, and we increased this to 128mb which didn't help. We get around the same number of "dropped" messages. We are logging from 5 machines, and getting ~9500 messages a day and we are making it log to just /var/log/messages at the moment. The network card is a 3com 3c905b (cyclone). Watching top for memory and processor usage doesn't indicate that anything is using a lot of either. Do we need to increase the UDP receive buffer? if so, where do we find it? it sounds worryingly like a kernel recompile job! Any help would be appreciated. thanks, chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 1

syslog-ng and logrotate
by yannick.haguenier＠tuxfamily.org 10 Jul '03

10 Jul '03

Hy, i have squid + syslog-ng 1.0.6.rc1 Syslog-ng look squid/access.log, and write log file (with date format) on a remote server (tcp). On squid there is a logrotate at 6 am. My pb : before the log rotate, all is good. After logrotate, syslog-ng don't write in the remote file. The last line appear in this file was create at 6am. The process run on the both server, and i have no error. If i run syslog-ng restart, syslog-ng write the ligne in remote file . the next error appear after the next logrotate. Does anyone know why this is happening? thanks

1 0

RE: [syslog-ng]The syslog-ng process dies
by Michael.Semling＠swisscom.com 10 Jul '03

10 Jul '03

Hi Madhvi, I had the same experience - I updated to 1.6.0rc3 and libol 0.3.10 since then I do not have this problem anymore. Regards, Michael -----Original Message----- From: Madhvi Gokool [mailto:madhvin@yahoo.com] Sent: Donnerstag, 10. Juli 2003 08:42 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]The syslog-ng process dies Hello I have noticed this problem twice now- I start syslog-ng manually from a script with the following command : - syslog-ng -f /etc/syslog-ng.conf Syslog messages get logged in their respective files/directories. However, some time during the night, the syslog-ng process dies by itself - The command ps -aux |grep syslog-ng yields no process ID and the log files show nothing. Syslog-ng version is 1.5.9 Is this a bug ?? Regards Madhvi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Does flags(fallback) work?
by Asher Yanich 09 Jul '03

09 Jul '03

Hi, I finally went ahead and upgraded my syslog-ng from 1.5.7 to 1.6.0r3. Previously, I used filter(DEFAULT) to catch all logs that had not matched anything else. I updated my config, to log { source(src); destination(d_default); flags(fallback); }; I however do not recieve anything to this destination, so it seems that fallback is broken? Can someone verify that this is the current state of syslog-ng? Thanks, -asher Asher Yanich Systems & Network Support Group Florida International University School of Computer Science "I've never had problems with 'extra time'. As far as I know, 'extra time' as a concept is right up there with Santa Claus and the Tooth Fairy." -Linus Torvalds

1 0

Regarding Php-Syslog-NG
by Perriero, Robert A. 07 Jul '03

07 Jul '03

ok, i have everything set up, and syslog-ng is working very nicely. Problem is that the script that runs to move logs from named pipe in /tmp to the mysql server does not work from cron. It works succesfully from a putty window, but that defeats the purpose. Does anyone have a working shell script for php-syslog-ng? My OS is Solaris 9 (SPARC). If anyone has this, could you please email me as soon as possible? Thanks in advance. Sincerely, Robert Perriero PS. Please don't send me the existing MySQL script that's currently on vermeer.org as that's the one I'm using. I need an updated script, or I need advice on how to get this to work correctly.

2 1

syslog-ng throttling and event reporter
by Russell Adams 07 Jul '03

07 Jul '03

I'm using Event Reporter on my Windows servers to forward their event log to my syslog-ng server. Recently, I've switched all of my Linux syslog clients to use TCP to speak to the syslog-ng server, without any problems. I've just enabled TCP on Event Reporter, and its behaving rather unusually. I'm seeing 30+ open TCP connections from the one Windows host I've enabled TCP on, and am experiencing messages that I'm frequently hitting my max connections value of 100 open connections. Is anyone running a similar configuration and seen similar problems? I suspect that Event Reporter is using one connection per message, as silly as that sounds. Its wild to contemplate it leaving those connections open. If its not a known problem, I'll break out a sniffer to see whats going on. Russell

1 0

Performance
by omar Brihi 03 Jul '03

03 Jul '03

Hello I would like to know how many TCP connections per seconds, the syslog-ng can handle simulteanously? Did anybody can tell me from his experience? how many equipments, bandwidth taken, Mbytes? regards omar ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

1 0

last message repeated?
by Chuck Berg 02 Jul '03

02 Jul '03

Is there a particular reason why syslog-ng doesn't generate "last message repeated x times" messages? It's very unfortunate to have the disk on my log server fill up because of one machine flooding the logs. For example, Solaris will send one "WARNING: /tmp: File system full, swap space limit exceeded" message for every write() that fails for that reason. It's easy to get tens of thousands of these per second.

1 0