March 2008 - syslog-ng - lists.balabit.hu

Troubleshooting local5.* output
by Sean Carolan 17 Mar '08

17 Mar '08

I am trying to troubleshoot some syslog servers that are not properly sending local5.* logs to a remote syslog-ng server. The syslog-ng server is behaving as it should, and I am able to do this from remote hosts: $ logger -p local5.info "My test message here" This message is correctly written to the local log and remote syslog-ng server. The filters on the syslog-ng box work correctly and the entry is made in the right file for the host. But there is one file on the client, /var/log/mylogfile.log that is being filled up by a running java process. Messages that are written to this file are *not* being sent to the remote server. I ran tcpdump and verified that there are no network packets accompanying these log entries. So, maybe someone can help me. How do I find out how this java process is writing to the log file, and why are messages not being forwarded to the remote host? lsof shows that the only process that has the /var/log/mylogfile.log open is the syslog daemon. Here are some configuration files if it helps: SERVER: /etc/syslog-ng/syslog-ng.conf (excerpt below) options { log_fifo_size(8192); # garden gnomes shouldn't log (Gnome has a buggy log implementation) # needs to be set on client systems, too... bad_hostname("gconfd"); use_time_recvd(no); group(logs); create_dirs(yes); dir_group(logs); dir_perm(0750); perm(0640); chain_hostnames(no); keep_hostname(yes); stats(3600); use_fqdn(yes); }; source syslog { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(5149) max-connections(300)); internal(); }; destination mylogfile.log { file(/var/log/syslog-ng/$HOST/mylogfile.log); }; destination boot.log { file(/var/log/syslog-ng/$HOST/boot.log); }; filter f_local7 { facility(local7); }; filter f_local5 { facility(local5); }; log { source(syslog); filter(f_local7); destination(boot.log); }; log { source(syslog); filter(f_local5); destination(mylogfile.log); }; CLIENT /etc/syslog.conf excerpt *.* @syslogngbox local7.* /var/log/boot.log local5.* /var/log/mylogfile.log

2 3

Repeated log messages?
by John Morrissey 17 Mar '08

17 Mar '08

Recently, we've noticed a few machines are filling up their log filesystems with duplicate log entries. At first, I thought this behavior was caused by running out of disk space (i.e., the machine runs out of disk and syslog-ng does some sort of buffering, and as disk space oscellates between a few hundred bytes available and completely full, syslog-ng is writing this buffered log data out to disk but never removing the log entries from its buffer), but I can't reliably reproduce it. I also noticed that sometimes this would happen when the remote syslog sub was unavailable, but I can't reliably reproduce this behavior by blocking UDP syslog traffic directed at the remote syslog hub. I'd also wonder how syslog-ng would know that UDP syslog traffic is being dropped, unless the nature of the traffic block is such that an ICMP message (host/port unreachable, etc.) is returned to the sending host. I've poked and prodded at syslog-ng, attempting to reliably reproduce this behavior, but haven't been able to. I'm not sure if either of these two events (out of disk space, loss of network access to the syslog hub) are simple coincidences or actually cause/contribute to the behavior. The odd part is that the duplicate log entries seem to be logged forever, such as if syslog-ng was in an infinite loop. Additionally, each duplicate log entry has an additional space each time it's duplicated. For example: Original log entries: Feb 12 06:28:12 rdr01 su[21942]: Successful su for nobody by root Feb 12 06:28:12 rdr01 su[21942]: + ??? root:nobody First round of duplicates, with a single trailing space: Feb 12 06:28:12 localhost su[21942]: Successful su for nobody by root Feb 12 06:28:12 localhost su[21942]: + ??? root:nobody Second round of duplicates, with two trailing spaces: Feb 12 06:28:12 localhost su[21942]: Successful su for nobody by root Feb 12 06:28:12 localhost su[21942]: + ??? root:nobody Third round of duplicates, with three trailing spaces: Feb 12 06:28:12 localhost su[21942]: Successful su for nobody by root Feb 12 06:28:12 localhost su[21942]: + ??? root:nobody [and so on] This is with syslog-ng 2.0.0-1etch1. john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 4

Can't compile 2.0.8 on Solaris 10
by Ralf Weber 13 Mar '08

13 Mar '08

Moin! I am having problems compiling syslog-ng under Solaris 10 both sparc and intel. The error is as follows: /usr/sfw/bin/gcc -g -O2 -Wall -o loggen loggen.o -lpthread - lresolv -lnsl -lrt -lsocket -ldoor -lfl -lglib-2.0 -L/opt/sfw/lib - levtlog Undefined first referenced symbol in file yylex /usr/sfw/lib/gcc/sparc-sun- solaris2.10/3.4.3/../../../libfl.so ld: fatal: Symbol referencing errors. No output written to loggen Now I did search the archive and there was one message of relevance: https://lists.balabit.hu/pipermail/syslog-ng/2006-February/008455.html but the problem there was an empty cfg-lex.c which isn't the case for me: rw@bh2:~/source/syslog-ng-2.0.8$ ls -l src/cfg-lex.* -rw-r--r-- 1 rw ipeng 55895 Jan 31 12:46 src/cfg-lex.c -rw-r--r-- 1 rw ipeng 8979 Dec 18 16:25 src/cfg-lex.l -rw-rw-r-- 1 rw ipeng 51404 Mar 11 13:36 src/cfg-lex.o There is however one thing strange in an earlier stage of the compile which is: if /usr/sfw/bin/gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/ glib-2.0 -I/usr/lib/glib-2.0/include -I/opt/sfw/include/eventlog - D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall - MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg- grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg- grammar.y: In function `yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg- grammar.y:891: warning: implicit declaration of function `strdup' However including <string.h> where this is in also didn't help. Any help on getting this compiled would be appreciated. So long -Ralf

3 7

Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4
by Ivey, Chris 12 Mar '08

12 Mar '08

OK, so I think I see my issue... I have the "FC8" version... how do I go about installing syslog-ng 2.0.8 on FC4 (or FC5, for that matter)? Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Ivey, Chris Sent: Wednesday, March 12, 2008 2:30 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4 Hi ScottO, I got pulled away from this onto a different project, and can now move back to it again. Here is what I get when I try to use RPM to install the application: [root@tahoe ~]# rpm -ivh syslog-ng-2.0.8-1.fc8.i386.rpm warning: syslog-ng-2.0.8-1.fc8.i386.rpm: Header V3 DSA signature: NOKEY, key ID ed00d312 error: Failed dependencies: rtld(GNU_HASH) is needed by syslog-ng-2.0.8-1.fc8.i386 I checked and made sure that rtld shows up on my machine... [root@tahoe ~]# rpm -qv glibc glibc-2.4-4 Any help would be GREATLY appreciated, so that I can move forward on this effort. Thanks!!!! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO Sent: Monday, March 03, 2008 8:23 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4 What's the error? On Mon, Mar 3, 2008 at 8:13 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com <mailto:Chris.ivey@acs-inc.com> > wrote: Sandor/ScottO, Thanks for the information that it works properly on old releases. If I could trouble you guys for *how* you made it work, that would be great. I did some testing using my personal Linux machine (FC5), and I could not get the application to install (could not find all the needed preliminaries). If you want to PM me for this, that would be fine, since I am sure the rest of the list does not need to be exposed to my lack of knowledge. (( For what it's worth - I inherited these machines, had nothing to do with the original setup/configuration, and now find myself as the owner/admin of an application I don't know much about. )) Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage On Mon, Mar 3, 2008 at 4:42 AM, Geller, Sandor (IT) <Sandor.Geller(a)morganstanley.com <mailto:Sandor.Geller@morganstanley.com> > wrote: Hi, > Folks, > I need to upgrade syslog-ng running on my 2 servers, > which are running Fedora Core 4. Is it possible to put 2.0.x > onto a machine running FC4? I was looking around this morning > for this information, and can't find anything that says "yay" > or "nay". Thanks! It should just work (TM). I'm using syslog-ng 2.0 on very old OS releases, all you might need is to install its requirements: eventlog, libnet, glib and optionally tcp-wrappers. Regards, Sandor -------------------------------------------------------- Agreed, fwiw, I have it working just fine on FC3. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu <mailto:syslog-ng@lists.balabit.hu> https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4
by Ivey, Chris 12 Mar '08

12 Mar '08

Hi ScottO, I got pulled away from this onto a different project, and can now move back to it again. Here is what I get when I try to use RPM to install the application: [root@tahoe ~]# rpm -ivh syslog-ng-2.0.8-1.fc8.i386.rpm warning: syslog-ng-2.0.8-1.fc8.i386.rpm: Header V3 DSA signature: NOKEY, key ID ed00d312 error: Failed dependencies: rtld(GNU_HASH) is needed by syslog-ng-2.0.8-1.fc8.i386 I checked and made sure that rtld shows up on my machine... [root@tahoe ~]# rpm -qv glibc glibc-2.4-4 Any help would be GREATLY appreciated, so that I can move forward on this effort. Thanks!!!! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO Sent: Monday, March 03, 2008 8:23 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4 What's the error? On Mon, Mar 3, 2008 at 8:13 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com <mailto:Chris.ivey@acs-inc.com> > wrote: Sandor/ScottO, Thanks for the information that it works properly on old releases. If I could trouble you guys for *how* you made it work, that would be great. I did some testing using my personal Linux machine (FC5), and I could not get the application to install (could not find all the needed preliminaries). If you want to PM me for this, that would be fine, since I am sure the rest of the list does not need to be exposed to my lack of knowledge. (( For what it's worth - I inherited these machines, had nothing to do with the original setup/configuration, and now find myself as the owner/admin of an application I don't know much about. )) Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage On Mon, Mar 3, 2008 at 4:42 AM, Geller, Sandor (IT) <Sandor.Geller(a)morganstanley.com <mailto:Sandor.Geller@morganstanley.com> > wrote: Hi, > Folks, > I need to upgrade syslog-ng running on my 2 servers, > which are running Fedora Core 4. Is it possible to put 2.0.x > onto a machine running FC4? I was looking around this morning > for this information, and can't find anything that says "yay" > or "nay". Thanks! It should just work (TM). I'm using syslog-ng 2.0 on very old OS releases, all you might need is to install its requirements: eventlog, libnet, glib and optionally tcp-wrappers. Regards, Sandor -------------------------------------------------------- Agreed, fwiw, I have it working just fine on FC3. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu <mailto:syslog-ng@lists.balabit.hu> https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

Solaris 10 non-global zone & syslog-ng performance question.
by Surlow, Jim 12 Mar '08

12 Mar '08

Folks, I'm a newbie to syslog-ng. Everything is working in my environment, running 2.0.8. But, when I try to stress the server I drop messages. I'm running from another physical server: ./loggen -D -s 111 -r 2000 -I 1 <hostname> 514 ; date average rate = 1818.00 msg/sec, count=1818 Thu Mar 6 18:07:17 MST 2008 The syslog-ng server is in a Solaris 10 non-global zone; my auth.info is going to /var/adm/ssh_DAY.log. date ; tail /var/adm/ssh_06.log | awk '/runid/ {print $9}' | sort -u | xargs -i egrep {} /var/adm/ssh_06.log | wc -l Thu Mar 6 18:07:23 MST 2008 1233 So, I'm dropping packets. I've stopped syslog-ng and started standard syslog. Syslog logs all my messages to the file when using a rate of 2000/sec. As you can from above, in my syslog-ng environment I lose about a 3rd. When I use a rate of 1000/sec, it is not quite as bad, but I do drop a significant amount of messages. I've read: http://www.l3jane.net/doc/server/syslog-ng/#tuning I've toyed with log_fifo_size (using values like 1000, 5000, 10000, 50000) log_fetch_limit (using values like 100, 200, 2000) sync (using values like 20, 40, 50, 100) I have "use_dns (no)" - turning that off first. Also, I commented out all but two sources, the one filter, the one log line. source s_ip148 { udp (ip(<x>.<y>.<z>.148)); }; source s_ip248 { udp (ip(<x>.<y>.<z>.248)); }; <x>, <y>, <z> are obviously replace in our environment with the octets for the subnet. Before trying standard syslog, I was running snoop in my global zone to ensure all the UDP packets were arriving. The count always matched the count shown by loggen. Since I can see all the messages with standard syslog in this Sol 10 non-global zone, I've ruled out: * the zone being an issue. * UDP tuning for the Solaris 10 host. * The internal hard drive i/o speed from being an issue. Looking at the log messages, I'm not hitting some cap (e.g. 1233) and then not logging any more. Random gaps (both of frequency and size) are seen throughout. Can someone give me some pointers? Thanks in advance, Jim

2 2

incorrect firewall logs with syslogng-2.0.0 [security error?]
by Jacek Kalinski 12 Mar '08

12 Mar '08

Hello, After upgradeing from syslogng-1.6.11 to 2.0.0 I've got a strange messages in /var/log/messages file: Nov 29 08:14:05 denise WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 11:10:19 denise PT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 16:42:16 denise W=0 RES=0x00 RST URGP=0 Nov 29 21:37:15 denise 116 ID=34901 DF PROTO=TCP SPT=3584 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0 These are truncated iptables logs. Because in firewall.log file are simmilar entries to truncated one, I think full file should be: Nov 29 11:10:19 denise firewallp=INVALID:1 a=DROP IN=eth1 OUT= MAC=00:30:4f:36:2b:dc:00:04:9a:2c:7f:20:08:00 SRC=193.41.230.81 DST=xxx.xxx.xxx.x LEN=576 TOS=0x00 PREC=0x00 TTL=117 ID=3495 PROTO=TCP SPT=443 DPT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 (xxx.xxx.xxx.x is a real server IP address - one 'x' is one digit) Config file with interesting lines: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(root); dir_group(root); owner(root); group(root); }; source local { unix-stream("/dev/log" max_connections(300)); file("/proc/kmsg"); # udp(ip(0.0.0.0) port(514)); internal(); }; # ..... # authpriv.none;cron.none;mail.none;news.none -/var/log/messages filter f_2 { not facility(news); }; filter f_3 { not facility(local5); }; filter f_4 { not facility(local6); }; filter f_5 { not facility(authpriv); }; filter f_6 { not facility(cron); }; filter f_7 { not facility(mail); }; filter f_notlocal7 { not facility(local7); }; filter f_notfirewall { not match("firewallp="); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_notimapd); filter(f_notpopa3d); filter(f_notnamed); filter(f_notfirewall); destination(d_2); }; #..... # firewallp.* -/var/log/firewall.log filter f_16 { level(warning) and match("firewallp="); }; destination d_12 { file("/var/log/firewall.log" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_12); }; #..... Do you know where could be an error? It is a production server so I can't debug syslog-ng on this machine (sorry). NOTE: the only truncated lines I can find are iptables (AFAIR they are logged by /proc/kmesg) entries. All other lines are complete. And it is probably a critical error in security. PS: simple statistics line from syslog-ng: Nov 30 00:00:06 denise syslog-ng[32682]: Log statistics; dropped='pipe(/dev/tty12)=0', processed='center(queued)=758289', processed='center(received)=369020', processed='destination(d_maillogimapd)=4245', processed='destination(d_5)=1', processed='destination(d_4)=0', processed='destination(d_3)=14259', processed='destination(d_2)=14259', processed='destination(d_13)=0', processed='destination(d_1)=6000', processed='destination(d_12)=6000', processed='destination(d_11)=369020', processed='destination(d_10)=36', processed='destination(d_8)=0', processed='destination(d_maillogpopa3d)=103224', processed='destination(d_7)=241245', processed='destination(d_6)=0', processed='source(local)=369020' I think you see that it could be a little hard to debug (with so many messages parsed by syslog-ng) ;) Jacek

3 6

[Bug 20] New: crash on SIGHUP if an optional log file input source is not present
by bugzilla＠bugzilla.balabit.com 12 Mar '08

12 Mar '08

https://bugzilla.balabit.com/show_bug.cgi?id=20 Summary: crash on SIGHUP if an optional log file input source is not present Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sayler(a)cs.duke.edu Type of the Report: bug Estimated Hours: 0.0 It looks like optional files break kill -HUP I have this in my configuration file pipe("/root/na/log/na.log" optional(yes)); Core was generated by `/usr/research/home/sayler/syslog-ng-2.0.8+20080303/src/syslog-ng -p /var/run/sy'. Program terminated with signal 11, Segmentation fault. #0 0x0805f1d5 in log_reader_get_pos (self=0x0) at logreader.c:506 506 res = lseek(self->fd->fd, 0, SEEK_CUR); (gdb) bt #0 0x0805f1d5 in log_reader_get_pos (self=0x0) at logreader.c:506 #1 0x08056a9f in affile_sd_deinit (s=0x8094a38, cfg=0x808f900, persist=0x8150db8) at affile.c:247 #2 0x08053bc2 in log_source_group_deinit (s=0x8094ac8, cfg=0x808f900, persist=0x8150db8) at sgroup.c:79 #3 0x080545d6 in log_center_deinit_component (key=0x8094b10 "s_all", value=0x8094ac8, self=0x8090260) at center.c:188 #4 0x08060642 in g_hash_table_foreach () #5 0x080549f1 in log_center_deinit (s=0x8090260, cfg=0x808f900, persist=0x8150db8) at center.c:281 #6 0x0804c800 in cfg_deinit (cfg=0x808f900, persist=0x8150db8) at cfg.c:218 #7 0x0804cd8a in cfg_reload_config ( fname=0x808b640 "/etc/syslog-ng/syslog-ng.conf", cfg=0x808f900) at cfg.c:383 #8 0x0804af1e in main_loop_run (cfg=0xbfa15638) at main.c:169 #9 0x0804b5cd in main (argc=5, argv=0xbfa156f4) at main.c:434 (gdb) list 501 off_t 502 log_reader_get_pos(LogReader *self) 503 { 504 off_t res; 505 506 res = lseek(self->fd->fd, 0, SEEK_CUR); 507 508 if (res >= 0) 509 return res - self->ofs; 510 return res; ... (gdb) print self $1 = (LogReader *) 0x0 (gdb) up #1 0x08056a9f in affile_sd_deinit (s=0x8094a38, cfg=0x808f900, persist=0x8150db8) at affile.c:247 247 cur_pos = log_reader_get_pos((LogReader *) self->reader); (gdb) list 242 if (persist) 243 { 244 gchar str[32]; 245 off_t cur_pos; 246 247 cur_pos = log_reader_get_pos((LogReader *) self->reader); 248 g_snprintf(str, sizeof(str), "%" G_GINT64_FORMAT, (gint64) cur_pos); 249 250 persist_config_add_survivor(persist, affile_sd_format_persist_name(self), str); 251 } (gdb) print self $2 = (AFFileSourceDriver *) 0x8094a38 (gdb) print (self A syntax error in expression, near `'. (gdb) print *self $3 = {super = {super = {ref_cnt = 1, pipe_next = 0x8094ac8, init = 0x80567c3 <affile_sd_init>, deinit = 0x8056a7f <affile_sd_deinit>, queue = 0x80538c3 <log_pipe_forward_msg>, free_fn = 0x8056b38 <affile_sd_free>, notify = 0x80565df <affile_sd_notify>}, optional = 1, drv_next = 0x0}, filename = 0x808f530, reader = 0x0, reader_options = {source_opts = { init_window_size = 100, window_size = 100}, options = 0, padding = 0, prefix = 0x0, msg_size = 8192, follow_filename = 0x8094aa0 "/root/na/log/na.log", follow_freq = -1, fetch_limit = 10, zone_offset = -1, keep_timestamp = 1, bad_hostname = 0x0}, flags = 1} -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

Syslog-ng losing messages on solaris 10
by AndyH＠nominet.org.uk 12 Mar '08

12 Mar '08

Hi, I've been running 2.0.6 on Solaris 10 and it all seemed to be working fine. On a new application I have found that it loses messages. This application sends 3-7000 messages/sec. Part of these messages contains a unique ID which increments. When I run the syslogd as supplied with Solaris 10 then all messages get logged, but when I use syslog-ng then it loses messages. On a Sun V210 I see these messages message overflow on /dev/log minor #6 -- is syslogd(1M) running? message overflow on /dev/log minor #6 -- is syslogd(1M) running? message overflow on /dev/log minor #6 -- is syslogd(1M) running? on the console, and eventually there is a hardware reset and the server reboots. I have tried running syslogd to just pass messages on to syslog-ng and this doesn't cause the hardware reset, but still loses some messages. I have also tried the time_sleep and log_fetch_limit options with no success. I have noticed that syslogd is multi-threaded but syslog-ng is only single threaded. Is this what is causing these messages to get missed? Are there any plans for a threaded version? Anyone have any ideas as to how to get all messages logged with syslog-ng? Regards Andy

2 10

Mail Alert
by John Duraisw 11 Mar '08

11 Mar '08

Hello, I am doing the following intercept stuff, and everything seems to be working fine. What I want to do is, in the subject line I want to parse the hostname. Could you guys help me with this. Thanks, -john destination mail-alert { program("/usr/local/bin/syslog-mail.sh"); }; filter f_config_alert { ( ( host("host1") or host("host2") or host("host3") or host("host4") ) and match("Configured from console") ); }; # Send alert when some Genius configure something log { source(s_net); source(s_system); filter(f_config_alert); destination(mail-alert); }; [root@central-logger ~]# more /usr/local/bin/syslog-mail.sh #!/bin/sh RECIPIENTS"john(a)abc.com" while read line; do echo $line | /bin/mail -s "Config Change notification for $1" $RECIPIENTS done

1 0