October 2006 - syslog-ng - lists.balabit.hu

proper procedure for filing bug reports
by Matt Zagrabelny 06 Oct '06

06 Oct '06

just curious what people do for bug reports with syslog-ng... thanks, -- Matt Zagrabelny - mzagrabe(a)d.umn.edu - (218) 726 8844 University of Minnesota Duluth Information Technology Systems & Services PGP key 1024D/84E22DA2 2005-11-07 Fingerprint: 78F9 18B3 EF58 56F5 FC85 C5CA 53E7 887F 84E2 2DA2 He is not a fool who gives up what he cannot keep to gain what he cannot lose. -Jim Elliot

2 1

problem with syslog-ng hanging on saturday after working all week
by Steven Meacham 06 Oct '06

06 Oct '06

Hi all, Need help. My syslog-ng is hanging on Saturdays. It is like the service just stops responding even though it is running. The system having the problem is just basically a syslog bridging/filtering server. I am using syslog-ng to accept syslog messages and filter for only what I need out of them, and then forwarding them on. It is basiclly setup like below: Webserver>>(udp 514)>syslog-ngfileterserver>>(udp1514)>Syslog Loghost Any help you could give to a newbie about debugging or find the issue would be great..Also any scripts to check the service and restart would be great to. Thanks Steven Meacham

4 4

Gentoo issues with new portage (maybe)
by Rob Munsch 04 Oct '06

04 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At least i think that's what this is. After a successful install of eventlog, i get this at syslog configure: - ----- checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... configure: error: Package requirements (eventlog) were not met: No package 'eventlog' found Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables EVTLOG_CFLAGS and EVTLOG_LIBS to avoid the need to call pkg-config. - ----- Why can't pkg-config find eventlog? Should i go bug Gentoo about this? (there's an eventlog ebuild, but it's masked...). And syslog-ng itself is at 1.6.9 (in ebuilds). Yeah, i looked at man pkg-config, I'm not sure how to proceed. Should i be telling p-c where to find it, or bypassing p-c entirely..? I see this: /usr/local/lib/pkgconfig/eventlog.pc which contains: - ----- prefix=/usr/local exec_prefix=${prefix} libdir=${exec_prefix}/lib includedir=${prefix}/include/eventlog Name: EventLog Description: General system logging format library Version: 0.2.5 Cflags: -I${includedir} Libs: -L${libdir} -levtlog - ----- Seems like enough info, yah? What went wrong? Anyone else on Gentoo hit this..? TIA, - -- Rob Munsch Solutions For Progress IT www.solutionsforprogress.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFIT4rBvBcJFK6xYURAsAGAKCPCygDfOkVaIoxgK5rybqRF6bavwCdHoX7 hcXJsQ1UPHt8O+kUIn0vjmE= =mt/P -----END PGP SIGNATURE-----

2 1

Question regarding filters
by Ian Meyer 03 Oct '06

03 Oct '06

I don't want to assume anything about how the program deals with messages, so my question is how do messages that match or do not match a filter cascade down? For instance if I have a filter: filter f_test { program('test'); }; and a destination that specific filter, under what conditions would it NOT make it to said destination? What's going on is I log output from a program, but it's making it's way into /var/log/messages, when it should be going to it's own definition /var/log/services/app/app.log. Does the order of log { } make a difference? filters? destinations? I looked around the faq and the reference manual and didn't find anything explaining the process flow. Thanks in advance! Ian

2 1

syslog drops stats
by Niki Hammler 02 Oct '06

02 Oct '06

Hi syslog-ng pro's, I always get messages like these: Oct 2 09:28:05 nobaq syslog-ng[2207]: STATS: dropped 548 I searched google but I could not find a solution or a good explanation why this happens. If this is true and syslog dropped 548 (!) log messages this would be bad. I think a syslog daemon is an important thing that should NOT just drop messages. I can't imagine that my system is not strong enough. 512MB RAM, 1.7Ghz. I've already set the FIFO size to a high value: $ grep size /etc/syslog-ng/syslog-ng.conf # log_fifo_size(2048); log_fifo_size(32768); log_msg_size(2048); But it does not help. Then I grepped the source to see where the problem comes from. There is a variable pktbuf_dropped_pkts and in the whole source I can not find any reference that increments this var. Is this warning uncritical? Is there any solution on this? Best regards, Niki PS: Debian sarge, v. 1.6.5

2 2

EventViewer to SysLog - looking for opinions
by Tom Valdes 01 Oct '06

01 Oct '06

I recently started evaluating tools to convert Windows Event Viewer messages to SysLog and I'm looking for opinions on the different ones and what to look for. I first started with EvtSys and it worked pretty well but it left out the hostname so it was hard to make server specific swatch statements. I then tried ntsyslog which shared the same problem. I'm now trying Snare (thanks Kevin for the tip) and it looks a lot more flexible as to what type of events get sent and it sends the hostname as well. When I first installed it, it worked fine and send messages.. After fiddling with it, it stopped working correctly. I'm going to start working with it again, but I'd like to here what else people are using. The 2 things the tool should have are: be free and transmit the Hostname. thanks, tom

3 3