August 2007 - syslog-ng - lists.balabit.hu

Syslog-ng appears to hang for local requests to log
by Paul Robert Marino 10 Aug '07

10 Aug '07

I just joined the list after seeing in the archive the syslog-ng causing other proccesses to freeze I've seen the same issue in syslog-ng-2.0.2. I also usualy see some error about exciding the maximum number of open files for root. if i happen to be loged in to the box as root I've been able to fix it by restarting syslog-ng. if ive been loged in as my normal useri can usualy run a sudo lsof but when i count the number of open files its onwhere near the number set in /etc/secutiy/limits.conf. i also ocasionaly see this in the logs right before it happens kernel: warning: many lost ticks. kernel: Your time source seems to be instable or some driver is hogging interupts kernel: rip default_idle+0x20/0x23

3 5

Compatability with Windows?
by Burns Andrew 09 Aug '07

09 Aug '07

Hi, I'm trying out Syslog-NG, and it's been working well with Linux, but I've been asked to start monitoring the eventlog of Windows 2000 Servers and Windows 2003 Servers. Is there a plugin or can Syslog-NG read those eventlog entries natively if they are sent to the Syslog-NG server? Any suggestions or tips are appreciated. Thanks, Andrew

6 5

Routers don´t send syslog
by Roberto Dud 09 Aug '07

09 Aug '07

Mrs, I have a lot of Routers configured to send logs to syslog-ng, but isn´t work. Only 1 router send ok, others 10 not ok. My configuration on routers is the same: service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone logging <my ip> logging buffered 10000 debugging logging trap debugging I check with command : show logging And it´s ok, for me. Anyone have a problema with routers? Thanks, Dud.

3 3

Problem with local*
by Javier Terceiro 08 Aug '07

08 Aug '07

Hello list, I am forming a system syslog and have a problem with facility's local*, I have two destinations, the first: filter f_local7_info { facility(local7) and level(info); }; destination df_local7_info { file("/var/log/$R_YEAR-$R_MONTH-$R_DAY/$SOURCEIP/$PROGRAM.error.log" template("$FULLDATE <> $PROGRAM <> $MSGONLY\n") template_escape(no)); }; log { source(s_udp); filter(f_local7_info); destination(df_local7_info); }; and the second: filter f_local6 { facility(local6); }; destination df_local6 { file("/var/log/$R_YEAR-$R_MONTH-$R_DAY/$SOURCEIP/router.log" template("$FULLDATE <> $PROGRAM <> $MSGONLY\n") template_escape(no)); }; log { source(s_udp); filter(f_local6); destination(df_local6); }; The problem is in which some messages with facility local6 are written in disc with facility local7, reason why does not respect its file. An example is the following one: Server:/var/log/10.0.0.51 # ls 239.error.log 241.error.log 244.error.log router.log Server:/var/log/10.0.0.51 # more 239.error.log 2007 Aug 8 03:30:59 <> 239 -- local6 -- <> *Apr 2 05:15:21: %LINK-3-UPDOWN: Interface Serial1/1:19, changed state to down The facility local6 is present in the menssage, but the name of file is $PROGRAM.error.log The version of syslog-ng that i use is 1.6.8. Some idea of so that this happens? -- Power by Debian. A greeting, Javier.

1 0

syslog-ng.conf help - syslog-ng writing everything to 'messages' in addition to $HOST.log
by Kevin Reiter 07 Aug '07

07 Aug '07

All, I'm fairly new to syslog-ng (been using syslogd for many years) and I have a question with the config file syntax. What I'm trying to do is log all remote hosts to /var/log/$HOST.log while keeping the logging host's logs seperate. What I'm seeing is all messages are being written to /var/log/$HOST.log, including the logging system, as well as to /var/log/messages. In a single day, /var/log/messages grows to over 11GB (I'm logging less than 100 devices - Windows servers, routers, and switches.) I haven't quite figured out which part of the config file is causing this to happen, since I'm still going through my growing pains with it. Can someone point me in the right direction with this? This is running on FreeBSD 6.2-RELEASE, and syslog-ng was installed via ports: root@logmeister [~]# pkg_info | grep syslog-ng syslog-ng-2.0.2 A powerful syslogd replacement In /etc/rc.conf I have the following defined: # We want syslog-ng, not the default syslogd: syslog_ng_enable="YES" syslogd_enable="NO" Here's my syslog-ng.conf file (note that I have the swatch portion at the end commented out. I'll figure that out once I get the important issues ironed out.) ------- Begin syslog-ng.conf ------- # /usr/local/etc/syslog-ng.conf # Modified for logmeister (running FreeBSD 6.2-RELEASE SMP) # # options # options { long_hostnames(on); sync(0); use_dns(yes);}; # # sources # source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); udp(); internal(); file("/dev/klog"); }; # # destinations # destination messages { file("/var/log/messages"); }; destination security { file("/var/log/security"); }; destination authlog { file("/var/log/auth.log"); }; destination maillog { file("/var/log/maillog"); }; destination lpd-errs { file("/var/log/lpd-errs"); }; destination xferlog { file("/var/log/xferlog"); }; destination cron { file("/var/log/cron"); }; destination debuglog { file("/var/log/debug.log"); }; destination consolelog { file("/var/log/console.log"); }; destination all { file("/var/log/all.log"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination slip { file("/var/log/slip.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination console { file("/dev/console"); }; destination allusers { usertty("*"); }; #destination loghost { udp("loghost" port(514)); }; # Log all remote hosts to their own file: destination remote { file("/var/log/$HOST.log" owner(root) group(wheel) perm(0644) dir_perm(0700) create_dirs(yes)); }; # # log facility filters # filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_not_authpriv { not facility(authpriv); }; filter f_console { facility(console); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # # log level filters # filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; filter f_is_debug { level(debug); }; # # program filters # filter f_ppp { program("ppp"); }; filter f_slip { program("startslip"); }; # # *.err;kern.warning;auth.notice;mail.crit /dev/console # log { source(src); filter(f_err); destination(console); }; log { source(src); filter(f_kern); filter(f_warning); destination(console); }; log { source(src); filter(f_auth); filter(f_notice); destination(console); }; log { source(src); filter(f_mail); filter(f_crit); destination(console); }; # # *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages # log { source(src); filter(f_notice); filter(f_not_authpriv); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_mail); filter(f_crit); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # # security.* /var/log/security # log { source(src); filter(f_security); destination(security); }; # # auth.info;authpriv.info /var/log/auth.log log { source(src); filter(f_auth); filter(f_info); destination(authlog); }; log { source(src); filter(f_authpriv); filter(f_info); destination(authlog); }; # # mail.info /var/log/maillog # log { source(src); filter(f_mail); filter(f_info); destination(maillog); }; # # lpr.info /var/log/lpd-errs # log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); }; # # ftp.info /var/log/xferlog # log { source(src); filter(f_ftp); filter(f_info); destination(xferlog); }; # # cron.* /var/log/cron # log { source(src); filter(f_cron); destination(cron); }; # # *.=debug /var/log/debug.log # log { source(src); filter(f_is_debug); destination(debuglog); }; # # *.emerg * # log { source(src); filter(f_emerg); destination(allusers); }; # # uncomment this to log all writes to /dev/console to /var/log/console.log # console.info /var/log/console.log # #log { source(src); filter(f_console); filter(f_info); destination(consolelog); }; # # uncomment this to enable logging of all log messages to /var/log/all.log # touch /var/log/all.log and chmod it to mode 600 before it will work # *.* /var/log/all.log # #log { source(src); destination(all); }; # # uncomment this to enable logging to a remote loghost named loghost # *.* @loghost # #log { source(src); destination(loghost); }; # # uncomment these if you're running inn # news.crit /var/log/news/news.crit # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice # #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; # # !startslip # *.* /var/log/slip.log # log { source(src); filter(f_slip); destination(slip); }; # # !ppp # *.* /var/log/ppp.log # log { source(src); filter(f_ppp); destination(ppp); }; # Log remote hosts to {hostname}.log ####################### ### Local Machine ##### ####################### # *.err;kern.warning;auth.notice;mail.crit /dev/console log { source(src); filter(f_err); destination(console); }; log { source(src); filter(f_kern); filter(f_warning); destination(console); }; log { source(src); filter(f_auth); filter(f_notice); destination(console); }; log { source(src); filter(f_mail); filter(f_crit); destination(console); }; # *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages log { source(src); filter(f_notice); filter(f_not_authpriv); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_mail); filter(f_crit); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # security.* /var/log/security log { source(src); filter(f_security); destination(security); }; # auth.info;authpriv.info /var/log/auth.log log { source(src); filter(f_auth); filter(f_info); destination(authlog); }; log { source(src); filter(f_authpriv); filter(f_info); destination(authlog); }; # mail.info /var/log/maillog log { source(src); filter(f_mail); filter(f_info); destination(maillog); }; # cron.* /var/log/cron log { source(src); filter(f_cron); destination(cron); }; # *.=debug /var/log/debug.log log { source(src); filter(f_is_debug); destination(debuglog); }; # *.emerg * log { source(src); filter(f_emerg); destination(allusers); }; ####################### ### Remote Hosts ###### ####################### # *.err;kern.warning;auth.notice;mail.crit log { source(src); filter(f_err); destination(remote); }; log { source(src); filter(f_kern); filter(f_warning); destination(remote); }; log { source(src); filter(f_auth); filter(f_notice); destination(remote); }; log { source(src); filter(f_mail); filter(f_crit); destination(remote); }; # *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err log { source(src); filter(f_notice); filter(f_not_authpriv); destination(remote); }; log { source(src); filter(f_kern); filter(f_debug); destination(remote); }; log { source(src); filter(f_lpr); filter(f_info); destination(remote); }; log { source(src); filter(f_mail); filter(f_crit); destination(remote); }; log { source(src); filter(f_news); filter(f_err); destination(remote); }; # security.* log { source(src); filter(f_security); destination(remote); }; # auth.info;authpriv.info log { source(src); filter(f_auth); filter(f_info); destination(remote); }; log { source(src); filter(f_authpriv); filter(f_info); destination(remote); }; # mail.info log { source(src); filter(f_mail); filter(f_info); destination(remote); }; # cron.* log { source(src); filter(f_cron); destination(remote); }; # *.=debug log { source(src); filter(f_is_debug); destination(remote); }; # *.emerg log { source(src); filter(f_emerg); destination(remote); }; # local.* log { source(src); filter(f_local0); destination(remote); }; log { source(src); filter(f_local1); destination(remote); }; log { source(src); filter(f_local2); destination(remote); }; log { source(src); filter(f_local3); destination(remote); }; log { source(src); filter(f_local4); destination(remote); }; log { source(src); filter(f_local5); destination(remote); }; log { source(src); filter(f_local6); destination(remote); }; log { source(src); filter(f_local7); destination(remote); }; # send all logs to swatch for (near) real-time alerts #log { # source(src); # destination(swatch); #}; ------- End syslog-ng.conf ------- Many Thanks, Kevin Reiter Senior Security Engineer Financial Services, Inc. 21 Harristown Road Glen Rock, New Jersey 07452 (201)652-6000, ext. 588 PGP ID: 0xEE665233 This message may contain confidential or proprietary information and is intended solely for the individual(s) to whom it is addressed. If you are not a named addressee you should not disseminate, distribute or copy this e-mail or act upon the information contained herein. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.

2 3

Cannot open file for writing (Permission denied)
by Ian Marlier 06 Aug '07

06 Aug '07

This is driving me up a wall, and I'm hoping that someone can give me some help... I'm trying to set up a server that's going to take syslog messages coming in on local5, and put them in a log file. I've defined a source that listens on all interfaces, on UDP port 514. That seems to be working fine -- netstat shows that syslog is listening on that port, and messages do come in on it. I've got a filter set up as filter f_comblog { facility(local5); }; I've got a destination set up this way: destination d_comblog { file("/space/comblog/local5" perm(0644)); }; And the the log statement is defined this way: log { source(netsrc); filter(f_comblog); destination(d_comblog); }; No complaints from syslog-ng about the syntax or anything else. The trouble that I'm having is that syslog-ng refuses to open the destination file for writing, giving me the message "Cannot open file /space/comblog/local5 for writing (Permission denied)" I get this message even with permissions relaxed all the way to 0777, on the file itself, on the directory in which the file is located, and even on the directory above that. I can create another file in the directory with identical permissions, and open it, write to it, etc with vi, so there isn't a problem with the partition being ro or anything like that. `lsof` indicates that no other process has the log file open for reading, writing, or anything else. Syslog-ng is running as root. The one thing that occurs to me is that there might be some problem with my mount tree. The directory /space has a partition mounted to it, and then /space/comblog has a different partition mounted on it. Is that something that would cause a problem for syslog-ng? I tried doing an strace, which was uninformative -- it just shows an "-1 EPERM" exit when syslog-ng tries to open the file. I'm going crazy with this one...anyone? Thanks! - Ian

2 2

syslog-ng-2.0.5 on HP-UX 11.11
by Uwe Martin 06 Aug '07

06 Aug '07

Hello, I try to compile the new version 2.0.5 on HP-UX 11.11. configure is running without erorrs. (./configure --enable-dynamic-linking) make stops with the following error : if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -DLIBNET_BIG_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -g -MT afinet.o -MD -MP -MF ".deps/afinet.Tpo" \ -c -o afinet.o `test -f 'afinet.c' || echo './'`afinet.c; \ then mv -f ".deps/afinet.Tpo" ".deps/afinet.Po"; \ else rm -f ".deps/afinet.Tpo"; exit 1; \ fi afinet.c: In function 'afinet_setup_socket': afinet.c:163: error: storage size of 'mreq' isn't known afinet.c:163: warning: unused variable 'mreq' *** Error exit code 1 How can I solve this problem ? kind regards Uwe Martin Festo AG & Co. KG Uwe Martin Abteilung IN-O Network-Operation Obere Kaiserstraße 303 D - 66386 St. Ingbert Tel: ++49 (0) 6894-591-6323 Fax: ++49 (0) 6894-591-6326 http://www.festo.com Der Inhalt dieses E-Mails ist ausschliesslich fuer den bezeichneten Adressaten bestimmt. Jede Form der Kenntnisnahme, Veroeffentlichung, Vervielfaeltigung oder Weitergabe des Inhalts dieses E-Mails durch unberechtigte Dritte ist unzulaessig. Wir bitten Sie, sich mit dem Absender des E-Mails in Verbindung zu setzen, falls Sie nicht der Adressat dieses E-Mails sind und das Material von Ihrem Computer zu loeschen. This e-mail and any attachments are confidential and intended solely for the addressee. The perusal, publication, copying or dissemination of the contents of this e-mail by unauthorised third parties is prohibited. If you are not the intended recipient of this e-mail, please delete it and immediately notify the sender. Rechtsform: Kommanditgesellschaft Sitz: Esslingen a.N. Registergericht Stuttgart HRA 211583 Umsatzsteuerident-Nummer: DE 145339206 Persoenlich haftende Gesellschafterin:Festo Aktiengesellschaft Sitz: Stuttgart Registergericht Stuttgart HRB 18535 Vorstand: Dr. Ekkehard Gericke, Lothar Kempf, Dipl.-Ing. Rudi Menrad Dr. Thomas Rubbe Dr. Eberhard Veit (Sprecher) Dr. Ulrich Walker Aufsichtsratsvorsitzender: Dr. Wilfried Stoll

7 14

Frances Wand/Poughkeepsie/IBM is out of the office.
by Frances Wand 06 Aug '07

06 Aug '07

I will be out of the office starting 08/06/2007 and will not return until 08/13/2007. Please call my cell phone listed in blue page for urgent issues. Thank you!

1 0

Syslog_ng-2.0.2-Post install reboot problems
by Shamim 02 Aug '07

02 Aug '07

Hi All, Please sugget me the possible cause of the below error message. ********************************************************************************************************** The following error message is seen during a post install reboot. This appears to be related to the installation of the Syslog_ng-2.0.2 . These messages will appear during system startups and additional messages will be generated as a result of the setroubleshootd daemon not being present. Subsequent removal the Syslog_ng-2.0.2 corrects this issue. Starting setroubleshootd: [ OK ] Starting NFS statd: [ OK ] Traceback (most recent call last): File "/usr/sbin/setroubleshootd", line 59, in ? from setroubleshoot.config import cfg File "/usr/lib/python2.4/site-packages/setroubleshoot/__init__.py", line 24, in ? log_init(sys.argv[0]) File "/usr/lib/python2.4/site-packages/setroubleshoot/log.py", line 127, in log_init syslog = logging.handlers.SysLogHandler(address='/dev/log') File "/usr/lib64/python2.4/logging/handlers.py", line 602, in __init__ self._connect_unixsocket(address) File "/usr/lib64/python2.4/logging/handlers.py", line 617, in _connect_unixsocket self.socket.connect(address) File "<string>", line 1, in connect socket.error: (13, 'Permission denied') Starting RPC idmapd: [ OK ] Starting system message bus: [ OK ] Starting Bluetooth services: [ OK ] ***************************************************************************************************** Thanks --------------------------------- Yahoo! Mail is the world's favourite email. Don't settle for less, sign up for your freeaccount today.

2 1

Syslog-ng appears to hang for local requests to log
by Russell Fulton 01 Aug '07

01 Aug '07

Hi Folks We operate a central syslog server for several thousand system on a linux box running syslog-ng 2.0rc3. For some time we have noticed that the machine hosting the service slowly locks up and we then have to reset the power to restart it. Recently we significantly increased the load on the box and now this is happening about once a week. Here are the symptoms we observer: 1. service to systems sending logs to the host are not affected. Logs continue to get written to disk 2. Cron jobs hang 3. login attempts hang 4. as do sudo attempts. 5. ssh sessions that were established before things turned to custard are not affected 6. top, sar etc. don't show anything unusual 7. ps shows hung cron jobs but nothing else unusual We are guessing that syslog-ng is causing any local process that tries to log to hang. In particular login, sudo and cron all cause login activity. If the system is left it eventually runs out of swap and processes. What we will do is to establish an ssh session to root so next time things come unstuck we can restart syslog-ng to see if that gets things going again. Any idea what is wrong or what we can do to diagnose the problem. Russell

3 3