March 2005 - syslog-ng - lists.balabit.hu

Syslog-NG 1.6.6 memory leak when sending UDP logs
by henry＠shoelacecity.com 04 Mar '05

04 Mar '05

I'm running 1.6.6 on Linux Redhat ES 3.0 logging Cisco router logs to local files and it's been running just fine for over a week. I just enabled forwarding for local4 and local7 (with spoof UDP) to 2 additional hosts via UDP and noticed, within a day, that it syslog-NG has consumed all available memory. It continues to log, however, the system starts killing processes off unless I restart syslog-ng. I checked the list, it seems like the closest similar problem I could find was back in 2000. Any advice for fixing/identifying the problem?

4 18

Fedora Core configuration files
by José Pedro Oliveira 04 Mar '05

04 Mar '05

Balazs, Could you add the four attached files to the contrib directory? They will be needed by the new specfile. Regards, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 10 Aug 2002 # - for Red Hat 7.3 # - totally do away with klogd # - add message "kernel:" as is done with klogd. # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # # Updated by Jose Pedro Oliveira (<jpo at di.uminho.pt>) - 05 Apr 2003 # - corrected filters 'f_filter2' and 'f_filter6' # these filters were only allowing messages of one specific # priority level; they should be allowing messages from that # priority and upper levels. # # Updated by Jose Pedro Oliveira (<jpo at di.uminho.pt>) - 25 Jan 2005 # - Don't sync the d_mail destination # # Updated by Jose Pedro Oliveira (<jpo at di.uminho.pt>) - 01 Feb 2005 # - /proc/kmsg is a file not a pipe. # (https://lists.balabit.hu/pipermail/syslog-ng/2005-February/006963.html) # options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; #filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; #!/bin/sh # # syslog-ng This starts and stops syslog-ng # # chkconfig: 2345 12 88 # description: reads and logs messages to the system console, log \ # files, other machines and/or users as specified by \ # its configuration file. # processname: /sbin/syslog-ng # config: /etc/syslog-ng/syslog-ng.conf # config: /etc/sysconfig/syslog-ng # pidfile: /var/run/syslog-ng.pid # ### BEGIN INIT INFO # Provides: $syslog ### END INIT INFO # Source function library. . /etc/rc.d/init.d/functions exec="/sbin/syslog-ng" prog=$(basename $exec) [ -f $exec ] || exit 0 # Source config [ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog lockfile=/var/lock/subsys/$prog umask 077 start() { echo -n $"Starting $prog: " daemon $exec $SYSLOGNG_OPTIONS retval=$? echo [ $retval -eq 0 ] && touch $lockfile return $retval } stop() { echo -n $"Stopping $prog: " killproc $prog retval=$? echo [ $retval -eq 0 ] && rm -f $lockfile return $retval } restart() { stop start } reload() { echo -n $"Reloading syslog-ng.conf file: " killproc $prog -HUP retval=$? echo return $retval } force_reload() { restart } fdr_status() { status $prog } case "$1" in start|stop|restart|reload) $1 ;; force-reload) force_reload ;; status) fdr_status ;; condrestart|try-restart) [ ! -f $lockfile ] || restart ;; *) echo $"Usage: $0 {start|stop|status|restart|try-restart|reload|force-reload}" exit 2 esac /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron { sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } #--- # Syslog-ng command line options # See syslog-ng(8) for more details #--- SYSLOGNG_OPTIONS=""

2 1

central log server not working
by Ed Davison 04 Mar '05

04 Mar '05

I am trying to setup a central log host and am having trouble getting events registered on the central server. It looks like the remote host does register with the central host but nothing shows in a log anywhere for it. I really need another set of eyes on this as I cannot figure this out for the life of me and I need to get this going. Here is the excerpt from /var/log/messages (cleaned on the ip numbers): --------8<--------8<--------8<-------- Feb 18 14:19:45 sec5 syslog-ng[27866]: syslog-ng version 1.6.5 starting Feb 18 14:19:45 sec5 syslog-ng[27866]: Changing permissions on special file /dev/tty12 Feb 18 14:24:00 sec5 syslog-ng[27866]: AF_INET client connected from 1.2.3.4, port 50378 --------8<--------8<--------8<-------- Here is the central loghost config file: --------8<--------8<--------8<-------- options { long_hostnames(off); sync(0); stats(43200); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_dns(yes); }; source gateway { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; source tcpgateway { unix-stream("/dev/log"); internal(); tcp(ip(0.0.0.0) port(514) max_connections(1000)); }; destination hosts { file("/var/log/syslogs/$HOST/$FACILITY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(gateway); destination(hosts); }; log { source(tcpgateway); destination(hosts); }; --------8<--------8<--------8<-------- The remote host config file is: --------8<--------8<--------8<-------- options { long_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; source gateway { unix-stream("/dev/log" max_connections(1000)); internal(); }; destination messages { file("/var/log/messages"); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; destination shell { tcp("1.2.3.1" port(514)); }; log { source(src); destination(messages); }; log { source(src); destination(console_all); }; log { source(gateway); destination(shell); }; --------8<--------8<--------8<-------- -- -------------------------- Ed Davison Sr. Systems Analyst McCombs School of Business 512-232-6620 voice

2 5

changed macro to $R_YEAR/$YEAR.$MONTH.$DAY
by Deras, Angel R./Information Systems 04 Mar '05

04 Mar '05

Joerg, I was able to start logging again after your pointer. I am still not able to create a dir with the $MONTH (nor $R_MONTH) macro, but am getting around the problem by using the macro "$R_YEAR/$YEAR.$MONTH.$DAY", which should be enough to distinguish each day's log. thank you very much, ard ===================================================================== Please note that this e-mail and any files transmitted with it may be privileged, confidential, and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other use of this communication or any of its attachments is strictly prohibited. If you have received this communication in error, please notify the sender immediately by replying to this message and deleting this message, any attachments, and all copies and backups from your computer.

1 0

MySQL-Syntax error
by Hermann-Josef Beckers 03 Mar '05

03 Mar '05

HI, I have the same problem as someone else in November. I'm trying to pipe data into MySQL, but Mysql complains about syntax. The proposed solution in November (upgrade von 1.6.4 to 1.6.5) doesn't fit, as I'm using 1.9.3 Here is the generated input for MySQL: ls0003INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '', 'kern', 'notice', 'notice', '05', '2005-03-03', '16:26:07', 'kernel', 'syslog-ng[10686]: syslog-ng starting up; version=\'1.9.3\' ' ); ls0003INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '', 'kern', 'notice', 'notice', '05', '2005-03-03', '16:26:07', 'kernel', 'syslog-ng[10686]: Initializing destination file writer; filename=\'/tmp/mysql.pipe\', template=\'/tmp/mysql.pipe\' ' ); 0.0.0.0INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '', 'daemon', 'err', 'err', '1b', '2005-03-03', '16:27:01', 'Security', 'Security: NT-AUTORIT\37777777704T\\SYSTEM: Fehlgeschlagene Anmeldung: Grund: Unbekannter Benutzername oder falsches Kennwort Benutzername: ANONYMOUS Dom\37777777744ne: KST Anmeldetyp: 3 Anmeldevorgang: NtLmSsp Authentifizierungspaket: NTLM Name der Arbeitsstation: \\\\LS0002 <78>CROND[2516]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg) ' ); Seems that the value for HOST is printed before the INSERT-string. "ls0003" is the host running syslog-ng. Another point: How do I keep the hostname for remote hosts? The string with "0.0.0.0" at the beginning is from a windows 2000 client. Here is my syslog-ng.conf: options { keep_hostname(yes); chain_hostnames(yes); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(src); destination(d_mysql); }; # source src { unix-dgram("/etc/log/log"); internal(); }; source src { unix-dgram("/dev/log"); internal(); udp(); }; # source src { unix-dgram("/dev/log"); internal(); }; # source net { udp(); }; Yours hjb _________________________________________ Diese E-Mail wurde geprüft von Symantec Antivirus

2 1

client couldn't reconnect to loghost after failure
by Ed Ravin 03 Mar '05

03 Mar '05

We're using syslog-ng 1.5.13 (yes, I know) on a bunch of diskless clients to send log messages to a central host. The main switch in our machine room had a hardware problem, and refused to pass packets for 20 minutes or so until we rebooted it. On two of my clients, syslog-ng subsequently stopped sending log messages to the central host after the switch recovered. Here's what was in the log: Mar 1 08:55:38 syslog-ng[13050]: io.c: do_write: write() failed (errno 9), Broken pipe Mar 1 08:55:38 syslog-ng[13050]: pkt_buffer::do_flush(): Error flushing data Mar 1 08:55:38 syslog-ng[13050]: Connection broken to AF_INET(loghost.example.com:514), reopening in 60 seconds Mar 1 08:57:53 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:00:08 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:02:24 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:04:39 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:05:38 syslog-ng[13050]: STATS: dropped 0 Mar 1 09:06:54 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:09:10 syslog-ng[13050]: Error connecting to remote host AF_INET(loghost.example.com:514), reattempting in 60 seconds Mar 1 09:25:39 syslog-ng[13050]: STATS: dropped 0 Mar 1 09:35:39 syslog-ng[13050]: STATS: dropped 0 The other host has a remarkably similar log. After 9:25:39, the only messages that made it to the central host are the "STATS: dropped 0" messages. Is this a bug that has been fixed in more recent versions? We've been meaning to upgrade the clients for a while (the central server is using a current syslog-ng), but haven't gotten to it yet.

1 0

RE : [syslog-ng]Installation problem on Fedora C3
by Marquis Thibodeau 03 Mar '05

03 Mar '05

Hi, Thanks for your quick answer... I didn't find the version I need.. the 1.5.x because I want to store the log in MySQL and it says that only 1.5.x is working with template (MySQL) Any other idea?? Thanks Marquis ________________________________ De: syslog-ng-admin(a)lists.balabit.hu de la part de Viper sec Date: mer. 2005-03-02 13:01 À: syslog-ng(a)lists.balabit.hu Objet : Re: [syslog-ng]Installation problem on Fedora C3 Hi I installed on FC3, it was ok. I used rpm from rpm.pbone.net. Regards, Viper$ec On Wed, 2 Mar 2005 12:53:03 -0500, Marquis Thibodeau <mthibodeau(a)avance.info> wrote: > Hi, > > I tried to install syslog-ng on my Fedora Core3 server and I get a bunch of > error in the compilation... > > Is someone can help me out... > > What thing do I need to provide here to get better help...??? > > Thanks > > Marquis _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng stopped logging at beginning of month (March 1)
by Deras, Angel R./Information Systems 03 Mar '05

03 Mar '05

Hi Friends, For some reason, syslog-ng did not create a new dir and destination file after it closed the last log on February 28 @ 23:59. It should have created a new dir in the form: <path>/2005/03/ and a file named "2005-03-01". However, this did not happen and I am still not able to get logging going. I am using syslog-ng version 1.6.6, running on FreeBSD 5.3. I installed it recently and it worked great from Feb 17 to Feb 28, each day creating that day's file; but it not create the March directory nor any other file. tcpdump sessions show that the udp packets to port 514 are arriving at the log server. Any help will be greatly appreciated. thanks, ard ===================================================================== Please note that this e-mail and any files transmitted with it may be privileged, confidential, and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other use of this communication or any of its attachments is strictly prohibited. If you have received this communication in error, please notify the sender immediately by replying to this message and deleting this message, any attachments, and all copies and backups from your computer.

2 1

Installation problem on Fedora C3
by Marquis Thibodeau 02 Mar '05

02 Mar '05

Hi, I tried to install syslog-ng on my Fedora Core3 server and I get a bunch of error in the compilation... Is someone can help me out... What thing do I need to provide here to get better help...??? Thanks Marquis

2 1

1.9.3 bug proposal : resolving $HOSTS in destination
by Gilles Demarty 02 Mar '05

02 Mar '05

We have an issue on syslog-ng 1.9.3 on this following case : when using the destination : destination d_tag {file("/var/log/hosts/$HOST/$FACILITY $YEAR-$MONTH-$DAY.$LEVEL");}; the following error appeared : Error opening file for writing; error='No such file or directory (2)', filename='localhost/var/log/hosts//mail 2005-02-28.notice' The resolved filename looks bugged. Here are the revelant debugging infos : Incoming log entry; line='<21>Feb 28 15:24:46 logger: test' Initializing destination file writer; filename='/var/log/messages', template='/var/log/messages' Initializing destination file writer; filename='localhost/var/log/hosts//mail 2005-02-28.notice', template='/var/log/hosts/$HOST/$FACILITY $YEAR-$MONTH-$DAY.$LEVEL' Error opening file for writing; error='No such file or directory (2)', filename='localhost/var/log/hosts//mail 2005-02-28.notice' This bug produce rapidly a 99% CPU load, mainly because all the sources are redirected to this "destination". syslog-ng 1.6.4 don't produce the bug. Attached is syslog-ng.conf that produce the bug. (ASCII \r\n format, sorry). -- Gilles DEMARTY ExaProtect Technology Tél: +33 (0) 4 26 23 25 25 Fax: +33 (0) 4 26 29 99 09 email(at)exaprotect.com www.exaprotect.com - "Be alert with your alerts" options { sync(0); create_dirs(on); time_reopen (10); log_fifo_size(1000); long_hostnames (off); keep_hostname (yes); use_dns (off); use_fqdn (off); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; source src { udp(ip(0.0.0.0)); }; destination d_tag { file("/var/log/hosts/$HOST/$FACILITY $YEAR-$MONTH-$DAY.$LEVEL"); }; destination d_dest {file("/var/log/messages"); }; log { source(s_sys); source(src); destination(d_dest); }; log { source(s_sys); source(src); destination(d_tag); };

5 6