July 2007 - syslog-ng - lists.balabit.hu

Solaris-9 Syslog-ng
by Rory Savage 27 Jul '07

27 Jul '07

I just installed syslog-ng on a Solaris 9 (SPARC) server. It will not log anything to the console nor to /var/adm/messages. Does anyone have any idea of what I am doing wrong? No existing syslog processes are running, I killed them and stopped them from start on reboot. I can not reboot this server now, it is something that has to remain up and running. The service is running: # ps -ef|grep syslog-ng root 29422 29002 0 17:33:14 pts/3 0:00 grep syslog-ng root 29364 1 0 17:27:44 ? 0:00 /usr/local/sbin/ syslog-ng -f /etc/syslog-ng/syslog-ng.conf -p /etc/syslog-ng/sy My /var/run/syslog_door file exists: # ls -la /var/run/syslog_door Drw-r--r-- 1 root other 0 Jul 25 16:49 /var/run/ syslog_door The contents of my syslog-ng.conf file: # syslog-ng configuration file. # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20070727 rsavage(a)nuvox.net options { sync (1); time_reopen (10); log_msg_size(8192); log_fifo_size(2048); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats(3600); mark_freq(1); }; source s_sys { internal(); sun-streams ("/dev/log" door("/var/run/ syslog_door")); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/messages"); }; destination d_mail { file("/var/log/syslog"); }; destination d_auth { file("/var/log/authlog"); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { level(err) or (level(notice) and facility (auth, kern)); }; filter f_filter2 { level(err) or (facility(kern) and level(notice)) or (facility(daemon) and level(notice)) or (facility(mail) and level(crit)); }; filter f_filter3 { level(alert) or (facility(kern) and level(err)) or (facility(daemon) and level(err)); }; filter f_filter4 { level(alert); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(kern) and level(notice); }; filter f_filter7 { facility(mail) and level(debug); }; filter f_filter8 { facility(user) and level(err); }; filter f_filter9 { facility(user) and level(alert); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_mlop); }; log { source(s_sys); filter(f_filter4); destination(d_mlrt); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_auth); }; log { source(s_sys); filter(f_filter7); destination(d_mail); }; log { source(s_sys); filter(f_filter8); destination(d_cons); destination(d_mesg); }; log { source(s_sys); filter(f_filter9); destination(d_mlop); destination(d_mlrt); }; -- Rory Savage, Systems Administrator Nuvox Communications, Server Operations A Data, Voice, and Solutions Provider Email: rsavage(a)nuvox.net

2 2

the lazy logging patch
by Alexander Clouter 27 Jul '07

27 Jul '07

Hi, Just curious if you were going to add something akin to the lazy logger patch I submitted some time back (of course written sensibly rather than in the hacky way I added): http://marc.info/?l=syslog-ng&m=116136122419201&w=2 Only asking as you said you would have a looking into adding $DESTIP (and probably $INTERFACE as you hinted at) later in the thread. I'm posting on the mailing list to hope to encourage someone else to say "hear hear I want that too", it's all about market pressure :) Cheers Alex

2 1

CentOS release 4.4 , Compile errors , syslog-ng 2.0.5
by Mr. James W. Laferriere 27 Jul '07

27 Jul '07

Hello All , Ok , What am I missing here ... , Tia , JimL /usr/lib/gcc/i386-redhat-linux/3.4.6/../../../libnet.a(libnet_resolve.o)(.text+0x457): In function `libnet_name2addr6': : warning: Using 'gethostbyname2' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(afinet.o)(.text+0x6e): In function `afinet_set_port': /home/archive/syslog-ng-2.0.5/src/afinet.c:58: warning: Using 'getservbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(afsocket.o)(.text+0x581): In function `afsocket_sd_process_connection': /home/archive/syslog-ng-2.0.5/src/afsocket.c:366: undefined reference to `request_init' libsyslog-ng.a(afsocket.o)(.text+0x58a):/home/archive/syslog-ng-2.0.5/src/afsocket.c:367: undefined reference to `sock_host' libsyslog-ng.a(afsocket.o)(.text+0x592):/home/archive/syslog-ng-2.0.5/src/afsocket.c:368: undefined reference to `hosts_access' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/home/archive/syslog-ng-2.0.5/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/archive/syslog-ng-2.0.5' make: *** [all] Error 2 # yum list installed glib* Installed Packages glib.i386 1:1.2.10-15 installed glib-devel.i386 1:1.2.10-15 installed glib2.i386 2.4.7-1 installed glib2-devel.i386 2.4.7-1 installed glibc.i686 2.3.4-2.25 installed glibc-common.i386 2.3.4-2.25 installed glibc-devel.i386 2.3.4-2.25 installed glibc-headers.i386 2.3.4-2.25 installed glibc-kernheaders.i386 2.4-9.1.98.EL installed glibc-profile.i386 2.3.4-2.25 installed glibc-utils.i386 2.3.4-2.25 installed # ver_linux Linux argus.sjc1.talkplus.com 2.6.9-42.0.3.ELsmp #1 SMP Fri Oct 6 06:21:39 CDT 2006 i686 i686 i386 GNU/Linux Gnu C 3.4.6 Gnu make 3.80 binutils 2.15.92.0.2 util-linux 2.12a mount 2.12a module-init-tools 3.1-pre5 e2fsprogs 1.35 reiserfsprogs line reiser4progs line pcmcia-cs 3.2.7 quota-tools 3.12. PPP 2.4.2 nfs-utils 1.0.6 Linux C Library 2.3.4 Dynamic linker (ldd) 2.3.4 Procps 3.2.3 Net-tools 1.60 Kbd 1.12 Sh-utils 5.2.1 Modules Loaded ipt_state ip_conntrack iptable_filter ip_tables md5 ipv6 i2c_dev i2c_core dm_mirror dm_multipath dm_mod button battery ac joydev uhci_hcd ehci_hcd e1000 ext3 jbd raid1 ata_piix libata sd_mod scsi_mod -- +-----------------------------------------------------------------+ | James W. Laferriere | System Techniques | Give me VMS | | Network Engineer | 663 Beaumont Blvd | Give me Linux | | babydr(a)baby-dragons.com | Pacifica, CA. 94044 | only on AXP | +-----------------------------------------------------------------+

1 0

syslog-ng 2.0.5 has been released
by devel＠balabit.hu 26 Jul '07

26 Jul '07

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.5 SUMMARY : new stable release DATE : Jul 26, 2007 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.5) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.5 Sun, 22 Jul 2007 15:15:18 +0200 Bugfixes: * Fixed the configure script to automatically detect whether libnet is installed and disable spoof-source support if it is not. * Fixed the processing of the global log_fifo_size() option, in some cases the global option did not have any effect. * Fixed possible blocking on /proc/kmsg during boot, when a great number of kernel messages are generated. * Fixed a possible segfault during the syslog-ng exit procedure, that can be triggered by stopping a syslog-ng instance after it has been reloaded at least once. Other changes: * Increased the default value of max-connections to 256 for UNIX stream sources. * Added support for PIX timestamps that include year information. * Added support for fractions of a second information in BSD timestamps generated by certain Cisco devices. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/ _______________________________________________ syslog-ng-announce mailing list syslog-ng-announce(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng-announce

1 0

Download location change
by Balazs Scheidler 26 Jul '07

26 Jul '07

Dear syslog-ng users, The download location for syslog-ng sources is being changed due to internal web reorganization. In the future, syslog-ng sources will be available from: http://www.balabit.com/products/syslog-ng/sources/ instead of the old download location. The location of the upgrade summary page will not be changed, and will remain: http://www.balabit.com/products/syslog-ng/opensource/upgrades/ Sorry, for the possible inconvinience. -- Balazs Scheidler <bazsi(a)balabit.hu>

5 14

Syslog-ng performance (CPU)
by Rory 25 Jul '07

25 Jul '07

I'm using syslog-ng as a receiver to relay messages to local processes and other remote syslog listeners. I'm not currently using any local file destinations. The issue I'm having is that as soon as I start receiving more than a few hundred messages per second (udp) syslog-ng uses significant CPU resources, even on an intel core-duo. At 1000 messages per second with an average message size < 300 bytes syslog-ng consumes 9-12% CPU. With an event rate closer to 4000 messages per second the CPU use is 35-30%. This seems excessive given that I'm doing no filtering at all. In a test configuration, I am only receiving (no log{} clauses at all) and this behaviour is still demonstrated. It seems that all the CPU use is related to incoming packet processing. The test system is Linux 2.6.20 (Ubuntu) running on a Core2 dual 2.16GHz. Once I have completed some profiling I will share the findings but in the meantime: am I missing something that should be obvious? Some searching through the mailing list archives hasn't helped me much. My test configuration file: options { time_reopen(10); chain_hostnames(yes); keep_hostname(no); log_fifo_size(65535); gc_idle_threshold(100); gc_busy_threshold(65535); use_dns(no); }; source remote_sources { udp(ip(0.0.0.0) port(514)); }; destination event_collector { tcp("127.0.0.1" port(1028)); }; # log { # source(remote_sources); # destination(event_collector); # }; Thanks, Rory

4 5

RE: [syslog-ng] problems with Cisco WiFi controller syslog messages
by Poley, Jason 24 Jul '07

24 Jul '07

Bazsi, So I finally got around to the upgrade this morning (now on 2.0.4), only one month later... Is it possible you can help with these obviously non-standard Cisco syslog timestamps? JDP --------------------------------- Jason D Poley Network Tech GS ITS Network County of Santa Barbara 805.568.2680 jpoley(a)co.santa-barbara.ca.us -----Original Message----- From: Poley, Jason Sent: Thursday, June 14, 2007 7:57 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] problems with Cisco WiFi controller syslog messages Thanks so much for the reply. So, I will upgrade to the latest version and hope for a fix from you I suppose. A question along those lines then... What is the implication of upgrading from 1.6.9 to 2.0.x? Are there any problems or changes that will affect my current logs? I suppose I should mention that I dump these to a mysql database and report against them with php-syslog-ng. I sure don't want to blow up the whole system. JDP --------------------------------- Jason D Poley Network Tech GS ITS Network County of Santa Barbara 805.568.2680 jpoley(a)co.santa-barbara.ca.us > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng- > bounces(a)lists.balabit.hu] On Behalf Of Balazs Scheidler > Sent: Thursday, June 14, 2007 3:43 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] problems with Cisco WiFi controller syslog > messages > > On Wed, 2007-06-13 at 07:02 -0700, Poley, Jason wrote: > > We have upgraded our Cisco WiFi controller and now its syslog messages > > contain milliseconds which syslog-ng does not know how to handle. > > > > I am running version 1.6.9 of syslog-ng on RedHat version 3. > > > > TCP dump of first 96 bytes... > > 06:57:07.584716 IP (tos 0x0, ttl 59, id 0, offset 0, flags [DF], proto > 17, > > length: 248) 161.213.8.243.32768 > 161.213.4.226.syslog: UDP, length 220 > > 0x0000: 4500 00f8 0000 4000 3b11 ed75 a1d5 08f3 > E.....@.;..u.... > > 0x0010: a1d5 04e2 8000 0202 00e4 660c 3c31 3238 > ..........f.<128 > > 0x0020: 3e20 4a75 6e20 3133 2030 363a 3536 3a31 > >.Jun.13.06:56:1 > > 0x0030: 362e 3732 3820 6170 665f 726f 6775 655f > 6.728.apf_rogue_ > > 0x0040: 6465 7465 6374 2e63 3a35 3735 2041 5046 > detect.c:575.APF > > 0x0050: 2d31 -1 > > > > Is this behavior different in a later version of syslog-ng and should I > > upgrade? > > syslog-ng 2.0.x supports milliseconds in timestamps, however it uses > ISO8601 timestamps for that purpose. As I see the snipped quoted here > uses a BSD timestamps with milliseconds added. > > Gee.. At least they could have added year information too. > > So, upgrading to 2.0.x will not solve your problems, but there's a > chance that I can change this there. > > -- > Bazsi > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >

4 6

Hostname resolution of chained hosts
by Darwin, Samuel 23 Jul '07

23 Jul '07

Hi, I am trying to log messages from many servers of the network, each to their own file. The messages are coming in via a program called Lasso, which polls windows servers and sends the messages to syslog-ng via TCP. Lasso turns out to look like a "relay" in syslog-ng parlance. Each message comes from it's source, through the lasso server, and arrives at the syslog-ng server. I have the chain_hostnames(yes) set. Syslog-ng is able to resolve the hostname of the relay server, and shows the hostname instead of the IP address. Good. But the source servers are only being displayed by their IP address in the ${HOST} macro. I am using the ${HOST} macro to create the destination filename. It is not being resolved into a hostname. Does anyone out there use any type of relaying, and do you see that each hop in the relay chain is being resolved from IP Address -> Hostname ?? Thanks, Sam Darwin Thirteen WNET

1 0

(no subject)
by Ahmad Al-Dosari 20 Jul '07

20 Jul '07

Hi All, Can some one tell how to log from different hosts to a single file? I have several firewalls/routers/CSS and would like to have single file for firewalls logs and another for routers logs and the same for CSS. All of the devices logs are sent using udp port 514 I use syslog-ng 2.0.4 and currently all logs are sent to a single file. Thanks.

5 4

Syslog-ng 2.0.4 and libnet...
by Root Administrator 20 Jul '07

20 Jul '07

Hi ALL I need some advises regarding syslog-ng 2.0.4 compilation with such option as --enable-spoof-source. The reason I need this option is that I would like syslog-ng to behave as source address spoofing. LIBNET prepared is libnet-1.1.2.1. I configured it in this manner. bash-2.05# ./configure --enable-dynamic-linking --with-libnet=/usr/local/src/libnet --enable-spoof-source I compiled it in this manner. bash-2.05# make make all-recursive Making all in src source='cfg-grammar.c' object='cfg-grammar.o' libtool=no \ depfile='.deps/cfg-grammar.Po' tmpdepfile='.deps/cfg-grammar.TPo' \ depmode=gcc /bin/bash ../depcomp \ gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0-I/usr/local/lib/glib- 2.0/include -I/usr/local/include/eventlog -DLIBNET_BIG_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -g -c `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c In file included from /home/bazsi/zwa/git//syslog-ng/syslog- ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:30: libnet.h: No such file or directory *** Error code 1 make: Fatal error: Command failed for target `cfg-grammar.o' Current working directory /usr/local/src/syslog-ng-2.0.4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/local/src/syslog-ng-2.0.4 *** Error code 1 make: Fatal error: Command failed for target `all' bash-2.05# Is libnet right version to compile syslog-ng with option of --enable-spoof-source ? Is my preparation enough to successfully compile syslog-ng 2.0.4 ? Any other libraries or tools needed to do so ? Regards Jabberwock

2 1