January 2008 - syslog-ng - lists.balabit.hu

2.0.7 contrib/rhel-packaging/syslog-ng.conf typos
by Joe Fegan 26 Jan '08

26 Jan '08

Hi, The example syslog-ng.conf in contrib/rhel-packaging of 2.0.7 has some syntax errors and this patch fixes them. I also noticed that this syslog-ng.conf configures syslog-ng to take over logging of messages from remote machines, but not logging of local messages. I think this mix is odd; it should either take over from syslogd altogether or not at all. This patch resolves that mix by commenting out the remote config. The idea is that installing syslog-ng will not interfere with syslogd up front, but will give you hints on how to do it later if you want. Please consider part or all of this patch for upstream. Joe. _________________________________________________________________ Windows Vista + Windows Live. Open up your digital life. Get Windows Live free. http://get.live.com

4 5

integration and release
by Balazs Scheidler 26 Jan '08

26 Jan '08

hi, Sorry for having been able to dedicate only a small portion of my time to syslog-ng, things have been rough recently. I'm going to integrate pending patches in the coming days and think about the more complex issues (time_sleep, disk flush time etc). Thanks for the patience. -- Bazsi

1 0

Syslog-ng too many open files
by Pedro Rafael Alves Simoes 26 Jan '08

26 Jan '08

Hello, I'm receiving many messages on my syslog-ng like this: syslog-ng[20419]: Error opening file for writing; filename="...", error='Too many open files (24)' syslog-ng[20419]: Error accepting new connection; error='Too many open files (24)' In lsof output, the syslog-ng daemon has many files opened and when I try to login from other console or change to root account, it gets blocked. I've increased the sysctl fs.file-max to 300000 but the problem persists. Any ideas what's going wrong?

4 3

Re: [syslog-ng] Syslog-ng too many open files
by Pedro Rafael Alves Simoes 25 Jan '08

25 Jan '08

> ------------------------------ > > Message: 3 > Date: Thu, 24 Jan 2008 12:41:36 +0000 > From: Joe Fegan <joe_fegan(a)hotmail.com> > Subject: Re: [syslog-ng] Syslog-ng too many open files > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <BAY111-W20A021959661E71A0B78C39B380(a)phx.gbl> > Content-Type: text/plain; charset="windows-1256" > > > What version of syslog-ng is this? Is it 2.0.7? > > Could it be the same issue recently reported as "syslog-ng 2.0.7 major problem?" > in the list archives, where syslog-ng 2.0.7 does not close old files after SIGHUP? > 300,000 is a lot of files... > I'm using Syslog-ng 2.0.0-1 in a Debian Etch Linux. > ------------------------------ > > Message: 4 > Date: Thu, 24 Jan 2008 12:46:53 -0000 > From: "Geller, Sandor $IT$" <Sandor.Geller(a)morganstanley.com> > Subject: Re: [syslog-ng] Syslog-ng too many open files > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <14F0A35F6E466D48BF11108F4E09E68C0970D239(a)LNWEXMB58.msad.ms.com> > Content-Type: text/plain; charset="us-ascii" > > Hi, > > > Hello, > > > > I'm receiving many messages on my syslog-ng like this: > > > > syslog-ng[20419]: Error opening file for writing; filename="...", > > error='Too many open files (24)' > > syslog-ng[20419]: Error accepting new connection; error='Too many open > > files (24)' > > Try raising the per-process number of open files. Please refer to > ulimit. > > > In lsof output, the syslog-ng daemon has many files opened and when I > > try to login from other console or change to root account, it gets > > blocked. > > > > I've increased the sysctl fs.file-max to 300000 but the > > problem persists. > > This raises the per-system limit only. per-process limits still > apply as well as the maximum (maybe 4096, I'm not sure) is hardcoded > into the kernel, so without recompiling you r kernel you can't exceed > this limitation. When you said that's hardcoded, you mean that I have to change the source code or it's configurable via make config? > > > Any ideas what's going wrong? > > Without seeing more details (syslog-ng version number, configuration, > approximate number of clients, client configs) we could only guess. > > Regards, > > Sandor > -------------------------------------------------------- > > NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. > >

2 1

increasing number of TCP connections from same number of remote hosts
by Nagy Daniel 25 Jan '08

25 Jan '08

Hi, It's syslog-ng v2.0.7 on RHEL4, compiled from source. The system is a log server, it receives logs via TCP from various clients. After restarting syslog-ng, netstat -t shows that each remote host open only one TCP connection to the server, which is normal. The problem is, that the number of established TCP connections is increasing constantly, but the number of clients is the same. For example netstat -t --numeric-ports | grep fmx23 now shows: tcp 0 0 barapp1:514 fmx23.freemail.privat:52391 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:50852 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:50172 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:59367 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:50979 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:55828 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:53013 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:50038 ESTABLISHED Why is that? AFAIK there should be only one established connection per client. Is it a server or client problem? Thanks, Daniel

2 4

udp 514 collision?
by Richard Morgan 24 Jan '08

24 Jan '08

Hi all- We're running syslog-ng in relay mode on a server which collects the udp syslogs from generic syslogd on a number of Linux and Solaris hosts in a single location. All the hosts around the collector are able to send logs to the collector, via 514/udp, and the logs are relayed on to our master server successfully. The problem comes on the relay host itself. We want to run syslog-ng as independently as possible and not have it replace the local syslogd. So, the local syslogd should send its logs via 514/udp to the syslog-ng instance. On RHEL4, it seems that the generic syslogd is showing as bound to 514/udp and any messages that the local syslogd would send on to syslog-ng are lost. Remember, this is all happening on the same host. Any syslog messages from other hosts arrive at the syslog-ng relay and are swiftly relayed on to the master server. # netstat -an | grep 514 tcp 0 0 149.174.133.19:514 0.0.0.0:* LISTEN tcp 0 0 149.174.133.19:9605 IP.FOR.SYSLOG-NG.MASTER:9514 ESTABLISHED (I think this piece is the problem:) udp 0 0 0.0.0.0:514 0.0.0.0:* udp 0 0 149.174.133.19:514 0.0.0.0:* syslog-ng Config bits: ------------------------------------------------------ source s_remote { tcp(localip(149.174.133.19) port(514)); udp(localip(149.174.133.19) port(514)); }; destination d_relay { tcp("IP.FOR.SYSLOG-NG.MASTER" port(9514)); }; log { source(s_remote); destination(d_relay); }; ------------------------------------------------------- Any ideas? Richard -------------------------------------------------------- Richard R. Morgan | richard at northerncrown.com --------------------------------------------------------

2 1

compilation problem
by Siwei Zhang 23 Jan '08

23 Jan '08

Hi there, I am trying to compile the syslog-ng-2.0.7 on CentOS 5 but failed with the following errors. Could someone help please? Thanks. Kevin SZ checking for LIBNET... which: no libnet-config in (/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin) no checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... yes checking whether to enable spoof source support... no checking whether to enable IPv6 support... yes checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... no configure: error: Cannot find GLib library version >= 2.2: is pkg-config in path? -bash-3.1$

4 4

HUP to syslog-ng does not close files
by Beirne Konarski 22 Jan '08

22 Jan '08

I'm upgrading from syslog-ng 2.0rc3 to 2.0.7. One thing that no longer works is when I send syslog-ng a hangup signal the currently open files aren't closed and reopened when the config file is reread. I verified this by running an lsof on syslog-ng and I see that it has files open that say "Deleted" next to the filename in the lsof output. If I send syslog-ng a hangup signal without deleting I files I do see a log entry that the config file is being reread. Because of all this I have had to change the restart line in the logrotate configuration from "syslog reload" to "syslog restart". Is this expected? Thanks, Beirne

2 1

Resolving host IPs on the central log server
by Steve Bernacki 21 Jan '08

21 Jan '08

My setup is pretty simple: I have a number of local syslog-ng "collectors" feeding into one central syslog-ng server. All systems are running syslog-ng 2.0.7. I'd like to optimize the collectors for speed and thus not attempt to resolve hostnames there, but rather pass the syslog message raw to the central log server who then performs the IP->DNS translation and writes the message to disk. I've experimented with the various dns_* options to no avail, as it seems like syslog-ng wants to either resolve the hostname at the collector, or not at all. Am I missing something simple here, or is this not possible with 2.0.7? Thanks for your help. Steve -- Steve Bernacki, Jr To date, the Pan-Massachusetts Challenge has raised 204 million dollars for cancer research. Get involved! http://www.pmc.org/

3 2

syslog-ng 2.0.7 major problem
by Balazs Scheidler 21 Jan '08

21 Jan '08

Hi, I've been biten by a non-trivial change in the 2.0.x branch again, so there's a quite severe problem in 2.0.7: - it does not close and reopen files when a SIGHUP is received. This causes problems for log rotation, especially if the files are compressed after rotation. The problematic patch is this: http://git.balabit/cgi-bin/gitweb.cgi?p=syslog-ng/syslog-ng--mainline--2.0.… I've pushed an experimental patch to fix the issue: http://git.balabit/cgi-bin/gitweb.cgi?p=syslog-ng/syslog-ng--mainline--2.0.… I'm goint to be much stricter to myself when deciding whether to include a patch to the 2.0.x branch in the nearfuture. Sorry for the problem. -- Bazsi

4 6