June 2004 - syslog-ng - lists.balabit.hu

dest. tcp and dest. pipe on HPUX
by Stephan Hendl 26 Jun '04

26 Jun '04

Hi, I use the syslog-ng-1.6.0rc4 on HPUX 11 and try to send the syslog data to a tcp-destination (is a ssh tunnel to a central syslog-server) as well as to a pipe. Unfortunately the syslog-ng creates the pipe but logs only to the tcp destination and _not_ to the pipe as well. Do you have any ideas? Stephan -------------------------------- # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (20000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; source s_pns1_tcp { tcp(ip(194.76.232.136) port(10514) max-connections(20)); }; destination d_syslog_tcp { tcp("localhost" port(10514)); }; destination d_cic { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template( "$DATE $HOST $PRIORITY [$FACILITY] $MESSAGE\n") template-escape(yes)); }; destination d_syslog { file("/var/adm/syslog/syslog.log" owner("root") group("sys") perm(0644)); }; destination d_console { file("/dev/console"); }; destination d_root { usertty("root"); }; destination d_all { usertty("*"); }; destination d_auth { file("/var/adm/syslog/auth"); }; destination d_user { file("/var/adm/syslog/user/log.$YEAR$MONTH$DAY"); }; destination d_mailerr { file("/var/adm/syslog/mailerr/log.$YEAR$MONTH$DAY"); }; destination d_mail { file("/var/adm/syslog/mail/log.$YEAR$MONTH$DAY" owner("root") group("mailadm") perm(0440)); }; filter f_syslog { not facility(mail); }; filter f_auth { (not facility(mail) and level(alert)) or (facility(auth) and level(warning)); }; filter f_filter1 { not facility(mail) and level(alert); }; filter f_filter2 { level(emerg); }; filter f_filter3 { facility(user) and level(info); }; filter f_mailerr { facility(mail) and not level(info); }; filter f_mail { facility(mail); }; log { source(s_pns1_tcp); destination(d_syslog_tcp); }; log { source(s_sys); destination(d_syslog_tcp); }; log { source(s_pns1_tcp); destination(d_cic); }; log { source(s_sys); destination(d_cic); }; log { source(s_sys); filter(f_syslog); destination(d_syslog); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_filter1); destination(d_console); destination(d_root); }; log { source(s_sys); filter(f_filter2); destination(d_all); }; log { source(s_sys); filter(f_filter3); destination(d_user); }; log { source(s_sys); filter(f_mailerr); destination(d_mailerr); }; log { source(s_sys); filter(f_mail); destination(d_mail); };

2 1

Disk error handled properly?
by John Feeney 25 Jun '04

25 Jun '04

Hello, I am running syslog-ng (1.4.17) on Linux (2.4.21) and received an error when the disk partition became full. Looking at the code, it does not look as though the error was handled very well. After the error, syslog-ng started to take up 26% of my CPU time and was unresponsive to other logged messages to the file that was being written to when the error occurred (even though the room was made in the partition). The specifics are: Received this error - Jun 25 13:16:57 port1-1 syslog-ng[147]: io.c: do_write: write() failed (errno 28), No space left on device So, do_write() correctly identifies the error and puts out a nice message that the disk is full. int res = write(self->fd, data, length); if(res < 0) { switch(errno) { case EINTR: case EWOULDBLOCK: return 0; default: werror( "io.c: do_write: write() failed (errno %i), %z\n"); } ... return(res); } The only place I can see where do_write is called is write_callback() where I would have liked to have seen a "if(w < -1) do_something" but the value of w is just sent in as an argument to BUF_FLUSH(). static void write_callback(struct nonblocking_fd *fd) { CAST(io_fd, self, fd); int res; struct fd_write w = {{ STACK_HEADER, do_write), fd->fd, self->fsync }; assert(self->buffer); res = BUF_FLUSH(self->buffer, &w.super); So, if w is an error (-1), what is &w.super equal to? Something not good. Maybe I have this wrong. Maybe there is another place where do_write() is called. Regardless, the value of w is not being checked so what is the proper course of action if w is -1? Note: my syslog-ng is running on an embedded system that does not have much flash memory to store these logs. The system has a process that truncates the log files when they exceed specific limits, but the granularity of the file size checking can mean that one or more processes can exceed their limit(s) and cause the disk to be full before the checker process wakes up and does the cleanup, as happened in this case. Thanks. John Feeney -------------------------------------------------------- This email message and any files transmitted with it contain confidential information intended only for the person(s) to whom this email message is addressed. If you have received this email message in error, please notify the sender immediately by telephone or email and destroy the original message without making a copy. Thank you.

1 0

RE: [syslog-ng]losing messages during a HUP
by Rule, Ted 25 Jun '04

25 Jun '04

I know I've mentioned it before on the list, but I too would dearly like a separate signal for log rotation purposes to help with any potential data loss. Note that the signal doesn't actually have to close and open destinations - it only really has to close all of them, as the next bit of traffic routed to any given destination should presumably re-open it anyway. Avoiding the need to re-open should make the coding simpler. Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

losing messages during a HUP
by Nick Williams 25 Jun '04

25 Jun '04

Folks, I'd like to report a couple of bugs with syslog-ng whereby there is a window (albeit small) during which messages will just be lost. The problem occurs when a HUP signal is sent to the daemon in order to perform a logrotate. During this time, the daemon re-checks its config file. Before doing that, it closes the old incoming connections. After completing the re-read, it will reconnect up the inputs (typically to the same endpoints, since they hardly ever change, if at all). For the FIFO /dev/log, it not only closes it but it apparently unlinks it as well. Theoretically, life is fine because the clients detect the closed socket and the clients themselves issue retries. All to the good. However, that's not all. On linux (where we're seeing the problem, I don't know if it happens elsewhere), if there is no-one reading from the FIFO then the client gets the error ECONNREFUSED and the libc syslog implementation happily realises what's going on and just retries. But when /dev/log is unlinked and the clients try and connect, they get a different error back - EPROTOCOL. This causes the clients to assume that a FIFO can't be used and fallback to 'lesser' protocols like udp, etc, never to go back up the fallback list to a better protocol. That's an efficiency concern, but at least messages don't get lost. More importantly, messages can get lost between the last read from the FIFO, and between the close() of the FIFO. This may sound unlikely, but we are definitely seeing lost messages at this time (we're logging a very high volume of messages). I can see two possible solutions, maybe there are more: 1. provide an additional signal for logrotate use which only closes and re-opens the logfiles, but doesn't do anything with the configfile. 2. make the re-read of the configfile more clever and only close inputs if really neccessary. Nick.

1 1

Syslog to oracle
by Marc Brown 23 Jun '04

23 Jun '04

Hi , can we have syslog messages logged to oracle database . If so , please send me some info and references on that. - marc __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - Send 10MB messages! http://promotions.yahoo.com/new_mail

2 1

BalaBit exhibits at LinuxTag
by Balazs Scheidler 20 Jun '04

20 Jun '04

Hi, This a quick note to let you know that BalaBit is going to have a small booth at LinuxTag. This year LinuxTag takes place in Karlsruhe, Germany 23-26th June, e.g. it starts next Tuesday. Our booth will be part of GUUG's commercial booth at Stand A82. You can find me there personally, so feel free to drop in and have a chat about syslog-ng's future directions. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Michael J. Bock/NetServ/DST/US is out of the office.
by MJBock＠dstsystems.com 18 Jun '04

18 Jun '04

I will be out of the office starting 06/18/2004 and will not return until 06/28/2004. I will respond to your message when I return.

1 0

log format
by Paul Gamble - MWEB 18 Jun '04

18 Jun '04

I'm a syslog-ng newbie and so am hoping that this is not too much of a FAQ. A nod of thanks to the syslog-ng developers for syslog-ng btw! I need to write a unix-socket-based destination server that will accept data from syslog-ng. Hence, I'm trying to find a documented definition of syslog-ng's log records as my server would receive them. Can anyone provide a pointer or two as I cannot find this in the docs? I have a test server that receives records of the following form: <22><standard syslog log<22><another standard syslog record>, etc, etc What is the meaning of <22>? Can I rely on this as a record separator? Many thanks, Paul MWEB: S.A.'s most trusted and reliable Internet Service Provider. Just Like That. To join, go to: http://join.mweb.co.za or call 0860032000.

2 1

filter problem
by bugtraq 18 Jun '04

18 Jun '04

Hi all. I have some network devices witch syslog function from example 1. 192.168.0.1 2. 192.168.0.10 I create syslog config and define this filter's ---------------------------------------------------------------------------- ------------------------------------- source s_network { udp ( ip (0.0.0.0) port (514) ); }; filter cisco_1 { host ("192.168.0.1"); }; filter at-rpg6_1 { host ("192.168.0.10"); }; destination cisco_1 { file ( /usr/local/syslog-ng/log/cisco.log ); }; destination d_file_6 { file ( /usr/local/syslog-ng/log/at-rpg6.log ); }; log { source ( s_network ); filter ( cisco_1 ); destination ( cisco_1); }; log { source ( s_network ); filter ( at-rpg6_1 ); destination ( d_file_6 ); }; ---------------------------------------------------------------------------- --------------------------------------- In this config I have some mistake, messages send from 192.168.0.10 stored into /usr/local/syslog-ng/log/at-rpg6.log And it also stored /usr/local/syslog-ng/log/cisco.log What's wrong ? forgive me for bad english WBR swop.

2 2

ZyXEL IES-3000 Chassis - DSLAM
by Emil Valsson 16 Jun '04

16 Jun '04

Anyone know if I can log from this ZyXEL? He supports from Local1 thru 7 UNIX logging. If yes, how would the config file for syslog-ng look like? Thanks!

1 0