August 2003 - syslog-ng - lists.balabit.hu

syslog-ng-1.6.0rc3 crashes after some hours
by Rudolfs Osins 15 Aug '03

15 Aug '03

Hello everyone, I have the folloving problem: After some hours as daemon (~1 - 2h) syslog-ng crashes, leaving no info on what happened in the logs or elsewhere. I run the daemon with syslog-ng -u syslog-ng -g syslog-ng and the user and group exists in the system. The config file I use is attached. Compile options are following: libol-0.3.10 ./configure --prefix=/usr/local/opt/libol make syslog-ng-1.6.0rc3 ./configure --prefix=/usr/local/opt/syslog-ng --with-libol=/usr/src/libol-0.3.10 make make install The system is a celeron 1700Mhz with 128Mb ram and there are just 2 other proccesses beside syslog-ng - fcron and ntpd. Another question is: when I delete a logfile when syslog-ng is still running for the first time, syslog-ng recreates the file, when it recives a message thats destination is the deleted file, but when I delete the same file a second time, it's not being recreated. Is there a way to make syslog-ng recreate the file everytime ? And the last question is, when could the message encryption feature be implemented ? Btw. great work ! Syslog-ng is a really good product ! best regards, Rudolfs

1 1

Behaviour on comm failure.
by Erik Ivanenko 14 Aug '03

14 Aug '03

Does syslog-ng guarantee delivery of messages when communcations to the logging host is lost? ie. are syslog-ng messages buffered until the communcations are re-established? Thank you!

1 0

half open connections.
by Erik Ivanenko 14 Aug '03

14 Aug '03

Hello, I don't know if this has been implemented, but I think not yet... Our intended usage of syslog-ng is for remote devices to annunciate alarms as part of a building automation system as folows: When a remote devices detects an alarm in a building system, a message is issued to the host via a syslog-ng TCP connection. The syslog-ng daemon on the host uses a FIFO to pass the message to a waiting task to dump that message into a database and add further formatting to the message for delivery to our alarms terminals. My problem is that if the remote devices is powered off, a 1/2 open connected will result on the server, that necessitates a SIGHUP to remove (or the syslog-ng to be restarted.) Is there a version of syslog-ng that will test each connection at a timed interval and close if the remote device is not present? Thank you for a great piece of work! Cheers.

1 0

RE: [syslog-ng]IETF Syslog Draft
by Clemson, Chris 13 Aug '03

13 Aug '03

Interesting. There's also http://www.ietf.org/internet-drafts/draft-ietf-syslog-sign-11.txt for security stuff. I know it's dated May but did anyone see it? > For those interested in where the standard is going: > > http://www.ietf.org/internet-drafts/draft-ietf-syslog-internat > ional-00.txt > > If you are interested in features and option, now is the time to speak > up. > > > Richard -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 2

RE: [syslog-ng]syslog-ng&logrotate
by Hamilton, Andrew 13 Aug '03

13 Aug '03

When you rotate the logs you have to send syslog-ng a SIGHUP to make it look at your new file. If you are using Linux if you look in /etc/logrotate.d there is a file called syslog, make sure it is picking up the correct pid file so that it is HUPing the right process on log rotation. Regards, Drew -----Original Message----- From: yannick.haguenier(a)tuxfamily.org [mailto:yannick.haguenier@tuxfamily.org] Sent: Thursday, July 10, 2003 7:03 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng&logrotate Hy, i have squid + syslog-ng 1.0.6.rc1 Syslog-ng look squid/access.log, and write log file (with date format) on a remote server (tcp). On squid there is a logrotate at 6 am. My pb : before the log rotate, all is good. After logrotate, syslog-ng don't write in the remote file. The last line appear in this file was create at 6am. The process run on the both server, and i have no error. If i run syslog-ng restart, syslog-ng write the ligne in remote file . the next error appear after the next logrotate. Does anyone know why this is happening? thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

resolve IP addresses
by Madhvi Gokool 12 Aug '03

12 Aug '03

> Hello > Can syslog-ng resolve IP addresses using the /etc/hosts file? We do not have > an internal dns at the moment. Currently , the filenames that are created > are the IP addresses of the routers that are pushing their syslog onto the > syslog server. > > Regards > Madhvi >

3 2

end of line character
by Franky Van Liedekerke 08 Aug '03

08 Aug '03

Hi all, I'm using syslog-ng for quite a while now, and I'm a happy user. However, there's one thing that I can't seem to be getting right: how to filter out messages ending on a specific word, e.g. I would like to ignore all messages that have the string "admin: $" in it (the dollar-sign indicating end-of-line). But the match expression doesn't seem to recognize this end-of-line character, so can anybody tell me how to achieve this? thanx already! Franky

1 0

RE: [syslog-ng]Program destination never executes
by Chris Robertson 08 Aug '03

08 Aug '03

Checked that, it works fine from the command line. :( Chris -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Thursday, August 07, 2003 3:33 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Program destination never executes On Thu, Aug 07, 2003 at 02:10:26PM -0700, Chris Robertson wrote: > I hoping that someone can point out what I'm doing wrong here. I have the > following configuration in my syslog-ng.conf file but the program referenced > in d_mysql_prog is never executed (I've tried a simple version that just > outputs to a file as well). Note the file gets all the messages properly > and I've cut out the non-relevant sections of the config. I don't see anything wrong here, I'd make sure the script isn't just dying as soon as it starts. -- Nate Windows is the answer, but only if the question was 'what is the intellectual equivalent of being a galley slave?' _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Program destination never executes
by Chris Robertson 07 Aug '03

07 Aug '03

I hoping that someone can point out what I'm doing wrong here. I have the following configuration in my syslog-ng.conf file but the program referenced in d_mysql_prog is never executed (I've tried a simple version that just outputs to a file as well). Note the file gets all the messages properly and I've cut out the non-relevant sections of the config. source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; source net { udp(ip("0.0.0.0") port(514)); }; destination d_file { file ("/tmp/syslog"); }; destination d_mysql_prog { program ("/root/syslog2.pl"); }; log { source(net);destination(d_mysql_prog); }; log { source(src);destination(d_mysql_prog); }; log { source(src);destination(d_file); }; log { source(net);destination(d_file); }; Thanks, Chris

2 1

RE: [syslog-ng]2 quick (i hope!) libol questions
by Clemson, Chris 07 Aug '03

07 Aug '03

ah, ok, thanks! > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: 07 August 2003 11:19 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]2 quick (i hope!) libol questions > > > On Thu, Aug 07, 2003 at 11:13:16AM +0100, Clemson, Chris wrote: > > I'm just about to upgrade to syslog-ng to try and see if it > stops the > > problem with dropping stats that we are having at the moment. > > > > in the docs it mentions that i need libol 0.3.x, which i am about to > > compile. > > however, searching on my system, i cant see any version of > libol, even > > though v1.2 of syslog-ng seems to need 0.2.8. > > > > My questions are, what does libol actually do, and why > wouldn't my machine > > already have a copy of it somewhere? > > libol is compiled into syslog-ng statically (by default), > therefore there's > no shared lib in the system. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD > 804E C82C 8EB1 > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0