October 2008 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] wip/syslog-ng2: 2.0.0 -> 2.0.9
by Brian A. Seklecki 16 Oct '08

16 Oct '08

Actually here's the updated distinfo from pkglint(8). Also should have included the syslog-ng@ crew to let them know about the update to pkgsrc-wip.sf.net ~BAS ----------- # more distinfo $NetBSD$ SHA1 (syslog-ng-2.0.9.tar.gz) = f7ea7bf6640d8ae2d745d70a883a7aa37f5bcd9d RMD160 (syslog-ng-2.0.9.tar.gz) = a937b39c7592e57533aa9f164127bef73c4dec0e Size (syslog-ng-2.0.9.tar.gz) = 378779 bytes SHA1 (patch-aa) = e69031ddeb20cec2c43edd8b03ec1cefc26a68c4 On Sat, 11 Oct 2008, Brian A. Seklecki wrote: > > Seems okay: > > /var/log/messages: > 2008 Oct 11 20:35:13 -04:00 metrotitan [syslog-ng][17211] [syslog] > [notice] syslog-ng[17211]: syslog-ng starting up; version='2.0.9' > > There's just one small bug which Bazsi says is fixed in Trunk/-rHEAD: > > https://lists.balabit.hu/pipermail/syslog-ng/2008-July/011880.html > (small patch at end of msg) > > Diff: > > root@metrotitan:/usr/pkgsrc/wip/syslog-ng2# cvs diff -u > cvs diff: Diffing . > Index: Makefile > =================================================================== > RCS file: /cvsroot/pkgsrc-wip/wip/syslog-ng2/Makefile,v > retrieving revision 1.3 > diff -u -r1.3 Makefile > --- Makefile 26 May 2008 13:59:47 -0000 1.3 > +++ Makefile 12 Oct 2008 00:36:04 -0000 > @@ -1,7 +1,7 @@ > # $NetBSD$ > # > > -PKGVERSION= 2.0.0 > +PKGVERSION= 2.0.9 > DISTNAME= syslog-ng-${PKGVERSION} > PKGNAME= syslog-ng2-${PKGVERSION} > > Index: distinfo > =================================================================== > RCS file: /cvsroot/pkgsrc-wip/wip/syslog-ng2/distinfo,v > retrieving revision 1.1.1.1 > diff -u -r1.1.1.1 distinfo > --- distinfo 30 Jun 2007 11:04:50 -0000 1.1.1.1 > +++ distinfo 12 Oct 2008 00:36:04 -0000 > @@ -1,5 +1,5 @@ > $NetBSD$ > > -SHA1 (syslog-ng-2.0.0.tar.gz) = 11a00e49f51056873d9889b8f2a62733b71bd040 > -RMD160 (syslog-ng-2.0.0.tar.gz) = ed2c3ff8eea834c0c2fdae03ce2f9068a6d24128 > -Size (syslog-ng-2.0.0.tar.gz) = 337553 bytes > +SHA1 (syslog-ng-2.0.9.tar.gz) = f7ea7bf6640d8ae2d745d70a883a7aa37f5bcd9d > +RMD160 (syslog-ng-2.0.9.tar.gz) = a937b39c7592e57533aa9f164127bef73c4dec0e > +Size (syslog-ng-2.0.9.tar.gz) = 378779 bytes > > > --------------------------------- > > $ more patch-aa > --- tests/loggen/loggen.c.orig 2008-10-11 20:42:13.000000000 -0400 > +++ tests/loggen/loggen.c 2008-10-11 20:42:36.000000000 -0400 > @@ -22,6 +22,8 @@ > > #define MAX_MESSAGE_LENGTH 8192 > > +#define AI_ADDRCONFIG 0x00000020 > + > #define USEC_PER_SEC 10e6 > #define MIN(a, b) ((a) < (b) ? (a) : (b)) > > > > l8*

1 1

Re: [syslog-ng] Encoding provlem when writing to postgres
by ml＠bortal.de 16 Oct '08

16 Oct '08

Hi Bazsi, > > where can i get syslog-ng 3.0? > > > > I cant find it on > > http://www.balabit.com/downloads/files/syslog-ng/sources/ > > I've just sent out an announcement that it's available as a git > repository. > > No formal releases have been made yet. I don't need a formal release announcment :) A snapshot or svn/cvs would be great. I just need that enconding support stuff :) Thanks, Mario

2 1

Re: [syslog-ng] Destination program behavior
by Gaetan Lord 16 Oct '08

16 Oct '08

>> My script is meant to run once and exit. Could it be the problem. > >Yes absolutely. You cannot exit after each log message, that is not permitted and explains why you are getting the SIGPIPE errors. You have to run in a loop, reading and processing >messages from stdin until you get an eof. See old postings to this list. Here's a pointer to one that gives an outline bash script that you can build upon. > >https://lists.balabit.hu/pipermail/syslog-ng/2008-March/011512.html Thank for the information. The script didn't work at first, at least under SuSE 10 with the native syslog-ng version 1.6.8 I compile and tried with version 2.0.9, and it work. :) I do have one more question for you. For now, I cannot replace the current syslog-ng V1.6.8. Can I run a second instance of syslog-ng, in this case version 2.0.9. The second one will have a different configuration file, and basically only run my destination program rule. Thanks again -- Helen Hayes - "Age is not important unless you're a cheese."

1 0

About Syslog-NG performance
by Yu Watanabe 15 Oct '08

15 Oct '08

Hello all, I am planning to build a syslog server using syslog-ng v 2.0.5. However, I am very concerned with the how much performace could syslog-ng can handle. Following is the system specification I am using. OS : RHEL 4 or RHEL 5 CPU : Xeon(R) E5205 (1.86GHz)×2 Memory : 4 GB I would like get an advice with the performace of the syslog-ng. Does any one has a testimonial with this? Yu Watanabe

2 2

Re: [syslog-ng] Encoding provlem when writing to postg res
by Paul Robert Marino 15 Oct '08

15 Oct '08

I've seen this with other web based apps. It usualy happens when tere is a control character in the text unfortunitly most text editors will simply ignore the character so it makes it hard to diagnose. If this is only happening with email related messages (which is not un-common) you may need to handle it at your mail server. Specificlty in the perl script that apears to be generating the message. Here is a regex I've used in the past in webforms where people would often copy and past fields from outlook that helped with the same error s/\P{IsPrint}//g this regex will strip out any characters that are not unicode printable. -----Original Message----- From: ml(a)bortal.de Subj: [syslog-ng] Encoding provlem when writing to postg res Date: Wed Oct 15, 2008 3:53 am Size: 1K To: syslog-ng(a)lists.balabit.hu Hello List, i get the following error when i try to write to postres: Error running SQL query; type='pgsql', host='XXX', port='', user='XXX', database='syslogng', error='ERROR: invalid byte sequence for encoding "UTF8": 0xe96461\x0aHINT: This error can also happen if the byte sequence does not match the encoding expected by the server, which is controlled by "client_encoding".\x0a', query='INSERT INTO msg_table (msg_rcv_time, msg_sent_time, hostname, msg_facility, msg_priority, msg_text) VALUES (\'2008-10-14T19:59:46+02:00\', \'2008-10-14T19:59:46+02:00\', \'foo\', \'mail\', \'warning\', \'mimedefang.pl[3497]: Message contains more than one Subject: header: Bulletin d\\\'\'info d\\\'\'Enseigner.TV et la fiche p\xffdagogique de l\\\'\'\xffmission du mois \xff 14 octobre 208 --> Bulletin d\\\'\'info d\\\'\'Enseigner.TV et la fiche p\xffdagogique de l\\\'\'\xffmission du mois \xff 14 octobre 208\')' How can i fix this? I am running postgresql-8.1 with Debian 4.0. Thanks, Mario ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 0

Encoding provlem when writing to postgres
by ml＠bortal.de 15 Oct '08

15 Oct '08

Hello List, i get the following error when i try to write to postres: Error running SQL query; type='pgsql', host='XXX', port='', user='XXX', database='syslogng', error='ERROR: invalid byte sequence for encoding "UTF8": 0xe96461\x0aHINT: This error can also happen if the byte sequence does not match the encoding expected by the server, which is controlled by "client_encoding".\x0a', query='INSERT INTO msg_table (msg_rcv_time, msg_sent_time, hostname, msg_facility, msg_priority, msg_text) VALUES (\'2008-10-14T19:59:46+02:00\', \'2008-10-14T19:59:46+02:00\', \'foo\', \'mail\', \'warning\', \'mimedefang.pl[3497]: Message contains more than one Subject: header: Bulletin d\\\'\'info d\\\'\'Enseigner.TV et la fiche p\xffdagogique de l\\\'\'\xffmission du mois \xff 14 octobre 208 --> Bulletin d\\\'\'info d\\\'\'Enseigner.TV et la fiche p\xffdagogique de l\\\'\'\xffmission du mois \xff 14 octobre 208\')' How can i fix this? I am running postgresql-8.1 with Debian 4.0. Thanks, Mario

2 1

syslog-ng 3.0 OSE and PE Release Date?
by Christian Lammers 14 Oct '08

14 Oct '08

Hello, I've compiled the 3.0 OSE successful and get it working. But also, it would be nice to test the Premium Edition in Version 3.0. I've read on the homepage, that it should be released in Q2 2008? I'm currently writing my bachelor thesis about "Audit proof logging", and in my opinion the syslog-ng 3.0 is the only professional tool to conform compliance requirements. Maybe, there is some Beta Version available? Thanks in advance, -- ------------------------------------------------------------------------ Christian Lammers Thinking Objects GmbH Tel. +49 71188770-301 Lilienthalstraße 2/1 Fax +49 711 88770-449 70825 Korntal/Stuttgart christian.lammers(a)to.com http://www.to.com Geschäftsführer: Markus Klingspor Sitz und Amtsgericht Stuttgart, HRB 19769 ------------------------------------------------------------------------

2 1

syslog-ng Agent, 3.0.3 release schedule (hatarido: 2008.10.22)
by Balazs Scheidler 14 Oct '08

14 Oct '08

hali, Rogtonzott megbeszelesunkon a kovetkezokben maradtunk: Memo: ----- * Zolinak szuksege van 1 napra egyedul, hogy az Agent olyan allapotba jusson, hogy a tobbi tesztelot is ra lehessen engedni (most nem kuld egyaltalan XP-n) * Szukseges funkcionalis tesztek: * 32/64 bit tesztek, telepitovel, kulonbozo kombinaciok, 2 nap * Vista funkcionalis teszt: 2nap * Hibajegybol most kb 20 van, amit tesztelni kell, feltetelezzuk, hogy a funkcionalis tesztekbol tovabbi 20 esik ki, igy 40 hibajegy tesztelesevel szamolunk, ami sacc/kb 6 embernap, ami viszont parhuzamosithato * Ghost meg csinalja az egy-ket nyitott hibajegyet, ha barmi a tesztelest blokkolo dolog van, akkor azt oldja meg inkabb * Abban maradtunk, hogy PZolin kivul MAndras es Lorant is syslog-ng agent-et fog tesztelni, Lorant alapvetoen holnaptol, MAndras matol * Szukseg van egy tesztkornyezetre, ld. todo TODO summary: ------------- * PZoli: ma elokesziti a tobbi tesztelest, a mindenkit blokkolo hibak kivasalasa * Ghost: ha van PZoli altal bejelentett blokkolo hiba, akkor az, ha nincs, akkor a meg nyitott hibajegyek * MAndras: * ma: tesztkornyezet osszerakasa, ami egy olyan Windows, ami: * minden audit esemeny bekapcsolva * IIS beallit, es fut, es logol * ISA beallit, es fut, es logol (ebben Scott/Ghost rendelkezhet infoval) * holnaptol: hibajegyteszt, esetleg szcenario teszt (PZoli megmondja) * Lorant: holnaptol hibajegyteszt, esetleg szcenraio teszt (PZoli megmondja) Abban maradtunk, hogy jovo het szerdara (okt. 22), az osszes uj funkcio letesztelve, hibajavitva lesz egy binarisunk, csak a release teszt lesz vissza. -- Bazsi

1 1

Benchmarking my syslog-ng infrastructure
by Francis Lacoste 14 Oct '08

14 Oct '08

Hello all, I am currently configuring my infrastructure to throw all logs to a dedicated syslog-ng server. I would like to benchmark it to know how many messages per seconds it can accept before it starts dropping. Is there any tools available ? Thanks. *Francis Lacoste*

2 1

FW: syslog-ng not working
by Ramprasad 13 Oct '08

13 Oct '08

Hi List, Do you have any suggestions for the below mentioned issue? Thanks & Regards, Ramprasad B ________________________________ From: Ramprasad Sent: Wednesday, October 08, 2008 12:43 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: syslog-ng not working Hi list, I have the following configuration in /etc/syslog-ng/syslog-ng.conf file on OpenSuSE 11.0 64 bit system. # cat /etc/syslog-ng/syslog-ng.conf options { long_hostnames(off); sync(0); perm(0640); stats(3600); }; source src { internal(); unix-stream("/dev/log"); unix-dgram("/dev/log"); }; destination d_filepath_10 { file("/tmp/syslog" fsync(yes)); }; filter f_filter_10 {level(debug .. emerg); }; log { source(src); filter(f_filter_10); destination(d_filepath_10); }; I don't see any log messaged being logged to /tmp/syslog file. Though, I restarted the syslog daemon, there is not effect. I went through some syslog-ng examples available on internet such as the one below, but still I don't see syslog-ng logging to the specified file - /tmp/syslog # cat /etc/syslog-ng/syslog-ng.conf options { keep_hostname(yes); long_hostnames(off); sync(1); log_fifo_size(1024); }; source src { unix-stream("/dev/log"); internal(); udp(); tcp(port(5140) keep-alive(yes)); }; destination syslog { file("/var/log/syslog"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/tmp/syslog"); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; log { source(src); filter(f_messages); destination(messages); }; Please help us on this. Thanks & Regards, Ramprasad B

1 0