February 2006 - syslog-ng - lists.balabit.hu

Make Error messages
by Stuart Boyle 28 Feb '06

28 Feb '06

I meant 2.5.31 Im running SUSE Linux. Stuart Boyle Network Engineer Cybertrust, inc . 11000 Broken Land Parkway, Suite 900 Columbia, MD 21044 Office: 443 367 7049 Cell: 410 336 3380 Fax: 443 367 7095 Email: stuart.boyle(a)cybertrust.com

1 0

RE: [syslog-ng] Make Error messages
by Stuart Boyle 28 Feb '06

28 Feb '06

Hello Bazsi I am running with flex-2.5.4, should I remove this and run 2.5.4 ?? Any help is gratefully appreciated. Stuart -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, February 28, 2006 6:46 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Make Error messages On Mon, 2006-02-27 at 16:08 -0500, Stuart Boyle wrote: > Im getting the following errors when I run make, ./configure runs > fine, no errors. > > I have bison and flex installed. Which version of flex do you have? I have flex 2.5.31 -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Filtering on date/time
by Dean Takemori 26 Feb '06

26 Feb '06

Hello, This is on a Debian system with syslog-ng 1.6.5-2.2. Is there any way to filter on the log timestamp? For example, suppose I have a (machine|program) that reboots once a day at 0400, and I don't want to log those events. I'd like to be able to set up a filter something like this ... filter match_dailyreboot { not (match("04:0[0-1]:[0-9][0-9]") and program("foo") and (match("Starting a brand new workday") or match("*many annoying daily restart message*") ) ); }; But as I understand the rules, match() only matches on the message. Is there any way in the 1.6.* series to filter on time and other bits? -dean takemori

3 2

syslog-ng 1.9.9 released
by Balazs Scheidler 26 Feb '06

26 Feb '06

Hi, I have released syslog-ng 1.9.9, a version marking the feature freeze towards syslog-ng 2.0.0. This is still a "development" release however this is more suited for production use than previous versions. The list of user-visible changes summarizing the changes since 1.9.8 can be found below. Please note that previous snapshots (dated after 2006-02-24) contained a severe problem that might have caused crashes which I have fixed in this release, but is not in the NEWS entry as 1.9.8 did not have this problem. The release is available at the usual place: http://www.balabit.com/products/syslog-ng/ The latest documentation is not yet available on the webpage, you'll have to wait for that till tomorrow when the next snapshot will be generated. 1.9.9 Sun, 26 Feb 2006 09:49:47 +0100 Some minor new features: * Added optional() option to pipe and unix drivers to make syslog-ng start even if the required directories/files do not exist. * Added DNS name resolution to udp and tcp targets. * Added a stats() keyword for 1.6.x compatibility. * Added processed counters for source/destination groups and the log center. * Added normalize_hostnames() option which converts all hostnames to lower case. * Added PID macro. * Added kernel flag to sources to indicate that messages coming from the source should default to 'kern.notice' instead of 'user.notice' * Added frac_digits() option which controls how many digits are printed in second fractions. * Added time_sleep() option to add a fixed latency to the poll loop required in some tuning situations. * Documentation updates. Changes: * Removed stats entries for files as they never lose messages and it would only clutter the log statistics output. * The meaning of the undocumented keep_timestamp() option was changed and documented, it controls whether syslog-ng uses the time of reception or the time included in the log message. Bugfixes: * Fixed port unreachable handling for UDP destinations. * Fixed PRI macro processing as it included the local hostname in addition to the priority value because of a missing break statement. * UNIX domain sockets are kept alive across SIGHUPs by default. * Fixed a possible segmentation fault on SIGHUP. * Fixed timezone extraction from incoming messages with ISO timestamp (only this syslog-ng can send these currently) * Fixed HOST_FROM, FULLHOST_FROM, SOURCEIP, DATE, R_DATE, S_DATE macros (some were still not implemented others worked incorrectly in some circumstances) * Fixed fractions of a second processing. -- Bazsi

1 0

Question about unix-dgram destinations
by Tom Morano 23 Feb '06

23 Feb '06

Hi all, I have an application that I would like to send all syslog messages to via an AF_UNIX/SOCK_DGRAM socket. I declared a unix-dgram destination in my syslog-ng.conf file and have configured syslog-ng so that it logs all messages to that destination. Everything works fine as long as my application is running before syslog-ng starts up. If I try to start up syslog-ng before my application, I get the following error message Re-Staring syslog servicesError connecting to AF_UNIX(/tmp/.mysock): Bad file descriptor and syslog-ng exits with an error. Is there any way I can have syslog-ng start before my application with a unix-dgram destination? Or am I just missing something obvious? BTW, I am using syslog-ng-1.6.8 Thanks in advance for any help with this... Tom

2 1

preparing for 1.9.9
by Balazs Scheidler 22 Feb '06

22 Feb '06

Hi, I have spent the last two days on hacking syslog-ng with a good number of fixes and couple of features requested a long time ago. Syslog-ng 1.9.8 got into Debian sid and apart from a couple of problems the house is not burning :) In summary syslog-ng 1.9.x is getting into shape, and slowly might be ready for some more production-like environments. I would like to ask you to give a try to these snapshot releases I've just uploaded to our website. Assuming no grave problems are found in the next day or two I'll release 1.9.9 and hopefully we can have a stable 2.0.0 in the nearfuture. I'm still not happy with the way log statistics (per source/destination dropped/processed counters) are written to the system log. I'm starting to think that the logfile is not necessarily the best medium to write this information to. I'm open to suggestions. The exact versions: eventlog-0.2.4+20060212.tar.gz syslog-ng-1.9.8+20060212.tar.gz The NEWS file entry is the longest ever in the history of 1.9.x, here it is: 1.9.9 Some minor new features: * Added optional() option to pipe and unix drivers to make syslog-ng start even if the required directories/files do not exist. * Added DNS name resolution to udp and tcp targets. * Added a stats() keyword for 1.6.x compatibility. * Added processed counters for source/destination groups and the log center. * Added normalize_hostnames() option which converts all hostnames to lower case. * Added PID macro. * Added kernel flag to sources to indicate that messages coming from the source should default to 'kern.crit' instead of 'user.notice' * Added frac_digits() option which controls how many digits are printed in second fractions. * Documentation updates. Changes: * Removed stats entries for files as they never lose messages and it would only clutter the log statistics output. * The meaning of the undocumented keep_timestamp() option was changed and documented, it controls whether syslog-ng uses the time of reception or the time included in the log message. Bugfixes: * Fixed port unreachable handling for UDP destinations. * Fixed PRI macro processing as it included the local hostname in addition to the priority value because of a missing break statement. * UNIX domain sockets are kept alive across SIGHUPs by default. * Fixed a possible segmentation fault on SIGHUP. * Fixed timezone extraction from incoming messages with ISO timestamp (only this syslog-ng can send these currently) * Fixed HOST_FROM, FULLHOST_FROM, SOURCEIP, DATE, R_DATE, S_DATE macros (some were still not implemented others worked incorrectly in some circumstances) * Fixed fractions of a second processing. -- Bazsi

2 3

Syslog logging failure only at boot (Mac OS X)
by Orth, Alan 17 Feb '06

17 Feb '06

List, I tried my best to search the archives for this information but I came up with no real answers. I've got three Mac OS X Panther servers running syslog-ng, and they run it very well. The only problem I have is when I reboot the servers syslog-ng starts from rc but fails to start logging. It's running, but it's not logging. I have to kill it and run it manually and then it runs. It's like it's choking on something by coming up too early in the boot process...? I've tried compiling 1.9.x to see if that fixes it, but I end up running into dependency problems down the line somewhere. (is 1.9.x that portable yet?). This is a drag when you go to check the logs from ssh, sudo, portsentry, mail, etc... and you find that syslog-ng never started logging after you rebooted 2 weeks ago. Yikes. Thanks for any insight, -- Alan Orth Upward Bound - Systems Administrator User Services - Field Technician California State University, Chico x6000

2 2

RE: [syslog-ng] Limit logging frequency of specific messages?
by SOLIS, ALEX 15 Feb '06

15 Feb '06

I don't understand. How might limiting be possible with a filter? Could you give a brief example? Thanks. Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Wednesday, February 15, 2006 5:09 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Limit logging frequency of specific messages? it should be possible with a filter, I'll add a bugreport to our bugzilla. (maybe there's one already though) On Tue, 2006-02-14 at 15:14 -0500, Frank Myhr wrote: > Hi, > > This morning a daemon went nuts and sent enough messages to fill up my > logging partition in a few seconds. As this partition is under /var > (/var/log) this made some other parts of my system unhappy. I think I've > fixed the particular problem that led to my system's self-inflicted DOS > but got to wondering if there's a way that syslog-ng could limit the > frequency with which it logs certain user-defined messages. Something > like iptables' limit match: > > -m limit --limit 15/hour --limit-burst 30 > > I haven't found a way to do this with syslog-ng 1.6.5 (debian sarge). Is > something like this feasible (or better, planned for a future release) > (or best: already there)? > > Thanks! > Frank > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

2 1

Limit logging frequency of specific messages?
by Frank Myhr 15 Feb '06

15 Feb '06

Hi, This morning a daemon went nuts and sent enough messages to fill up my logging partition in a few seconds. As this partition is under /var (/var/log) this made some other parts of my system unhappy. I think I've fixed the particular problem that led to my system's self-inflicted DOS but got to wondering if there's a way that syslog-ng could limit the frequency with which it logs certain user-defined messages. Something like iptables' limit match: -m limit --limit 15/hour --limit-burst 30 I haven't found a way to do this with syslog-ng 1.6.5 (debian sarge). Is something like this feasible (or better, planned for a future release) (or best: already there)? Thanks! Frank

2 1

Re: [syslog-ng] RFC3339 fractional second logging
by rlott＠ivhs.com 13 Feb '06

13 Feb '06

1 0