December 2008 - syslog-ng - lists.balabit.hu

[Bug 14] New: Maintain symlinks to current and previous log output files...
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=14 Summary: Maintain symlinks to current and previous log output files... Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=218688 OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'm hoping that upstream might consider adding functionality to syslog-ng to allow it to track current and previous log files and maintain symlinks to them, as a user option. This replicates one of the options that I (and others) find useful in cronolog. This has been previously discussed on the syslog-ng mailing list, though apparently nothing fully came of it. The archive of that discussion is at: https://lists.balabit.hu/pipermail/syslog-ng/2002-June/003452.html Obviously, it's probably somewhat of a low priority, but it would be nice. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

syslog-ng client messages delayed
by mark peters 22 Mar '10

22 Mar '10

Hi, We are running into a issue where syslog-ng clients who are configured to forward to a central syslog-ng destination server that are reasonably chatty are getting there messages delayed at the source (ie. 'tcpdump'ing the client shows it is sending messages from N minutes ago, where N is anything from 5 to 60 minutes on average sometimes more). We have also seen a small percentage of loss at the destination. On these 'delayed' clients we also see the resident memory footprint on the growing. Clients are running 1.6.12 (have tried 2.0.8 also - same symptons). The central syslog-ng server is running 2.0.8. relevant config entries are: syslog-ng client: options { sync (1); time_reopen (10); log_fifo_size (2097152); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination d_central { tcp("log2.xyz.com" port(5140)); }; filter f_local5 { facility(local5); }; log { source(s_sys); filter(f_local5); destination(d_central); flags(final); }; syslog-ng central server: options { time_reopen (10); log_fifo_size (2097152); long_hostnames (off); use_dns (yes); dns_cache (yes); dns_cache_expire (28800); use_fqdn (no); create_dirs (yes); dir_perm (0755); perm (0644); keep_hostname (no); use_time_recvd (no); stats_freq(600); flush_timeout(16000); flush_lines(256); time_sleep(80); }; destination d_server { file("/logs/server.$LEVEL.log"); }; filter f_server { facility(local5) and program("server"); }; log { source(s_sys); filter(f_server); destination(d_server); flags(final); }; to give a rough idea of message volume the server is receiving approximately 50 million log lines per day on average any help/information would be appreciated thanks -------------------------------------- Easy + Joy + Powerful = Yahoo! Bookmarks x Toolbar http://pr.mail.yahoo.co.jp/toolbar/

3 4

[Bug 21] New: call shutdown() before closing a socket
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=21 Summary: call shutdown() before closing a socket Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bazsi(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 syslog-ng should call shutdown() before closing a socket to ensure the contents of the socket buffer are emptied. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 23] New: MySQL default configuration causes error on 'pid' column
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=23 Summary: MySQL default configuration causes error on 'pid' column Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mark(a)la-croix.net Type of the Report: bug Estimated Hours: 0.0 When configuring a MySQL destination, the default 'pid' column type is INT. However, if a message comes through with no PID, the SQL command tries to insert an empty quoted string, which causes an error in MySQL 5.0. Example error: Error running SQL query; type='mysql', host='!MY_DB_HOST!', port='', user='syslog-ng', database='syslog-ng', error='1366: Incorrect integer value: \'\' for column \'pid\' at row 1', query='INSERT INTO !MY_LOG_CLIENT_HOST!_2008_09_23 (date, facility, level, host, program, pid, message) VALUES (\'2008-09-23 12:24:35\', \'1\', \'5\', \'!MY_LOG_CLIENT!\', \'root\', \'\', \'test\')' The message is coming from a TCP source from which a large percentage of messages have no PID associated. The workaround is to explicitly set the PID column to VARCHAR so it can handle empty strings, but it would be nice to see the empty PID case gracefully handled. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 9

[Bug 24] New: .pid file not set correctly (STOP not working)
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=24 Summary: .pid file not set correctly (STOP not working) Product: syslog-ng Version: unspecified Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: man(a)inspektsecurity.com Type of the Report: --- Estimated Hours: 0.0 Hi. in installed syslog-ng 3.0.1 PE (syslog-ng-premium-edition-3.0.1-linux-i386.run). The installation is on a CentOS 5 system (RedHat spin-off). Although the program itself works fine, the RC scripts STOP command does not work. I traced the problem down to the .pid file not being set correctly. According to the RC script the .pid file shoud be in: PIDFILE=$SYSLOGNG_PREFIX/var/run/syslog-ng.pid resulting in the below when running STOP/RESTART ------------ [root@test-server:~] /etc/init.d/syslog-ng restart -n Restarting syslog-ng: -n Stopping syslog-ng: -n Starting syslog-ng: Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (98)' Error initializing source driver; source='tcp_input_syslog', id='tcp_input_syslog#0' Error initializing message pipeline; failed ------------- I found out that the pid file set is actually: /var/run/syslogd.pid So changing the RC script to: PIDFILE=/var/run/syslogd.pid seems to work. br /Marc -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[patch] Add follow_freq_ms option
by Joe Shaw 16 Jan '09

16 Jan '09

Hi, As I mentioned in the last thread, I've found myself wanting to have better than one second resolution for the follow_freq() option. Attached is a patch which adds a follow_freq_ms option, which takes its value in milliseconds rather than full seconds. follow_freq() continues to work as it did previously. Thanks, Joe

3 7

bug in http://www.balabit.com/downloads/files/syslog-ng/sources/3.0.1/source/syslog-ng_3.0.1.tar.gz
by Joseph Pietras 08 Jan '09

08 Jan '09

There is, as far as I know, only a 1 character bug! (and it is missing a "!") The file is src/misc.c $ diff -c misc.c misc.c.orig *** misc.c 2008-12-30 12:12:36.000000000 -0600 --- misc.c.orig 2008-12-30 12:24:00.000000000 -0600 *************** *** 274,280 **** struct passwd *pw; *uid = 0; ! if (!*user) return FALSE; pw = getpwnam(user); --- 274,280 ---- struct passwd *pw; *uid = 0; ! if (*user) return FALSE; pw = getpwnam(user); Hope this helps, hope it gets to someone who can fix it, thanks for syslog-ng. -joseph This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the originator of the message. This footer also confirms that this e-mail message has been scanned for the presence of computer viruses. Any views expressed in this message are those of the individual sender, except where the sender specifies and with authority, states them to be the views of Iowa Student Loan.

2 1

importing old syslog-ng messages
by Daniel L. Spells Sr. 05 Jan '09

05 Jan '09

Sirs, Is there a way to import /var/log/messages, created by syslog-ng, into syslog-ng to be placed into a database? Daniel

5 11

Syslog-NG, log4j, tabs, whitespace, indent
by John Skopis 31 Dec '08

31 Dec '08

Hello, I believe that the log4j SyslogAppender is sending logs to syslog-ng that begin with a '\t' (or four spaces). The leading whitespace is trimmed either because it's not allowed per the syslog RFC, or for some other (hopefully) good reason. Can I turn this behavior off? an example would be a message: Dec 10 16:17:52 testbox at java.lang.Thread.run(Thread.java:619) which should be Dec 10 16:17:52 testbox \tat java.lang.Thread.run(Thread.java:619) Thanks, John Skopis Systems Administrator

3 7

Behavior when followed files are renamed
by Joe Shaw 30 Dec '08

30 Dec '08

Hi, I couldn't find this anywhere in the online docs. What's the behavior of syslog-ng OSE when a file which is being followed with follow_freq() is renamed? Thanks, Joe P.S. From a git checkout of 3.0, doc/reference doesn't exist... is it gone, or does it get pulled from somewhere else when a tarball is built?

4 7