November 2007 - syslog-ng - lists.balabit.hu

syslog-ng bugzilla
by Balazs Scheidler 26 Nov '07

26 Nov '07

Hi, We have created a public bugzilla installation in order to make syslog-ng bugtracking easier. The address is: http://bugzilla.balabit.com/ >From now on, please file syslog-ng related problems there. I've also set up an automatic bugzilla->mailing list gateway, so any changes to the bugzilla will be posted to this mailing list. -- Bazsi

1 0

IPv6 Link local address use with syslog-ng
by Philip Bellino 22 Nov '07

22 Nov '07

Hello, Running syslog-ng-2.0.5 on a Linux host 2.6.22.9. syslog-ng.conf entry as follows: source s_all { tcp6(ip(2001:470:1f00:1288:220:abff:febe:4dac) port(1468)); }; When syslog-ng is started, the Global address (2001:470:1f00:1288:220:abff:febe:4dac) binds and connects fine. If I have the Link Local Address configured below: source s_all { tcp6(ip(fe80::220:abff:febe:4dac) port(1468)); }; And start syslog-ng, it either errors on the bind or the connect(g_connect in gsockaddr.c) with an errno of 22 (Invalid Argument). Looking at the code shows that there is no use of the sockaddr_in6 "sin6_scope_id", which is required to be set when using Link Local addresses since they need to use the interface number (sin6_scope_id). Has anyone run into this issue? If so, is there a workaround or a code patch for this? Thanks, Phil Bellino Phil Bellino Software Engineer MRV Communications, Inc. 295 Foster Street Littleton, MA. 01460 Phone: 978-952-4807 Fax: 978-952-5444 Email: pbellino(a)mrv.com <http://www.mrv.com/>

4 12

TMI: spam-like messages every 30 sec?
by Kim Cary 22 Nov '07

22 Nov '07

Hi folks, Every 30 seconds I get one of these messages in my syslog file, on behalf of syslog-ng, for each and every file destination (I have about 50): Reaping unused destination files; template='/var/log/blah/$YEAR/ $MONTH/$HOST/maillog' Now this happens even for very heavily used log destinations, including the firewall, which is getting a few hundred hits a minute. Basically, this is filling up my /var partition every couple days and I'd like to stop it. I haven't found the config to use to turn this log message OFF, and I would like to know why even the busiest logs are getting tagged as 'unused'. Can someone give me some clues here? Much appreciation, KC

2 1

Tuning help?
by Cole Tuininga 21 Nov '07

21 Nov '07

I have a FreeBSD 5.4 system running syslog-ng 2.0.5 - there's no load on it. If I run the following perl code: ** Begin Code ** use Sys::Syslog qw(:DEFAULT setlogsock); # start some logging setlogsock 'unix'; openlog('task', 'pid', 'daemon'); syslog 'info', 'starting'; $txt = 'blah'; for (1..8) { syslog 'debug', $_. ' len('. length($txt) . ') '. $txt; $txt = "$txt $txt"; } for (1..100) { syslog 'debug', $_. ' len('. length($txt) . ') '. $txt; $txt = "$txt bleargh"; } ** End Code ** I seem to be dropping a random message or two during the second loop. I've tried tuning the syslog-ng conf file several different ways without luck. The relevant pieces of the current iteration of the conf file are: options { long_hostnames(off); flush_lines(1); time_reopen(10); time_reap(600); log_fifo_size(4096); }; source src { unix-dgram("/var/run/log" log_msg_size(65536) log_fetch_limit(5)); unix-dgram("/var/run/logpriv" perm(0600) log_msg_size(65536) log_fetch_limit(5)); udp(log_msg_size(65536) log_fetch_limit(5)); internal(); file("/dev/klog" log_msg_size(65536) log_fetch_limit(5)); }; destination task_log { file( "/var/log/task.log" perm(0664) ); }; filter f_task{ program("task"); }; log {source(src); filter(f_task); destination(task_log); flags(flow-control);}; Anybody have any ideas why I'm dropping random lines? Thanks in advance... -- Cole Tuininga http://www.tuininga.org/

2 2

syslog-ng-2.0.5: err "Duplicate stats counter"
by Alberto Avi 21 Nov '07

21 Nov '07

Hi everyone, I'm trying to configure a few templated logs on Linux boxes to a remote syslog-ng server (available through stunnel connection). All is working fine in the remote syslog-ng server: I can see all the data I expected and I can manage them happly. There is only a small issue on the client side: the syslog-ng don't send "stats" and "mark" messages. When I start the deamon I have this error: [root@usftpl201 sbin]# ./syslog-ng -d -v -F Duplicate stats counter; counter='tcp(AF_INET(127.0.0.1:61514))' This is my syslog-ng configuration on client side: # general options options { mark_freq(1); stats_freq(2); time_reopen(5); time_reap(300); flush_lines(1); flush_timeout(5000); log_fifo_size(3); normalize_hostnames(yes); keep_hostname(yes); use_fqdn(no); owner(root); group(root); perm(0600); dir_owner(root); dir_group(root); dir_perm(0600); log_msg_size(8192); }; # define sources source s_system { file("/var/log/messages" follow_freq(1)); file("/var/log/secure" follow_freq(1)); file("/var/log/cron" follow_freq(1)); file("/var/log/up2date" follow_freq(1)); file("/var/log/osad" follow_freq(1)); }; source s_proftpd { file("/var/log/proftpd/auth.log" follow_freq(1) flags(no-parse)); file("/var/log/proftpd/access.log" follow_freq(1) flags(no-parse)); }; # define filters filter f_system { not match("logger"); }; filter f_proftpd { not match("FTP Time"); }; # define templates template t_system { template("$DATE $HOST TYPE: MSG-SYSTEM MSG: $MSG\n"); }; template t_proftpd { template("$DATE $HOST TYPE: MSG-PROFTPD MSG: $MSG\n"); }; # define destinatios destination d_system { tcp("127.0.0.1" port(61514) template(t_system)); }; destination d_proftpd { tcp("127.0.0.1" port(61514) template(t_proftpd)); }; # define logs log { source(s_system); filter(f_system); destination(d_system); }; log { source(s_proftpd); filter(f_proftpd); destination(d_proftpd); }; This is my configuration on central syslog-ng server: options { time_reopen(15); time_reap(600); flush_lines(4); flush_timeout(6000); log_fifo_size(1); chain_hostnames(yes); normalize_hostnames(on); create_dirs(yes); chain_hostnames(yes); long_hostnames(no); keep_hostname(yes); use_fqdn(no); use_dns(no); owner(root); group(root); dir_owner(root); dir_group(root); dir_perm(0600); log_msg_size(8192); }; # define sources source s_tcp { tcp(ip(127.0.0.1) port(60514) max-connections(512) tcp-keep-alive(yes)); }; # define filters filter f_system { match("MSG-SYSTEM"); }; filter f_proftpd { match("MSG-PROFTPD"); }; # define templates template t_system { template("RECDATE: $R_YEAR/$R_MONTH/$R_DAY $R_HOUR:$R_MIN:$R_SEC SYSLOG: ussysl310 RHOST: $HOST RDATE: $S_YEAR/$S_MONTH/$S_DAY $S_HOUR:$S_MIN:$S_SEC $MS G\n"); template_escape(no); }; template t_proftpd { template("RECDATE: $R_YEAR/$R_MONTH/$R_DAY $R_HOUR:$R_MIN:$R_SEC SYSLOG: ussysl310 RHOST: $HOST RDATE: $S_YEAR/$S_MONTH/$S_DAY $S_HOUR:$S_MIN:$S_SEC $MS G\n"); template_escape(no); }; # define destinations destination d_system { file("/var/data/syslog-ng/linux-hosts/$YEAR/$MONTH/$DAY/$HOST/$HOST-$DAY$MONTH$YEAR-system.log" template(t_system)); }; destination d_proftpd { file("/var/data/syslog-ng/linux-hosts/$YEAR/$MONTH/$DAY/$HOST/$HOST-$DAY$MONTH$YEAR-proftpd.log" template(t_proftpd)); }; # define logs log { source(s_tcp); filter(f_system); destination(d_system);}; log { source(s_tcp); filter(f_proftpd); destination(d_proftpd); } Any suggestions are appreciated. Alberto.

2 2

Syslog-NG 2.0.5 on OpenBSD 4.2
by Brian A. Seklecki 21 Nov '07

21 Nov '07

http://people.collaborativefusion.com/~seklecki/openbsd42_port_syslog-ng205… # pkg_info | egrep -i "syslog|event" eventlog-0.2.5 eventlog syslog-ng library syslog-ng-2.0.5 syslogd replacement # syslog-ng -V syslog-ng 2.0.5 # uname -a OpenBSD build-openbsd-i386-42 4.2 GENERIC#375 i386 Pkgsrc is next but I have to catch a bus. ~BAS # tar tzvf /usr/ports/packages/i386/all/eventlog-0.2.5.tgz -r--r--r-- 1 root wheel 698 Nov 20 13:56 +CONTENTS -r--r--r-- 1 root wheel 149 Nov 20 13:56 +DESC -rwxr-xr-x 1 root bin 56325 Nov 20 13:52 lib/libevtlog.so.0.0 -r--r--r-- 1 root bin 6602 Nov 20 13:52 include/eventlog/evtlog.h -r--r--r-- 1 root bin 2168 Nov 20 13:52 include/eventlog/evtmaps.h -rw-r--r-- 1 root bin 90848 Nov 20 13:52 lib/libevtlog.a -rwxr-xr-x 1 root bin 811 Nov 20 13:52 lib/libevtlog.la -r--r--r-- 1 root bin 237 Nov 20 13:52 lib/pkgconfig/eventlog.pc # tar tzvf /usr/ports/packages/i386/all/syslog-ng-2.0.5.tgz -r--r--r-- 1 root wheel 528 Nov 20 14:23 +CONTENTS -r--r--r-- 1 root wheel 568 Nov 20 14:23 +DESC -r--r--r-- 1 root bin 5899 Nov 20 14:23 man/man5/syslog-ng.conf.5 -r--r--r-- 1 root bin 3268 Nov 20 14:23 man/man8/syslog-ng.8 -r-xr-xr-x 1 root bin 1215516 Nov 20 14:23 sbin/syslog-ng

1 0

Patch for open source syslog-ng-2.0.5
by Philip Bellino 19 Nov '07

19 Nov '07

The following attached patch is being submitted against the open source syslog-ng-2.0.5. * src/afsocket.c (afsocket_dd_format_stats_name): Using IPv6 for a destination of tcp6 or udp6: There was no case statement for AF_INET6 and as a result, "driver_name" was never filled in with either tcp6 or udp6. The subsequent routine (g_snprintf) that used "driver_name" caused a segmentation fault. This is now fixed. <<syslog-ng-Changelog.doc>> <<afsocket.diff>> Phil Bellino Software Engineer MRV Communications, Inc. 295 Foster Street Littleton, MA. 01460 Phone: 978-952-4807 Fax: 978-952-5444 Email: pbellino(a)mrv.com <http://www.mrv.com/>

2 1

about unix-dgram
by hi ro 19 Nov '07

19 Nov '07

Hi, Can I use "unix-dgram" as a destination config over RedHatLinux(RHEL ES version4 update5). I want to do following. 1. syslog-ng server receive syslog-message. 2. syslog-ng server write the message to a fifo pipe. (I want to config destination using unix-dgram.) 3. client-ap read the message from the fifo pipe. (I think client-ap can read messages one by one using unix-dgram.) Thanks hiro _________________________________________________________________ Hotmail限定　Windows Live x Lost Odysseyプレゼントキャンペーン　12月21日まで http://go.windowslive.jp/

2 3

Is there any problems when network config is changed?
by hi ro 16 Nov '07

16 Nov '07

Hi, Is there any problems when following occurs? [Precondition] Syslog-ng starts with a config about A-ADDRESS(IP ADDRESS). [Question] 1. Down NIC(A-ADDRESS) with ifdown. → Is there any problems? 2. Change IP-ADDRES from A to B. → Is there any problems? 3. UP NIC(B-ADDRESS) with ifup → Is there any problems? I know that syslog-ng can't start after 3. Thankshiro _________________________________________________________________ 今話題になってる出来事や有名人をランキングで毎週発表「MSN 気になる言葉」 http://keyword.jp.msn.com/default.aspx

2 3

Is there any problems when network config is changed?
by hi ro 16 Nov '07

16 Nov '07

Hi, Is there any problems when following occurs? [Precondition] Syslog-ng starts with a config about A-ADDRESS(IP ADDRESS). [Question] 1. Down NIC(A-ADDRESS) with ifdown. → Is there any problems? 2. Change IP-ADDRES from A to B. → Is there any problems? 3. UP NIC(B-ADDRESS) with ifup → Is there any problems? I know that syslog-ng can't start after 3. Thankshiro _________________________________________________________________ 【MSNビデオ】超貴重！驚きの大物対談が実現。作家村上龍が話題のあの人に迫る http://video.msn.co.jp/rvr/default.htm

1 0