November 2006 - syslog-ng - lists.balabit.hu

Config parse error in syslog-ng 2.0.0
by Jacek Kalinski 28 Nov '06

28 Nov '06

Hi, I have a config file working fine with syslog-ng-1.6.11. But the same config won't work with 2.0.0. Problem (as I've checked, compiling syslog-ng with YYDEBUG) is in: dir_owner(0); dir_group(0); owner(0); group(0); 2 first lines of config: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(0); dir_group(0); owner(0); group(0); }; Debug from checking syntax: ... Reducing stack by rule 212 (line 731), KW_STATS_FREQ '(' NUMBER ')' -> options_item Stack now 0 4 18 73 156 73 156 73 156 Entering state 73 Reading a token: Next token is token ';' () Shifting token ';' () Entering state 156 Reading a token: Next token is token KW_KEEP_HOSTNAME () Shifting token KW_KEEP_HOSTNAME () Entering state 42 Reading a token: Next token is token '(' () Shifting token '(' () Entering state 125 Reading a token: Next token is token KW_YES () Shifting token KW_YES () Entering state 206 Reducing stack by rule 271 (line 868), KW_YES -> yesno Stack now 0 4 18 73 156 73 156 73 156 73 156 42 125 Entering state 211 Reading a token: Next token is token ')' () Shifting token ')' () Entering state 308 Reducing stack by rule 217 (line 736), KW_KEEP_HOSTNAME '(' yesno ')' -> options_item Stack now 0 4 18 73 156 73 156 73 156 73 156 Entering state 73 Reading a token: Next token is token ';' () Shifting token ';' () Entering state 156 Reading a token: Next token is token KW_DIR_OWNER () Shifting token KW_DIR_OWNER () Entering state 66 Reading a token: Next token is token '(' () Shifting token '(' () Entering state 149 Reading a token: Next token is token NUMBER () syntax error at 2 Error: popping token '(' () Stack now 0 4 18 73 156 73 156 73 156 73 156 73 156 66 Error: popping token KW_DIR_OWNER () Stack now 0 4 18 73 156 73 156 73 156 73 156 73 156 Error: popping token ';' () Stack now 0 4 18 73 156 73 156 73 156 73 156 73 Error: popping nterm options_item () Stack now 0 4 18 73 156 73 156 73 156 73 156 Error: popping token ';' () Stack now 0 4 18 73 156 73 156 73 156 73 Error: popping nterm options_item () Stack now 0 4 18 73 156 73 156 73 156 Error: popping token ';' () Stack now 0 4 18 73 156 73 156 73 Error: popping nterm options_item () Stack now 0 4 18 73 156 73 156 Error: popping token ';' () Stack now 0 4 18 73 156 73 Error: popping nterm options_item () Stack now 0 4 18 73 156 Error: popping token ';' () Stack now 0 4 18 73 Error: popping nterm options_item () Stack now 0 4 18 Error: popping token '{' () Stack now 0 4 Error: popping token KW_OPTIONS () Stack now 0 Cleanup: discarding lookahead token NUMBER () When I change 'dir_owner' to: dir_owner(root) next error found is on 'dir_group': Reading a token: Next token is token KW_DIR_GROUP () Shifting token KW_DIR_GROUP () Entering state 67 Reading a token: Next token is token '(' () Shifting token '(' () Entering state 150 Reading a token: Next token is token NUMBER () syntax error at 2 BUT manual, says: dir_owner(uid) User id. documantecion says: â â â âThe default owner of â âdir_owner() âuserid âroot ânewly created â â â â âdirectories. â The same problem with: owner and group options (so all options working with UID/GID). Is it an error in my configuration, or in docs? :) Is it possible to keep compatibility with syslog-1.6 (so use UID/GID instead of username)? Jacek -- Wortal chelloPL: http://chellopl.one.pl Forum dyskusyjne: http://chellopl.one.pl/forum/ Bramka news: http://chellopl.one.pl/bramka/ i inne - sprawdź sam!

2 2

Re: syslog-ng Digest, Vol 15, Issue 12
by dwarnock＠harbrook.net 28 Nov '06

28 Nov '06

I am on holiday from the 17th August returning on Monday the 31st August. If your query is urgent please contact the office on +44 (0)1423 508060 or Neil Harvey on +44 (0)15395 64734 (nharvey(a)harbrook.net) Regards David Warnock

5 9

Weird ${HOST} values
by Wolfram Schlich 27 Nov '06

27 Nov '06

Hi, I just experienced some weird behaviour regarding the resolution of the ${HOST} variable/macro. There seems to be a difference whether the remote log client runs sysklogd or syslog-ng. Basic setup =========== syslog-ng 2.0 log server ------------------------ /etc/hosts: host1.syslog-ng.local 192.168.10.1 host1.sysklogd.local 192.168.20.1 /etc/syslog-ng/syslog-ng.conf: normalize_hostnames(yes); keep_hostname(no); use_dns(yes); use_fqdn(yes); No address or hostname/fqdn is served by a real DNS server, everything is contained in /etc/hosts. Case #1 ======= syslog-ng 2.0 log server ------------------------ /etc/syslog-ng/syslog-ng.conf: chain_hostnames(yes); messages received from sysklogd log clients ------------------------------------------- ${HOST} resolves to host1.sysklogd.local ${FULLHOST} resolves to host1.sysklogd.local/host1.sysklogd.local messages received from syslog-ng 1.6 log clients ------------------------------------------------ ${HOST} resolves to host1 ${FULLHOST} resolves to host1/host1.syslog-ng.local Case #2 ======= syslog-ng 2.0 log server ------------------------ /etc/syslog-ng/syslog-ng.conf: chain_hostnames(no); messages received from sysklogd log clients ------------------------------------------- ${HOST} resolves to host1.sysklogd.local messages received from syslog-ng 1.6 log clients ------------------------------------------------ ${HOST} resolves to host1.syslog-ng.local Where does that difference come from?! Shouldn't syslog-ng on the log server just not care about whatever hostname the log client sent due to keep_hostname(no) and use the data from /etc/hosts? How come that messages directly being sent to the syslog-ng log server are affected by chain_hostnames() *at all*?! Puzzled, Wolfram :)

2 1

Re: Reloading configuration
by G.W. Haywood 27 Nov '06

27 Nov '06

Hi there, On Sat, 25 Nov 2006 syslog-ng-request(a)lists.balabit.hu wrote: > Just a question: We figured that out for ourselves... :) > Can syslog-ng reload its configuration file (changed) without being > restarted? I couldn't find anything related in the documentation. You didn't see the man page? Admittedly it says it isn't up to date, but it does answer the question in the second paragraph of DESCRIPTION. Sending syslog-ng the HUP signal does not restart it (so it will have the same PID as it did before the HUP sinal was received) but it does cause it to re-read its configuration file, and also to close and then reopen any log files. If the new configuration is OK, it will use it. If it isn't, it will carry on using the old one. -- 73, Ged.

2 1

RE: [syslog-ng] Reloading configuration
by Anselmo Lacerda S. de Melo 24 Nov '06

24 Nov '06

4 3

Reloading configuration
by Anselmo Lacerda Silveira de Melo 24 Nov '06

24 Nov '06

Hi Just a question: Can syslog-ng reload its configuration file (changed) without being restarted? I couldn't find anything related in the documentation. Thanks in advance Anselmo -- ------------------------------------- Anselmo Lacerda Silveira de Melo Estagiário de P&D AsGa | *Acesso* | Sistemas | Wireless E-mail: anselmo.melo(a)asga.com.br Skype: anselmo.asga http://www.asga.com.br -------------------------------------

2 1

Silence syslog-ng upon connection reopening?
by Wolfram Schlich 24 Nov '06

24 Nov '06

Hi, is it possible to silence syslog-ng running on a log client when it reopens a TCP connection to the syslog-ng log server? For example, when you restart syslog-ng on the server due to some configuration change or whatever other reason, syslog-ng on the log client logs this to syslog.err: syslog-ng[13214]: io.c: do_write: write() failed, EOF detected syslog-ng[13214]: pkt_buffer::do_flush(): Error flushing data syslog-ng[13214]: Connection broken to AF_INET(log-server:514), reopening in 10 seconds Can I make syslog-ng NOT log those messages until, let's say, the reopening failed at least N times? The reason is I am using tenshi to monitor the remote logs on the log server in order to alert me about messages with the severities err, crit and emerg. I can, however, add special trash patterns to my tenshi config to disregard the above messages, but I don't feel comfortable about it (for example, when there was a real problem, like a network outage for, let's say, more than 60 seconds). Switching to UDP does not look like a brilliant alternative either ;) Best regards -- Wolfram Schlich

2 4

syslg-ng hangs on damnsmalllinux boot
by Heiko Blume 23 Nov '06

23 Nov '06

Hello, i try to run syslog-ng 2.0.0 compiled with eventlog-0.25 and glib-2.12.4 on damnsmalllinux 3.0.1 (knoppix variant based on linux 2.4.26). It is started in a script like this which is called from bootlocal.sh sudo /opt/syslog-ng/sbin/syslog-ng \ --cfgfile=/opt/syslog-ng/etc/syslog-ng.conf \ --chroot=/data/var/log \ --user=65534 \ --group=65534 unfortunately it will hang causing mischief, like programs blocking on it, so the boot script does not complete and no login is possible at all. it can only be killed with "-9". The "messages" and "syslog" logfiles look like this, so the chroot etc has worked correctly, the config is valid etc etc: Nov 22 00:19:22 s_all@box syslog-ng[682]: syslog-ng starting up; version='2.0.0' Nov 22 00:19:22 s_all@box kernel: Linux version 2.4.26 (root@Knoppix) (gcc versi on 2.95.4 20011002 (Debian prerelease)) #1 SMP Sa Apr 17 19:33:42 CEST 2004 [blaaaaaaaaaaaaah] Nov 22 00:19:22 s_all@box kernel: Linux agpgart interface v0.99 (c) Jeff Hartmann But hereafter nothing happens anymore :-((( If it is started manually later on it seems to work. I tried starting it with --debug, but that didn't say anything at all, although i ran configure with --enable-debug (is that relevant?) I applied the patch from http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg265412.html to prevent blocking on tty's but that didn't help. In the config file i then set use_dns(no) and commented out the usertty() destination, so it is only logging to files. no external programs, pipes etc are used. the only source used is this: source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-dgram("/dev/log"); unix-dgram("/data/tftpboot/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the next line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) udp(); tcp(); }; any help would be appreciated!!! regards, -- Heiko(a)Blume.AG

2 8

comm method with clients
by Constantine Kousoulos 23 Nov '06

23 Nov '06

Hello, From what i read in the reference manual, there is a fixed number of available source drivers (internal, file, tcp, etc) in syslog-ng. I would like to develope a new kind of driver (communication method) to collect messages from clients. Is syslog-ng customizable enough to accomplish something like that relatively easy? :) I am a newbie in this mailing list so please forgive me if my question sounds too naive. Thanks, Constantine

2 1

Syslog-ng load testing
by Vaibhav Goel 22 Nov '06

22 Nov '06

Hi all I am planning to do some capacity and load testing our syslog-ng servers over TCP. Towards that end, I will be writing a script to send packets to a syslog-ng host. Has anyone done anything similar? I was just thinking of writing a simple script that will open multiple sockets to the server and send a message (based upon our current calculated average message size). Any other suggestions are appreciated. Thanks,

4 15