August 2003 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]src/tests/testall failed!
by Wang, Zhenyu Z 20 Aug '03

20 Aug '03

I use the config file in contrib directory named syslog-ng.conf.Redhat. --begin-- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; --end-- syslogd & klogd are stopped. But syslog-ng failed to start. #service syslog status syslogd is stopped klogd is stopped #syslog-ng Error opening file /proc/kmsg for reading (No such file or directory) Error initializing configuration, exiting. Then I try to forget about kernel logging first. I use another simple configuration for test. --begin-- # Simple syslog-ng.conf file. options { use_fqdn(no); sync(0); }; source s_sys { unix-stream("/dev/log"); internal(); }; destination d_security { file("/var/log/security"); }; destination d_messages { file("/var/log/messages"); }; destination d_console { usertty("root"); }; filter f_authpriv { facility(auth, authpriv); }; filter f_messages { level(info .. emerg) and not facility(auth, authpriv); }; filter f_emergency { level(emerg); }; log { source(s_sys); filter(f_authpriv); destination(d_security); }; log { source(s_sys); filter(f_messages); destination(d_messages); }; log { source(s_sys); filter(f_emergency); destination(d_console); }; --end-- syslog-ng seems to start this time. But I find a file named '?' in the syslog-ng starting directory,it contains the exact logging messages. #syslog-ng #ls ? bin doc etc ... #logger -p local0.info "test test" #cat ? Aug 20 09:43:20 s_sys@power syslog-ng[351]: syslog-ng version 1.6.0rc3 starting Aug 20 09:43:20 s_sys@power syslog-ng[351]: syslog-ng version 1.6.0rc3 starting Aug 20 09:44:00 s_sys@power CROND[358]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/qrunner) Aug 20 09:44:00 s_sys@power CROND[358]: (mailman) CMD (/usr/bin/python -S /var/mailman/cron/qrunner) Aug 20 09:44:38 s_sys@power root: test test Aug 20 09:44:38 s_sys@power root: test test # The result is same by replace unix-stream with unix-dgram in source directive. The debug output is like: #syslog-ng -d -F io.c: listening on fd 3 syslog-ng version 1.6.0rc3 starting io.c: Preparing fd 4 for reading Read EOF on fd 4. Marking fd 4 for closing. Closing fd 4. io.c: Preparing fd 4 for reading Read EOF on fd 4. Marking fd 4 for closing. Closing fd 4. io.c: Preparing fd 4 for reading io.c: Preparing fd 5 for writing Read EOF on fd 4. Marking fd 4 for closing. Closing fd 4. io.c: Preparing fd 4 for reading Read EOF on fd 4. Marking fd 4 for closing. Closing fd 4. ... best regards zhen -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, August 19, 2003 8:20 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]src/tests/testall failed! I have 8 Redhat 7.3 systems running syslog-ng with that very source statement, except I use unix-dgram, and it works fine. Have you stopped klogd? Are you chroot-ing? Why don't you post your entire config file? That may help us help you more. Regards, Drew -----Original Message----- From: Wang, Zhenyu Z [mailto:zhenyu.z.wang@intel.com] Sent: Tuesday, August 19, 2003 1:33 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]src/tests/testall failed! Can you tell me why the script does not work? On my RH7.3, syslog-ng.conf.Redhat is not working fine. source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; $syslog-ng Error opening file /proc/kmsg for reading (No such file or directory) Error initializing configuration, exiting. Is there something in system I should tune? zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Forwarding unchanged Syslog messages
by Hamilton Andrew 19 Aug '03

19 Aug '03

The keep_hostname is a server option really. If you are receiving messages on that host than keep_hostname is what you are looking for. The server on the other end of your connection,ie 192.168.1.1 needs to be syslog-ng and have its keep_hostname option set to on. Turn chain_hostnames off as all this does is put each hostname that it has passed through on the hostname chain. You probably don't want that. Regards, Drew -----Original Message----- From: Harrie van Arragon [mailto:harrieva@web.de] Sent: Tuesday, August 19, 2003 9:19 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Forwarding unchanged Syslog messages Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie __________________________________________________________________________ Die sicherste Form der Kommunikation: E-Mails verschluesseln, Spam-Filter, Adressverifizierung, digitale Unterschrift: http://freemail.web.de _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Forwarding unchanged Syslog messages
by Harrie van Arragon 19 Aug '03

19 Aug '03

Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie __________________________________________________________________________ Die sicherste Form der Kommunikation: E-Mails verschluesseln, Spam-Filter, Adressverifizierung, digitale Unterschrift: http://freemail.web.de

1 0

RE: [syslog-ng]Wild files
by Hamilton Andrew 19 Aug '03

19 Aug '03

Again, post your config file. I'm not sure what you are asking. Are you talking about wild cards in filenames? There are macros designed to help you use dynamic files. Regards, Drew -----Original Message----- From: Wang, Zhenyu Z [mailto:zhenyu.z.wang@intel.com] Sent: Tuesday, August 19, 2003 5:41 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Wild files Could you answer my question on wild files like '?' or '"'? It seems to contain the log message as well, while it failed to log message into dest like: destination d_message { file("/var/log/messages"); }; $syslog-ng -d -F binding fd 3, unixaddr: /dev/log io.c: Preparing fd 3 for reading syslog-ng version 1.6.0rc3 starting io.c: Preparing fd 4 for writing (then stopped) thanks zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]src/tests/testall failed!
by Hamilton Andrew 19 Aug '03

19 Aug '03

I have 8 Redhat 7.3 systems running syslog-ng with that very source statement, except I use unix-dgram, and it works fine. Have you stopped klogd? Are you chroot-ing? Why don't you post your entire config file? That may help us help you more. Regards, Drew -----Original Message----- From: Wang, Zhenyu Z [mailto:zhenyu.z.wang@intel.com] Sent: Tuesday, August 19, 2003 1:33 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]src/tests/testall failed! Can you tell me why the script does not work? On my RH7.3, syslog-ng.conf.Redhat is not working fine. source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; $syslog-ng Error opening file /proc/kmsg for reading (No such file or directory) Error initializing configuration, exiting. Is there something in system I should tune? zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Wild files
by Wang, Zhenyu Z 19 Aug '03

19 Aug '03

Could you answer my question on wild files like '?' or '"'? It seems to contain the log message as well, while it failed to log message into dest like: destination d_message { file("/var/log/messages"); }; $syslog-ng -d -F binding fd 3, unixaddr: /dev/log io.c: Preparing fd 3 for reading syslog-ng version 1.6.0rc3 starting io.c: Preparing fd 4 for writing (then stopped) thanks zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Forwarding unchanged Syslog messages
by Harrie.van.Arragon＠steinmuehlen-brot.de 19 Aug '03

19 Aug '03

Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie

1 0

RE: [syslog-ng]src/tests/testall failed!
by Wang, Zhenyu Z 19 Aug '03

19 Aug '03

Can you tell me why the script does not work? On my RH7.3, syslog-ng.conf.Redhat is not working fine. source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; $syslog-ng Error opening file /proc/kmsg for reading (No such file or directory) Error initializing configuration, exiting. Is there something in system I should tune? zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Reliable syslog and network outages
by Roland Turner 18 Aug '03

18 Aug '03

I'm trying to work out whether syslog-ng can deliver syslog messages reliably in the face of client reboots during network partitions. From reading the documentation, it is not clear where log_fifo stores its data (disk or memory) and therefore whether or not log entries on a remote syslog client that queue up during a partition of the network which seperates syslog client from loghost will remain queued if the syslog client host reboots. If my approach is unworkable, pointers or aid on how to solve the general problem another way would be greatly appreciated. Here are the details: 1. Several administered machines are located at diverse locations, generally where they are used primarily/entirely by local users. 2. Local users can ordinarily continue to do useful work even if they lose external network connectivity for a while; consequently HA network connectivity is not a user requirement. 3. The machines do not generally require direct intervention very often, so from an administration standpoint, 100% reachability is also not a requirement. 4. As a result of points 2 and 3, highly reliable connectivity is not available; outages of minutes or hours really do occur. 5. Pre-syslog-ng implementations of syslog using UDP will simply lose all log entries during the time that a network is partitioned. This is definitely not OK. 6. Syslog-ng appears to offer TCP-based delivery which certainly solves one issue; normal network paket loss is not an issue. 7. Syslog-ng appears to maintain an internal FIFO which, if sized large enough on a syslog relay host at the remote location(s), could collect all log information generated during a partition and then successfully deliver it when connectivity is restored. 8. If, however, syslog-ng's internal FIFO is memory-based then if the remote location's syslog relay host is rebooted during the network partition then all that it has accumulated and not yet transferred will be lost. (Similarly if the death of the TCP connection is treated as reason to give up, rather than continually retry.) 9. What information I have found on dealing with this appears to deal with loghost unreliability rather than network unreliability, and thus recommends providing HA through additional, redundant, loghosts. Setting aside the problems in reconcilliation of logs that this implies, it takes away the reason for having syslog deliver via IP directly (rather than, say, email) entirely. Does syslog-ng provide a means to deal with this problem? Does some other solution exist? Thanks in advance. - Raz

3 5

src/tests/testall failed!
by Wang, Zhenyu Z 18 Aug '03

18 Aug '03

After I have successfully compiled syslog-ng-1.0.6rc3, I run src/tests/testall script but it failed. Config file is syslog-ng.conf.eval. source src { unix-stream("input"); }; destination d1 { file("d1"); }; destination d2 { file("d2"); }; destination d3 { file("d3"); }; destination d4 { file("d4"); }; destination d5 { file("d5"); }; destination d6 { file("d6"); }; destination d7 { file("d7"); }; filter f1 { facility(local0); }; filter f2 { facility(local1) and level(debug); }; filter f3 { facility(local2) and not level(debug); }; filter f4 { not (facility(local3) and level(debug)); }; filter f5 { facility(local4) or level(info); }; filter f6 { facility(local4) or not level(info); }; filter f7 { not (facility(local4) or level(info)); }; log { source(src); filter(f1); destination(d1); }; log { source(src); filter(f2); destination(d2); }; log { source(src); filter(f3); destination(d3); }; log { source(src); filter(f4); destination(d4); }; log { source(src); filter(f5); destination(d5); }; log { source(src); filter(f6); destination(d6); }; log { source(src); filter(f7); destination(d7); }; Error message is like: + rm 'd?' rm: cannot remove `d?': No such file or directory + ../syslog-ng -f syslog-ng.conf.eval -p syslog-ng.pid Warning: No source refers to internal messages, they'll go to /dev/null + logger -u input -p local0.debug 'msg: local0.debug' + logger -u input -p local1.debug 'msg: local1.debug' + logger -u input -p local1.info 'msg: local1.info' + logger -u input -p local2.debug 'msg: local2.debug' + logger -u input -p local2.info 'msg: local2.info' + logger -u input -p local3.debug 'msg: local3.debug' + logger -u input -p local4.info 'msg: local4.info' + logger -u input -p local6.info 'msg: local6.info' + logger -u input -p local4.debug 'msg: local4.debug' + logger -u input -p local6.info 'msg: local6.info' ++ cat syslog-ng.pid + pid= + kill -TERM ./test.eval: kill: : no such pid + sleep 2 + kill -TERM ./test.eval: kill: : no such pid + rm syslog-ng.pid ++ wc -l 'd?' wc: d?: No such file or directory + result= + rm 'd?' rm: cannot remove `d?': No such file or directory + '[' '' '!=' ' 1 d1 1 d2 1 d3 10 d4 6 d5 7 d6 5 d7 31 total' ']' + echo 'evaluation test failed' evaluation test failed + exit 1 I appreciate somebody tell me why. I have also found some "?" files in the direcotory starting syslog-ng daemon. What can these "?" be used? Zhen Not speaking for my employer -- all opinions are my own (and my fault)

2 1