September 2004 - syslog-ng - lists.balabit.hu

Message retension period
by Jim Mozley 20 Sep '04

20 Sep '04

I have a remote server running syslog-ng collecting messages from network devices that are local to it and transferring them to a central server using TCP. This is to avoid messages being lost when UDP is used a a network problem occurs. All works as it should and I have tested breaking the link between the local collection station and the central server; the messages are passed to the central server when the link is restored. I had a question regarding how long the remote server will hold on to the messages when it cannot pass them to the central server. Is this a time dependent parameter, memory limit or hard coded somewhere? I couldn't find a destination driver configuration parameter for this in the documentation. Jim Mozley

2 9

Problem on Solaris with door?
by jesse.keefe＠convergys.com 19 Sep '04

19 Sep '04

Hello, On Solaris 8 and Solaris 9, I have problems with syslog-ng mysteriously dying because of door problems. This setup has worked well for over a year and is cropping up randomly. The symptom is su - hangs. I can shut syslog-ng down and start syslog and everything is fine. I've tried bringing a syslog-ng daemon and conf file from a working server over and the problem still exists. Any help would be appreciated!! Thanks, Jesse Keefe Sr Analyst, Open Systems Convergys Corp 513-723-3689 -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

3 2

Core Dump issue on FreeBSD 4.10-STABLE
by Emre Bastuz 18 Sep '04

18 Sep '04

Hi, on https://lists.balabit.hu/pipermail/syslog-ng/2004-September/ I saw that some people (Loic Minier, Michihito Matsubara and Mike Williams) already had discussed the core dump issue on FreeBSD 4.10-STABLE. Apparently they have the same problem that I have desribed in https://lists.balabit.hu/pipermail/syslog-ng/2004-September/006444.html. I was just wondering if there has been any progress? Any fixes in sight? Regards, Emre -- http://www.emre.de UIN: 561260 PGP Key ID: 0xAFAC77FD I don't see why some people even HAVE cars. -- Calvin

3 4

Logging to program destinations has odd prefix?
by Lars Kellogg-Stedman 17 Sep '04

17 Sep '04

Hello, Text logged to a program via the program() destination has a prefix of the form <nnn>, which I'm assuming is the encoding of the syslog level and facility. Great! But I don't want it :). Is there any way to prevent this text from being logged? Sure, I can write a "wrapper" program to edit these messages before they reach the intended destination, but my template doesn't ask for this information, so I'm not sure it should be there. -- Lars -- Lars Kellogg-Stedman <lars(a)oddbit.com>

2 1

Re: [syslog-ng]Message retension period
by Jim Mozley 16 Sep '04

16 Sep '04

Todd Glassey @ Att.Net wrote: > If you are looking for a legal answer then under SOX and other global > legislation there are formal retension periods of as much as seven > years. While that wasnt quite what you asked, any company or entity > would need some kind of log management process under ISO17799/ITIL/ and > COBIT standards that assures that *no* information is lost in the > logging process - that means what it means - if your logging systems are > separate and not auditable - then you may have to provide log management > for the whole period. > > > > That means simply that the remote server needs to hold onto the logs for > whatever the periodicity of your log maintanence process/program is. Thanks for that, they are being stored locally on the remote server too. It was a purely technical question about passing messages between syslog-ng servers. Jim Mozley

1 0

Message queueing
by mailing lists 16 Sep '04

16 Sep '04

This is in regards to the method in which syslog-ng queues and writes messages to disk. The way I understand it, syslog-ng accepts syslog messages on UDP port 514, determines what action to take, then writes each line separately to its determined place. Even if the queueing option is set, syslog-ng will still write the messages one at a time into their respective files. If this is a correct (albeit slim) understanding of syslog-ng's workings, I ask the following questions: Why is this the case? Is it possible to alter syslog-ng to queue multiple lines and write them together in a single write to speed up the IO process? The reason I am asking this question is that our syslog-ng instance will often receive thousands of requests per second, and I believe it is the disk IO that is causing the loss of data. The machines are powerful enough (dual 2.8Ghz processors, though I understand syslog-ng is not multi threading), with plenty of memory (2GB) and storage space (500GB). Any insight into this issue would be greatly appreciated. Thanks, Bill

1 0

Startup / Re-read config file
by Dave Johnson 16 Sep '04

16 Sep '04

Configuring a named pipe in syslog-ng and without the named-pipe-file being there causes syslog-ng to not start up. Why not error and continue? And when logs are rotated (kill -hup), check again?

2 1

]RE: [syslog-ng]Log formatting] - syslog-ng $MSG formatting
by Robert.COward＠deploymenthealth.osd.mil 16 Sep '04

16 Sep '04

Loïc, Thanks for the response. I wonder if there is a way I could strip it out, a wrapper perhaps. --- 13 September 2004 "You cannot show real respect to your parents by perpetuating their errors.... Do you consider that the inventor of a steel plow cast a slur upon his father who scratched the ground with a wooden one? I do not consider that an invention by the son is a slander upon the father; I regard each invention simply as an improvement; and every father should be exceedingly proud of an ingenious son. If Mr. Talmage has a son, it will be impossible for him to honor his father except by differing with him." (Robert Green Ingersoll, 1833-1899) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

2 1

logging source: netlink socket ?
by Horváth Ákos 16 Sep '04

16 Sep '04

I am a new syslog-ng user and am very happy with it. But last I found the first thing which I wanted to do and was not able :) Could be possible to log the iptables ULOG target... with that packet filter logging without trashing dmesg could be done. And it had probably many other applications, too :) I did not found anything with netlink sockets in the 1.6.4 source. My primary goal was to know if I missed something? thanks, MaXX

2 1

Re: Log formatting - Solution
by Robert.COward＠deploymenthealth.osd.mil 14 Sep '04

14 Sep '04

Thanks for the response Nick and Loic. I managed to solve my problem. I upgraded to 1.6.5 w/ libol 0.3.14. This allowed me to use the $MSGONLY tag. Works perfectly. Thanks again. --- 14 September 2004 "This is all very interesting, and I daresay you already see me frothing at the mouth in a fit; but no, I am not; I am just winking happy thoughts into a little tiddle cup." (Nabokov, Lolita) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

1 0