April 2006 - syslog-ng - lists.balabit.hu

RE: [syslog-ng] HUP does not work
by Lumir Unzeitig (DHL CZ) 20 Apr '06

20 Apr '06

The problem is: A central syslog server logs huge number of maillog messages from a server. HUP signal is sent to the syslog-ng in postrotate instructions when logrotate runs. All log files are rotated properly except maillog. The old maillog messages are in the proper file, but no new file is created and thus nothing is logged for the facility . When I stop/start syslog-ng daemon it's working good. Yes, you are right. No start time of syslog-ng process gets changed when HUP is sent. Sorry my bad idea. Thanks for your help Lumir Unzeitig -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Sandor Geller Sent: Wednesday, April 19, 2006 3:31 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] HUP does not work Lumir Unzeitig (DHL CZ) wrote: > Hi, > > I use syslog-ng-1.6.9-1. When the server should be killed by HUP signal > (logrotate ) nothing happens (no time change in process table) The HUP signal doesn't kill syslog-ng, it's effect is to reopen the destinations. > I attached list of HUP action and strace of the action. You straced the kill command, not syslog-ng, so the output isn't useful. > The daemon uses pipes() and udp() as the sources. > > Do you have any idea? What problem do you want to solve? -- Sandor Geller wildy(a)balabit.hu _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

Changing sysconf dir ?!
by Jochen Kirn 19 Apr '06

19 Apr '06

Hi, Does it make sense to rework the "--sysconfdir" option of configure, so that I can define the actual directory where syslog-ng.conf is being placed ? $ ./configure --sysconfdir=/usr/local/syslog-ng/etc $ make && make install -> /usr/local/syslog-ng/etc/syslog-ng/syslog-ng.conf where it should look like /usr/local/syslog-ng/etc/syslog-ng.conf (without the unneccessary/additional 'syslog-ng' directory in /usr/local/syslog-ng/etc) any ideas ? regards Jochen

2 1

zero-loss from source{pipe()}
by Jon Stearley 19 Apr '06

19 Apr '06

manual snippet: "syslog-ng always reads its incoming log channels to prevent the running daemons from blocking." log_fifo_size() is offered as mitigation strategy. is there a way to force syslog-ng not to do this - option i've missed (or undocumented), preprocessor DEFINE, etc? why: i want to re-bin some historical logs into a $YEAR/$MONTH/$DAY/ $HOUR/$HOST file layout. syslog-ng is configured with a source pipe and destination as above, and fed via a fifo: find /historical/log/dir -type f -exec cat {} /tmp/myfifo \; but the resulting output dir is only 1/3 the size of the input dir. syslog-ng internal() messages include: syslog-ng[425]: Cannot open file /scratch/ptest/2005/05/13/13/sn5 for writing (No such file or directory) syslog-ng[425]: STATS: dropped 0 "dropped 0" seems inaccurate. this continues to happen even when log_fifo_size() is set higher than the maximum actual number of lines in an output file (which i happen to know for this test case). i could throttle feeding the pipe, but then it's trial-and-error to find the zero-loss rate. is there a better way? i'm running syslog-ng 1.6.0 on an old debian box, but since 1.6.x and 1.9.x manuals both contain the statement above i doubted an upgrade would behave differently in this respect? so i thought i'd ask. many thanks! -- +--------------------------------------------------------------+ | Jon Stearley (505) 845-7571 (FAX 844-9297) | | Sandia National Laboratories Scalable Systems Integration | +--------------------------------------------------------------+

2 3

HUP does not work
by Lumir Unzeitig (DHL CZ) 19 Apr '06

19 Apr '06

Hi, I use syslog-ng-1.6.9-1. When the server should be killed by HUP signal (logrotate ) nothing happens (no time change in process table) I attached list of HUP action and strace of the action. The daemon uses pipes() and udp() as the sources. Do you have any idea? Thanks for your help. Regards Lumir Unzeitig [root@server root]# ps -ef|grep syslog-n[g] 26 4893 1 0 15:06 ? 00:00:00 /sbin/syslog-ng -p /var/run/syslog-ng.pid -u syslog-ng -g syslog-ng -C /service/log [root@server root]# kill -HUP 4893 [root@server root]# ps -ef|grep syslog-n[g] 26 4893 1 0 15:06 ? 00:00:00 /sbin/syslog-ng -p /var/run/syslog-ng.pid -u syslog-ng -g syslog-ng -C /service/log [root@server root]# strace kill -HUP 4893 execve("/bin/kill", ["kill", "-HUP", "4893"], [/* 29 vars */]) = 0 uname({sys="Linux", node="server", ...}) = 0 brk(0) = 0x8345000 open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=77678, ...}) = 0 old_mmap(NULL, 77678, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb75e3000 close(3) = 0 open("/lib/tls/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200X\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1572440, ...}) = 0 old_mmap(NULL, 1279916, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x51c000 old_mmap(0x64f000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x132000) = 0x64f000 old_mmap(0x652000, 10156, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x652000 close(3) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb75e2000 set_thread_area({entry_number:-1 -> 6, base_addr:0xb75e2500, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 munmap(0xb75e3000, 77678) = 0 brk(0) = 0x8345000 brk(0x8366000) = 0x8366000 brk(0) = 0x8366000 open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=32148976, ...}) = 0 mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb73e2000 close(3) = 0 kill(4893, SIGHUP) = 0 exit_group(0) = ?

2 1

RE: [syslog-ng] DOMAIN Name Variable
by Breitman, Jason 18 Apr '06

18 Apr '06

Is there any update to this discussion? Will someone work on this? Thanks. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Valdis.Kletnieks(a)vt.edu Sent: Tuesday, March 14, 2006 9:24 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] DOMAIN Name Variable On Tue, 14 Mar 2006 09:04:13 GMT, David Anderson said: > Rob, > > Monday, March 13, 2006, 11:47:52 PM, you wrote: > > > that would be the TLD, yes: but i got the impression jason means > > 'domain' more like xyz.com foo.edu how.de > > > so therefore 'starting with the string before the last dot.' > > That doesn't work, as many domains outside of the US have a 3-part > domain, as in xyz.co.uk. And even within the US, the number of levels in the domain are quite flexible. For instance, most of our hosts are of the form 'hostname.dept.vt.edu' - but in a few cases, we have only 3 levels (mostly central servers), and in others we have 5 levels - the CS department has a few hosts of the form 'hostname.project.cs.vt.edu' for some large long-term groups. The only sane definition is "everything between the *first* period and the *final* period" (yes, there's a (usually implicit) trailing period in there, and some DNS resolvers would consider that 'foo.cc.' was a domain under the 'cc' top-level domain, and 'foo.cc' was 'foo.cc.vt.edu'. And forgetting the trailing dot is a favorite way to hose up an entry in a BIND zone file. ;) echo ${FQDN} | cut -d. -f2- is what you want. THE INFORMATION CONTAINED IN THIS MESSAGE AND ANY ATTACHMENT MAY BE PRIVILEGED, CONFIDENTIAL, PROPRIETARY OR OTHERWISE PROTECTED FROM DISCLOSURE. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, copying or use of this message and any attachment is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and permanently delete it from your computer and destroy any printout thereof.

1 0

RE: [syslog-ng] Changing sysconf dir ?!
by Heigl Florian - Munich-MR - external 18 Apr '06

18 Apr '06

hi, > Does it make sense to rework the "--sysconfdir" option of > configure, so that I can define the actual directory where > syslog-ng.conf is being placed ? > > $ ./configure --sysconfdir=/usr/local/syslog-ng/etc > $ make && make install > > -> /usr/local/syslog-ng/etc/syslog-ng/syslog-ng.conf > > where it should look like > > /usr/local/syslog-ng/etc/syslog-ng.conf > (without the unneccessary/additional 'syslog-ng' directory in > /usr/local/syslog-ng/etc) I stumbled over that issue and ended up using the config file path command line option instead, which is not a very beautiful way of site localization :) florian

1 0

log_fifo_size and locked tables
by Rob Munsch 17 Apr '06

17 Apr '06

'allo all, I've 1.6.9 in a centralized environment logging to MySQL. I'm currently working up a rotate system whereby: - the db is locked - mysqldump, gzip, scp off the box - rows with a timestamp older than 7 days are deleted - unlock - carry on. and was wondering a couple things. Firstly, 1) is this a horribly bad idea that should be replaced with a completely different plan? failing that, 2) How long does the default log_fifo_size of 2048 (lines, yes?) hold up, volume-wise? That is, while the tables are locked, i am assuming that this is where messages start piling up until they're unlocked. At the moment, i'm not dealing with high volume, but once everything seems in place i'm going to be adding many more hosts. is there any kind of rule of thumb for this value vis-a-vis the logs generated? At what sort of daily volume should i look towards upping it? Thanks! -- Rob Munsch Solutions For Progress IT

5 7

a question about facilities in syslog-ng
by Mohsen A. Momeni 17 Apr '06

17 Apr '06

Hi, Is it possible to change the facility of messages in destination part when sending messages to TCP or UDP destination? I have seen some applications providing the option to change the facility for remote logging. They get the host and facility. Is it possible in syslog-ng or linux default syslog? Is there any other logger that support this feature? Regards, Mohsen

1 0

Problems compiling syslog-ng on RH9 with spoof source
by Veum, Gary 14 Apr '06

14 Apr '06

Hi, I'm having some difficulty building syslog-ng on RH9 with spoof source. I've looked through the archives and haven't seen this particular issue. I've tried it using 1.6.5, 1.6.7, 1.6.10. They all have the same problem. I've loaded libol-0.3.16 and libnet-1.1.2.1-2.0. It will build fine w/o spoof source enabled. The start of the compiling problem appears as below. Any suggestions? thanks. -gv if gcc -DHAVE_CONFIG_H -I. -I/usr/src/redhat/SOURCES/syslog-ng-1.6.10/src -I. -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -g -O2 -Wall -I/usr/src/redhat/SOURCES/libol-0.3.16/src -D_GNU_SOURCE -MT afinet.o -MD -MP -MF ".deps/afinet.Tpo" \ -c -o afinet.o `test -f 'afinet.c' || echo '/usr/src/redhat/SOURCES/syslog-ng-1.6.10/src/'`afinet.c; \ then mv -f ".deps/afinet.Tpo" ".deps/afinet.Po"; \ else rm -f ".deps/afinet.Tpo"; exit 1; \ fi In file included from afinet.c:47: afinet.c.x:34: parse error before "libnet_t" afinet.c.x:34: warning: no semicolon at end of struct or union afinet.c.x:41: parse error before '}' token afinet.c.x: In function `do_afinet_dest_mark': afinet.c.x:50: dereferencing pointer to incomplete type afinet.c.x:51: dereferencing pointer to incomplete type afinet.c.x:52: dereferencing pointer to incomplete type afinet.c.x:53: dereferencing pointer to incomplete type afinet.c.x: In function `do_afinet_dest_free': afinet.c.x:59: dereferencing pointer to incomplete type

2 1

Synchronize logs after network outrage
by news gonzo news gonzo 14 Apr '06

14 Apr '06

hello, I'll have a question :) I would like to know if main server for syslog-ng is unreachable, when the connection redone, Are the 2 syslog will be synchronized ? and is there a specific message which describe the 2 events (deconnection and re-connection) ? Thx a lot --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici.

1 0