November 2004 - syslog-ng - lists.balabit.hu

program destination on OpenBSD
by Balazs Scheidler 18 Nov '04

18 Nov '04

hi, I was reported a reload with program() destinations on OpenBSD. As it seems the OpenBSD shell kills the whole process group it is part of when the shell receives a SIGTERM. As it currently stands syslog-ng is part of the shell's process group, which means that syslog-ng will be terminated upon the receipt of a SIGHUP: 1) syslog-ng gets a SIGHUP, 2) it terminates all its children (which includes a /bin/sh -c) 3) the OpenBSD shell issues kill -TERM 0, which sends a TERM signal to syslog-ng This patch should fix the issue, and will be included in tomorrow's snapshot: diff -u syslog-ng/src/afprogram.c:1.7.4.1 syslog-ng/src/afprogram.c:1.7.4.2 --- syslog-ng/src/afprogram.c:1.7.4.1 Mon Mar 22 12:56:33 2004 +++ syslog-ng/src/afprogram.c Thu Nov 18 10:57:27 2004 @@ -109,6 +109,7 @@ dup2(fd, 2); close(fd); close(msgpipe[1]); + setsid(); execl("/bin/sh", "/bin/sh", "-c", self->progname->data, NULL); _exit(127); } -- Bazsi

1 0

log to database and storage (urgent)
by Jeremy Doe 17 Nov '04

17 Nov '04

Hello list I compiled syslog-ng version 1.6.5 on Red Hat 3.0. The remote logging mechanism works (for example it fills my database) but he dont logs to the filesystem (storage). It means I shoud have two copies of log: one in database and one on filesystem for save. From my configuratioon I excpect to make directories and files with logs. For example /mnt/syslog/hosts/192.168.21.15/auth/200410 shoud be there. With lsof and ls I see no transaction to filesystem (I SIGHUPED syslog-ng) # Globale Optionen options { use_fqdn(no); use_dns(no); dns_cache(no); keep_hostname(yes); create_dirs(yes); long_hostnames(off); sync(1); log_fifo_size(1024); }; # Quellen/Sources source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); # auf UDP 514 listening udp(); }; source network { udp(); }; # Log syslog-ng zu mysql database destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(src); destination(d_mysql); }; # Log syslog-ng zu shared Storage destination std { file("/mnt/syslog/hosts/$HOST/$FACILITY/$YEAR_$MONTH" owner(root) group(root) perm(0601) dir_perm(0700) create_dirs(yes) ); }; log { source(network); destination(std); }; I also tried with the configuration from friendly campin (http://www.campin.net/syslog-ng/expanded-syslog-ng.conf) with minimal modifcation (we dont use dns). Please share ur knowledge with me (tried serveral days without luck) kind regards Jeremy

2 1

file compression
by Timothy Webster 15 Nov '04

15 Nov '04

I noticed that file compression is not currently implemented in syslog-ng 1.6.5. Is file compression expected in the near future. I need integrated file compression because writing from syslog, then reading to compress then writing the compressed data is killing my disk io. 1 write, 1 read, ~1/3 write If anybody has got something in cvs let me know. I am interested in lzo compression rather then bz2 or z(gzip). lzo it is about 1/2 space efficient as z, but it is also about 4 times faster. Which suits my needs of realtime compression better. -tim.

4 4

ISODATE offset?
by scott 15 Nov '04

15 Nov '04

syslog-ng is recording the date as > 2004-11-05T14:21:17+1000 Which is wrong; it should be > 2004-11-05T14:21:37+1100 as `date --iso-8601` returns. What gives?

3 10

How do I discard a message with syslog-ng?
by Ed Ravin 15 Nov '04

15 Nov '04

I want syslog-ng to discard a message that matches a particular string. There doesn't seem to be an easy way to do that, so I came up with this scheme instead: [...] filter unwanted { program("noisy-daemon") and match("unwanted alarm"); }; [...] destination discard { file("/dev/null" perm(0666) dir_perm(0755) create_dirs(no)); }; [...] log { source(remote); filter(unwanted); destination(discard); flags(final); }; In spite of the "flags(final)" in the log path, the unanted message still shows up in my other log paths. Have I misunderstood how to use "final"? Is there some other way to discard a message? My environment is NetBSD 1.5 and NetBSD 2.0. Thanks, -- Ed

3 7

MySQL client dying
by Peterson, Lars 11 Nov '04

11 Nov '04

Hello, I've followed the how-to (the one at the very top) here: http://vermeer.org/display_doc.php?doc_id=1 <http://vermeer.org/display_doc.php?doc_id=1> in order to set up a syslog to MySQL pipe using syslog-ng. syslog-ng: 1.6.5 libol-0.3.14 MySQL: 4.1.7 OS: HP-UX 11.11 All seems to be working great, except for the fact that occasionally the mysql client seems to die. When I do a 'ps' to look for the client process, I still see it running. Tracing the client processes using 'tusc' shows that it is writing the 'INSERT INTO' commands to the named pipe (/tmp/mysql.pipe). Nothing is being inserted into the DB though. I have observed that each time it has died, there seems to have been a large burst of syslog messages coming in. Last time it died I saw about 50 messages within one second... Any ideas? I'm looking to isolate the problem so that I can either: 1) auto restart syslog-ng when this happens 2) find a fix, so that this doesn't keep happening! TIA, Lars Peterson ********************************************************************** Robert W. Baird & Co. is required by regulation to review and store both outgoing and incoming electronic correspondence. Baird may be required to produce e-mail records for the SEC or other regulators in a criminal investigation. E-mail transmission cannot be guaranteed to be secure, timely or error-free. Baird therefore recommends that you do not send confidential information to us via electronic mail, including account numbers, social security numbers or any personal identification numbers. This is not an offer, or solicitation of an offer to buy or sell any security investment or other product. Any information regarding specific investment products is subject to change without notice. Any review, forwarding, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer on which it exists.

1 0

nested entries?
by scott 11 Nov '04

11 Nov '04

Anyone using SpamAssassin? Somehow, I'm getting nested entries in the log. WTF? Heres two examples (one per line in the log file, obviously). 2004-11-11T16:39:02+1000 chloe spamd[704]: connection from localhost [127.0.0.1] at port 41701 2004-11-11T16:39:02+1000 chloe qmail-smtpd: 1100151542.380171 tcpserver: end 2373 status 0 and 2004-11-11T16:39:02+1000 chloe spamd[2381]: info: setuid to slittle succeeded 2004-11-11T16:39:02+1000 chloe spamd[2381]: processing message <fb1301c4c7a3$99512e23$b7b0ab10(a)arrakis.es> for slittle:1000. 2004-11-11T16:39:02+1000 chloe spamd[2381]: identified spam (10.4/5.0) for slittle:1000 in 0.2 seconds, 3493 bytes. 2004-11-11T16:39:02+1000 chloe qmail: 1100151542.681701 new msg 12805507 I thought maybe the trailing \n was getting broken somehow, so I tried dumping SQL statements to file, and they're nested too (there's no closing quotes, brackets or semicolon before the next INSERT statement). INSERT INTO logs (host, facility, priority, level, tag, date, program, msg) VALUES ( 'chloe', 'mail', 'info', 'info', '16', unix_timestamp('2004-11-11T16:39:02+1000'), 'spamd', 'spamd[704]: connection from localhost [127.0.0.1] at port 41701 INSERT INTO logs (host, facility, priority, level, tag, date, program, msg) VALUES ( 'chloe', 'mail', 'info', 'info', '16', unix_timestamp('2004-11-11T16:39:02+1000'), 'qmail-smtpd', 'qmail-smtpd: 1100151542.380171 tcpserver: end 2373 status 0'); and INSERT INTO logs (host, facility, priority, level, tag, date, program, msg) VALUES ( 'chloe', 'mail', 'info', 'info', '16', unix_timestamp('2004-11-11T16:39:02+1000'), 'spamd', 'spamd[2381]: info: setuid to slittle succeeded INSERT INTO logs (host, facility, priority, level, tag, date, program, msg) VALUES ( 'chloe', 'mail', 'info', 'info', '16', unix_timestamp('2004-11-11T16:39:02+1000'), 'spamd', 'spamd[2381]: processing message <fb1301c4c7a3$99512e23$b7b0ab10(a)arrakis.es> for slittle:1000. INSERT INTO logs (host, facility, priority, level, tag, date, program, msg) VALUES ( 'chloe', 'mail', 'info', 'info', '16', unix_timestamp('2004-11-11T16:39:02+1000'), 'spamd', 'spamd[2381]: identified spam (10.4/5.0) for slittle:1000 in 0.2 seconds, 3493 bytes. INSERT INTO logs (host, facility, priority, level, tag, date, program, msg) VALUES ( 'chloe', 'mail', 'info', 'info', '16', unix_timestamp('2004-11-11T16:39:02+1000'), 'qmail', 'qmail: 1100151542.681701 new msg 12805507');

1 0

RE: [syslog-ng]problem compiling under sunOS 7
by ARGEXT-HIDALGO, FRANCISCO 10 Nov '04

10 Nov '04

It worked, thank you very much. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Martes, 09 de Noviembre de 2004 01:00 p.m. To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]problem compiling under sunOS 7 Try compiling with GNU as instead of the system supplied one. On Tue, 2004-11-09 at 16:10, ARGEXT-HIDALGO, FRANCISCO wrote: > I have the following compilation error and no clue on what could the problem be. I never had this problem on other systems (Linux). Does anyone know whats the problem? > Thank you. > > Making all in src > make all-recursive > Making all in . > if gcc -DHAVE_CONFIG_H -I. -I/home/fhidalgo/syslog-ng-1.6.5/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -MT main.o -MD -MP -MF ".deps/main.Tpo" \ > -c -o main.o `test -f 'main.c' || echo '/home/fhidalgo/syslog-ng-1.6.5/src/'`main.c; \ > then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ > else rm -f ".deps/main.Tpo"; exit 1; \ > fi > /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1210: error: unknown opcode ".subsection" > /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1210: error: statement syntax > /usr/ccs/bin/as: "/var/tmp/ccACFkjc.s", line 1218: error: unknown opcode ".previous" [snipped] -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

FQDN does not work
by Stephan Hendl 10 Nov '04

10 Nov '04

Hi list, I try to get FQDN in my /var/log/messages but it doesn't work. The option part of my syslog-ng.conf is like: options { sync (0); time_reopen (10); log_fifo_size (10000); long_hostnames (no); use_fqdn (yes); use_dns (yes); dns_cache (yes); create_dirs (yes); keep_hostname (yes); }; Version: syslog-ng-1.6.4 What do I wrong? Thanks! Stephan

1 0

Antw: [syslog-ng]syslog on HP-UX 11
by Stephan Hendl 10 Nov '04

10 Nov '04

Hi, your source-line should be like source s_sys { pipe(/dev/log pad_size(2048)); internal(); }; The pad_size is important (see manual and faq) Stephan >>>Olivia.Leonard(a)davy.ie 11/04 12:13 pm >>> Hi I have set up a central logging server using syslog-ng (on solaris 8) - all the solaris servers, windows servers, and routers are logging to it with no big issues. I want to get a HP-UX box logging to it and it's proving difficult. Initially In installed syslog-ng 1.5.8 from a depot and it sent only a startup message to the central server but none of the other messages such as logins, su and so on. So I tried getting it to log to it using it's own native syslog - it just won't log anything. It resolves loghost and gives no errors on startup/restart but it just doesn't log anything (eventhough my central server listens on UDP 514 and gets messages from routers/switches) Could anyone help me out with this?? Attached are both my syslog.conf and my syslog-ng.conf. Thanks Olivia ********************************************************************************************************************************************************************** /etc/syslog.conf # mail.debug /var/adm/syslog/mail.log #*.info;mail.none /var/adm/syslog/syslog.log #*.alert /dev/console #*.alert root #*.emerg * *.emerg;*.alert;*.crit;*.err;*.warning;*.notice;*.info;*.debug @loghost # *********************************************************************************************************************************************************************** /opt/syslog_ng/etc/syslog-ngsyslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source src {unix-stream(/dev/log); internal(); }; destination everything {file(/home/leonarol/logfile); }; ## set up logging to loghost destination loghost { tcp(172.16.117.170 port(5140)); }; filter f_ssh_login_attempt { program(sshd.*) and match((Failed|Accepted)) and not match(Accepted (hostbased|publickey)); }; filter f_emergency { level(emerg); }; filter f_alert { level(alert); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_warn { level(warn); }; filter f_notice { level(notice); }; filter f_info { level(info); }; log { source(src); filter(f_emergency); destination(everything); }; log { source(src); filter(f_alert); destination(everything); }; log { source(src); filter(f_crit); destination(everything); }; log { source(src); filter(f_err); destination(everything); }; log { source(src); filter(f_warn); destination(everything); }; log { source(src); filter(f_notice); destination(everything); }; log { source(src); filter(f_info); destination(everything); }; log { source(src); filter(f_emergency); destination(loghost); }; log { source(src); filter(f_alert); destination(loghost); }; log { source(src); filter(f_crit); destination(loghost); }; log { source(src); filter(f_err); destination(loghost); }; log { source(src); filter(f_warn); destination(loghost); }; log { source(src); filter(f_notice); destination(loghost); }; log { source(src); filter(f_info); destination(loghost); }; The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, any disclosure, copying, distribution or any other action taken or any views, opinions or advice contained in this e-mail are those of the sending individual and not necessarily those of the firm. It is possible for data transmitted by e-mail to be deliberately or accidentally corrupted or intercepted. For this reason where the communication is by e-mail, J&E Davy does not accept any responsibility for any breach of confidence which may arise from the use of this medium. If you have received this e-mail in error please notify us immediately at mailto:helpdesk@davy.ie and delete this e-mail from your system.

1 0