April 2006 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] I/O error since upgrade to v1.9.9-1 [again w/o attachments]
by ma.LAN.ge 06 Apr '06

06 Apr '06

> > Yesterday I updated my Debian Etch (kernel 2.6.16-1) with syslog-ng > > v1.9.9-1. > > > > I had to modify syslog-ng.conf, cause syslog-ng did not start after > > upgrading (syntax error line xxx). > > I already reported similar issues in our bugzilla about (currently) > unimplemented features in the 1.9 branch which were working in the 1.6 > branch. Hopefully Bazsi will implement the missing features or convert > these errors into warnings and FIXME-s in the near future :)) > > > OK, I merged my old .conf with the new .conf and cleaned some old .log > files > > in /var/log/. > > > > syslog-ng script started now w/o any syntax errors, but in > /var/log/messages > > folowing occurs massively and rapidly: > > > > syslog-ng: I/O error occurred while writing, error='Operation not > permitted > > (1)', fd='5' | fd='17' > > If your configuration isn't confidental, please post your configuration OK, attached. (now compressed ;) > with the list of the /proc/[syslog-ng_pid]/fd directory. Hm, unbeliebvable, but true: I only restarted syslog-ng and it seems to work. No more errors like mentioned above occurred anymore (until now =). But a question besides: How can I hide the syslog-ng 'log statistics' list from being displayed in syslog? It nerves a little bit ;) > > Unfortunately there are issues with the current 1.9.9 version. Syslog-ng > 1.9.x entered into debian unstable and testing, so it's getting > used/tested more widely than before. If your machine is in production > use, I recommend to downgrade to the latest 1.6.x package, and hold it > until the remaining issues will be fixed. -- Thx in advance. E-Mails und Internet immer und �berall! 1&1 PocketWeb, perfekt mit GMX: http://www.gmx.net/de/go/pocketweb

2 2

I/O error since upgrade to v1.9.9-1 [again w/o attachments]
by ma.LAN.ge 06 Apr '06

06 Apr '06

Hi everybody out there =) Yesterday I updated my Debian Etch (kernel 2.6.16-1) with syslog-ng v1.9.9-1. I had to modify syslog-ng.conf, cause syslog-ng did not start after upgrading (syntax error line xxx). OK, I merged my old .conf with the new .conf and cleaned some old .log files in /var/log/. syslog-ng script started now w/o any syntax errors, but in /var/log/messages folowing occurs massively and rapidly: syslog-ng: I/O error occurred while writing, error='Operation not permitted (1)', fd='5' | fd='17' Please help me =) [I've sent this message again w/o attachments, cause maybe my first mail was too big for this list.] -- Thx in advance =) Analog-/ISDN-Nutzer sparen mit GMX SmartSurfer bis zu 70%! Kostenlos downloaden: http://www.gmx.net/de/go/smartsurfer

3 3

IPv6 support
by Michael Clark 05 Apr '06

05 Apr '06

We've got a client looking into moving to IPv6 and their asking if syslog-ng support IPv6. My initial response is sure if the OS supports IPv6 (Solaris in this case, which it does). However, there are some address centric parameters in the configuration file that might be affected by IPv6. I checked the FAQ but didn't find anything on the search. Does anyone know if IPv6 support works with syslog-ng? BTW, this is a large network which will have lots of legacy IPv4 networks that it will have to connect to as well so this isn't going to happen within the next year. It's more of a planning question so they can start mapping out the change. ______________________ Michael W. Clark Adaptive Architecture, Inc. (www.adapt2.com) mclark(a)adapt2.com

2 2

syslog-ng dying after reload
by Rune V. Sjøen 05 Apr '06

05 Apr '06

When logrotate does this: /var/log/messages { rotate 4 weekly missingok notifempty postrotate /etc/init.d/syslog-ng reload >/dev/null <--- this endscript } syslog-ng dies without any trace in the logs. '/etc/init.d/syslog-ng restart' works fine. I've included an strace[1] of '/etc/init.d/syslog-ng reload' and the syslog-ng config file[2]. This is version 1.9.9-1 Any help in this matter would be appreciated. [1] Strace execve("/etc/init.d/syslog-ng", ["/etc/init.d/syslog-ng", "reload"], [/* 15 vars */]) = 0 uname({sys="Linux", node="rainbow.homelinux.org", ...}) = 0 brk(0) = 0x80f5000 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=27071, ...}) = 0 old_mmap(NULL, 27071, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7fc2000 close(3) = 0 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/libncurses.so.5", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p\343\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0644, st_size=268396, ...}) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc1000 old_mmap(NULL, 273580, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f7e000 old_mmap(0xb7fb8000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x39000) = 0xb7fb8000 close(3) = 0 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/tls/libdl.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\20\f\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0644, st_size=9592, ...}) = 0 old_mmap(NULL, 12404, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f7a000 old_mmap(0xb7f7c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0xb7f7c000 close(3) = 0 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/tls/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\320O\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1266800, ...}) = 0 old_mmap(NULL, 1272764, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e43000 old_mmap(0xb7f70000, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x12d000) = 0xb7f70000 old_mmap(0xb7f78000, 7100, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f78000 close(3) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e42000 mprotect(0xb7f70000, 20480, PROT_READ) = 0 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7e426c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 munmap(0xb7fc2000, 27071) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 open("/dev/tty", O_RDWR|O_NONBLOCK|O_LARGEFILE) = 3 close(3) = 0 open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=288544, ...}) = 0 mmap2(NULL, 288544, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7dfb000 close(3) = 0 brk(0) = 0x80f5000 brk(0x80f6000) = 0x80f6000 brk(0x80f7000) = 0x80f7000 brk(0x80f8000) = 0x80f8000 getuid32() = 0 getgid32() = 0 geteuid32() = 0 getegid32() = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 time(NULL) = 1143980943 brk(0x80f9000) = 0x80f9000 open("/etc/mtab", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=242, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc8000 read(3, "/dev/hda1 / ext3 rw,acl,errors=r"..., 4096) = 242 close(3) = 0 munmap(0xb7fc8000, 4096) = 0 open("/proc/meminfo", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc8000 read(3, "MemTotal: 515576 kB\nMemFre"..., 1024) = 598 close(3) = 0 munmap(0xb7fc8000, 4096) = 0 brk(0x80fa000) = 0x80fa000 rt_sigaction(SIGCHLD, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGCHLD, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGQUIT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGQUIT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigaction(SIGQUIT, {SIG_IGN}, {SIG_DFL}, 8) = 0 uname({sys="Linux", node="rainbow.homelinux.org", ...}) = 0 brk(0x80fb000) = 0x80fb000 stat64("/root", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat64(".", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 getpid() = 6890 getppid() = 6889 getpgrp() = 6889 rt_sigaction(SIGCHLD, {0x807b7c0, [], 0}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 open("/etc/init.d/syslog-ng", O_RDONLY|O_LARGEFILE) = 3 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfcdd8f8) = -1 ENOTTY (Inappropriate ioctl for device) _llseek(3, 0, [0], SEEK_CUR) = 0 read(3, "#! /bin/sh\n#\n# skeleton\texample "..., 80) = 80 _llseek(3, 0, [0], SEEK_SET) = 0 getrlimit(RLIMIT_NOFILE, {rlim_cur=1024, rlim_max=1024}) = 0 dup2(3, 255) = 255 close(3) = 0 fcntl64(255, F_SETFD, FD_CLOEXEC) = 0 fcntl64(255, F_GETFL) = 0x8000 (flags O_RDONLY|O_LARGEFILE) fstat64(255, {st_mode=S_IFREG|0755, st_size=2199, ...}) = 0 _llseek(255, 0, [0], SEEK_CUR) = 0 brk(0x80fc000) = 0x80fc000 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 read(255, "#! /bin/sh\n#\n# skeleton\texample "..., 2199) = 2199 brk(0x80fd000) = 0x80fd000 open("/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/lib/gconv/gconv-modules", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=45568, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc8000 read(3, "# GNU libc iconv configuration.\n"..., 4096) = 4096 brk(0x80fe000) = 0x80fe000 read(3, "lias\tJS//\t\t\tJUS_I.B1.002//\nalias"..., 4096) = 4096 brk(0x80ff000) = 0x80ff000 brk(0x8100000) = 0x8100000 brk(0x8101000) = 0x8101000 read(3, "ule\tINTERNAL\t\tISO-8859-3//\t\tISO8"..., 4096) = 4096 brk(0x8102000) = 0x8102000 brk(0x8103000) = 0x8103000 brk(0x8104000) = 0x8104000 read(3, "lias\tISO-IR-199//\t\tISO-8859-14//"..., 4096) = 4096 brk(0x8105000) = 0x8105000 brk(0x8106000) = 0x8106000 brk(0x8107000) = 0x8107000 read(3, "\t\tto\t\t\tmodule\t\tcost\nalias\tCSEBCD"..., 4096) = 4096 brk(0x8108000) = 0x8108000 brk(0x8109000) = 0x8109000 read(3, "ule\t\tcost\nalias\tCP284//\t\t\tIBM284"..., 4096) = 4096 brk(0x810a000) = 0x810a000 brk(0x810b000) = 0x810b000 brk(0x810c000) = 0x810c000 read(3, "lias\tCP864//\t\t\tIBM864//\nalias\t86"..., 4096) = 4096 brk(0x810d000) = 0x810d000 brk(0x810e000) = 0x810e000 brk(0x810f000) = 0x810f000 read(3, "module\tIBM937//\t\tINTERNAL\t\tIBM93"..., 4096) = 4096 brk(0x8110000) = 0x8110000 brk(0x8111000) = 0x8111000 brk(0x8112000) = 0x8112000 read(3, "\tEUC-JP//\nalias\tUJIS//\t\t\tEUC-JP/"..., 4096) = 4096 brk(0x8113000) = 0x8113000 brk(0x8114000) = 0x8114000 brk(0x8115000) = 0x8115000 read(3, "module\t\tcost\nalias\tISO-IR-143//\t"..., 4096) = 4096 brk(0x8116000) = 0x8116000 brk(0x8117000) = 0x8117000 brk(0x8118000) = 0x8118000 read(3, "-BOX//\nmodule\tISO_10367-BOX//\t\tI"..., 4096) = 4096 brk(0x8119000) = 0x8119000 brk(0x811a000) = 0x811a000 read(3, "module\tINTERNAL\t\tEUC-JISX0213//\t"..., 4096) = 512 read(3, "", 4096) = 0 close(3) = 0 munmap(0xb7fc8000, 4096) = 0 brk(0x811b000) = 0x811b000 open("/usr/lib/gconv/ISO8859-1.so", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200\4\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0644, st_size=5340, ...}) = 0 brk(0x811c000) = 0x811c000 old_mmap(NULL, 8228, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7fc6000 old_mmap(0xb7fc7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0xb7fc7000 close(3) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 stat64("/sbin/syslog-ng", {st_mode=S_IFREG|0755, st_size=243436, ...}) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 stat64("/etc/default/syslog-ng", {st_mode=S_IFREG|0644, st_size=320, ...}) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 stat64("/etc/default/syslog-ng", {st_mode=S_IFREG|0644, st_size=320, ...}) = 0 open("/etc/default/syslog-ng", O_RDONLY|O_LARGEFILE) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=320, ...}) = 0 brk(0x811d000) = 0x811d000 read(3, "# If variables is not set here, "..., 320) = 320 close(3) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 brk(0x811e000) = 0x811e000 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 brk(0x811f000) = 0x811f000 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 brk(0x8120000) = 0x8120000 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 brk(0x8121000) = 0x8121000 rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0 _llseek(255, -9, [2190], SEEK_CUR) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7e42708) = 6891 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGCHLD (Child exited) @ 0 (0) --- waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], WNOHANG) = 6891 waitpid(-1, 0xbfcdc4ec, WNOHANG) = -1 ECHILD (No child processes) sigreturn() = ? (mask now []) rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigaction(SIGINT, {0x807a090, [], 0}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {0x807a090, [], 0}, 8) = 0 stat64(".", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat64("/sbin/start-stop-daemon", {st_mode=S_IFREG|0755, st_size=18488, ...}) = 0 stat64("/sbin/start-stop-daemon", {st_mode=S_IFREG|0755, st_size=18488, ...}) = 0 brk(0x8122000) = 0x8122000 rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7e42708) = 6892 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGCHLD (Child exited) @ 0 (0) --- waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], WNOHANG) = 6892 waitpid(-1, 0xbfcdbdac, WNOHANG) = -1 ECHILD (No child processes) sigreturn() = ? (mask now []) rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigaction(SIGINT, {0x807a090, [], 0}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {0x807a090, [], 0}, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 read(255, "\nexit 0\n\n", 2199) = 9 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 exit_group(0) = ? [2] syslog-ng.conf ###### # Standard syslog levels # emerg alert crit err warning notice info debug # Standard syslog facilities # auth, authpriv, cron, daemon, ftp, kernel, lpr, mail, news, syslog, user, uucp ###### # Options options { chain_hostnames(0); time_reopen(10); time_reap(360); #sync(0); log_fifo_size(2048); create_dirs(yes); owner(root); group(adm); perm(0640); dir_owner(root); dir_group(root); dir_perm(0755); use_dns(no); #log_msg_size(2048); stats_freq(86400); }; ###### # Sources source all { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); # udp(); }; source krnl {file("/proc/kmsg" log_prefix("kernel: "));}; source int { internal(); }; source main { unix-stream("/dev/log"); }; source net { udp(); }; ###### # Destinations destination df_auth { file("/var/log/auth.log"); }; destination df_syslog { file("/var/log/syslog"); }; destination df_cron { file("/var/log/cron.log"); }; destination df_daemon { file("/var/log/daemon.log"); }; destination df_kern { file("/var/log/kern.log"); }; destination df_lpr { file("/var/log/lpr.log"); }; destination df_mail { file("/var/log/mail.log"); }; destination df_mail_err { file("/var/log/mail.err"); }; destination df_user { file("/var/log/user.log"); }; destination df_uucp { file("/var/log/uucp.log"); }; destination df_messages { file("/var/log/messages"); }; destination df_debug { file("/var/log/debug.log"); }; destination df_network { file("/var/log/network.log"); }; destination dp_xconsole { pipe("/dev/xconsole"); }; # X console destination du_all { usertty("*"); }; # Users logged in destination df_report { file("/var/log/report.log"); }; ###### # Filters filter f_auth { facility(auth,authpriv); }; filter f_syslog { not facility(auth,authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warning { level(warn); }; filter f_error { level(err); }; filter f_critical { level(crit); }; filter f_over_info_up { level(info..emerg); }; filter f_over_notice { level(notice..emerg); }; filter f_over_warning { level(warn..emerg); }; filter f_over_error { level(err..emerg); }; filter f_over_critical { level(crit..emerg); }; filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; filter f_xconsole { facility(daemon,mail) or level(debug,info,notice,warn) or (facility(news) and level(crit,err,notice)); }; ###### # Logs # order matters if you use "flags(final);" log { source(net); destination(df_network); flags(final); }; log { source(all); filter(f_auth); destination(df_auth); flags(final); }; log { source(all); filter(f_mail); filter(f_error); destination(df_mail_err); }; log { source(all); filter(f_mail); destination(df_mail); flags(final); }; log { source(all); filter(f_cron); destination(df_cron); flags(final); }; log { source(all); filter(f_daemon); destination(df_daemon); }; log { source(all); filter(f_kern); destination(df_kern); }; log { source(all); filter(f_debug); destination(df_debug); }; log { source(all); filter(f_over_error); destination(df_report); }; log { source(all); filter(f_emergency); destination(du_all); }; log { source(all); destination(df_messages); }; log { source(all); filter(f_xconsole); destination(dp_xconsole); }; -- -=<X>=- Rune V. Sjøen You always pass failure on the way to success http://www.opensourcesolutions.no

2 6

2GB log file size restrictions 1.9 tree
by William Bell 01 Apr '06

01 Apr '06

Is there a way to configure this restriction, nothin is mentioned about it in the doc's. Up until recently I deployed 1.6 tree across all my devices and i never ran into this problem. I just recently upgraded to the 1.9 tree and now syslog-ng just crashes when a 2gb file is reached. If anyone has ANY ideas there are greatly accepted. William Bell CWIE Security

2 1