February 2005 - syslog-ng - lists.balabit.hu

snapshots now working
by Balazs Scheidler 29 Mar '05

29 Mar '05

hi, As of today I've disabled snapshot generation because of some internal changes of our web service. It will be restored soon. (you can remind me if it does not work in about a week) -- Bazsi

3 3

Syslog-NG 1.6.6 memory leak when sending UDP logs
by henry＠shoelacecity.com 04 Mar '05

04 Mar '05

I'm running 1.6.6 on Linux Redhat ES 3.0 logging Cisco router logs to local files and it's been running just fine for over a week. I just enabled forwarding for local4 and local7 (with spoof UDP) to 2 additional hosts via UDP and noticed, within a day, that it syslog-NG has consumed all available memory. It continues to log, however, the system starts killing processes off unless I restart syslog-ng. I checked the list, it seems like the closest similar problem I could find was back in 2000. Any advice for fixing/identifying the problem?

4 18

Fedora Core configuration files
by José Pedro Oliveira 04 Mar '05

04 Mar '05

Balazs, Could you add the four attached files to the contrib directory? They will be needed by the new specfile. Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 10 Aug 2002 # - for Red Hat 7.3 # - totally do away with klogd # - add message "kernel:" as is done with klogd. # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # # Updated by Jose Pedro Oliveira (<jpo at di.uminho.pt>) - 05 Apr 2003 # - corrected filters 'f_filter2' and 'f_filter6' # these filters were only allowing messages of one specific # priority level; they should be allowing messages from that # priority and upper levels. # # Updated by Jose Pedro Oliveira (<jpo at di.uminho.pt>) - 25 Jan 2005 # - Don't sync the d_mail destination # # Updated by Jose Pedro Oliveira (<jpo at di.uminho.pt>) - 01 Feb 2005 # - /proc/kmsg is a file not a pipe. # (https://lists.balabit.hu/pipermail/syslog-ng/2005-February/006963.html) # options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; #filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; #!/bin/sh # # syslog-ng This starts and stops syslog-ng # # chkconfig: 2345 12 88 # description: reads and logs messages to the system console, log \ # files, other machines and/or users as specified by \ # its configuration file. # processname: /sbin/syslog-ng # config: /etc/syslog-ng/syslog-ng.conf # config: /etc/sysconfig/syslog-ng # pidfile: /var/run/syslog-ng.pid # ### BEGIN INIT INFO # Provides: $syslog ### END INIT INFO # Source function library. . /etc/rc.d/init.d/functions exec="/sbin/syslog-ng" prog=$(basename $exec) [ -f $exec ] || exit 0 # Source config [ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog lockfile=/var/lock/subsys/$prog umask 077 start() { echo -n $"Starting $prog: " daemon $exec $SYSLOGNG_OPTIONS retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval } stop() { echo -n $"Stopping $prog: " killproc $prog retval=$? echo [ $retval -eq 0 ] && rm -f $lockfile return $retval } restart() { stop start } reload() { echo -n $"Reloading syslog-ng.conf file: " killproc $prog -HUP retval=$? echo return $retval } force_reload() { restart } fdr_status() { status $prog } case "$1" in start|stop|restart|reload) $1 ;; force-reload) force_reload ;; status) fdr_status ;; condrestart|try-restart) [ ! -f $lockfile ] || restart ;; *) echo $"Usage: $0 {start|stop|status|restart|try-restart|reload|force-reload}" exit 2 esac /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron { sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } #--- # Syslog-ng command line options # See syslog-ng(8) for more details #--- SYSLOGNG_OPTIONS=""

2 1

central log server not working
by Ed Davison 04 Mar '05

04 Mar '05

I am trying to setup a central log host and am having trouble getting events registered on the central server. It looks like the remote host does register with the central host but nothing shows in a log anywhere for it. I really need another set of eyes on this as I cannot figure this out for the life of me and I need to get this going. Here is the excerpt from /var/log/messages (cleaned on the ip numbers): --------8<--------8<--------8<-------- Feb 18 14:19:45 sec5 syslog-ng[27866]: syslog-ng version 1.6.5 starting Feb 18 14:19:45 sec5 syslog-ng[27866]: Changing permissions on special file /dev/tty12 Feb 18 14:24:00 sec5 syslog-ng[27866]: AF_INET client connected from 1.2.3.4, port 50378 --------8<--------8<--------8<-------- Here is the central loghost config file: --------8<--------8<--------8<-------- options { long_hostnames(off); sync(0); stats(43200); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_dns(yes); }; source gateway { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; source tcpgateway { unix-stream("/dev/log"); internal(); tcp(ip(0.0.0.0) port(514) max_connections(1000)); }; destination hosts { file("/var/log/syslogs/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(gateway); destination(hosts); }; log { source(tcpgateway); destination(hosts); }; --------8<--------8<--------8<-------- The remote host config file is: --------8<--------8<--------8<-------- options { long_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; source gateway { unix-stream("/dev/log" max_connections(1000)); internal(); }; destination messages { file("/var/log/messages"); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; destination shell { tcp("1.2.3.1" port(514)); }; log { source(src); destination(messages); }; log { source(src); destination(console_all); }; log { source(gateway); destination(shell); }; --------8<--------8<--------8<-------- -- -------------------------- Ed Davison Sr. Systems Analyst McCombs School of Business 512-232-6620 voice

2 5

1.9.3 bug proposal : resolving $HOSTS in destination
by Gilles Demarty 02 Mar '05

02 Mar '05

We have an issue on syslog-ng 1.9.3 on this following case : when using the destination : destination d_tag {file("/var/log/hosts/$HOST/$FACILITY $YEAR-$MONTH-$DAY.$LEVEL");}; the following error appeared : Error opening file for writing; error='No such file or directory (2)', filename='localhost/var/log/hosts//mail 2005-02-28.notice' The resolved filename looks bugged. Here are the revelant debugging infos : Incoming log entry; line='<21>Feb 28 15:24:46 logger: test' Initializing destination file writer; filename='/var/log/messages', template='/var/log/messages' Initializing destination file writer; filename='localhost/var/log/hosts//mail 2005-02-28.notice', template='/var/log/hosts/$HOST/$FACILITY $YEAR-$MONTH-$DAY.$LEVEL' Error opening file for writing; error='No such file or directory (2)', filename='localhost/var/log/hosts//mail 2005-02-28.notice' This bug produce rapidly a 99% CPU load, mainly because all the sources are redirected to this "destination". syslog-ng 1.6.4 don't produce the bug. Attached is syslog-ng.conf that produce the bug. (ASCII \r\n format, sorry). -- Gilles DEMARTY ExaProtect Technology Tél: +33 (0) 4 26 23 25 25 Fax: +33 (0) 4 26 29 99 09 email(at)exaprotect.com www.exaprotect.com - "Be alert with your alerts" options { sync(0); create_dirs(on); time_reopen (10); log_fifo_size(1000); long_hostnames (off); keep_hostname (yes); use_dns (off); use_fqdn (off); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; source src { udp(ip(0.0.0.0)); }; destination d_tag { file("/var/log/hosts/$HOST/$FACILITY $YEAR-$MONTH-$DAY.$LEVEL"); }; destination d_dest {file("/var/log/messages"); }; log { source(s_sys); source(src); destination(d_dest); }; log { source(s_sys); source(src); destination(d_tag); };

5 6

levtlog error udring compile
by Colin O'Keeffe 01 Mar '05

01 Mar '05

Iam using suse 9.2 ive done ./configure then i do make and i get gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o -lnsl -Wl,-static -lfl -L/opt/gnome/lib -lglib-2.0 -levtlog -Wl,-call_shared /usr/lib/gcc-lib/i586-suse-linux/3.3.4/../../../../i586-suse-linux/bin/ld: cannot find -levtlog collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/home/cokeeffe/syslog-ng-1.9.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/cokeeffe/syslog-ng-1.9.3' make: *** [all] Error 2 whats up? -- Colin O'Keeffe

2 4

Logs lost in the FIFO
by torpedo 01 Mar '05

01 Mar '05

Hi All, I have the confusion regarding logs which are not read by the Destination programs. In case of FIFO, if the destination program which is reading the logs from syslog-ng is slow and unable to sysnchronise with the syslog-ng and there is also a limit for the fifo buffer(amount of data it holds) then where does thoses logs goes , are those logs recoverable. In other case of FIFO, if there is no destination program reading the logs from the FIFO what happens to the logs which are collected by the syslog-ng are those logs droped. How syslog-ng handles all these situations. Please help me out. Thank you all in advance, Regards, torpedo

3 7

Logserver doesn't receving remote logs
by Viper sec 28 Feb '05

28 Feb '05

Hey , I have a central logserver with syslog-ng installed and configured (see above syslog-ng.conf), some clients (in conf just remotehost5) send (514/udp) their logs to this logserver; but logserver isn't receiving these logs. When I try to use local system logs, it's ok, create the log files, but with remote host doesn't. I have created /var/log/HOSTS/{nameserver}, and clients, that use syslog has in syslog.conf *.warning @logserver (/etc/hosts is ok). remotehost5 is pinging logserver. Anybody has any ideia about it? (thanks too much) logserver: linux Fedora Core 3 syslog-ng-1.6.5-6 libol-0.3.14-1 /* syslog-ng.conf logserver = = local server */ options{ sync(0); keep_hostname(no); log_fifo_size(1000); long_hostnames(off); use_dns(no); use_fqdn(no); create_dirs(yes); }; source s_sys{ unix-stream("/dev/log"); internal(); }; source s_udp{ udp(ip(192.168.100.100) ); }; #listenned interface on server filter f_remotehost5sec{ host( "web5" ) and level( warning .. emerg ) and facility( authpriv ); }; filter f_logservermesg{ level(info .. emerg) and not (facility(authpriv) and facility(mail) and facility(cron)); }; filter f_logserversec { facility(authpriv) and level(info .. emerg); }; destination d_remotehost5mesg { file("/var/log/HOSTS/remotehost5/$YEAR-$MONTH-$DAY.secure" ); }; destination d_remotehost5sec { file("/var/log/HOSTS/remotehost5/$YEAR-$MONTH-$DAY.secure" ); }; destination d_logservermesg { file("/var/log/HOSTS/logserver/$YEAR-$MONTH-$DAY.message"); }; destination d_logserversec { file("/var/log/HOSTS/logserver/$YEAR-$MONTH-$DAY.secure"); }; log { source(s_udp); filter(f_remotehost5mesg); destination(d_remotehost5mesg); }; log { source(s_sys); filter(f_logservermesg); destination(d_logservermesg); }; log { source(s_sys); filter(f_logserversec); destination(d_logserversec); };

3 3

route some messages to /dev/null
by Denis Kot 28 Feb '05

28 Feb '05

I want to route some messages to /dev/null. how to do it? -- Denis Kot denis?jabber.org.by ICQ: 13680126 Mobil: +375 29 6-1234-78

3 7

1.9.3 compatibility with glib 2.2
by Gilles Demarty 28 Feb '05

28 Feb '05

Hi all, on my way trying to compile syslog-ng 1.9.3 on a RedHat Entreprise Server 3.0 with glib 2.2, the only compiling error was the existence of g_queue_get_length() in afinter.c. g_queue_get_length() is a function introduced since glib 2.4. I wonder why you prefer using g_queue_get_length() instead of g_queue_is_empty() in that particular context, since you do a double neg of that value to get a gboolean. Therefore, I propose the following patch. This patch allow compatibility with glib 2.2, and is, i hope, more efficient (since a non empty test shoud be as efficient as an enumeration). # diff afinter.c ~/syslog-1.9.3-patched/src/afinter.c 35c35 < return !!g_queue_get_length(internal_msg_queue); --- > return !g_queue_is_empty(internal_msg_queue); 41c41 < return !!g_queue_get_length(internal_msg_queue); --- > return !g_queue_is_empty(internal_msg_queue); my €.02 -- Gilles DEMARTY ExaProtect Technology Tél: +33 (0) 4 26 23 25 25 Fax: +33 (0) 4 26 29 99 09 email(at)exaprotect.com www.exaprotect.com - "Be alert with your alerts"

2 1