March 2005 - syslog-ng - lists.balabit.hu

destination Program - missing syslog sutdown message
by Brian Kee 19 Mar '05

19 Mar '05

I have a relatively simple perl program that is called from syslog-ng using destination <name> { program("/path/to/program"); }; syntax in syslog-ng.conf. I have noticed an interesting thing regarding the syslog-ng stop/start messages. When starting the syslog-ng daemon (via init script), I get an appropriate log messages sent to my program: Mar 19 01:54:52 loki2 syslog-ng[21700]: syslog-ng version 1.6.5 starting However, when stopping the daemon, I get no stop messages sent to the program, though I do see them sent to other configured destinations. (example stop message: Mar 19 01:48:41 loki2 syslog-ng[21187]: syslog-ng version 1.6.5 going down) Any ideas, or experience with a similar behavior? Any way to force the stop message to be sent to my program? IOW is this behavior configurable? Thank You, Brian A. Kee __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

1 0

problem in logging apache-log
by niraj 18 Mar '05

18 Mar '05

Hi I want to log access log of apache with the help of syslog-ng.But it is not working.I have added the code below. TIA Niraj source apachesrc{ file("/var/log/httpd/access_log"); }; destination destfile{ file("apache-ng.log"); }; log { source(apachesrc); destination(destfile); };

2 1

logging problem
by niraj 18 Mar '05

18 Mar '05

Hi I want to log access log of apache with the help of syslog-ng.But it is not working.I have added the code below. TIA Niraj source apachesrc{ file("/var/log/httpd/access_log"); }; destination destfile{ file("apache-ng.log"); }; log { source(apachesrc); destination(destfile); };

2 1

sudden hourly restarts
by sscalsk 16 Mar '05

16 Mar '05

I have been running syslog-ng v1.6.5 for about 6 months with no problems. Its the main syslog process and logs the days traffic to a single messages file, it does a little filtered for selected hosts and forwards them on (w/spoofing) to another device. Just this week, for some unknown reason I've yet to find, syslog-ng reinitializes a new configuration on the hour (just as if it received a HUP) and overwrites the previous hours file. Now I rotate the logs at midnight via cron, there i move the file and kill HUP the syslog-ng process which works fine. remove_if_older is not set in my config so its taking the default. Anyone else ever have unexplained hourly restarts on the syslog-ng process? -= stan ________________________________________________________________ Sent via the WebMail system at mail.ameritel.net --- [This E-mail scanned for viruses by mail.ameritel.net]

2 1

too much time() ?
by Dave Johnson 12 Mar '05

12 Mar '05

We did some maintaince on our sol9 central syslog-ng server recently running syslog-ng v1.6.4, and noticed something... truss -p on the syslog-ng process shows an abundant number of time() calls. The ratio of time() to read()/write()s were a factor of 20-40x. * This is even with use_time_recv(no); in the global options. I'm trying to understand if this is something that could be cut down some or if its a standard solaris process overhead... ?

2 2

RE: [syslog-ng]RE: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3
by Marquis Thibodeau 11 Mar '05

11 Mar '05

OK, I will try to make it working.. Thanks for the confirmation Marquis -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Earls, Michael Sent: 11 mars 2005 06:43 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]RE: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3 Syslog-ng version 1.5 and up have support for mysql templates. Thanks, Michael PGP Info: KeyID 0x0DFD993C Fingerprint F903 0325 5105 2CDB 4BF4 C88B 72F7 BA7A 28CC 598A -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] Sent: Thursday, March 03, 2005 7:33 AM To: syslog-ng(a)lists.balabit.hu; syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3 Hi, Thanks for your quick answer... I didn't find the version I need.. the 1.5.x because I want to store the log in MySQL and it says that only 1.5.x is working with template (MySQL) Any other idea?? Thanks Marquis _____ De: syslog-ng-admin(a)lists.balabit.hu de la part de Viper sec Date: mer. 2005-03-02 13:01 À: syslog-ng(a)lists.balabit.hu Objet : Re: [syslog-ng]Installation problem on Fedora C3 Hi I installed on FC3, it was ok. I used rpm from rpm.pbone.net. Regards, Viper$ec On Wed, 2 Mar 2005 12:53:03 -0500, Marquis Thibodeau <mthibodeau(a)avance.info> wrote: > Hi, > > I tried to install syslog-ng on my Fedora Core3 server and I get a bunch of > error in the compilation... > > Is someone can help me out... > > What thing do I need to provide here to get better help...??? > > Thanks > > Marquis _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail transmission contains information that is confidential and may be privileged. It is intended only for the addressee(s) named above. If you receive this e-mail in error, please do not read, copy or disseminate it in any manner. If you are not the intended recipient, any disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please erase it from your computer system. Your assistance in correcting this error is appreciated.

1 0

RE: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3
by Earls, Michael 11 Mar '05

11 Mar '05

Syslog-ng version 1.5 and up have support for mysql templates. Thanks, Michael PGP Info: KeyID 0x0DFD993C Fingerprint F903 0325 5105 2CDB 4BF4 C88B 72F7 BA7A 28CC 598A -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] Sent: Thursday, March 03, 2005 7:33 AM To: syslog-ng(a)lists.balabit.hu; syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3 Hi, Thanks for your quick answer... I didn't find the version I need.. the 1.5.x because I want to store the log in MySQL and it says that only 1.5.x is working with template (MySQL) Any other idea?? Thanks Marquis _____ De: syslog-ng-admin(a)lists.balabit.hu de la part de Viper sec Date: mer. 2005-03-02 13:01 À: syslog-ng(a)lists.balabit.hu Objet : Re: [syslog-ng]Installation problem on Fedora C3 Hi I installed on FC3, it was ok. I used rpm from rpm.pbone.net. Regards, Viper$ec On Wed, 2 Mar 2005 12:53:03 -0500, Marquis Thibodeau <mthibodeau(a)avance.info> wrote: > Hi, > > I tried to install syslog-ng on my Fedora Core3 server and I get a bunch of > error in the compilation... > > Is someone can help me out... > > What thing do I need to provide here to get better help...??? > > Thanks > > Marquis _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail transmission contains information that is confidential and may be privileged. It is intended only for the addressee(s) named above. If you receive this e-mail in error, please do not read, copy or disseminate it in any manner. If you are not the intended recipient, any disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please erase it from your computer system. Your assistance in correcting this error is appreciated.

1 0

Apache Access Log Load and Syslog-ng Stability
by Jason Stafford 11 Mar '05

11 Mar '05

Howdy, I'm trying to setup a load balanced system with several web servers and one central log server. Currently I have syslog-ng running and pipe the output form apache to logger. This is all running locally on one box. However, syslog-ng just randomly hangs and apache stop processing requests. I can restart apache and it still does not respond, but i can just restart syslog-ng and then it all starts working again. Is syslog-ng designed to handle this kinda of load, around 3 million entries a day? I have been googling for hours and can only find some comments about log_fifo_size and reap_time in the options section? here is my current config, if that helps any options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination d_http_access { file("/var/log/HTTP/$YEAR-$MONTH-$DAY/$YEAR-$MONTH-$DAY.accesslog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(\ yes)); }; destination d_http_search { file("/var/log/HTTP/$YEAR-$MONTH-$DAY/$YEAR-$MONTH-$DAY.searchlog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(\ yes)); }; destination d_http_error { file("/var/log/HTTP/$YEAR-$MONTH-$DAY/$YEAR-$MONTH-$DAY.errorlog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(ye\ s)); }; filter f_http_access { match("APACHE_ACCESS_LOG") and not match("test.html"); }; filter f_http_search { match("APACHE_ACCESS_LOG") and match("/content/search"); }; filter f_http_error { match("APACHE_ERR_LOG"); }; log { source(s_sys); filter(f_http_access); destination(d_http_access); }; #Log httpd search access logs log { source(s_sys); filter(f_http_search); destination(d_http_search); }; #Log httpd error logs log { source(s_sys); filter(f_http_error); destination(d_http_error); }; ###################################################3 httpd.conf log line CustomLog "|/usr/bin/logger -p local0.info -t APACHE_ACCESS_LOG" tracking

2 2

Michael J. Bock/NetServ/DST/US is out of the office.
by MJBock＠dstsystems.com 11 Mar '05

11 Mar '05

I will be out of the office starting 03/10/2005 and will not return until 03/16/2005. I will respond to your message when I return. ----------------------------------------- This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.

1 0

Syslog-ng fails during build
by Phillip Cockrell 10 Mar '05

10 Mar '05

Hi, I have googled and I still cant find an answer to this, wondering if anyone here knows. I am trying to build a syslog-ng RPM on Red Hat AS3, however, I get the following error: gcc -O2 -g -march=i386 -mcpu=i686 -Wall -I/usr/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv -lwrap /usr/lib/libol.a -lnsl cfg-lex.o(.text+0x42f): In function `yylex': /usr/src/redhat/BUILD/syslog-ng-1.6.5/src/cfg-lex.c:1123: undefined reference to `yywrap' cfg-lex.o(.text+0xbdf): In function `input': /usr/src/redhat/BUILD/syslog-ng-1.6.5/src/cfg-lex.c:1450: undefined reference to `yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-1.6.5/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-1.6.5/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-1.6.5/src' make: *** [all-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.65939 (%build) I built libol and libol-devel RPMs and they are both installed: libol-0.3.15-1 libol-devel-0.3.15-1 Any ideas? -- Phillip Cockrell [pcockrel(a)rackspace.com] RTS System Administrator Rackspace Managed Hosting Office: (210) 447-4161 Cell: (210) 618-6229 Pager: page.pcockrel(a)rackspace.com

2 2