September 2003 - syslog-ng - lists.balabit.hu

Problem with syslog-ng and Sys::Syslog
by Jyri Hovila 05 Sep '03

05 Sep '03

Hi! (Jarkko: Sori että häiritsen sinua tällaisella. Ajattelin että saattaisit olla kiinnostunut.) I'm having a weird problem with syslog-ng (version 1.5.24) and Perl module Sys::Syslog. I use Perl 5.8.0 and OpenBSD 3.3. When logging a timestamp using Sys::Syslog, it gets corrupted: This: syslog('local3|info',"TESTING - 12:34:56"); Turns into this: Sep 5 23:49:12 my.server.com root: TESTING - 12: 34:56 Notice the extra space between "12:" and "34". The problem does *not* occur if I do ``logger -p local3.info "TESTING - 12:34:56"''. I don't know if the problem is actually within syslog-ng or Sys::Syslog. Any ideas what could be wrong and how it could be fixed? Thanks! =) - Jyri

2 1

exit matching rules after first match
by Fanselow, William 05 Sep '03

05 Sep '03

Is there any way to configure syslog-ng to exit the matching rules upon it's first match, much as most firewalls do (it appears that all matching rules are checked even after a match has been made). This would make my config file much simpler and presumably ease processing resources. If this feature doesn't currently exist, wouldn't it be a cool addition to future releases! ------------------------ William Fanselow Level(3) Communications 720.888.8363 ------------------------

1 0

RE: [syslog-ng]DNS Problem?
by Glasser, Rob 03 Sep '03

03 Sep '03

Actually all systems are using Veritas Volume Manager to mirror the disk. Rob Glasser desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net -----Original Message----- From: nate [mailto:nate@campin.net] Sent: Tuesday, September 02, 2003 4:16 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]DNS Problem? On Tue, Sep 02, 2003 at 03:45:46PM -0700, Glasser, Rob wrote: > Wow, old thread of mine. > > It appears to be disk/load related on the syslog server itself. These > messages only appear in the middle of the night when a find job runs > on the directories and files syslog-ng writes to and deletes old files > (syslog-ng writes to files with a datestamp in the filename). When I > don't run this script I don't have any problems. Funny thing is this > happens on my boxes that are Netra 1125's, dual 400Mhz procs, 18GB > 10000 RPM disks, but doesn't happen on my boxes that are Ultra 1's, > single 84Mhz prco, 9GB 7200 RPM disks. Go figure. We're moving this > stuff onto new hardware on a SAN so hopefully the problems will go > away then. Wild guess, are you using disksuite to mirror/manage those fast disks? That'll slow things way the hell down and take up all your CPU time when funning find. -- Nate "If builders built buildings they way computer programmers write programs, the first woodpecker that came along would have destroyed all civilization." - Weinberg's Law _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]DNS Problem?
by Glasser, Rob 03 Sep '03

03 Sep '03

Wow, old thread of mine. It appears to be disk/load related on the syslog server itself. These messages only appear in the middle of the night when a find job runs on the directories and files syslog-ng writes to and deletes old files (syslog-ng writes to files with a datestamp in the filename). When I don't run this script I don't have any problems. Funny thing is this happens on my boxes that are Netra 1125's, dual 400Mhz procs, 18GB 10000 RPM disks, but doesn't happen on my boxes that are Ultra 1's, single 84Mhz prco, 9GB 7200 RPM disks. Go figure. We're moving this stuff onto new hardware on a SAN so hopefully the problems will go away then. Rob Glasser -----Original Message----- From: Unger, Christian [mailto:C.unger@st-ag.de] Sent: Tuesday, June 10, 2003 11:33 PM To: syslog-ng(a)lists.balabit.hu Subject: AW: [syslog-ng]DNS Problem? May you using, Windows 2000 ADS integraded DNS Servers. Then you should look into you logfiles of the Windows box. The 2000 DNS Server dies some time on havy load. MS knows that problem and so the DNS kommt with a autorestart funktion. But you can get a dns time out during the restart. Or your ADS is in combination with Exchange 2000, so the DNS (DC Server) has some time havy load during the LDAP querys from Exchange. The DNS Respons now needs extremly long. If you have this you should need 3 DS in the primary Exchange 2000 Site and split the Exchange querys over the tree global catalog Server. Thas my 2000 knowlage ;) I hope it helps someone. -----Ursprüngliche Nachricht----- Von: Glasser, Rob [mailto:rob.glasser@attws.com] Gesendet: Mittwoch, 11. Juni 2003 00:50 An: syslog-ng(a)lists.balabit.hu Betreff: RE: [syslog-ng]DNS Problem? These are internal systems located in the same datacenter although not necessarily on the same network. reverse lookups work, in fact for any system that has a problem, it's usually only one message out of hundreds for the day that has the problem, all other messages from those systems resolve fine. Rob Glasser desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net -----Original Message----- From: Nicholas Bernstein [mailto:nick@docmagic.com] Sent: Tuesday, June 10, 2003 3:47 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]DNS Problem? First off, what hosts are they failing to resolve? If they are hosts from somewhere out on the internet, they might not have an in-addr.arpa address associated with the ip, and may not be reverse lookup-able. Have you tried to verify that the systems can look up the ip? E.G. 'host a.b.c.d '? On Tue, 2003-06-10 at 15:40, Glasser, Rob wrote: > I'm having some name lookup weirdness and not sure of the cause. > Thought I'd post the scenario to the group before I start tweaking my > configuration to see if it can be fixed. > > First off, I'm running syslog-ng 1.6.0rc3, and on the systems I'm > having problems, they are Sun Netra systems, dual procs, 2GB of > memory, running Solaris 8. My options look like this: > > log_fifo_size(2048); > time_reopen(10); > use_fqdn(yes); > keep_hostname(no); > use_dns(yes); > dns_cache(yes); > long_hostnames(off); > > I have 2 servers with this configuration acting as centralized > loghosts for a datacenter. They are identical boxes, running > identical syslog-ng configurations, on the same VLAN as the DNS > servers they point to. > > Both of these boxes will periodically fail to lookup a name? and log > an entry under it's IP address instead of it's fully qualified host > name. There appears to be no pattern what so ever to it, and the log > entries that get logged by IP are different on each syslog-ng server. > The load on these systems is pretty minimal. The number of messages > logged by IP address is averaging about 10 a day out of about 13000 > messages being logged. > > To make things even more interesting, I have a similar setup in > another datacenter, but they are older smaller systems, only Ultra > 1's, single proc, with only 128 MB of memory, running Solaris 2.6, > acting as centralized servers for about 3 times the number of > servers. The syslog-ng version and configuration is identical. On > these systems I can not find any entries logged by IP address, > everything appears to be working fine. > > Any ideas what might be causing this? My gut reaction is to blame it > on the DNS boxes since the problem is only happening in one data > center and not another, but wanted to see if anyone else has already > been down this road first. > > Thanks > > Rob Glasser > AT&T Wireless > UNIX Systems Administrator > -- +---------------------------------------------------------------+ | Nicholas Bernstein | nick(a)docmagic.com | | UNIX Systems Administrator | http://www.docmagic.com | | Document Systems Inc. | | | gpg: F706 8C4E 78FA DDDD 53A0 019F D983 FE28 2002 D1F3 | +---------------------------------------------------------------+ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Sending mail to root?
by Florian Lindner 02 Sep '03

02 Sep '03

Hello, I try to define a destination which sends the log entry to root: destination d_mailroot { program("/usr/bin/mail -s '[syslog] Exception detected' root"); }; But this is not working. mail does not notice that it should close stdin and send the mail. I think something like a EOF or at least in single line with a dot. How can I accomplish sending the mail? Thanks, Florian

4 17

What does this message mean?
by gary_tay＠platts.com 01 Sep '03

01 Sep '03

Hi List Folks, Anyone bother to explain to me what this message means? Aug 28 08:44:50 src@hostname syslog-ng[191]: pkt_buffer::do_flush(): Error flushing data OS: Solaris 8 syslog-ng: 1.6.0rc3 Pls let me know if you need more info. Rgds Gary

2 1