May 2004 - syslog-ng - lists.balabit.hu

Problem with 1.6.2 on Solaris 8 - lwp_sema_wait(0xFEF0DE60)
by Wyner, Peter 14 May '04

14 May '04

All, I am running into an issue on a previously working syslog_ng 1.6.2 server. There were no configuration changes between when it worked and now (when it doesn't). The syslog sever will process a large number of packets for a period of time and then suddenly the processor utilization goes down to zero, files stop being written, and truss shows: door_call(6, 0xFFBED340) (sleeping...) signotifywait() (sleeping...) lwp_sema_wait(0xFEF0DE60) (sleeping...) I am collecting syslog on a high udp port: # # Syslog-ng example configuration file for Solaris # # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.solaris,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Solaris 2.5.1 and below uses the STREAMS driver, above extends it # with doors. For 2.5.1 remove the door() option from the source declaration. # options { log_fifo_size(1024); sync(0); dns_cache(yes); dns_cache_expire(60); use_dns(yes); chain_hostnames(no); keep_hostname(no); }; source local { sun-streams("/dev/log"); internal(); }; source std_udp { udp( port(52001) ); }; destination all { file("/var/log/messages"); }; destination dst1 { file("/syslog/dst1/current/$HOST" dir_perm(0755) perm(0644)); }; log { source(local); destination(all); }; log { source(std_udp); destination(dst1); }; Any ideas? Thanks, Peter

2 1

cisco host not being resolved
by Badat, Qassim, ALABS 14 May '04

14 May '04

Hi, I am new to syslog-ng so excuse my ignorance. I have installed syslog-ng 1.6.2 on Solaris 8. I am getting the logs but the host names are not being resolved. . Strangely logs from another vendor's does have the names resolved by syslog-ng. Any idea whats causing the problem for cisco ? My syslog-ng.conf file: options { long_hostnames(off); sync(0); }; source sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source net { udp(); }; destination network { file("/var/log/syslog-ng"); }; log { source(net); destination(network); }; log { source(sys); destination(network); }; Regards, QB

1 0

syslog-ng 1.6.4
by Balazs Scheidler 14 May '04

14 May '04

Hi, After the embarassing Solaris related problem in 1.6.3, I'm releasing 1.6.4 which fixes that issue, otherwise nothing else changed. It is being uploaded to our website and should be available tomorrow at the latest. Here's the NEWS file: News for the 1.6.4 release Fri, 14 May 2004 16:42:25 +0200 * fixed a STREAMS handling bug introduced by the IRIX compatibility patches integrated in 1.6.3 -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 14 May '04

14 May '04

Yes, patch is working well. Dmitri -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, May 14, 2004 3:13 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message Does this mean that the patch works well?

1 0

Syslog-ng will not configure properly on vanilla Red Hat
by Keg 14 May '04

14 May '04

syslog-ng needs the libol library, which I compiled and installed to it's default location, /usr/local/lib. When configuring syslog-ng I get this error: <snip> checking for strptime... yes checking for TCP wrapper library... -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.13... no configure: error: Required libol version not found Here is the library: syslog:/usr/local/lib #ls -la total 124 drwxr-xr-x 2 root root 4096 May 13 06:45 . drwxr-xr-x 23 root root 4096 Jan 10 10:55 .. -rw-r--r-- 1 root root 51408 May 13 06:45 libol.a -rwxr-xr-x 1 root root 698 May 13 06:45 libol.la lrwxrwxrwx 1 root root 14 May 13 06:45 libol.so -> libol.so.0.0.0 lrwxrwxrwx 1 root root 14 May 13 06:45 libol.so.0 -> libol.so.0.0.0 -rwxr-xr-x 1 root root 50799 May 13 06:45 libol.so.0.0.0 I added /usr/local/lib to /etc/ld.so.conf and ran ldconfig. (even rebooted as well) This did not work. I added /usr/local/lib to LD_LIBRARY_PATH, this did not work. I tried configuring with --with-libol=/usr/local and got same error. I tried configuring with --with-libol=/usr/local/lib and got same error. I tried configuring with --with-libol=/usr/local, however, this time I get this error: checking for TCP wrapper library... -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.13... configure: error: libol-config not found in the specified location libol-config is in /usr/local/bin: syslog:/usr/local/src/Syslog-Ng/syslog-ng-1.6.3 #ls -l /usr/local/bin/ -rwxr-xr-x 1 root root 1298 May 13 06:45 libol-config I have followed every doc as instructed. This is a vanilla RH 9 system with all updates. Thx for any help. cc

4 7

RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 14 May '04

14 May '04

Thank you, The patch fixed the problem with an error message about STREAMS. Dmitri -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, May 13, 2004 4:32 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Problem with 1.6.3 on Solaris. Message Can you test if this patch fixes it? For me it seems to work. diff -u -r1.16.4.1 afstreams.c --- src/afstreams.c 10 Mar 2004 18:43:28 -0000 1.16.4.1 +++ src/afstreams.c 13 May 2004 11:31:10 -0000 @@ -175,6 +175,7 @@ struct nonblocking_fd *io_stream_get(struct io_backend *backend, int fd, UINT8 *hostname_re, + UINT32 max_log_line, struct log_handler *pipe) { NEW(stream_fd, f); @@ -184,6 +185,7 @@ f->super.read = stream_read_callback; f->super.want_read = 1; f->pipe = pipe; + f->max_log_line = max_log_line; if (hostname_re == NULL) regcomp(&f->bad_hostname, "^$", REG_NOSUB | REG_EXTENDED); else @@ -239,7 +241,7 @@ close(fd); return ST_FAIL | ST_QUIT; } - self->stream_fd = io_stream_get(cfg->backend, fd, cfg->bad_hostname, c); + self->stream_fd = io_stream_get(cfg->backend, fd, + cfg->bad_hostname, cfg->log_msg_size, c); REMEMBER_RESOURCE(cfg->resources, &self->stream_fd->super); -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

Re: [syslog-ng]Syslog-ng will not configure properly on vanilla Red Hat
by Chris Paalman 13 May '04

13 May '04

If you look more carefully on the website you will notice that the files are sorted by filename and not by date. Thus you will find what you are looking for in the middle of the list. Chris Paalman >Reply-To: syslog-ng(a)lists.balabit.hu > > >I just realized it is looking for libol > 0.3.13, but the latest on the >site is 0.3.9 which it says to use with syslog-ng 1.6.3. > >Where can I get this newer version of libol???? >??

1 0

RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 13 May '04

13 May '04

Sorry for confusion - may be the solution will help someone in future as well. The problem I had was related to reverse lookups - I didn't have few zones registered in DNS and reverse lookup was taking 1-2 minutes.. During that time syslog-ng was dropping messages.. I guess it will be nice to isolate lookup function from messages processing if possible.. Thank you for your help and for really nice product! Sorry for confusion - 1.6.3 is working just fine! Dmitri -----Original Message----- From: Dmitri Smirnov Sent: Thursday, May 13, 2004 11:13 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message Tried to increase UDP udp_max_buf to 524288 (from 262144) - doesn't help. STATS reports 0 lost messages... ;( Plus 1.6.3 hangs for me after 200-300 messages (3-5 minutes)... 1.6.1 doesn't hang but losing messages :( Dmitri -----Original Message----- > > Another problem with syslog-ng in general (1.6.1 or later) - we're > started to lose about 10% of syslog messages. > The config file is not too big and messages do arrive on server for > sure (confirmed with snoop) but every few minutes syslog-ng is losing > some of them. Any recommendation on tuning or troubleshooting? if the packet arrives to the log host but syslog-ng does not receive it (e.g. your STATS line shows 0 dropped messages), it is possible that the UDP receive buffer is too small. try increasing the UDP receive buffer, it should be possible with some OS dependant tools (ndd comes to mind on Solaris)

1 0

RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 13 May '04

13 May '04

Tried to increase UDP udp_max_buf to 524288 (from 262144) - doesn't help. STATS reports 0 lost messages... ;( Plus 1.6.3 hangs for me after 200-300 messages (3-5 minutes)... 1.6.1 doesn't hang but losing messages :( Dmitri -----Original Message----- > > Another problem with syslog-ng in general (1.6.1 or later) - we're > started to lose about 10% of syslog messages. > The config file is not too big and messages do arrive on server for > sure (confirmed with snoop) but every few minutes syslog-ng is losing > some of them. Any recommendation on tuning or troubleshooting? if the packet arrives to the log host but syslog-ng does not receive it (e.g. your STATS line shows 0 dropped messages), it is possible that the UDP receive buffer is too small. try increasing the UDP receive buffer, it should be possible with some OS dependant tools (ndd comes to mind on Solaris)

1 0

Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 13 May '04

13 May '04

Looks like version 1.6.3 is not working well on Solaris 8. Few minutes after the start it generates hundreds of messages like: syslog.err syslog-ng[27013]: do_stream_read: STREAMS device gave too long line I think it is the result of changes related to HP-UX and pad_size (from 10k to 256 bytes ?) Another problem with syslog-ng in general (1.6.1 or later) - we're started to lose about 10% of syslog messages. The config file is not too big and messages do arrive on server for sure (confirmed with snoop) but every few minutes syslog-ng is losing some of them. Any recommendation on tuning or troubleshooting? Dmitri

2 2