August 2003 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]last message repeated?
by Rule, Ted 28 Aug '03

28 Aug '03

Dear old syslogd has explicit code to save a copy of the last message received, and compare it with the current message ( less the timestamp field and it only saves 256 bytes of message(?) ), so as to throttle out such floods. It's fairly basic, however, as it imposes no time restriction on the history buffer, so duplicate messages hours apart don't cause separate messages to be logged. As far as I'm aware, syslog-ng has never had this feature, but I agree it would be highly desirable to add to future releases. On the face of it, the basic functionality provided in syslogd shouldn't be difficult thing to code. however, the tricky bells&whistles feature would be to add a separate message history/throttle/cache(?)/aging(?) for each source IP so that a server could correctly spot multiple copies of the same message within a given timeframe even if intervening messages were from a different source. Ted -----Original Message----- From: Chuck Berg <chuck(a)encinc.com>@FLEXTECH Sent: Wednesday 02 July 2003 21:53 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]last message repeated? Is there a particular reason why syslog-ng doesn't generate "last message repeated x times" messages? It's very unfortunate to have the disk on my log server fill up because of one machine flooding the logs. For example, Solaris will send one "WARNING: /tmp: File system full, swap space limit exceeded" message for every write() that fails for that reason. It's easy to get tens of thousands of these per second. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Re: syslog-ng digest, Vol 1 #1032 - 9 msgs (Vacation)
by TIM MOORE 28 Aug '03

28 Aug '03

FYI: I will be out on vacation from 8/28 until 9/8. Please contact the NOC if you need immediate assistance. Thanks, Tim Moore

1 0

Re: syslog-ng digest, Vol 1 #1031 - 10 msgs (Vacation)
by TIM MOORE 28 Aug '03

28 Aug '03

FYI: I will be out on vacation from 8/28 until 9/8. Please contact the NOC if you need immediate assistance. Thanks, Tim Moore

1 0

template_escape character not valid for oracle
by Matt Scifo 27 Aug '03

27 Aug '03

Hello I just started using syslog-ng with an oracle database as my destination. I have discovered that Oracle does not accept a backslash as an escape character (I thought backslash was a standard). The following query does not work in Oracle... INSERT INTO messages (ID, TIMESTAMP, HOST ,FACILITY, PRIORITY, TAG, PROGRAM, MESSAGE) VALUES ('', to_date('2003-08-26 11:51:00', 'yyyy-mm-dd hh24:mi:ss'), 'host1', 'local0', 'warning', '84', '1', 'STOP: \'edrasmu\' message') It will only accept a single quote for escaping a single quote... INSERT INTO messages (ID, TIMESTAMP, HOST ,FACILITY, PRIORITY, TAG, PROGRAM, MESSAGE) VALUES ('', to_date('2003-08-26 11:51:00', 'yyyy-mm-dd hh24:mi:ss'), 'host1', 'local0', 'warning', '84', '1', 'STOP: ''edrasmu'' message') How hard would it be to change the escape character that syslog-ng is looking for, or even better, make a template_escape(string) option which accepts a custom escape string? Where is the code that handles the escaping of characters located in the source? Matt Scifo mscifo(a)o1.com

2 2

newbie linux/syslog-ng server question...
by Matt Miller 25 Aug '03

25 Aug '03

When running syslog-ng on linux, do I still need to run klogd... or does syslog-ng replace syslogd and klogd? matt -- Matt Miller IT Infrastructure Team Duke University - Fuqua School of Business

2 1

RE: [syslog-ng]$DAY in
by Jérôme Fenal 25 Aug '03

25 Aug '03

It seems that syslog-ng thinks you're looking for $DAY_ and not $DAY. Try to replace the underscore by a dot, or RTFM to see if syslog-ng supports specifying variables that way : ${DAY}. Regards, J. -----Original Message----- From: William Pope [mailto:pope.william@epa.gov] Sent: Mon 8/25/2003 20:43 To: syslog-ng(a)lists.balabit.hu Cc: Subject: [syslog-ng]$DAY in I recently upgraded syslog-ng from version 1.4.17 to 1.6.0rc3. After the upgrade, the system logs do not include the DAY when sent to the following destination. destination hosts { file("/var/adm/logs/$HOST/$YEAR/$MONTH/$DAY_$FACILITY"); }; I get logs like /var/logs/HOST/2003/08/kern.log instead of /var/logs/HOST/2003/08/25_kern.log like I did with version 1.4.17. The day and the underscore are missing. I am using the same conf file as 1.4.17. Any help would be greatly appreciated! I am sure I am missing something stupid. Thank you, Will ------------------------------------------------------------------- This is a PRIVATE message, intended for the designated recipient(s) only and may contain privileged or confidential information. If you have received this message in error, please notify me immediately, delete the original, and destroy any paper copies. Any other use of the email by you is prohibited. NOTE: Regardless of content, this e-mail shall not operate to bind the sender to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose. This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

1 0

$DAY in
by William Pope 25 Aug '03

25 Aug '03

I recently upgraded syslog-ng from version 1.4.17 to 1.6.0rc3. After the upgrade, the system logs do not include the DAY when sent to the following destination. destination hosts { file("/var/adm/logs/$HOST/$YEAR/$MONTH/$DAY_$FACILITY"); }; I get logs like /var/logs/HOST/2003/08/kern.log instead of /var/logs/HOST/2003/08/25_kern.log like I did with version 1.4.17. The day and the underscore are missing. I am using the same conf file as 1.4.17. Any help would be greatly appreciated! I am sure I am missing something stupid. Thank you, Will ------------------------------------------------------------------- This is a PRIVATE message, intended for the designated recipient(s) only and may contain privileged or confidential information. If you have received this message in error, please notify me immediately, delete the original, and destroy any paper copies. Any other use of the email by you is prohibited. NOTE: Regardless of content, this e-mail shall not operate to bind the sender to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose.

1 0

Any one ported syslog-ng for IRIX system
by Shah, Sanjay T [FI] 22 Aug '03

22 Aug '03

Has any one ported syslog-ng for IRIX system? Can you please provide some info on source ? Thanks sanjay

1 0

syslog-ng failed on Coosbay server,succeeded on Langley
by Wang, Zhenyu Z 22 Aug '03

22 Aug '03

After receiving your answer, I have tried a lot of configuration ways to make my syslog-ng to run on Coosbay server. But it failed at last. Then I compile and install syslog-ng-1.6rc3 on Langley server with RH7.3. Put sample config file into use. Everything seems so fine. I am now happy with syslog-ng. I am not sure about the difference between Coosbay and Langley. But syslog-ng does have some problems running on coosbay server. I don't know why. thanks zhen -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, August 19, 2003 8:20 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]src/tests/testall failed! I have 8 Redhat 7.3 systems running syslog-ng with that very source statement, except I use unix-dgram, and it works fine. Have you stopped klogd? Are you chroot-ing? Why don't you post your entire config file? That may help us help you more. Regards, Drew -----Original Message----- From: Wang, Zhenyu Z [mailto:zhenyu.z.wang@intel.com] Sent: Tuesday, August 19, 2003 1:33 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]src/tests/testall failed! Can you tell me why the script does not work? On my RH7.3, syslog-ng.conf.Redhat is not working fine. source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; $syslog-ng Error opening file /proc/kmsg for reading (No such file or directory) Error initializing configuration, exiting. Is there something in system I should tune? zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Power fail restart
by Erik Ivanenko 21 Aug '03

21 Aug '03

I am running version 1.5.13. All but 2 of 60 remote devices FAILED to reconnect when the power returned in Ontario. The cental logging host did not go off-line, as it was on emergency power. I use the standard /etc/init.d/syslog-ng start scripts for the remote devices. They are all Linux machines. After issuing HUP to the central host, 9 of 60 connections are working. Running "snoop" shows that the remote daemons have stopped trying to connect. I thought that syslog-ng was supposed to reconnect after such events? Can anyone tell me what I can do to make these remote devices reconnect? Must I manually restart syslog-ng on each remote client? Thanks in advance...

2 1