November 2007 - syslog-ng - lists.balabit.hu

Connection broke using remote syslog-ng clients
by LESOUEF Emmanuel 05 Nov '07

05 Nov '07

Hello, I'm getting this kind of logs (facility syslog) on my central syslog-ng server : Oct 31 12:08:10 lxnetmgmt syslog-ng[8698]: EOF occurred while idle; fd='6' Oct 31 12:08:10 lxnetmgmt syslog-ng[8698]: Connection broken; time_reopen='10' Oct 31 12:08:20 lxnetmgmt syslog-ng[8698]: Connection failed; error='Connection refused (111)', time_reopen='10' It occurs after restarting the central syslog-ng server. These messages come from remote hosts sending their logs via tcp to the central syslog-ng server. Any idea ? Thanks for your help. -- Emmanuel Lesouef DSI | CRBN t : 0231069671 m : e.lesouef(a)crbn.fr

3 2

Patch submission
by Philip Bellino 03 Nov '07

03 Nov '07

Hello, Could someone provide me with directions on how to submit a patch to the open source 2.0.5 syslog-ng? Thanks, Phil Bellino Phil Bellino Software Engineer MRV Communications, Inc. 295 Foster Street Littleton, MA. 01460 Phone: 978-952-4807 Fax: 978-952-5444 Email: pbellino(a)mrv.com <http://www.mrv.com/>

2 3

timezone issues
by Campbell Simpson 03 Nov '07

03 Nov '07

Hi I'm having problems using the timezone() function on my source drivers. My syslog-ng server is set up to receive syslog messages from the network. The servers sending to it are set to GMT+0 and the timezone information is not sent in the syslog messages. I would like to be able to do a conversion on the received time stamp and write the time to a fifo buffer in localtime on the syslog box. I'm running syslog-ng 2.0.5 on Redhat Enterprise. My config looks like: options { sync (20); stats_freq (60); dns_cache (yes); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (persist_only); dns_cache_hosts(/etc/hosts); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_net { udp(port(514) time_zone(+00:00)); }; destination splunk1 { pipe("/var/data/syslog.fifo" template("$DATE $TZ - $R_TZ - $S_TZ $HOST $MSG\n")); }; destination splunk2 { pipe("/var/data/syslog2.fifo"); }; destination aaatransact { file("/var/data/aaatransact.log"); }; destination aaaprocess { file("/var/data/aaaprocess.log"); }; log { source(s_net); filter(f_local4); destination(splunk1); }; log { source(s_net); filter(f_local4); destination(aaatransact); }; log { source(s_net); filter(f_local5); destination(splunk2); }; log { source(s_net); filter(f_local5); destination(aaaprocess); }; The output to /var/data/syslog.fifo however looks like: Oct 26 00:39:55 +13:00 - +13:00 - +13:00 blah blah blah It doesn't matter what I change the time_zone value to, it always gets reported as +13:00. Even setting the global recv_time_zone doesn't change anything... Anyone got any ideas? Thanks Campbell

2 1

syslog-ng crashing at startup
by Shashank Vinchurkar 03 Nov '07

03 Nov '07

Hi, I have cross compiled syslog-ng-2.0.5 for 64bit mips processor. I am using glib-2.12.13. syslog-ng server crashes at startup. Here is the stack trace of the crash: Reading symbols from /lib64/libnsl.so.1...done. Loaded symbols for /lib64/libnsl.so.1 Reading symbols from /lib64/librt.so.1...done. Loaded symbols for /lib64/librt.so.1 Reading symbols from /syslog-ng/lib/libglib-2.0.so.0...done. Loaded symbols for /syslog-ng/lib/libglib-2.0.so.0 Reading symbols from /syslog-ng/lib/libevtlog.so.0...done. Loaded symbols for /syslog-ng/lib/libevtlog.so.0 Reading symbols from /lib64/libc.so.6...done. Loaded symbols for /lib64/libc.so.6 Reading symbols from /lib64/libpthread.so.0...done. Loaded symbols for /lib64/libpthread.so.0 Reading symbols from /lib64/ld.so.1...done. Loaded symbols for /lib64/ld.so.1 Core was generated by `./syslog-ng -v -d -F -f /syslog-ng/syslog-ng.conf'. Program terminated with signal 11, Segmentation fault. #0 0x0000005555bd9a30 in free () from /lib64/libc.so.6 (gdb) bt #0 0x0000005555bd9a30 in free () from /lib64/libc.so.6 #1 0x000000012000e6a8 in log_msg_clear_matches (self=0x120133e10) at logmsg.c:512 #2 0x000000012000f790 in log_msg_unref (self=0x120133e10) at logmsg.c:532 #3 0x0000000120012984 in log_writer_fd_dispatch (source=<value optimized out>, callback=<value optimized out>, user_data=<value optimized out>) at logwriter.c:324 #4 0x00000055558cdf84 in IA__g_main_context_dispatch (context=0x120133560) at gmain.c:2045 #5 0x00000055558d1a68 in g_main_context_iterate (context=0x120133560, block=1, dispatch=1, self=<value optimized out>) at gmain.c:2677 #6 0x00000055558d2298 in IA__g_main_context_iteration (context=0x120133560, may_block=1) at gmain.c:2736 #7 0x0000000120006b34 in main_loop_run (cfg=0xffffc61930) at main.c:164 #8 0x000000012000715c in main (argc=<value optimized out>, argv=<value optimized out>) at main.c:426 Thanks for the help in advance. -Shashank

2 1

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. :Question about Syslog
by eric.savidan＠orange-ftgroup.com 02 Nov '07

02 Nov '07

I will be out of the office starting 02/11/2007 and will not return until 06/11/2007.

1 0

Eric Savidan/France/Equant is out of the office. : Question about Syslog
by eric.savidan＠orange-ftgroup.com 02 Nov '07

02 Nov '07

I will be out of the office starting 02/11/2007 and will not return until 06/11/2007.

1 0