April 2006 - syslog-ng - lists.balabit.hu

RE: [syslog-ng] Apache 2 + logger + syslog-ng
by Doyon, Jean-Francois 12 Apr '06

12 Apr '06

Sorry, Here's the system information: syslog-ng 1.6.9 built from source (on both ends) CentOS/RHEL 4.3 (on both ends) Apache 2.2 built from source as well /usr/bin/logger from package util-linux-2.12a-16.EL4.12 Thanks, J.F. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: April 11, 2006 8:03 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Apache 2 + logger + syslog-ng On Mon, 2006-04-10 at 14:04 -0400, Doyon, Jean-Francois wrote: > Hello, > > I've implemented centralized logging for my web servers using > syslog-ng and Apache's log pipe functionality. > you forgot to mention syslog-ng version, which is an important piece of information when reporting a problem. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Antw: Re: [syslog-ng] log_fifo_size and locked tables (Abwesenheitsnotiz)
by Stephan Hendl 12 Apr '06

12 Apr '06

Sehr geehrte Damen und Herren, ich bin vom 12.-21.04.2006 nicht im Hause. In dringenden Fällen wenden Sie sich bitte an Herrn Göring (Tel. -545). Viele Grüße Stephan Hendl

1 0

Regarding flush_timeout option !
by Arumugam, Rama 11 Apr '06

11 Apr '06

Hi, We're trying to use syslog-ng to log messages in an application. I'm trying to use sync option to buffer some messages and then flushing but I would like to use a combination of flushing based on the number of messages and time. I found out there's an option flush_timeout which does timely flushing irrespective of the number of messages specified with sync option but that option doesn't seem to work with my version of syslog-ng 1.6.9. Does anybody have any idea which version of syslog-ng support this option or is there any other equivalent option ? Thanks, Rama Confidentiality Notice This e-mail (including any attachments) is intended only for the recipients named above. It may contain confidential or privileged information and should not be read, copied or otherwise used by any other person. If you are not a named recipient, please notify the sender of that fact and delete the e-mail from your system.

2 1

Apache 2 + logger + syslog-ng
by Doyon, Jean-Francois 11 Apr '06

11 Apr '06

Hello, I've implemented centralized logging for my web servers using syslog-ng and Apache's log pipe functionality. All seemed to work quite well until I noticed that on the log server, where the entries get writen to file, all log lines get truncated at exactly 400 characters! I haven't messed with the log_msg_size() setting, which should be at default 2048. I still tried to increase, just to see, and it didn't change anything. I'm using the $MSGONLY template, so that the log file looks exactly like a regular Apache log file. On the log server side I have: ------ options { use_dns(no); dns_cache(no); stats(3600); }; source syslog_int { internal(); }; source apache_tcp { tcp(port(1999) keep-alive(yes) tcp-keep-alive(yes) max-connections(2)); }; destination apache_file { file("/home/atlas/var/log/access_log" template("$MSGONLY\n") template_escape(no) ); }; destination syslog_file { file("/home/atlas/var/log/syslog-ng.log"); }; log { source(syslog_int); destination(syslog_file); }; log { source(apache_tcp); destination(apache_file); }; ------ And on the log "clients" (the apache machines): ------ options { use_dns(no); dns_cache(no); stats(3600); }; source syslog_int { internal(); }; source apache_stream { unix-stream("/home/atlas/var/log/access_log.socket" keep-alive(yes)); }; destination syslog_file { file("/home/atlas/var/log/syslog-ng.log"); }; destination apache_tcp { tcp(192.168.100.91 port(1999) tcp-keep-alive(yes)); }; log { source(syslog_int); destination(syslog_file); }; log { source(apache_stream); destination(apache_tcp); }; ------ Along with: CustomLog "|/usr/bin/logger -u /home/atlas/var/log/access_log.socket" combined Anybody have any clue as to what's happening here??? I'm out of ideas ... Thanks! Jean-François Doyon Internet Service Development and Systems Support / Spécialiste de dèveloppements internet et soutien technique Canada Centre for Remote Sensing/Centre Canadien de télédétection Natural Resources Canada/Ressources Naturelles Canada http://atlas.gc.ca Tel./Tél.: (613) 992-4902 Fax: (613) 947-2410

2 1

suggestions for a web frontend to syslog data
by Doug Ahern 08 Apr '06

08 Apr '06

I've got syslog-ng logging in a traditional fashion to files on a filesystem. Some of my user community is clamoring for a web fronted with search features. Does anyone have any suggestions for any packages that might be able to provide this sort of functionality? In preparation for this, I've got the pieces together to send messages to a MySQL database, so that is no problem. Doug Ahern University System of Georgia

4 3

RE: [syslog-ng] suggestions for a web frontend to syslog data
by Heigl Florian - Munich-MR - external 07 Apr '06

07 Apr '06

> We're using Splunk (http://www.splunk.com) as a visual > front-end to our > syslog data. Wow, compared to php-syslog this seems like ferrari and fiat. Are You still happy with it? I played around in their demo site and am really amazed by it. Florian

4 4

RE: [syslog-ng] filters do not work from syslogd pipe as a source
by Lumir Unzeitig (DHL CZ) 07 Apr '06

07 Apr '06

[root@czchovwint011 root]# cat /dev/log-syslog-ng & [1] 12411 [root@czchovwint011 root]# logger -p mail.info "xxxxxxxxxxxxxxx" Apr 7 16:29:24 czchovwint011 root: xxxxxxxxxxxxxxx I tried the proposal action and it's partially clear. It is going out in the same format as it is in the syslog file file - without facility and priority. So I have to create pipe for all the lines in syslog.conf and not to use filters. Thanks a lot Jochen. Regards Lumir Unzeitig ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jochen Kirn Sent: Friday, April 07, 2006 3:09 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] filters do not work from syslogd pipe as a source 2006/4/7, Lumir Unzeitig (DHL CZ) <lumir.unzeitig(a)dhl.com>: .. It's looking like the facility, priority information has been lost after syslogd evaluation or by going through the pipe. (All events go only to /dev/null destination) Have you tried to log the messages read from the pipe without the filter to a file and post an example of the log entries to this mailling list ? I've a similar problem on AIX (5.3 ML3) where the system syslog daemon writes its messages to a named pipe and syslog ng should read from it. But for some odd reason AIX syslog adds the FACILITY and LEVEL to the log message which causes that the LEVEL field "shifts" to the right. Therefore Syslog-NG isn't able to parse this correctly, because it interpreted the FACILITY entry as program name ... I don't know what causes this, because I can't reproduce this problem on AIX 5.2 or below. regards Jochen

1 0

filters do not work from syslogd pipe as a source
by Lumir Unzeitig (DHL CZ) 07 Apr '06

07 Apr '06

Hi all, I installed syslog-ng for central logging in a company. The remote logging works perfectly. The syslog-ng machine should log its own logs to central repository and to typical /var/log by syslogd as well. I changed the original syslogd port to different one (510/udp) and created a pipe device which will be used for transport between syslogd and syslog-ng. /etc/syslog.conf ----------------------- *.info;mail.none;authpriv.none;cron.none /var/log/messages *.* |/dev/log-syslog-ng ----------------------- Generally the pipe is working the events are logged in by syslogd and syslog-ng as well. BUT if I apply any standard filter for the pipe source the statement is false in spite of should being true. Part of /etc/syslog-ng/syslog-ng.conf ----------------------------------------------------- options { ....... }source s_local { pipe("/dev/log-syslog-ng"); file("/proc/kmsg"); }; destination d_mesg_XXXX { file("/local/messages"); }; destination d_null { file("/dev/null"); }; filter f_mail_XXXX { level(debug); }; log { source(s_local); filter(f_mail_XXXX); destination(d_mesg_XXXX); }; log { source(s_local); destination(d_null); flags(final); }; ---------------------------------------------------- It's looking like the facility, priority information has been lost after syslogd evaluation or by going through the pipe. (All events go only to /dev/null destination) Any help is appreciated. Thanks Lumir Unzeitig

2 1

$HOST macro doing weird stuff
by Paul Krizak 06 Apr '06

06 Apr '06

I'm using the $HOST macro in a template, the relevant configuration bits being: template t_human_readable { template("$R_FULLDATE $HOST $FACILITY.$PRIORITY $MESSAGE\n"); template-escape(no); }; source s_external_syslog { udp(port(514)); }; destination d_big_messages { file ( "/var/log/logs/messages.log" template(t_human_readable) owner(root) group(root) perm(0644) ); }; log { source(s_external_syslog); destination(d_big_messages); }; The weird thing is that occasionally the $HOST field shows up as the IP address, but without dots, i.e. 163181224153. I haven't really discovered a pattern to it yet, but I'm wondering if maybe it's a bug in the DNS caching code. I'm using pretty large values: dns_cache(yes); dns_cache_size(10000); dns_cache_expire(3600); dns_cache_expire_failed(30); Any ideas? -- Paul Krizak 5900 E. Ben White Blvd. MS 625 Advanced Micro Devices Austin, TX 78741 Linux/Unix Systems Engineering Phone: (512) 602-8775 Microprocessor Solutions Sector Cell: (512) 791-0686

3 4

Re: [syslog-ng] I/O error since upgrade to v1.9.9-1
by ma.LAN.ge 06 Apr '06

06 Apr '06

> On Wed, 2006-04-05 at 20:00 +0200, ma.LAN.ge wrote: > > > > Yesterday I updated my Debian Etch (kernel 2.6.16-1) with syslog-ng > > > > v1.9.9-1. > > > > > > > > I had to modify syslog-ng.conf, cause syslog-ng did not start after > > > > upgrading (syntax error line xxx). > > > > > > I already reported similar issues in our bugzilla about (currently) > > > unimplemented features in the 1.9 branch which were working in the 1.6 > > > branch. Hopefully Bazsi will implement the missing features or convert > > > these errors into warnings and FIXME-s in the near future :)) > > > > > > > OK, I merged my old .conf with the new .conf and cleaned some old > .log > > > files > > > > in /var/log/. > > > > > > > > syslog-ng script started now w/o any syntax errors, but in > > > /var/log/messages > > > > folowing occurs massively and rapidly: > > > > > > > > syslog-ng: I/O error occurred while writing, error='Operation not > > > permitted > > > > (1)', fd='5' | fd='17' > > > > > > If your configuration isn't confidental, please post your > configuration > > OK, attached. (now compressed ;) > > > with the list of the /proc/[syslog-ng_pid]/fd directory. > > Hm, unbeliebvable, but true: I only restarted syslog-ng and it seems to > > work. No more errors like mentioned above occurred anymore (until now > =). > > It must have been some kind of permission problem on one/more of the > destination files. "Operation not permitted" was returned in response > for write(). OK, I've got this problem again. (see attachments, 1 for private mail) I attached the syslog and a pic from the /proc/<pid>/fd/ directory with sockets etc. The syslog seems to point me to a possible reason: while initializing my firewall with iptables rules, these I/O errors occur. After that, the errors disappear in syslog. But a good syslog should always be started before most services, cause it should log system messages ;) So it should also work while initializing my firewall rules 8) So, how can we cath this problem to find a solution? > > > > > But a question besides: How can I hide the syslog-ng 'log statistics' > list > > from being displayed in syslog? It nerves a little bit ;) > > use stats_freq(-1) in your global options. Thx for this =) -- Thx in advance "Feel free" - 10 GB Mailbox, 100 FreeSMS/Monat ... Jetzt GMX TopMail testen: http://www.gmx.net/de/go/topmail

2 1