July 2007 - syslog-ng - lists.balabit.hu

Timestamp inconsistency
by Tim Boyer 04 Jul '07

04 Jul '07

I'm running 2.0.0, and the docs say that The sender can specify the timezone of the messages. If the incoming message includes a timezone it is associated with the message. Otherwise, the local timezone is assumed. I'm not specifying any timezone, but I'm seeing a bunch of messages stamped UTC mixed in with EDT, which makes the log a bit... weird: Jun 24 21:38:01 tolstoy.denmantire.com sshd[7949]: Connection closed by 192.168 Jun 24 17:40:01 tolstoy.denmantire.com crond[7987]: (root) CMD (/usr/lib/sa/sa1 Jun 24 21:43:01 tolstoy.denmantire.com sshd[7994]: Connection closed by 192.168 Jun 24 17:44:34 tolstoy.denmantire.com syslog-ng[11618]: Log statistics; droppe Jun 24 21:48:02 tolstoy.denmantire.com sshd[8036]: Connection closed by 192.168 Jun 24 17:50:01 tolstoy.denmantire.com crond[8082]: (root) CMD (/usr/lib/sa/sa1 Jun 24 21:53:03 tolstoy.denmantire.com sshd[8107]: Connection closed by 192.168 So just to test, I did this: TZ="UTC+23:56" logger "Look I'm logging from yesterday" and sure enough, it logged it as yesterday. So I tried to explicitly set the time zones: options { send_time_zone(-04:00); recv_time_zone(-04:00); destination dtolstoy_all { file("/var/log/tolstoy.log" owner(root) group(hobbit) perm(0640) time_zone(-04:00)); Restarted syslog-ng, and: Jun 24 17:09:00 tolstoy.denmantire.com syslog-ng: syslog-ng startup succeeded Jun 23 21:13:09 tolstoy.denmantire.com tim: Look I'm logging from yesterday I don't understand why it's not logging as local time without me having to do anything. And I _really_ don't understand why the explicit instructions don't work. Pounters in the the right direction appreciated... -- Tim Boyer Director Information Systems and Engineering Projects Denman Tire Corporation tim(a)denmantire.com

6 9

Re: [syslog-ng] Assistance compiling 1.6.12
by tim.brown＠juno.com 03 Jul '07

03 Jul '07

agreed, unfortunately the latest I've been able to locate for Solaris 9 on sparc is 2.1.3. I would greatly appreciate any pointers to where I might locate a version later that 2.2. -- Carson Gaspar <carson(a)taltos.org> wrote: tim.brown(a)juno.com wrote: > That would be ideal if I could locate a version of glib >= 2.2 for > Solaris 9 on sparc, based on the following: > > checking for GLIB... Requested 'glib-2.0 >= 2.2' but version of GLib is > 2.0.7 > no > configure: error: Cannot find GLib library version >= 2.2: is > pkg-config in path? Download, compile, install. It's not that hard ;-) -- Carson _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _____________________________________________________________ Click for free info on online degrees and make $150K/ year http://track.juno.com/s/lc?u=http://tagline.untd.us/fc/Ioyw6iigA5BTZcRbYLnF…

2 1

One destination stopped logging?
by Hari Sekhon 03 Jul '07

03 Jul '07

Hi, I've got syslog-ng on my mail server and today I noticed while trying to debug something else that there was nothing in the maillog. I thought this was very odd as there should be lots of stuff, so I checked syslog-ng was running. It was but I decided to restart it and then the maillog started to fill up again. Now it's been several days since it's written anything to the mail log, but it has continued writing to the /var/log/messages destination during that time. Here is my config: options { chain_hostnames(off); sync(0); stats(43200); log_fifo_size(30000); }; source src { unix-stream("/dev/log" max-connections(1000)); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; destination d_net { tcp("ip_to_logserver" port(logserver_port) ); }; destination maillog { file("/var/log/maillog"); }; destination mailerr { file("/var/log/mail.err"); }; filter f_mail { facility(mail); }; filter f_mailerr { facility(mail) and level(err); }; filter f_notmailjunk { not (program("postfix/*") and not level(err)); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_mailerr); destination(mailerr); }; log { source(src); filter(f_notmailjunk); destination(messages); destination(d_net); }; Possible idea: My logserver was flooded as I was doing something else on it and it's likely that logs didn't get through (I know, I know - I wanted a separate machine for this of course but my boss holds the money...). Is it possible that the logger filled up locally backlogged messages for the logserver and this caused logs to be lost for the other destination maillog as syslog-ng was full or something? Does this sound like it or not at all? I am using syslog-ng 1.6.11 by the way. Thanks Hari -- Hari Sekhon

3 5

Constant disconnects
by Tim Boyer 03 Jul '07

03 Jul '07

I'm running 2.0.0, and have eight remote servers logging to a central server. Seven of those servers are running fine; the eighth keeps getting log messages like this: Jun 26 10:41:33 kyushu.denmantire.com syslog-ng[6829]: syslog-ng starting up; version='2.0.0' Jun 26 10:41:33 kyushu.denmantire.com syslog-ng: syslog-ng startup succeeded Jun 26 10:41:33 kyushu.denmantire.com syslog-ng[6829]: EOF occurred while idle;fd='5' Jun 26 10:41:33 kyushu.denmantire.com syslog-ng[6829]: Connection broken; time_reopen='60' My first assumption was a firewall problem, but tcpdump says that data's getting there: 10:42:49.013423 IP kyushu-vpn-cli.denmantire.com.37759 > buran.denmantire.com.5142: S 1168830611:1168830611(0) win 5840 <mss 1460,sackOK,timestamp 316509070 0,nop,wscale 2> 10:42:49.014768 IP buran.denmantire.com.5142 > kyushu-vpn-cli.denmantire.com.37759: S 845996771:845996771(0) ack 1168830612 win 5792 <mss 1460,sackOK,timestamp 39334539 316509070,nop,wscale 7> Any ideas what could be causing the connection to drop - but only on this server? Thanks much, -- Tim Boyer Director IT and Engineering Projects Denman Tire Corporation (330) 675-4249

5 11

Log messages looping back infinitely
by Christopher Cowart 02 Jul '07

02 Jul '07

Hello, I've had a recent problem where my dhcpd logs appear to be arriving and rearriving until /var fills up. My log traffic looks like this (all over udp/syslog and IPSec): ------------+ all logs +----------+ dhcpd logs +------------+ dhcp servers|---------->|log server|------------>|other server|----| ------------+ +----------+ +------------+ | ^ | | all logs except dhcpd | -------------------------------------| This configuration has been in effect and working as expected for about 11 months now. Approximately 2 weeks ago, I was reviewing my morning cronspam and discovered that /var had filled up on my log server. The dhcpd log was the obvious culprit, expanded to fill my entire log partition. I'm attaching sample entries so you can take a look if you are so inclined; I apologize for sanitizing out the data in the messages, but they're both protected data and not important to the discussion at hand. There should be *no* dhcpd log messages originating on the log server. When logging is working properly, the host field in the entries properly reflect their dhcp servers of origin. When logging becomes fubar'd, I see a lot of messages with localhost in that field, all with increasing amounts of whitespace in them. syslog-ng spins the CPU to 100% and proceeds to fill up /var with these "feedback" entries. This has happened 3 times in the past 2 weeks. It always begins at midnight. I checked my crons -- I have an hourly execution of logrotate. It is configured to rotate most of my logs (dhcpd included) once a day, which happens at midnight. It politely runs `pkill -HUP syslog-ng' after truncating the log files; this works successfully for all the other logfiles on the log server and has been working fine for dhcpd for the previous 11 months as well. The other likely candidate for trouble is the "other server" from the diagram above that logs back to the log server. I'm relatively certain that this (alone) is not the cause of the problem. I was painstakingly careful to not generate any feedback loops in its configuration. The incoming udp messages have a dedicated source, which is written to a dedicated destination. I'm having trouble piecing two and two together here. I don't think either of these things are causing the problem, but they're the only obvious culprits. Neither of them, if misconfigured, would explain why the duplicates all appear to come from the localhost. Why would the udp source on the logserver be receiving the messages it sends, but only recently and only immediately after midnight? I haven't had the chance to do a tcpdump yet to see the actual network traffic; twice now I've gotten there after /var was already full and tonight when I did finally catch it in the act, I was too concerned about stopping it to troubleshoot it. Stopping and starting syslog-ng returns my logging into a normal state of affairs. $ uname -a | FreeBSD pitfall.rescomp.berkeley.edu 6.1-RELEASE-p3 FreeBSD | 6.1-RELEASE-p3 #0: Mon Aug 21 15:42:31 PDT 2006 | root@new-pitfall.rescomp.berkeley.edu:/usr/obj/usr/src/sys/RCBSD_1 | i386 $ syslog-ng -V | syslog-ng 2.0.0 First time-stamp in fubar'd logfile: Jun 29 00:00:07 First localhost entry: Jun 29 00:02:19 (Line #256) Last time-stamp in fubar'd logfile: Jun 29 00:08:46 Number of "good" entries: 1266 Number of localhost entries: 1123083 Total number of entries: 1124349 If anyone has tips for continuing my troubleshooting process, please let me know. I'd be tempted to upgrade to 2.0.2 (it's in ports), but given the changelogs didn't mention anything about random feedback loops, I didn't figure it would help much. Thanks in advance for your time, -- Chris Cowart Lead Systems Administrator Network Infrastructure, RSSP-IT UC Berkeley

2 1

Static compilation
by Nicolas de Marqué - Fromentin 02 Jul '07

02 Jul '07

Hello, I have problems with compilation of syslog-ng on a solaris 5.8 : After Syslog-ng Configuration : ./configure --prefix=/tmp/local --disable-spoof-source --enable-static-linking => i have this error : checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib => but i have the correct file : ls -la /tmp/local/lib/libglib-2.0.a -rw-r--r-- 1 outils dinb 2096104 Jun 28 15:51 /tmp/local/lib/libglib-2.0.a Have you an idea about this problem? Nicolas

3 2

error compiling syslog-ng-2.0.2 and syslog-ng-2.0.4+20070626
by Serge Torop 02 Jul '07

02 Jul '07

Hello, then I compiling the syslog-ng-2.0.2 on RedHat Enterpise Linux 4 (kernel 2.6.9-42.ELsmp) I see the message: .. [skip].. rm -f libsyslog-ng.a ar cru libsyslog-ng.a misc.o utils.o messages.o syslog-names.o cfg.o cfg-lex.o cfg-grammar.o macros.o filter.o logmsg.o logpipe.o logsource.o driver.o sgroup.o dgroup.o center.o templates.o logreader.o logwriter.o affile.o afstreams.o afuser.o afprog.o af socket.o afunix.o afinet.o afinter.o children.o stats.o gsockaddr.o fdwrite.o fdread.o memtrace.o dnscache.o ranlib libsyslog-ng.a if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo './'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -Wl,-Bdynamic libsyslog-ng.a(misc.o)(.text+0x3a9): In function `resolve_hostname': /home/tsp/syslog-ng-2.0.2/src/misc.c:185: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:110: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x2b2): In function `log_msg_ref': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:497: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x34e): In function `log_msg_unref': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:511: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xe02): In function `log_msg_ack_block_end': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:631: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref': /home/tsp/syslog-ng-2.0.2/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref': /home/tsp/syslog-ng-2.0.2/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free': /home/tsp/syslog-ng-2.0.2/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new': /home/tsp/syslog-ng-2.0.2/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x2a6): In function `log_template_ref': /home/tsp/syslog-ng-2.0.2/src/templates.c:169: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x30e):/home/tsp/syslog-ng-2.0.2/src/templates.c:180: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error code 1 make[2]: Leaving directory `/home/tsp/syslog-ng-2.0.2/src' make[1]: *** [all-recursive] Error code 1 make[1]: Leaving directory `/home/tsp/syslog-ng-2.0.2' make: *** [all] Error code 2 the same error with syslog-ng-2.0.4+20070626. Is this possible to fix or solve this problem? Thanks for advance. -- Serge P. Torop St.Petersburg, Russia

3 6