July 2005 - syslog-ng - lists.balabit.hu

RE: [syslog-ng] Error parsing conf file?
by Balazs Scheidler 07 Jul '05

07 Jul '05

Hi, > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler > Sent: Tuesday, July 05, 2005 6:47 AM > To: Syslog-ng users' and developers' mailing list > Subject: RE: [syslog-ng] Error parsing conf file? > > > On Mon, 2005-07-04 at 15:56 -0600, Zb Indelak wrote: > > Any progress / clues on the multiple file-open bug? I'm using a > > multi-processor (2 CPUs) system, if that perhaps makes a difference. > > With the 20050704 snapshot I've seen a single file open over 20 times > > each. > > not yet, sorry, I was hunting down a bug for a customer, so did not have too much time lately. But I'm trying to look into this RSN. > > ps: I hate bugs that screw up the heap structure :( > I have now fixed this issue with the following patch: --- orig/src/logwriter.c +++ mod/src/logwriter.c @@ -327,7 +327,11 @@ log_writer_deinit(LogPipe *s, GlobalConf LogWriter *self = (LogWriter *) s; if (self->source) - g_source_destroy(self->source); + { + g_source_destroy(self->source); + g_source_unref(self->source); + self->source = NULL; + } return TRUE; } It will be included in tomorrow's snapshot. -- Bazsi

1 0

DB probs
by Edward Brookhouse 05 Jul '05

05 Jul '05

Hi all - I am upgrading from the syslog-ng 1.7 branch on one machine to another server using the 1.9.4 branch. Using this on the new server I am building, I can not get any data to write to a mysql database. Using mysql 4.1.11-2 and Syslogng 1.9.4 on RH Fedora Core 4 kernel 2.6.12-1 Using the syslog-ng config file and database setup from the older server that is still running does not work. So - I tried switching from using a mysql pipe file to using sqlsyslogd - same results - Log data flows in, gets written to a log file, but never gets inserted into the db - The db structure looks ok - the sqlsyslogd is running well - not much in the way of being able to debug that but ....gonna try to pass it through a debugger Here is the relevant portion of my conf destination sqlsyslogd { program("/usr/local/sbin/sqlsyslogd -h localhost -u root -t logs syslog -p"); }; With the password specified in sqlsyslogd.conf (this is one word on a line by itself - is that right???) When a log entry comes in I do see an error about writing to FD 7 [root@io etc]# syslog-ng -F -e -v -d -f /etc/syslog-ng/syslog-ng.conf Starting destination program; cmdline='/usr/local/bin/syslog-mail' Starting destination program; cmdline='/usr/local/sbin/sqlsyslogd -h localhost -u root -t logs syslog -p' Starting destination program; cmdline='/usr/local/bin/syslog-mail-perl' syslog-ng starting up; version='1.9.4' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Syslog connection accepted; to='AF_UNIX(/dev/log)', from='AF_UNIX(\xff\xff\xff\xff\x19)' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Incoming log entry; line='<86>Jul 5 11:05:01 sshd[6703]: Accepted password for ebroo from ::ffff:172.17.17.193 port 33316 ssh2' Initializing destination file writer; filename='/var/log/syslog', template='/var/log/syslog' Initializing destination file writer; filename='/var/log/HOSTS/io/2005/07/05/05', template='/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY_$HOST_$YEAR_$ MONTH_$DAY' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' EOF occurred while reading; fd='7' Closing log reader fd; fd='7' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Syslog connection accepted; to='AF_UNIX(/dev/log)', from='AF_UNIX(-)' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Incoming log entry; line='<38>Jul 5 11:05:01 sshd(pam_unix)[6705]: session opened for user ebroo by (uid=0)' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' EOF occurred while reading; fd='7' Closing log reader fd; fd='7' log_reader_fd_prepare(); window_size='100' log_reader_fd_prepare(); window_size='100' Any thoughts appreciated!!!!!!!!!!!! Edward ebroo(a)healthydirections.com

1 1

RE: [syslog-ng] syslog.conf for Solaris box to send to Syslog-NG server
by Stew Redfield 05 Jul '05

05 Jul '05

Shane, Here's my base /etc/syslog.conf for Solaris # Push to loghost (/etc/hosts or DNS) [syslog-ng] # syslog-ng handles prioritization/alerting *.warn;*.alert;*.emerg;*.err;*.info @loghost # Keep mail annoyances local mail.debug /var/log/syslog.mail # Keep consistency for debugging/console work kern.notice;auth.notice /dev/sysmsg kern.debug;daemon.notice;mail.crit /var/adm/messages When in doubt, be explicit (and syslog is m4 parsed so make sure the tabs are really tabs...) HTH, Stew -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Shane Presley Sent: Tuesday, July 05, 2005 12:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog.conf for Solaris box to send to Syslog-NG server Hello, I have a syslog-ng centralized host, setup and working great. My routers and various other devices send their messages to it. I'd like to have my Solaris servers send to it as well. They run the solaris syslog deamon, not syslog-ng. I've included the syslog.conf below for a server that we have doing this (forwarding logs). But I didn't set this up myself, and I'd like to understand the format. The line that seems to forward the logs is # Send all messages to the logger *.debug @10.10.10.1 auth.notice @10.10.10.1 Is that sending all syslog messages? Basically we want anything that would normally be logged to /var/adm/messages to go the log server as well. Does the above line only mean debug, or does that mean anything debug or greater? Thanks Shane # Copyright (c) 1991-1998 by Sun Microsystems, Inc. # All rights reserved. # # syslog configuration file. # # This file is processed by m4 so be careful to quote (`') names # that match m4 reserved words. Also, within ifdef's, arguments # containing commas must be quoted. # *.err;kern.notice;auth.notice /dev/sysmsg *.err;kern.debug;daemon.notice;mail.crit /var/adm/messages *.alert;kern.err;daemon.err operator *.alert root *.emerg * # Send all messages to the logger *.debug @10.10.10.1 auth.notice @10.10.10.1 # if a non-loghost machine chooses to have authentication messages # sent to the loghost machine, un-comment out the following line: #auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost) mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) # # non-loghost machines will use the following lines to cause "user" # log messages to be logged locally. # ifdef(`LOGHOST', , user.err /dev/sysmsg user.err /var/adm/messages user.alert `root' user.emerg * _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog.conf for Solaris box to send to Syslog-NG server
by Shane Presley 05 Jul '05

05 Jul '05

Hello, I have a syslog-ng centralized host, setup and working great. My routers and various other devices send their messages to it. I'd like to have my Solaris servers send to it as well. They run the solaris syslog deamon, not syslog-ng. I've included the syslog.conf below for a server that we have doing this (forwarding logs). But I didn't set this up myself, and I'd like to understand the format. The line that seems to forward the logs is # Send all messages to the logger *.debug @10.10.10.1 auth.notice @10.10.10.1 Is that sending all syslog messages? Basically we want anything that would normally be logged to /var/adm/messages to go the log server as well. Does the above line only mean debug, or does that mean anything debug or greater? Thanks Shane # Copyright (c) 1991-1998 by Sun Microsystems, Inc. # All rights reserved. # # syslog configuration file. # # This file is processed by m4 so be careful to quote (`') names # that match m4 reserved words. Also, within ifdef's, arguments # containing commas must be quoted. # *.err;kern.notice;auth.notice /dev/sysmsg *.err;kern.debug;daemon.notice;mail.crit /var/adm/messages *.alert;kern.err;daemon.err operator *.alert root *.emerg * # Send all messages to the logger *.debug @10.10.10.1 auth.notice @10.10.10.1 # if a non-loghost machine chooses to have authentication messages # sent to the loghost machine, un-comment out the following line: #auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost) mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) # # non-loghost machines will use the following lines to cause "user" # log messages to be logged locally. # ifdef(`LOGHOST', , user.err /dev/sysmsg user.err /var/adm/messages user.alert `root' user.emerg *

1 0

RE: [syslog-ng] Error parsing conf file?
by Zb Indelak 05 Jul '05

05 Jul '05

Any progress / clues on the multiple file-open bug? I'm using a multi-processor (2 CPUs) system, if that perhaps makes a difference. With the 20050704 snapshot I've seen a single file open over 20 times each. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, June 30, 2005 3:16 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Error parsing conf file? On Thu, 2005-06-30 at 11:07 +0200, Balazs Scheidler wrote: > On Tue, 2005-06-28 at 09:46 -0600, Zb Indelak wrote: > > *** Problems start here *** > > syslog-ng 1651 root 82w REG 8,8 489 5216302 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280843 > > syslog-ng 1651 root 83w REG 8,8 489 5216302 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280843 > > [root@simda02 NSM]# ps -ef|grep syslog > > root 1651 1 0 15:36 ? 00:00:01 ./syslog-ng -f /etc/syslog-ng/syslog-ng.conf > > root 1682 1508 0 15:39 pts/2 00:00:00 grep syslog > > [root@simda02 NSM]# kill -9 1651 > > [root@simda02 NSM]# echo;date;lsof +d > > /var/nsm/inbox/router/cisco/ios/12.0/syslog > > > > This seems to be an unrelated issue that it opens the same file > multiple times. This is no good. I'll look into this as well. > I don't really see how syslog-ng could open the same file twice, unless you had multiple file() destinations which refers to the same file. Is it the case? (judging your posted configuration, it is not, but maybe you did not copy-paste your complete config. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Year in logs
by syrykh Alain 04 Jul '05

04 Jul '05

Hello, Is there a way to include year directly in log messages , without rewrite logs into a specific format; I would like find messages in log like that : "*2005 *Jun 3 16:09:12 s_sys@..........." Thanks In advance

3 2