April 2004 - syslog-ng - lists.balabit.hu

Re: [syslog-ng]maximum config file size
by Scooter T 05 Apr '04

05 Apr '04

There are 272 log statements in the "large" config file, 243 in the pared down version. What's the magic number? 256? 2004-03-31, sze keltezéssel 21:13-kor Scooter T ezt írta: > Has anyone encountered any problems with a fairly large syslog-ng.conf > file? I am seeing substantial UDP packet loss with a file that is > roughly 1300 lines (about 70k). If I pare it down to around 1200 > lines (about 60k), all is well. Is this a known limitation? the log routing might be the culprit here, do you have many log statements in your file? can you reduce those? -- Bazsi --------------------------------- Do you Yahoo!? Yahoo! Small Business $15K Web Design Giveaway - Enter today

2 1

Could offline-mode be done with TCP option?
by Jason Haar 05 Apr '04

05 Apr '04

Hi there We're running a multi-country network of syslog-ng with centralized logging (via TCP). However, due to the possibility of network failure, I am not willing to rely on the central server for triggering alerts - so we do that on the actual leaf syslog servers instead. However, it would be much better if we could actually centralize our alerting system (due to what we are alerting about). So I was wondering if syslog-ng's TCP transport layer could be turned into something like MySQL's master-slave mode: write to a cache file first, then write to remote server, and if that succeeds, remove from cache file. That way if a network outage occurred, the cache file would just get larger and larger, then when the network came up again, it would flow through without any records being lost. [I know the fifo option allows this in RAM - I guess all that I'm wondering about is could that be done on disk instead?. A cache file would survive restarts/etc.] -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

2 1

Re: [syslog-ng] SIGHUP
by Mitja Marondini 05 Apr '04

05 Apr '04

Balasz, thank you for your help. Now it works! Mitja 2004-04-02, p keltezéssel 17:33-kor Balazs Scheidler ezt írta: > 2004-04-02, p keltezéssel 13:30-kor Mitja Marondini ezt írta: > can you paste your configuration file? you seem to have two sources with > the same name, probably you have two unix domain socket sources > (unix-stream and unix-dgram) I mean you seem to have two unix-domain sources referring to the same socket. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

SIGHUP
by Mitja Marondini 02 Apr '04

02 Apr '04

Hi, syslog-ng aborts after receiving SIGHUP. <---- SIGHUP received, restarting syslog-ng Marking fd 3 for closing. Marking fd 4 for closing. Marking fd 5 for closing. Marking fd 6 for closing. syslog-ng: cfgfile.c:166: add_persistent_info: Assertion `!p' failed. Aborted ----> I have Red Hat 7.3 with libol-0.3.13-1 and syslog-ng-1.6.2-1. Thank you for help in advance! Mitja

2 2

fallback with override?
by Mike Nerone 01 Apr '04

01 Apr '04

I want to do something very simple that should be easily configurable, but I can't figure out how to do it. Here's a greatly simplified example that illustrates my need: I want to log specific filters to specific destinations, with a fallback to catch anything non-specific, but ALSO to to log *everything* to the console (I would not do thise in practice, of course, but it should be doable). My first obvious thought was to use this (again, this is very simplified - I don't want anyone to think this would be my real syslog config - that would be embarrassing :D): log { source(src); filter(cron); destination(cron); }; # Catch cron stuff log { source(src); destination(messages); flags(fallback); }; # Everything else log { source(src); destination(console); }; # But no matter what, *everything* to console I assumed that the "fallback" would log anything not caught by a *previous* non-fallback log statement (the fact that the 'final' flag exists suggested to me that ordering was observed), but that does not appear to be the case. Everything does indeed get logged to the console with that config, but the fallback log gets *nothing* (ostensibly because all messages are caught by the console log statement). Can anyone think of a way to do this (I'm probably missing the obvious here)? Or perhaps the fallback algorithm could/should be modified to observe ordering (i.e. ignore log statements that appear after the fallback log statement in the config)? Mike Nerone /* The only secure computer is one that is unplugged from the network -- and the wall. */ <Activism>Did you know that our brilliant legislators recently (and quietly) legalized spam? The law now says that anyone who wants to *can* spam with no fear of punishment. They even named the law the "CAN SPAM" Act. Read about it at http://www.cauce.org/news/index.shtml, then talk about it with your congressman.</Activism>

1 0

Installation Help.
by Chaitanya 01 Apr '04

01 Apr '04

Hi, I was trying to install Syslogd on Redhat Linux 9, for which i am not sure of its compatibilty. I installed the following packages successfully. a. Libol, b. Stunnel. c. Logsentry. But when i couldnot able to install syslog-ng. Is syslog-ng compatible with Red hat linux. Does anybody know the development website for syslog-ng. Thanks a lot. With Regards! Chaitanya.

2 1

remote log server
by Rick S. 01 Apr '04

01 Apr '04

What do I need to put in the .conf file to have the logs sent over the net work to another machine? Rick S.

1 0

maximum config file size
by Scooter T 01 Apr '04

01 Apr '04

Has anyone encountered any problems with a fairly large syslog-ng.conf file? I am seeing substantial UDP packet loss with a file that is roughly 1300 lines (about 70k). If I pare it down to around 1200 lines (about 60k), all is well. Is this a known limitation? --------------------------------- Do you Yahoo!? Yahoo! Finance Tax Center - File online. File on time.

2 1