December 2006 - syslog-ng - lists.balabit.hu

remove_if_older()
by anthony lineham 21 Dec '06

21 Dec '06

>From the description in the reference manual I was expecting remove_if_older() to cause a destination file to be deleted once the file becomes older than the specified age, in seconds. However, this is not the behaviour I have observed. It seems that the age check is only made the first time the file is written too. I've had a quick look through the code and it looks like the age check is only made in affile_dw_init, which I assume is called when the file is first opened. This would be consistent with my observations. Is this the intended behaviour? Thanks Anthony

4 8

max-connections
by Hari Sekhon 20 Dec '06

20 Dec '06

I've got a central logserver on syslog-ng and am getting the following in my logs: syslog-ng[26180]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 but I clearly have source s_tcp { tcp( port(50514) max-connections(1000)); }; source s_udp { udp(); }; in my syslog-ng.conf and the server was restarted since this change (it was made a while ago). Can anybody tell me why this is? Is it possible that it's the udp which is hitting the 100 limit (I thought since udp was connectionless this would unlikely)? -- Hari Sekhon

3 4

newbie question on dns_cache in syslog2.x
by jrhendri＠maine.rr.com 20 Dec '06

20 Dec '06

Apologies in advance for the the newbie question. I did search the archives, the FAQ and look at the source before posting. I am configuring a fedora core 5 system with syslog-ng-2.0rc4 and have not had any success with dns_cache(yes) actually doing anything. I setup tcpdump to watch the DNS traffic and am generating logs toward the box. No matter whether I have dns_cache enabled or not I see dns lookups for each inbound message. When I look at the source code, I find the resolve_hostname() function in misc.c and I don't see any caching code. What I do see is: /* FIXME: add nscache support here */ Am I missing something? How does dns_cache(yes) actually work? I do want to use hostnames in the logging directories, but I do not want each syslog message to trigger a DNS query. Should I just use nscd on the server and not worry about it :-) Thanks again! Jim

3 3

Use of sockaddr_storage in src/fdread.c
by Albert Chin 19 Dec '06

19 Dec '06

While building syslog-ng-2.0.0 on Solaris 7/SPARC: cc -DHAVE_CONFIG_H -I. -I. -I.. -DPATH_SYSCONFDIR=\"/etc/opt/TWWfsw/syslogng20\" -DPATH_LOCALSTATEDIR=\"/var/opt/TWWfsw/syslogng20\" -I/opt/TWWfsw/libglib26/include -I/opt/TWWfsw/libglib26/lib/include -I/opt/TWWfsw/gettext014/include -I/opt/TWWfsw/syslogng20/include/eventlog -D_GNU_SOURCE -mr -Qn -xstrconst -xO2 -xtarget=ultra2 -xarch=v8plusa -c fdread.c "fdread.c", line 45: incomplete struct/union/enum sockaddr_storage: sas This platform does not have struct sockaddr_storage, as used in src/fdread.c. Is syslog-ng _only_ for IPV6 systems? -- albert chin (china(a)thewrittenword.com)

2 1

src/afstreams.c needs prototype for g_fd_set_cloexec()
by Albert Chin 18 Dec '06

18 Dec '06

src/afstreams.c should #include misc.h for the prototype of g_fd_set_cloexec(). Patch attached. -- albert chin (china(a)thewrittenword.com)

2 1

$MSG value
by news gonzo news gonzo 18 Dec '06

18 Dec '06

Hello, Should it be possible to modify the value of $MSG or $MSGONLY (with a tool like sed for example) ? Thx in advance. ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com

3 2

syslog-ng 2.0.0 successful on Mac OS X Tiger
by Orth, Alan 14 Dec '06

14 Dec '06

Good morning, For some time now I've have syslog-ng 1.6 working on Mac OS X Panther servers, but I could never get 1.6 or 1.9 (and probably some early 2.0 betas) to work. I just completed an install of 2.0.0 on a clean installed Tiger server. I don't have a complicated logging setup (4 filters, 4 logging destinations), but I do like syslog-ng's ability to eliminate the need for log rotation by logging filters and directory structures... I know I had been trying every few months over the last year or so to get this installed, and a few other people posted with trouble getting it to run, so I'll post some stats about my setup: Machine is a 2 GHz G5 Xserve running Mac OS X Server 10.4.8 (8L127). $ uname -a Darwin hostname.school.edu 8.8.0 Darwin Kernel Version 8.8.0: Fri Sep 8 17:18:57 PDT 2006; root:xnu-792.12.6.obj~1/RELEASE_PPC Power Macintosh powerpc RackMac3,1 Darwin Good work, whoever fixed it! -- Alan Orth Upward Bound - Systems Administrator User Services - Field Technician California State University, Chico x6000

3 9

syslog-ng 2.0.0 successful on Mac OS X Tiger
by Usman Wahid 14 Dec '06

14 Dec '06

Listed below: struct in6_addr { union { __uint8_t __u6_addr8[16]; __uint16_t __u6_addr16[8]; __uint32_t __u6_addr32[4]; } __u6_addr; /* 128-bit IP6 address */ }; On Mon, 2006-12-04 at 14:00 +0800, Usman Wahid wrote: >Hi, > >I am getting the following error message, while compiling syslog-ng-2.0 on >Mac OS X server 10.4.6, > >dnscache.c: In function 'dns_cache_key_hash': >dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' >dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' >dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' >dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' >make[2]: *** [dnscache.o] Error 1 >make[1]: *** [all-recursive] Error 1 >make: *** [all] Error 2 > >I am using eventlog-0.2.6, glib-2.12.4 and pkg-config-0.21. Any ideas to >solve the problem? Can you show me the definition of struct in6_addr in your system header files? -- Bazsi _________________________________________________________________ Find singles online in your area with MSN Dating and Match.com! http://cp.intl.match.com/eng/msn/msnsg/wbc/wbc.html

2 1

syslog-ng overload
by Serge Torop 13 Dec '06

13 Dec '06

Hello, all. On my system Linux RedHat EL AS3 kernel: Linux 2.4.21-20.EL #1 Wed Aug 18 20:58:25 EDT 2004 i686 i686 i386 GNU/Linux I note high loading CPU 99% by syslog-ng. Syslog-ng version 1.6.11 (1.6.8 too), libol 0.3.18 (0.3.16 too). Is this possible to resolve high loading CPU problem? Thanks to advance. Top cmd output: 21:33:07 up 20 days, 10:13, 3 users, load average: 1,09, 1,71, 1,93 112 processes: 109 sleeping, 3 running, 0 zombie, 0 stopped CPU states: cpu user nice system irq softirq iowait idle total 21,6% 0,0% 78,4% 0,0% 0,0% 0,0% 0,0% Mem: 510932k av, 351192k used, 159740k free, 0k shrd, 80412k buff 201384k actv, 82448k in_d, 2608k in_c Swap: 1975912k av, 13060k used, 1962852k free 181536k cached PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND 23460 root 25 0 852 852 664 R 99,8 0,1 3:36 0 syslog-ng 23518 root 15 0 1188 1188 848 R 0,1 0,2 0:00 0 top 1 root 15 0 496 460 436 S 0,0 0,0 0:04 0 init 2 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 keventd 3 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 kapmd 4 root 34 19 0 0 0 SWN 0,0 0,0 0:00 0 ksoftirqd/0 7 root 25 0 0 0 0 SW 0,0 0,0 0:00 0 bdflush 5 root 15 0 0 0 0 SW 0,0 0,0 0:21 0 kswapd 6 root 15 0 0 0 0 SW 0,0 0,0 0:14 0 kscand 8 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 kupdated 9 root 15 0 0 0 0 SW 0,0 0,0 0:18 0 mdrecoveryd 18 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 raid1d 19 root 15 0 0 0 0 SW 0,0 0,0 0:05 0 raid1d 20 root 15 0 0 0 0 SW 0,0 0,0 0:14 0 raid1d 21 root 15 0 0 0 0 SW 0,0 0,0 0:03 0 raid1d 22 root 15 0 0 0 0 SW 0,0 0,0 0:03 0 kjournald 79 root 23 0 0 0 0 SW 0,0 0,0 0:00 0 khubd 1648 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 kjournald 1649 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 kjournald 1650 root 15 0 0 0 0 SW 0,0 0,0 20:21 0 kjournald # ldd /sbin/syslog-ng librt.so.1 => /lib/tls/librt.so.1 (0x00d02000) libnsl.so.1 => /lib/libnsl.so.1 (0x007b5000) libresolv.so.2 => /lib/libresolv.so.2 (0x00ef5000) libc.so.6 => /lib/tls/libc.so.6 (0x00111000) libpthread.so.0 => /lib/tls/libpthread.so.0 (0x00df5000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x00691000) # syslog-ng configuration file. # Main configuration # -------------------------------------------------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); use_time_recvd(yes); stats(3600); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log" max_connections(2000)); internal(); }; # Filters section # --------------------------------------------------------------- destination d_kern { file("/var/log/kernel/kernel.$MONTH.$YEAR"); file("/dev/tty12"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages.$FACILITY.$LEVEL"); }; destination d_auth { file("/var/log/secure/secure.$MONTH.$YEAR"); }; destination d_authinfo { file("/var/log/secure/auth-info.$MONTH.$YEAR"); }; destination d_mail { file("/var/log/mail/maillog.$DAY.$MONTH.$YEAR"); }; destination d_mailacct { file("/var/log/mail/act/mailacct.$DAY.$MONTH.$YEAR"); }; destination d_fetchm {file("/var/log/fetchmail/fetchmaillog.$DAY.$MONTH.$YEAR"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot/boot.$MONTH.$YEAR"); }; destination d_cron { file("/var/log/cron/cron.$MONTH.$YEAR"); }; destination d_mlal { usertty("*"); file("/var/log/console/console.$MONTH.$YEAR"); file("/dev/tty10"); }; destination d_named { file("/var/log/named/named.$MONTH.$YEAR"); }; destination d_iptbl { file("/var/log/iptables/iptables.$MONTH.$YEAR"); file("/dev/tty11"); }; destination d_daemons { file("/var/log/daemons/daemons-info.$MONTH.$YEAR"); }; destination d_pop { file("/var/log/pop/poplog.$DAY.$MONTH.$YEAR"); }; destination d_useradd { file("/var/log/secure/useradd.log"); }; destination d_apcupsd { file("/var/log/apc/apcupsd.log"); }; destination d_syslogngd { file("/var/log/syslog-ng/syslog-ng.$MONTH.$YEAR"); }; destination d_smartd { file("/var/log/smartd/smartd.$MONTH.$YEAR"); }; destination d_drwebp { file("/var/log/drweb/mail/drweb-postfix-$DAY.$MONTH.$YEAR"); }; # Filters sections # ----------------------------------------------------------------- filter f_filter1 { facility(kern) and not match("IPFILTER"); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron) or facility(local1) or facility(local2) or facility(local3) or facility(local4) or facility(local5) or (facility(daemon) and level(info)) or (facility(kern) and level(info)) or (facility(auth) and level(info)) ); }; filter f_filter3 { facility(authpriv) and not match("useradd"); }; filter f_filter4 { facility(mail) and not (match("mailacct") or match("fetchmail")); } ; filter f_filter5 { level(err..emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; filter f_filter9 { facility(mail) and match("mailacct"); }; filter f_filter10 { match("named"); }; filter f_filter11 { facility(kern) and match("IPFILTER"); }; filter f_filter12 { facility(daemon) and not match("dhcpd") and not match("apcupsd"); }; filter f_filter13 { facility(auth) and level(info); }; filter f_filter14 { facility(local2) and not match("pppd"); }; filter f_filter15 { facility(mail) and match("fetchmail"); }; filter f_filter18 { facility(authpriv) and match("useradd"); }; filter f_filter20 { match("apcupsd"); }; filter f_filter21 { match("syslog-ng"); }; filter f_filter22 { match("sshd"); }; filter f_filter23 { facility(local5); }; filter f_filter24 { facility(local4); }; # Bodybuilding # ------------------------------------------------------------- #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter1); destination(d_kern); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_sys); filter(f_filter9); destination(d_mailacct); }; log { source(s_sys); filter(f_filter10); destination(d_named); }; log { source(s_sys); filter(f_filter11); destination(d_iptbl); }; log { source(s_sys); filter(f_filter12); destination(d_daemons); }; log { source(s_sys); filter(f_filter13); destination(d_authinfo); destination(d_mlal); }; log { source(s_sys); filter(f_filter14); destination(d_pop); }; log { source(s_sys); filter(f_filter15); destination(d_fetchm); }; log { source(s_sys); filter(f_filter18); destination(d_useradd); }; log { source(s_sys); filter(f_filter20); destination(d_apcupsd); }; log { source(s_sys); filter(f_filter21); destination(d_syslogngd); }; log { source(s_sys); filter(f_filter22); destination(d_mlal); }; log { source(s_sys); filter(f_filter23); destination(d_smartd); }; log { source(s_sys); filter(f_filter24); destination(d_drwebp); }; -- Serge P. Torop St.Petersburg, Russia

3 3

Does -d imply -F
by Albert Chin 12 Dec '06

12 Dec '06

According to the admittedly out-of-date man page: -d, --debug Set "debug mode". Prints out various messages to aid in debugging and stops it from becoming a daemon. To activate debugging in the yacc parser, either use this option twice or combine with -v. -F, --foreground Don't fork into background. Do, does -d imply -F as -d "stops it from becoming a daemon."? Looking at src/main.c, this does not seem to be the case. do_fork=0 only when -F is specified. -- albert chin (china(a)thewrittenword.com)

2 1