June 2006 - syslog-ng - lists.balabit.hu

messages > log_msg_size result in weird behaviour
by Seb Boving 09 Jun '06

09 Jun '06

Hi, I've been troubleshooting a weird behaviour of syslog-ng (tried 1.6.4, 1.6.8 and 1.6.11) when the message is larger than the log_msg_size() (before i had actually noticed that fact). Basically, the problem can be reduced to: ---------- config: options { log_msg_size(50); }; source src { unix-stream("/dev/log"); internal(); }; destination d1 { file("/tmp/d1"); }; destination d2 { file("/tmp/d2"); }; filter f1 { facility(user) and level(warn..emerg); }; filter f2 { facility(user) and level(info..emerg); }; log { source(src); filter(f1); destination(d1); }; log { source(src); filter(f2); destination(d2); }; ----- # log a message > log_msg_size to syslog echo '1234567890123456789012345678901234567890123456789012345678901234567890' | logger -p user.err ------ /tmp/d1 logs: Jun 8 16:46:16 src@seb1 logger: 1234567890123456789012 ----- while /tmp/d2 logs: Jun 8 16:46:16 src@seb1 logger: 1234567890123456789012 Jun 8 16:46:16 src@seb1 345678901234567890123456789012345678901234567890 change f1's "warn" to info or lower and it starts showing the full message as well. change f2's "info" to warn or higher and it stops showing the full message as well. The original problem involves messages with newline, in which case the f1 filter only seems shows the first line, but that is probably irrelevant. I assume that despite the message being larger than the max allowed size, this shouldn't happen, or did i miss anything? thanks. -seb.

1 0

RE: Syslog-ng-1.9.11 for Solaris 10
by Shah, Maunir 07 Jun '06

07 Jun '06

Sorry had to repost it again, as I wasn't registered. Thanks Maunir Shah 630-285-5875 - desk 630-550-6266 - cell ________________________________ From: Shah, Maunir Sent: Wednesday, June 07, 2006 12:05 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Syslog-ng-1.9.11 for Solaris 10 We have a created a zone in Solaris 10 but I'm installing this software on the parent server or the global zone and I was able to compile libol-0.3.18 just fine. But I'm running into issues while I do a "make" for Syslog-ng-1.9.11 and attach is the error output, which I can't seem to find any solutions on the web. Any help would be appreciated.... ke-nms06:root:#make make all-recursive Making all in src if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT misc.o -MD -MP -MF ".deps/misc.Tpo" \ -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ else rm -f ".deps/misc.Tpo"; exit 1; \ fi if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT utils.o -MD -MP -MF ".deps/utils.Tpo" \ -c -o utils.o `test -f 'utils.c' || echo './'`utils.c; \ then mv -f ".deps/utils.Tpo" ".deps/utils.Po"; \ else rm -f ".deps/utils.Tpo"; exit 1; \ fi --------more successful output-------------- if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT afunix.o -MD -MP -MF ".deps/afunix.Tpo" \ -c -o afunix.o `test -f 'afunix.c' || echo './'`afunix.c; \ then mv -f ".deps/afunix.Tpo" ".deps/afunix.Po"; \ else rm -f ".deps/afunix.Tpo"; exit 1; \ fi if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT afinet.o -MD -MP -MF ".deps/afinet.Tpo" \ -c -o afinet.o `test -f 'afinet.c' || echo './'`afinet.c; \ then mv -f ".deps/afinet.Tpo" ".deps/afinet.Po"; \ else rm -f ".deps/afinet.Tpo"; exit 1; \ fi afinet.c: In function `afinet_resolve_name': afinet.c:81: warning: implicit declaration of function `memset' afinet.c: In function `afinet_setup_socket': afinet.c:156: error: `SOL_IP' undeclared (first use in this function) afinet.c:156: error: (Each undeclared identifier is reported only once afinet.c:156: error: for each function it appears in.) afinet.c:181: error: request for member `_S6_un' in something not a structure or union afinet.c:188: error: `SOL_IPV6' undeclared (first use in this function) *** Error code 1 make: Fatal error: Command failed for target `afinet.o' Current working directory /usr/dist/syslog-ng-1.9.11/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/dist/syslog-ng-1.9.11 *** Error code 1 make: Fatal error: Command failed for target `all' ke-nms06:root:# Maunir Shah 630-285-5875 - desk 630-550-6266 - cell ******************************* IMPORTANT MESSAGE ****************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. ********************************************************************************

2 1

RE: [syslog-ng] Solaris 8 Hangs
by Neill Flynn 07 Jun '06

07 Jun '06

offending server: source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; Syslog-ng server: source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_tcp { tcp(port(5140) max-connections(200)); }; source s_udp { udp(); }; -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 07 June 2006 10:19 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Solaris 8 Hangs On Wed, 2006-06-07 at 08:47 +0100, Neill Flynn wrote: > I have been running syslog-ng 1.6.6 in a Solaris/RH environment > (almost 70 syslog-ng clients). All works fine but for two Solaris 8 > machines which do not allow me to su from my own account, if I "su -", > the process hangs indefinitely. I can open a second connection and > kill part of the su process and gain access. When I switch off > syslog-ng and start syslog, all work fine. Also, both the local files > and the remote syslog-ng server log the su as it happens. can you paste your source statement (more specifically, do you have sun_door() configured?) -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

2 1

RE: [syslog-ng] memory leak?
by Cai Wang(CD) 07 Jun '06

07 Jun '06

How can I limit it if modify the src code manually? Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Cai Wang(CD) Sent: 2006年6月7日 17:35 To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] memory leak? Thanks I used 1.6.10 now, and the memory usage grows from 5800K bytes to 9800K bytes, and I have last the traffic for 2 hours. Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 2006年6月7日 17:32 To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] memory leak? On Wed, 2006-06-07 at 17:20 +0800, Cai Wang(CD) wrote: > But, I have tested the version 1.6.5, it can be reproduced. But does it grow without limit? 8.5MB does not really ring the alarm for a busy syslog-ng process. And as I said 1.6.7 included the last leak fix and 1.6.5 is certainly before that. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] memory leak?
by Cai Wang(CD) 07 Jun '06

07 Jun '06

Thanks I used 1.6.10 now, and the memory usage grows from 5800K bytes to 9800K bytes, and I have last the traffic for 2 hours. Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 2006年6月7日 17:32 To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] memory leak? On Wed, 2006-06-07 at 17:20 +0800, Cai Wang(CD) wrote: > But, I have tested the version 1.6.5, it can be reproduced. But does it grow without limit? 8.5MB does not really ring the alarm for a busy syslog-ng process. And as I said 1.6.7 included the last leak fix and 1.6.5 is certainly before that. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] memory leak?
by Cai Wang(CD) 07 Jun '06

07 Jun '06

But, I have tested the version 1.6.5, it can be reproduced. Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 2006年6月7日 17:19 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] memory leak? On Wed, 2006-06-07 at 15:41 +0800, Cai Wang(CD) wrote: > Hi > > I have installed the Syslog-NG 1.6.10 in Red Hat 9.0 > environment, but when I test it as the following situation: > > > > Message sender à RH9 (Syslog-NG) à Message receiver > > > > They worked in Giga bits networks, but when I send message to > receiver in 800M bps rate, the memory usage of Syslog-NG last to > increase > > When Syslog-NG started, it used 5800k bytes of memory, and it > used 8500k bytes after 1 hour. > > Could u give me some advice? It might be used for internal memory based buffers (controlled by log_fifo_size) I currently don't know about any memory leaks after 1.6.7 (which was related to spoof-source support) -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Solaris 8 Hangs
by Neill Flynn 07 Jun '06

07 Jun '06

I have been running syslog-ng 1.6.6 in a Solaris/RH environment (almost 70 syslog-ng clients). All works fine but for two Solaris 8 machines which do not allow me to su from my own account, if I "su -", the process hangs indefinitely. I can open a second connection and kill part of the su process and gain access. When I switch off syslog-ng and start syslog, all work fine. Also, both the local files and the remote syslog-ng server log the su as it happens. Anyone any ideas? Thanks, Neill ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

2 1

memory leak?
by Cai Wang(CD) 07 Jun '06

07 Jun '06

Hi I have installed the Syslog-NG 1.6.10 in Red Hat 9.0 environment, but when I test it as the following situation: Message sender --> RH9 (Syslog-NG) --> Message receiver They worked in Giga bits networks, but when I send message to receiver in 800M bps rate, the memory usage of Syslog-NG last to increase When Syslog-NG started, it used 5800k bytes of memory, and it used 8500k bytes after 1 hour. Could u give me some advice? Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com

2 1

RE: [syslog-ng] Starting syslog-ng as root
by Muath Al Khalaf 02 Jun '06

02 Jun '06

Thank you very much. I have disabled SELinux and every thing goes fine. Do you think it is better to run syslog-ng with or without SELinux especially that I may use MySQL and PHP-syslog-ng? Kind regards -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jose Pedro Oliveira Sent: Saturday, May 27, 2006 6:59 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Starting syslog-ng as root -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Muath Al Khalaf wrote: > Hi, > I am using Redhat Enterprise 4. I am using the official rpm image built > by Balabit for RHE 4 with their startup script. The executable did not > return anything (at least in front of me inside console). For strace I > do not know how to use it. You may be having problems with SELinux. In RHEL4, CentOS, and Fedora Core 3 you need to enable the use_syslogng SELinux boolean before starting the syslog-ng daemon [1]. To check the use_syslogng boolean status getsebool -a | grep syslogng To enable it (and saving its value) setsebool -P use_syslogng 1 jpo [1] - you need to have the a recent selinux-policy-targeted - -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFEeHc6l0metZG9hRsRAvqLAJ41iuwCrKNhFhyG2lWyv6Q2eScdzACgmoMD QzNXnXkc4tuHT0bbK5Fl5iw= =s/7p -----END PGP SIGNATURE-----

4 7

Solaris 10
by Walt Rich 01 Jun '06

01 Jun '06

Gents, I found some instructions on the net where Roberto Nibali had successfully installed syslog-ng on Solaris 10 (although I've not seen the email come from the mailing list) and have a couple of questions: What version of syslog-ng would be best to use? I've currently installed 1.6.11 and libol 0.3.18. Where do I find the file svc.method.syslog-ng? Step 4 of Roberto's instructions are to copy that file to /lib/svc/method/syslog-ng Where do I find the file svc.manifest.syslog-ng.xml as in Step 5 the instructions read to copy this to /var/svc/manifest/system/syslog-ng.xml. Any input regarding installing syslog-ng on solaris 1- would be most appreciated. Thanks!

1 0