October 2006 - syslog-ng - lists.balabit.hu

lazy logger++
by Alexander Clouter 22 Oct '06

22 Oct '06

Hi, This is probably the last thing you care about during the release candidate phase but a single bit of extra functionality would be greatly useful for those using the multicast logging feature. What I am planning on doing is having something like the following in my syslog-ng.conf file which is fantastic as to add logging groups I just add extra udp() lines to s_multicastGeneric and nothing else is needed. At the moment I would need separate source/destination/log entries per multicast group address, which is upsetting and results in a hideous configuration file. ==================== source s_multicastGeneric { ## squid # access udp(ip(239.194.251.0) port(514)); # cache udp(ip(239.194.251.32) port(514)); }; destination df_multicastGeneric { file("/var/log/syslog-ng/mulitcastGeneric/$DESTIP/$R_YEAR$R_MONTH$R_DAY.log"); }; log { source(s_multicastGeneric); destination(df_multicastGeneric); flags(final); }; ==================== I have actually had a go at patching syslog-ng to do this, however my patching effort is getting out of control. My method is to add the IP_PKTINFO (or IP_RECVDSTADDR) socket option to the multicast receive section in afinet_setup_socket() but thats about as far as I have gotten. I'm still working on trying to produce a patch myself but I am hoping someone on this list might have a better idea on how to cleanly get the information needed for $DESTIP to function from macros.c without doing anything major to the sourcecode. Whilst I am in my 'moon-on-a-stick' request list, a $HOST_TO in addition to $DESTIP would be handy too. :) As I said, I'm working on a patch at my end and will post it here once done, but its unlikely to be pretty... :) Cheers Alex

2 3

Destination regex question
by James Whitt 18 Oct '06

18 Oct '06

My question is about using regex and breaking up the parts of a string to use in the destination. Here's the situation. We have all of our firewalls logging into one box that is running syslog-ng. We want to break them up into a directory structures such as: /logs/location1/firewall/host1/ /logs/location2/firewall/host1/ /logs/location2/firewall/host2/ Now the hostname contains all the information needed to do this. For example, a host name might be: firewallname.firewall.location1 anothername.firewall.location2 Up to this point, for each location I've had to do the following in syslog to map to the correct directory: destination location1_firewall { file("/logs/location1/firewall/$HOST/$R_YEAR-$R_MONTH-$R_DAY.log"); }; filter location1_firewall { host(.firewall.location1$); }; log { source(external); filter(location1_firewall); destination(location1_firewall); }; This works completely fine. The only issue is that we have over 80 different locations, so this would need to have these three lines modified and added for each location. We're also adding more over time, so each time another location is set up, we need to go through the configuration and update. I was hoping there woud be a way to just combine them all together. Something like: destination firewall { host(.firewall.(.+)$); file("/logs/$1/firewall/$HOST/$R_YEAR-$R_MONTH-$R_DAY.log"); }; filter firewall { host(.firewall.); }; log { source(external); filter(firewall); destination(firewall); }; I know the regex syntax might be different, but was curious if this kind of situation is possible.

2 1

Error accepting AF_UNIX connection, opened connections: 100, max: 100
by Hari Sekhon 18 Oct '06

18 Oct '06

I'm getting the following on a host that is sending logs to a remote central logserver: syslog-ng[2390]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 Why is this happening? It isn't accepting logs, it's only sending them. And I also increased the remote logserver's max to 100 with the following line source s_tcp { tcp( port(<someport>) max-connections(1000)); }; For a start, I don't have 100 hosts logging to the remote logserver. Second, this host isn't the logserver so it shouldn't have this in it's /var/log/messages!!!! Can anyone explain this strange behavior? Thanks -h -- Hari Sekhon

2 3

1.6.11 stops logging on Garbage Collect (Solaris 9)
by Kim Cary 11 Oct '06

11 Oct '06

Our installation of syslog-ng writes to 3 pipes and a dozen files from 2 IP sources. About 2-3 times a week it will stop logging in 1-12 files. The last record in these files will almost always coincide with a Garbage Collect record in /var/log/syslog (which always continues to collect records). Solaris syslog is NOT running. Solaris logadm sends HUP to syslog-ng on any rotate. We tried TCP logging from some systems for a while, but its all UDP now. Important to note, it may not be all files that stop receiving records, or even all the files from a single source. We need reliable logs. How do we begin to debug this issue?

2 1

logging by hostname
by Istvan Szukacs 11 Oct '06

11 Oct '06

Hi! I would like to log several computer which are behind nat. The problem is i cannot find the right metod to log by the hostname not by the ip reverse name from where the packets come. But i got this: Oct 1 02:34:27 external ip/external ip Is there a possibility to devide the logs by the original hostname? thx

4 3

Re : [syslog-ng] Syslog and syslog-ng on HP-UX
by olivier "madmax"rolland 11 Oct '06

11 Oct '06

I have to run syslog and syslog-ng because syslog-ng have not been probated in my compagny yet. I want to log the same message in syslog and in syslog-ng but i conclude that's not possible for the two daemons to read the same pipe. Syslog-ng extract only messages that syslogd don-t want to. Thanks for your help and if you have an idea for a solution contact me. ----- Message d'origine ---- De : Gellér Sándor <wildy(a)balabit.hu> À : Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Envoyé le : Mercredi, 11 Octobre 2006, 11h29mn 17s Objet : Re: [syslog-ng] Syslog and syslog-ng on HP-UX olivier "madmax"rolland wrote: > Hello! > I have a problem, > I want that syslog and syslog-ng 1.6.7 to coexist on a HP-UX 11.11 and HP-UX 11.23. > I install syslog-ng 1.6.7 and it works but the problem is that syslog-ng don't log when syslogd runs. I'n not familiar with HP-UX, but my first guess is that you are using the same source for both daemons. Remove the standard HP-UX log source from syslog-ng.conf and reload syslog-ng. What is the purpose to use two syslog daemons on the same machine? Do you want to log the same messages with syslog and syslog-ng, or do you want to separate them? -- Gellér Sándor wildy(a)balabit.hu _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Demandez à ceux qui savent sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

Re: Subject: [syslog-ng] 1.6.11 stops logging on Garbage Collect (Solaris 9)
by Kim Cary 11 Oct '06

11 Oct '06

Whilst working further on this problem, I was tailing the log and this popped up: /var/log/syslog:Oct 10 13:50:01 mylogserver syslog-ng[20167]: do_stream_read: getmsg() trying to return too much ctl data, res=4294967295 Resource temporarily unavailable Is this any clue to the problem we are having? How do I interpret that message? I don't find any info on it in Google or this list... > Date: Mon, 9 Oct 2006 09:19:42 -0700 > From: Kim Cary <Kim.Cary(a)pepperdine.edu> > Subject: [syslog-ng] 1.6.11 stops logging on Garbage Collect (Solaris > 9) > To: syslog-ng(a)lists.balabit.hu > Message-ID: <9B0A23E1-566A-465A-BB00-BA3FF0EA0FBC(a)pepperdine.edu> > Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed > > Our installation of syslog-ng writes to 3 pipes and a dozen files > from 2 IP sources. > > About 2-3 times a week it will stop logging in 1-12 files. The last > record in these files will almost always coincide with a Garbage > Collect record in /var/log/syslog (which always continues to collect > records). > > Solaris syslog is NOT running. > Solaris logadm sends HUP to syslog-ng on any rotate. > We tried TCP logging from some systems for a while, but its all UDP > now. > > Important to note, it may not be all files that stop receiving > records, or even all the files from a single source. > > We need reliable logs. How do we begin to debug this issue?

2 1

Syslog and syslog-ng on HP-UX
by olivier "madmax"rolland 11 Oct '06

11 Oct '06

Hello! I have a problem, I want that syslog and syslog-ng 1.6.7 to coexist on a HP-UX 11.11 and HP-UX 11.23. I install syslog-ng 1.6.7 and it works but the problem is that syslog-ng don't log when syslogd runs. My syslog-ng.conf look like: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe("/dev/log" pad_size(2048)); internal(); unix-stream ("/dev/log.un"); }; What I have to do to resolve this problem? Thanks for help! ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com

2 1

Syslog-ng and filter question ...
by Sébastien CRAMATTE 10 Oct '06

10 Oct '06

Hello list, I've just setup a centralized syslog-ng server with mysql Remote clients work well but I'v got a little problem with a filter ... On each client I've got snmp daemon running and nagios network manager server polling clients ... My problem is that each time my nagios NMS connect it to a client it appears this line in daemon.info client log "Oct 10 03:15:48 vlanrouter1 snmpd[1868]: Connection from 192.168.0.12 " I would like to filter this line to exclude it from the remote log ... So I 've added this filter filter f_not_daemon_info { (not facility(daemon) and not level(info)); }; but not works and all "daemon" and all "info" levels are removed not just "daemon.info" I've search to remove this log from snmp daemon directly but seems to be a bug on my snmpd release ... I hope that someone have got the solution Regards Sebastien

4 7

bug report
by Matt Zagrabelny 09 Oct '06

09 Oct '06

i sent out an email a couple of days ago asking about this. i will try once more... does anyone on the list know the preferred way of submitting bug reports to the developers? i have considered using reportbug and letting the debian maintainer facilitate my bug. thanks, -- Matt Zagrabelny - mzagrabe(a)d.umn.edu - (218) 726 8844 University of Minnesota Duluth Information Technology Systems & Services PGP key 1024D/84E22DA2 2005-11-07 Fingerprint: 78F9 18B3 EF58 56F5 FC85 C5CA 53E7 887F 84E2 2DA2 He is not a fool who gives up what he cannot keep to gain what he cannot lose. -Jim Elliot

4 8