February 2008 - syslog-ng - lists.balabit.hu

Leap Year
by hi ro 06 Mar '08

06 Mar '08

Hi, Do you have any problem about Leap Year? Thanks hiro _________________________________________________________________ Hotmailユーザの半数近くが使用しています。Windows Liveメッセンジャー。 http://messenger.live.jp/

3 2

Syslog-ng 2.0.x on Fedora Core 4
by Ivey, Chris 03 Mar '08

03 Mar '08

Folks, I need to upgrade syslog-ng running on my 2 servers, which are running Fedora Core 4. Is it possible to put 2.0.x onto a machine running FC4? I was looking around this morning for this information, and can't find anything that says "yay" or "nay". Thanks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

3 2

Problem with installation
by vempati Ramprasad 29 Feb '08

29 Feb '08

Hi frnds, When Iam trying to do a make on syslog-ng,Iam getting the following error.Could you let me know,how do I resolve this problem.Iam in desperate need for this. My configuration is : Redhat Linux : 3.2.2-5 Kernel : 2.4.31 eventlog-0.2.7.tar.gz syslog-ng-2.0.8.tar.gz. gcc version : 3.2.2 When I do "make" in syslog-ng directory....(After ./configure step) Iam getting the following error. "In file included from /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:61: parse error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:591: parse error before ')' token /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:624: parse error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/root/rams/syslog-ng-2.0.8/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/rams/syslog-ng-2.0.8' make: *** [all] Error 2 [root@ramprasad syslog-ng-2.0.8]#" Please help me. -ramprasad. Rgds, Ramprasad Vempati

2 1

Syslog-ng 2.0.x on FC4?
by Ivey, Chris 25 Feb '08

25 Feb '08

Folks, I need to upgrade my syslog-ng running on my 2 servers, which are running Fedora Core 4. Is it possible to put 2.0.x onto a machine running FC4? I was looking around this morning for this information, and can't find anything that says "yay" or "nay". Thanks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

1 0

syslog partialy ignores the firewall filter...
by eial＠cs.bgu.ac.il 24 Feb '08

24 Feb '08

I've setup an firewall and I want to log the rejects to a separate log file, I've done that but I've not been able to drop the messages from dmesg, here is my conf file # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo,v 1.7 2007/08/02 04:52:18 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux # contributed by Michael Sterrett options { chain_hostnames(off); sync(0); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; source src { unix-stream("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; #firewall filter f_firewall { match("Rejected: "); }; filter f_no_firewall { not match("Rejected: "); }; destination firewall { file("/var/log/iptables.log" owner("root") group("adm") perm(0640)); }; log { source(src); filter(f_firewall); destination(firewall); flags(final); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; # ...if you intend to use /dev/console for programs like xconsole # you can comment out the destination line above that references /dev/tty12 # and uncomment the line below. #destination console_all { file("/dev/console"); }; log { source(src); filter(f_no_firewall); destination(messages); }; log { source(src); destination(console_all); }; how can I fix it? thanks

3 3

time_sleep() and inadvertent admission control
by John Morrissey 22 Feb '08

22 Feb '08

About a year ago, I noticed heavy CPU consumption during certain workloads (many processes sending a small number of log messages per process, such as a busy Postfix machine) due to io_iter spinning very rapidly on poll(). We kludged around it by adding the time_sleep() directive, to add an artificial delay at the end of the io_iter loop and prevent the loop from rolling over too quickly: http://marc.info/?l=syslog-ng&m=114009552929622&w=2 We started using time_sleep(30) across all of our machines, since that delay value didn't seem to cause any problems for our workloads and we wanted to keep the configuration uniform. We noticed recently that time_sleep() exhibits some inadvertent admission control behavior. When poll() indicates that the listener socket has activity (new connections), syslog-ng seems to accept() only once on it, allowing one new connection per poll(). As a result, it only allows: 1000 / time_sleep() connections per second. Accordingly, with time_sleep(30), only 33 connections would be allowed every second. This became problematic when we added a logger into our qmail-pop3d chain. Normally, qmail-pop3d is invoked thusly: qmail-popup $HOSTNAME auth_pop qmail-pop3d ./Maildir/ qmail-popup starts, pops its args, and then exec()s what's left over. By default, qmail's POP3 daemon doesn't log user information, so we added a very simple syslogging script to this exec chain, like so: qmail-popup $HOSTNAME auth_pop qmail-loguser qmail-pop3d ./Maildir/ [jwm@periscope:pts/0 ~> cat qmail-loguser #!/bin/sh logger -t $(basename $0) -- "${HOME##*/} from $TCPREMOTEIP on $TCPLOCALIP" exec "$@" This was disastrous under load, since the admission control behavior caused by time_sleep() made logger(1) block, quickly causing the machine to run out of memory. I realize time_sleep() is a kludge, but more advanced dynamic tuning to replace it seems like it would be error-prone and difficult to troubleshoot when things go wrong. I would also argue that time_sleep() is meant to prevent spinning on poll() and its effect was not intended for *new connections*, since new connections did not cause the original problem of excessive CPU consumption. time_sleep() unnecessarily throttles new connections, which in workloads like qmail's are critical to scalability. For example, syslog-ng still consumes only ~2% of a dual 2.8GHz Xeon machine's CPUs even with this rapid-connection qmail workload. Instead, would it make sense for syslog-ng to accept() on the listener FD (it would need to be marked as non-blocking; I haven't looked into the ramifications if it isn't already) until there are no more new connections waiting, perhaps with a hard ceiling if starvation of other FDs is a worry? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

4 7

Why syslog-ng'config permission change ?
by hi ro 22 Feb '08

22 Feb '08

Hi, I installed syslog-ng. At that time, syslog-ng.conf's permission was 644. I let A user (not root) to update syslog-ng.conf, so I changed permission to 666. But I reboot the Server, then syslog-ng.conf's permission returned 644. Why ? Thanks hiro _________________________________________________________________ 出会いがない、と嘆いているあなたにぴったりの恋人探し！まずは無料検索！ http://match.jp.msn.com/channel/index.aspx?avo=1&trackingid=1034447

4 4

syslog-ng does not resume log when disk is full at first, and then disk space available
by Andrej Lobovski 21 Feb '08

21 Feb '08

Hi. I have a problem, with syslog-ng 2.0.0-1etch1 on debian 4. It is like this: - syslog-ng fills /var/log/syslog with messages - then /var partition becomes full and I get "No space left on device (28)" error written in /var/log/syslog (tail -f on this file), which is expected - then I make some disk space available on /var partition, BUT syslog-ng does not resume writing in /var/log/syslog at all Am I missing any options in /etc/syslog-ng/syslog-ng.conf ? Thank you very much Andrej Podgorsek _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

5 15

bugzilla down
by Balazs Scheidler 20 Feb '08

20 Feb '08

hi, I've just been told that bugzilla.balabit.com is currently down. I hope it can be fixed tomorrow. For the time being, just send bugreports to this list. Sorry for the outage. -- Bazsi

1 0

Syslog-ng sometime dies at 04:02
by Peter Michael Calum 20 Feb '08

20 Feb '08

Hi I have installed syslog-ng on RHEL 5 as an RPM (syslog-ng-2.0.8-1.fc8.i386.rpm). It runs fine except for this problem : Every night at 04:02 som script runs and make a reload of the configuration. This comes out with some errors in the messages file, but the real problem is, that syslog-ng sometime stops running at this time. I'm running syslog-ng together with php-syslog-ng Hope anyone can help rgds, Peter Calum Denmark Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))' My configuration file : options { sync (0); chain_hostnames(on); stats(43200); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; source s_everything { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_everything); destination(d_mysql); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; # vim:set ai ts=4 sw=4 sts=4 et:

5 19