May 2006 - syslog-ng - lists.balabit.hu

Searching past posts?
by jarrod.schous＠sasktel.sk.ca 05 May '06

05 May '06

Is there a way to search the past posts so I don't need to waste everyone valuable time with questions that have likely been asked many times before? NOTICE: This confidential e-mail message is only for the intended recipient(s). If you are not the intended recipient, be advised that disclosing, copying, distributing, or any other use of this message, is strictly prohibited. In such case, please destroy this message and notify the sender.

2 1

Problem logging messages from console server
by Berthold Cogel 05 May '06

05 May '06

Hello! I've build our loghost with syslog-ng 1.6.9 on a RHEL 3 system with destinations which include the hostnames: destination d_mesg { file ("/var/local/logmaster/$HOST/messages"); }; ... Global options are: check_hostname (yes); keep_hostname (yes); use_dns (yes); dns_cache (yes); use_fqdn (yes); chain_hostnames (no); create_dirs (yes); This works as expected for all hosts, except one. Our console server (Digi CM 32) sends lines like LOCAL1.NOTICE: May 4 09:53:17 Data Buffering: ... This gets logged by syslog-ng as 'May 4 09:53:17 Data Buffering: ... ' for a host 'Data'. With the syslog, that comes with RHEL 3, I get log entrys like 'May 4 09:53:17 digi-cm32 Data Buffering: ... '. To me this doesn't look like a DNS problem. The log format of the console server looks similar to the format I get when I transfer the log entrys via a second syslog-ng: <facility>.<level>: <date> <host> DATA I've run out of ideas at the moment. Any help is welcome. Regards Berthold Cogel

2 2

Howto avoid or reduce nr of STATS dropped?
by Martin Meiler 04 May '06

04 May '06

Hello everybody, we face a problem with our log-server at our department since the last few weeks. Previously there was no problem concerning this log-server but now we get messages like syslog-ng[...] STATS: dropped 38142 or sometimes even more. How can we avoid these dropped messages? Or how can we influence the number of dropped messages? Or why are messages dropped? Since the syslog protocol is based on UDP we can not really avoid that some packets are dropped if many of them arrive at nearly the same time, or is there a solution. Thanks for an answer. Best regards Martin -- -------------------------------------------------------------------- _/ _/_/ _/_/_/ Friedrich Alexander Universität Erlangen _/ _/ _/ _/ Lehrstuhl für Sensorik _/ _/ _/ Paul-Gordanstr. 5, 91052 Erlangen, Germany _/ _/_/ _/_/ _/ _/ _/ University of Erlangen _/ _/ _/ _/ Department of Sensor Technology _/_/_/ _/_/ _/_/_/ Paul-Gordanstr. 5, 91052 Erlangen, Germany Dipl.-Ing. Martin Meiler tel.: (+49)-9131-85-23140 fax.: (+49)-9131-85-23133 email: Martin.Meiler(a)lse.eei.uni-erlangen.de

2 1

TTL patch, helpful for multicasting logs
by Alexander Clouter 04 May '06

04 May '06

Hi, After my earlier multicast patch I quickly realised that if syslog-ng is actually sending UDP multicast syslog data the TTL on the IP packets is by default 1. This results in the packet being expired at the gateway and never being able to leave the subnet....not too handy :( After clobbering it around for a few days I have rolled out this patch to address the problem which should be applied in addition, and after, the multicast patch I released the other day (also re-included in this email). The patch adds a new parameter to the destination tcp()/udp() drivers called ttl() and it takes a number between 0 and 255. When set to zero, it uses the default kernel parameter[1] but when set to 1->255 the TTL on the packet being sent is set to this. Of course if the parameter is not specified it defaults to zero. This should now allow you to use destination du_moo { udp("239.1.2.3" port(514) ttl(7)); }; in your config files. It works on unicast traffic too, I guess you could use it as a layer of defence to guarentee that your syslog packets never leave your network by setting the TTL to a low value. I always wanted to get around to emailing the samba folk a TTL patch to do this sort of thing, so roaming samba laptop users could get some feeling of security that only the local network can get access to their shares....however this is now getting a bit offtopic :) Hope you all find it useful, now back to my multicasting syslog cluster :) Cheers Alex [1] under linux its one, and probably the same for most OS's

2 5

Silent fail on program() without execute bit
by Brian A. Seklecki 03 May '06

03 May '06

When an external program is not executable by the user running the syslong-ng process, messages sent to destination{}; with system fail silently. Even ith "-dvv" flags, there's no indication of a problem. No mention of this behavior as a feature in the docs, either. l8* -lava

1 0

Weird issue
by Didier Conchaudron 03 May '06

03 May '06

Hi folks, I've a loghost receiving tons of logs from many servers and I'm experiencing problems regarding 2 destinations: a log forwarding to another server, and written logs for each servers. The logs forwarding work for most of the servers described into the filter written bellow, but some logs from some servers are not forwarded. First I think about a mistake into my regexp. For example, for the server ptcassidc01.ad5.ad.foo.com , I tried host("ptcassidc01.ad5.ad.foo.com"), host("ptcassidc01*"), and host("ptcassidc01") but none works. For the written log files I've the same problem, the logs which are not forwarded are not written too. So I'm thinking of a filter issue. Maybe it's too big and it can't be parsed rightly. It's not a network issue, the network load is about 250 Kb/sec. Regards, Didier Conchaudron Here're the destinations: destination dest_soc_pilot_project { udp("an ip address" port(514) ); }; destination dest_soc_exaprotect_agent { file("/data/logs/exaprotect/$HOST" owner(syslog) group(syslog) perm(0644)); }; Here's the filter I use: filter f_soc_pilot_project { level(info...emerg) and not facility(mail) and ( host("bcv51se9") or host("bcv50s56") or host("bcv50s9b") [ many many others, maybe 100 ] or host("plwarsidc01") or host("ptcassidc01") ); }; And finaly the log statements: log { source(net); filter(f_soc_pilot_project); destination(dest_soc_pilot_project); }; log { source(local); filter(f_soc_pilot_project); destination(dest_soc_pilot_project); }; log { source(net); filter(f_soc_pilot_project); destination(dest_soc_exaprotect_agent); }; log { source(local); filter(f_soc_pilot_project); destination(dest_soc_exaprotect_agent); }; Here're the main options: options { owner("root"); group("root"); dir_perm(0750); perm(0640); log_fifo_size(10000); chain_hostnames(no); keep_hostname(yes); check_hostname(yes); use_dns(yes); dns_cache(yes); dns_cache_size(1000); dns_cache_expire(36000); dns_cache_expire_failed(900); use_fqdn(yes); create_dirs(yes); use_time_recvd(no); stats(6000); sync(50); }; ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

Remote SYSLOG-NG logging - can't log from remote
by rlubbers＠sysctl.net 03 May '06

03 May '06

I am at my wits end with this. Some devices are logging remotely, but others are not. I can see the packets arrive on UDP port 514 using tcpdump, but the packets don't get recorded in the proper file. I have tried nearly everything, and I am certain I am doing something silly, but maybe you can help out. Here is my syslog-ng.conf.file: ************************************************************* source local { unix-dgram("/var/run/log"); udp(ip(0.0.0.0) port(514)); internal(); }; ### SECURITY LOG - This logs filter f_9 { facility(security) and level(debug..emerg); }; destination d_3 { file("/var/log/security" create_dirs(yes)); }; log { source(local); filter(f_9); destination(d_3); }; ### MAIL LOG - This logs filter f_12 { facility(mail) and level(info..emerg); }; destination d_5 { file("/var/log/maillog" create_dirs(yes)); }; log { source(local); filter(f_12); destination(d_5); }; ### PHONE DACS LOGS - This also logs filter f_40 { level(debug..emerg) and host("172.12.67.28"); }; destination d_60 { file("/var/log/dacs/ftldgaaw_dac_1.log" create_dirs(yes)); }; log{ source(local); filter(f_40); destination(d_60); }; ### ROUTER LOG - This does NOT log filter f_19 { host("192.168.1.128"); }; destination d_19 { file("/var/log/netrouter_pisst.log" create_dirs(yes)); }; log{ source(local); filter(f_19); destination(d_19); };

2 1

how to start the syslog-ng demeaon
by wayne yu 03 May '06

03 May '06

Hi: I configured my syslog-ng on the solaris 9 computer.' when I did /etc/init.d/syslog start, and then ps -ef |grep syslog-ng, nothing is list. How can i find out how the syslog-ng works. Thanks Wayne __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

syslog-ng hanging?
by Tony Davis 03 May '06

03 May '06

Hi, I recently converted our RedHat EL servers (Release 3 Update 6) form the sysklog package to syslog-ng. On some of the servers syslog-ng appears to be occasionally hanging, i.e. messages stop getting written to the various log files. This also has a knock on effect of stopping logins, cron jobs hanging, etc, presumably because they are waiting to write to a log file. I read in the archives that this can be caused by something else using /dev/log but there's no other syslogd or minilogd processes running and lsof gives the following: COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1384 root 5u unix 0xf778c880 1703 /dev/log syslog-ng 1384 root 6u unix 0xf777e8c0 1715 /dev/log I'm using the RedHat conf file bundled in the contribs directory that comes with the source code. Any ideas would be welcome. Thanks Tony ***************************************************** You can find us at www.voca.com ***************************************************** This communication is confidential and intended for the exclusive use of the addressee only. You should not disclose its contents to any other person. If you are not the intended recipient please notify the sender named above immediately. Registered in England, No 1023742, Registered Office: Voca Limited Drake House, Three Rivers Court, Homestead Road, Rickmansworth, Hertfordshire, WD3 1FX This message has been checked for all email viruses by MessageLabs.

3 2

syslog-ng 1.6.10 release broken
by Balazs Scheidler 01 May '06

01 May '06

Hi, It came to my attention that syslog-ng 1.6.10 broke file("/proc/kmsg") support with the recent performance improvement patches as /proc/kmsg does not support nonblocking mode. The issue might cause the complete system to deadlock. Non-Linux platforms, or installation where /proc/kmsg is not directly processed by syslog-ng is not affected. I'm going to release 1.6.11 as soon as possible to fix this issue. -- Bazsi

1 0