October 2005 - syslog-ng - lists.balabit.hu

dropping
by Ferenc Wagner 07 Oct '05

07 Oct '05

Hi, Using Debian Sarge I set up a configuration where some 160 machines log by TCP to a single central server. When the machines boot (all at the same time) they obviously put quite some load on the server, which results in lines like Oct 6 20:55:18 bigyo syslog-ng[24969]: STATS: dropped 1303 after the client connected messages. Also there is a constant periodic loss (the clients run synchronised, so cron jobs fire simultaneously) amounting to Oct 7 06:35:27 bigyo syslog-ng[24969]: STATS: dropped 9 Is there a way to overcome this? In average the log traffic is fairly low, but huge bursts do happen as described above. Setting log_fifo_size on the server didn't help much; it logs straight onto disk: [stock Debian Sarge part distributing local logs elided] options { keep_hostname (yes); }; source s_cl { tcp (max_connections (255)); }; destination d_cl { file ("/var/log/cluster/$HOST" template ("$DATE $MSG\n") group ("adm") perm (0640) create_dirs (yes) dir_perm (750)); }; log { source (s_cl); destination (d_cl); }; The clients are configured like this (full file): options { use_dns (no); }; source s_all { internal (); unix-stream ("/dev/log"); file ("/proc/kmsg" log_prefix ("kernel: ")); }; destination bigyo { tcp ("bigyo"); }; log { source (s_all); destination (bigyo); }; Stock Sarge syslog-ng 1.6.5 with Debian patches on all machines. -- Thanks, Feri.

4 3

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 07 Oct '05

07 Oct '05

> The latest snapshot having the fix is always at most 24 hours > later. So > you might want to download the latest snapshot again today and verify > your findings. I don't have time to do it right now but it would be > perfect if you could spare some minutes and try again with the newest > snapshot drop. > > Best regards, > Roberto Nibali, ratz I tried the latest snapshot of syslog-ng, but it fails to compile the initial module. I get: misc.c: In function `get_local_timezone_ofs': misc.c:83: error: structure has no member named `tm_gmtoff' Bottom line... I'm unable to test the facility/level fix because I can't get a clean compilation on the latest version. Sorry. Marvin

3 5

RE: [syslog-ng] - Syslog not logging
by Marvin.Nipper＠Stream.com 07 Oct '05

07 Oct '05

> -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > kevin(a)herald.ca > Sent: Tuesday, October 04, 2005 11:21 AM > To: Syslog-ng users' and developers' mailing list > Subject: [syslog-ng] - Syslog not logging > > However, I see no logging in any of the destination files. Is > there some > type of debugging switch to help determine why the logs are not being > written to? > > Thanks for any help, > > Kevin What version of 1.9.5 are you using? I recently reported a problem with facility/level filtering in the original (July) 1.9.5 version, and that was supposed to be fixed in the latest snapshot. However, I'm having a problem compiling that snapshot on Solaris 8, so I can't test it (but I'd bet it probably will work!). Your configuration appears to look a lot like mine did, with respect to facility/level filtering. It wouldn't surprise me that you might be having exactly the same problem. You might try the latest snapshot to see if it resolves your issue. All, FWLIW..... Marvin

4 4

modifying $host in the distination
by Terry 06 Oct '05

06 Oct '05

Hello, The $HOST variable in cases contains the IP address of the host. This makes perfect sense but I want it to be the hostname. Can I have a mapping of some sorts in the config: 10.10.0.1 == foorouter Thanks!

2 1

Syslog 1.6.8 compile error
by Rohald van Baars 06 Oct '05

06 Oct '05

Hi, can someone please help me to get the compile right. OS: RHEL ES 3 update 4 The ./configure went well no errrors. But the make did not go so well: Error message(s) : >> snip gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afpr gram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv / sr/local/lib/libol.a -lnsl -Wl,-Bstatic -Wl,-Bdynamic cfg-lex.o(.text+0x45f): In function `yylex': /root/rpm/syslog-ng/syslog-ng-1.6.8/src/cfg-lex.c:1123: undefined reference to yywrap' cfg-lex.o(.text+0xb33): In function `input': /root/rpm/syslog-ng/syslog-ng-1.6.8/src/cfg-lex.c:1450: undefined reference to yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/root/rpm/syslog-ng/syslog-ng-1.6.8/src' make: *** [all-recursive] Error 1 << snap Can someone plz explain what went wrong? Rohald van Baars Digitenne B.V. The netherlands WWW: www.digitenne.nl ############################################################################ Attention: The information contained in this message and or attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any system and destroy all copies. ############################################################################

4 3

Re: [syslog-ng] Syslog-ng configuration.
by Adams, Russell L. 06 Oct '05

06 Oct '05

See the syslog-ng FAQ on campin.net, and also: http://www.adamsinfoserv.com/central_syslog.pdf Russell On Fri, Oct 07, 2005 at 12:28:47AM +0530, Krishnakumar Menon wrote: > > > > > Hi , > > I am new to this group. Just recently felt a need to centralize all my > /var/adm/messages for my 12 different machines. > > The job is I have 12 Solaris machines. > > I want to make one server as central syslog server. The rest 12 servers > will send their messages file to this central syslog server where the > activities will be logged. > > Few queries. > > a. How will syslog-ng will help me to achieve this? > b. Which is the latest software and patch to be downloaded ? > c. What activities i.e. installation/configuration needs to be done > at Server side and client side ? > d. How to monitor and administer these files. i.e. is their any > GUI's or CLI's in place ? > > > > Thanks and regards > > Krishna > > > > > > **************** CAUTION - Disclaimer ***************** > This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended > solely for the use of the addressee(s). If you are not the intended > recipient, please notify the sender by e-mail and delete the original > message. Further, you are not to copy, disclose, or distribute this > e-mail or its contents to any other person and any such actions are > unlawful. This e-mail may contain viruses. Infosys has taken every > reasonable precaution to minimize this risk, but is not liable for any > damage you may sustain as a result of any virus in this e-mail. You > should carry out your own virus checks before opening the e-mail or > attachment. Infosys reserves the right to monitor and review the content > of all messages sent to or from this e-mail address. Messages sent to or > from this e-mail address may be stored on the Infosys e-mail system. > ***INFOSYS******** End of Disclaimer ********INFOSYS*** > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >

1 0

Syslog-ng configuration.
by Krishnakumar Menon 06 Oct '05

06 Oct '05

Hi , I am new to this group. Just recently felt a need to centralize all my /var/adm/messages for my 12 different machines. The job is I have 12 Solaris machines. I want to make one server as central syslog server. The rest 12 servers will send their messages file to this central syslog server where the activities will be logged. Few queries. a. How will syslog-ng will help me to achieve this? b. Which is the latest software and patch to be downloaded ? c. What activities i.e. installation/configuration needs to be done at Server side and client side ? d. How to monitor and administer these files. i.e. is their any GUI's or CLI's in place ? Thanks and regards Krishna **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS***

1 0

syslog-ng on AIX 5.3
by Michael Mannsberger 06 Oct '05

06 Oct '05

Does not log at all. Anybody got this working on AIX?

2 1

RE: [syslog-ng] Bugreport: Ver 1.9.5 problems with facility/level filtering
by Marvin.Nipper＠Stream.com 06 Oct '05

06 Oct '05

> I've added a simple configure check on tm_gmtoff and if it does not > exist I fall back to the global "timezone" variable. > > It should be available in the yesterday's snapshot. > > -- > Bazsi THANKS so much. Really appreciated!

1 0

RE: [syslog-ng] Centralize different kind of logs ...
by Marvin.Nipper＠Stream.com 06 Oct '05

06 Oct '05

> -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of > CIKALA Frederic ROSI/DOSI > Sent: Thursday, October 06, 2005 2:27 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Centralize different kind of logs ... > > Hello, i haven't received my second mail for this ML, so i re send it > > I'm wondering if i'll use syslog-ng in order to centralize a > lot of logs that are from different kind of machines. > > Actually i've to centralize logs that are from Active > Directory, Exchange .... > > For example, those others machines have UNIX, Solaris, > Windows and VMS for OS ... > > In fact, i don't know if it exists a tool that can do this > thing for my several servers ... > > Thanks for help :) Take a look at SNARE. You can find it here: http://www.intersectalliance.com/projects/index.html It's a good way to get Windows Event Logs fed upstream to syslog-ng.

1 0