May 2006 - syslog-ng - lists.balabit.hu

Solaris 8 login hangs
by Neill Flynn 19 May '06

19 May '06

I have been running syslog-ng 1.6.6 in a Solaris/RH environment (almost 70 syslog-ng clients). All works fine but for two Solaris machines which do not allow me to su from my own account, if I "su -", the process hangs indefinitely. I can open a second connection and kill part of the su process and gain access. When I switch off syslog-ng and start syslog, all work fine. Also, both the local files and the remote syslog-ng server log the su as it happens. Anyone any ideas? ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

1 0

Re: [syslog-ng] syslog-ng stalls system
by Tony Davis 18 May '06

18 May '06

> Hi > > I've ran into serious problems yesterday with my Debian server and > finally was able to nail down the problem to syslog-ng and/or the > logging subsystem (or whatever it is called). I first noticed troubles > after I did a apt-get install, which hang while installing ssl-cert due > to a failure to create a group (connected to the symptoms mentioned > below). > > Symptoms: > - a growing number of unterminated /USR/SBIN/CRON processes (strace: > "connect(7, {sa_family=AF_FILE, path="/dev/log"}, 16") > - unable to 'su <user>' (Ctrl-C to return to shell) > - unable to establish a ssh connection (terminal hangs after entering > password, sshd <defunct> in processes) > - unable to login physically at the server itself ("You have new mail", > but no command line, Ctrl-C to return to the login screen) > - when logged in prior the failures, either 'shutdown' nor 'reboot' > have any effect (system must be shut down by /etc/init.d/reboot stop) > - no new entries in /var/log/cron.log or /var/log/syslog > > Temporary Cure: > - reboot and prevent syslog-ng from starting at boot > > Sidenotes: > - All other services work as expected > > I've got to know Linux in recent years, but it seems I'm not capable of > solving such a difficult issue by myself. Do you have any suggestions? > > Thank you very much! > Kind regards > Mario Hi Mario, I reported the exact same problem back on the 5th May but, so far, I haven't found a resolution. This was running syslog-ng version 1-6-10-1 on RedHat EL 3 using the RedHat conf file in the contribs directory bundled with the source. Tony ***************************************************** You can find us at www.voca.com ***************************************************** This communication is confidential and intended for the exclusive use of the addressee only. You should not disclose its contents to any other person. If you are not the intended recipient please notify the sender named above immediately. Registered in England, No 1023742, Registered Office: Voca Limited Drake House, Three Rivers Court, Homestead Road, Rickmansworth, Hertfordshire, WD3 1FX This message has been checked for all email viruses by MessageLabs.

3 2

log messages with LF
by PREVOSTO, Laurent 18 May '06

18 May '06

Hi, i'm afraid this is some kind of FAQ but is there a way to have syslog-ng correctly prints logs messages that contain LF ('\n') ? It looks like they are wiped out in log_msg_parse() (logmsg.c) but is there a reason for such a behaviour ? Regards Laurent

2 1

syslog-ng stalls system
by Mario Aeby 18 May '06

18 May '06

Hi I've ran into serious problems yesterday with my Debian server and finally was able to nail down the problem to syslog-ng and/or the logging subsystem (or whatever it is called). I first noticed troubles after I did a apt-get install, which hang while installing ssl-cert due to a failure to create a group (connected to the symptoms mentioned below). Symptoms: - a growing number of unterminated /USR/SBIN/CRON processes (strace: "connect(7, {sa_family=AF_FILE, path="/dev/log"}, 16") - unable to 'su <user>' (Ctrl-C to return to shell) - unable to establish a ssh connection (terminal hangs after entering password, sshd <defunct> in processes) - unable to login physically at the server itself ("You have new mail", but no command line, Ctrl-C to return to the login screen) - when logged in prior the failures, either 'shutdown' nor 'reboot' have any effect (system must be shut down by /etc/init.d/reboot stop) - no new entries in /var/log/cron.log or /var/log/syslog Temporary Cure: - reboot and prevent syslog-ng from starting at boot Sidenotes: - All other services work as expected I've got to know Linux in recent years, but it seems I'm not capable of solving such a difficult issue by myself. Do you have any suggestions? Thank you very much! Kind regards Mario -- Mario Aeby Stritenstrasse 47 CH-3176 Neuenegg Mobile 078 690 50 11 Fax 031 741 28 93 http://www.eMeidi.com/

3 2

syslog-ng GUI
by Arya, Manish Kumar 18 May '06

18 May '06

Hi Guys, I am storing logs on a central server having 3T SAN, using follwing template destination indexlog { file("/logs/log01/indexlog/$YEAR/$MONTH/$DAY/$HOST" template("$HOUR:$MIN:$SEC,$PROGRAM,$FACILITY,$PRIORITY,$MSGONLY\n") template-escape(yes) owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; my logging is done perfectly :) like /logs/log01/indexlog/2006/05/11/hostnames I want to have a GUI to view logs with following facilities -search logs on basis on date/time, text patterns in messages,hostnames. -should provide facility to have filters associated with user authentication/authorization. -should be able to to parallel search to improve search response time. Regards, -Manish __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

8 13

error installing
by Raymond Norton 17 May '06

17 May '06

Any idea how to fix this? /home/admin/syslog-ng-1.6.10/src/cfg-lex.c:1126: undefined reference to `yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/home/admin/syslog-ng-1.6.10/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/admin/syslog-ng-1.6.10/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/admin/syslog-ng-1.6.10/src' make: *** [all-recursive] Error 1

3 3

Newbie Looking for Help
by Mark R. White 16 May '06

16 May '06

I want to setup a syslog-ng server to do syslogging for my network. So far it's easy, the part I'm having trouble with, and I'm not even sure if it's possible, is I want to log by device to it's own individual syslog file. Hence the reason for using syslog-ng vice sysklogd, I think the syntax would be something as follows, but I could be way off base. device1 /var/log/network/device1 log { source(device1) filter (?????) destination (?????) }; I also don't understand where to define the facilities as I did in standard syslog. Any help would be greatly appreciated. One other quick question, when I do a default install of syslog-ng (on Debian Etch), it automatically logs to the tty. Is this correct for all versions, and whether it is or it's not, how do I stop it? Thanks again, Mark

5 9

Help: Cannot open file for writing (Permission denied)
by Muath Al Khalaf 15 May '06

15 May '06

Hi, I have just installed syslog-ng on Redhat enterprise 4. I am using it as remote logging server for a syslog-ng client. Here is my remote logging configuration: source s_remote { tcp(ip(0.0.0.0) port(514)); udp(ip(0.0.0.0) port(514)); }; destination d_separatedbyhosts { file("/var/log/syslog-ng/$HOST/messages" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes)); }; log { source(s_remote); destination(d_separatedbyhosts); }; I am getting the following error message in /var/log/syslog-ng.log on the same machine using tail "cannot open file /var/log/syslog-ng/host1messages for writing (Permission denied)" I have tried to create the file myself and give it 777 permission along with all the directories /var, /var/log, /var/log/syslog-ng If you notice here, 1- syslog-ng is writing error messages from the same machine to /var/log/syslog-ng which means syslog-ng is working well for local logging on the same machine ( I have stopped syslogd). 2- The error has a file name "host1messages" while in the configuration file it is "/$HOST/messages" 3- I am accessing the syslog-ng server using remote SSH from windows using putty client. When I open the /var/log/syslog-ng.log file using "vi" I got a strange character instead of "/" in the previous error message between "host1" and "messages". While - as you have seen above - using tail I do not get any character neither / nor the strange one in the syslog-ng file. Kind regards

1 0

RE: [syslog-ng] Newbie Looking for Help
by Mark R. White 13 May '06

13 May '06

Thanks for all the help I've received so far. Although, I'm still not able to do what I need to do. Right now, I just want to log one specific device to a specific log file. One email I received said I should use the netmask filter option, although for some reason, my system doesn't like that option. Here is the temp syslog-ng.conf I'm using. I have the full backed up, I just want to get this part working. Syslog-ng starts, but it doesn't actually log any thing. I cut this down so it would be easier to work with, although it's very possible that I cut out a required part of the log file. As of right now, I don't care if it logs any from the local system. I just need to log the pix device listed. Thanks in advance for any help, Mark # # Configuration file for syslog-ng under Debian # # attempts at reproducing default syslog behavior # the standard syslog levels are (in descending order of priority): # emerg alert crit err warning notice info debug # the aliases "error", "panic", and "warn" are deprecated # the "none" priority found in the original syslogd configuration is # only used in internal messages created by syslogd ###### # options options { # disable the chained hostname format in logs # (default is enabled) chain_hostnames(0); # the time to wait before a died connection is re-established # (default is 60) time_reopen(10); # the time to wait before an idle destination file is closed # (default is 60) time_reap(360); # the number of lines buffered before written to file # you might want to increase this if your disk isn't catching with # all the log messages you get or if you want less disk activity # (say on a laptop) # (default is 0) #sync(0); # the number of lines fitting in the output queue log_fifo_size(2048); # enable or disable directory creation for destination files create_dirs(yes); # default owner, group, and permissions for log files # (defaults are 0, 0, 0600) owner(root); group(root); perm(0644); # default owner, group, and permissions for created directories # (defaults are 0, 0, 0700) dir_owner(root); dir_group(root); dir_perm(0744); # enable or disable DNS usage # syslog-ng blocks on DNS queries, so enabling DNS may lead to # a Denial of Service attack # (default is yes) use_dns(no); # maximum length of message in bytes # this is only limited by the program listening on the /dev/log Unix # socket, glibc can handle arbitrary length log messages, but -- for # example -- syslogd accepts only 1024 bytes # (default is 2048) #log_msg_size(2048); }; # sources # all known message sources source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the above line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) udp(); }; #destinations for log files destination corppix_d { file ("/var/log/network/corppix/pix.log" owner (root) group (root) perm (0644) dir_perm (0744)); }; #filters filter corppix_f { netmask("10.10.10.2"); facility(local4); }; # logs log { filter(corppix_f); destination(corppix_d); };

2 1

Tokenizing messages
by Dukes Clayton 13 May '06

13 May '06

Hi Folks, I'm trying to figure out if there is a way to further parse incoming messages. Right now I have: destination db_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") template-escape(yes)); }; But I want to take $MSG and parse it into individual tokens. How can I accomplish this? Tia! -Clayton

1 0