July 2008 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] syslog-ng Digest, Vol 39, Issue 20
by Anurag Agarwal 24 Jul '08

24 Jul '08

Thanks Bazsi for reply. Relevant portion is below ************************************************************** destination console { usertty("wimaxnoc"); }; filter ps_nt_re { match("PS NOT REACHABLE"); }; log { source(network); filter(ps_nt_re); destination(console); }; ************************************************************** Please help. Anurag aggarwal -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Thursday, July 24, 2008 3:30 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 39, Issue 20 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Re : Re : Re : Syslogd + Syslog-ng (Christopher Cashell) 2. Re: Re : Re : Re : Syslogd + Syslog-ng (Leandro Ferreira da Silva) 3. Re: Using regexp in match() (Balazs Scheidler) 4. Re: Usertty sending messages to all user and without login also (Balazs Scheidler) ---------------------------------------------------------------------- Message: 1 Date: Wed, 23 Jul 2008 10:04:34 -0500 From: Christopher Cashell <ChristopherCashell(a)solutionary.com> Subject: Re: [syslog-ng] Re : Re : Re : Syslogd + Syslog-ng To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <48874882.8070904(a)solutionary.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Leandro Ferreira da Silva did thus speak on 7/23/2008 7:14 AM: > The configuration is the standart, I only do the follow changes. > > # sources > source src { unix-dgram("/var/run/log"); > unix-dgram("/var/run/logpriv" perm(0600)); > udp(); internal(); file("/dev/klog"); }; > > I add this, > source r_src { udp(ip("*client.domain*") port(514)); }; Here's your problem. For src, you define 'udp()' as one of your log sources, without including any specific options for it. This will cause syslog-ng to go with its defaults for udp(), which is bind to *all* IP addresses assigned to the box, on port 514. Then, for r_src, you are telling syslog-ng to bind to a specific IP address on the box and port 514. When syslog-ng attempts to start, it will fail with the error message you received because that ip/port is already in use (by the source src, which is bound to all IP's). Unless you have a need to bind to a specific IP address on the box, I'd recommend removing 'udp();' from src, and replacing the current 'udp(ip("*client.domain*") port(514));' in r_src with 'udp();'. -- Christopher Cashell ------------------------------ Message: 2 Date: Wed, 23 Jul 2008 14:39:03 -0300 From: Leandro Ferreira da Silva <ferreira(a)iqm.unicamp.br> Subject: Re: [syslog-ng] Re : Re : Re : Syslogd + Syslog-ng To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <48876CB7.7080909(a)iqm.unicamp.br> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Christopher Cashell wrote: > Leandro Ferreira da Silva did thus speak on 7/23/2008 7:14 AM: >> The configuration is the standart, I only do the follow changes. >> >> # sources >> source src { unix-dgram("/var/run/log"); >> unix-dgram("/var/run/logpriv" perm(0600)); >> udp(); internal(); file("/dev/klog"); }; >> >> I add this, >> source r_src { udp(ip("*client.domain*") port(514)); }; > > Here's your problem. For src, you define 'udp()' as one of your log > sources, without including any specific options for it. This will > cause syslog-ng to go with its defaults for udp(), which is bind to > *all* IP addresses assigned to the box, on port 514. > > Then, for r_src, you are telling syslog-ng to bind to a specific IP > address on the box and port 514. When syslog-ng attempts to start, it > will fail with the error message you received because that ip/port is > already in use (by the source src, which is bound to all IP's). > > Unless you have a need to bind to a specific IP address on the box, > I'd recommend removing 'udp();' from src, and replacing the current > 'udp(ip("*client.domain*") port(514));' in r_src with 'udp();'. > It worked!! The real problem was udp () at src. Thank you very much for all the help... Now I'll go complete my rules.. See you!! =P ------------------------------ Message: 3 Date: Thu, 24 Jul 2008 10:16:27 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] Using regexp in match() To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Cc: documentation(a)balabit.com Message-ID: <1216887387.8130.5.camel(a)bzorp.balabit> Content-Type: text/plain; charset=UTF-8 On Tue, 2008-07-22 at 09:45 +0200, Jan Kreps wrote: > > ------------ P?vodn? zpr?va ------------ > > Od: Jan Kreps <krepsj(a)seznam.cz> > > P?edm?t: Re: [syslog-ng] Using regexp in match() > > Datum: 10.7.2008 10:29:35 > > ---------------------------------------- > > > > > > I'm trying to setup central syslog-ng server for my Exchange servers. On > > > windows servers I use Epilog agent (brother of Snare) forwarding tracking > > > logs to central syslog. > > > Obviously I have used bad regexp. Exchange tracking log uses tabs as delimiters. > > But when I saved $MSG string to text log, tabs was changed to '\011'. > > > > So now I changed my regexp to use tabs as delimiters: > > > > filter f_parsing { > > match("([^\t]*)\t([^\t]*)\t"); > > }; > > > > This works like charm and saves first two tab delimited fields (date and time in > > this case) to $1 and $2. > > > > Some more remarks to subject. > > Syslog-ng Administrator guide 1.1.1 Edition from May 2008 says on page 111: > > "The regular expressions can use up to 255 regexp matches ($1 ... $255)." > > and on page 112: > > "Regarding braces around macro names, the following two formats are equivalent "$MSG" and "${MSG}"." > > Fact is that for regexp matches greater than 9 it MUST be in ${} format. If you use for instance $12 it resolves as content of $1 + character '2'. I found that I have to use ${} syntax in ChangeLog remark for patch 137. I guess that should be stated in Admin Guide more clearly. In this respect, statement "The regular expressions can use up to 255 regexp matches ($1 ... $255)" is not true and should be corrected. > right, this should be fixed in the documentation. > And I have one question about file creation. > > When something is logged a file is created according to destination(). But when I delete the file, it's not created anymore, until restart of syslog-ng. Is that correct/expected behaviour? > > I run Debian Etch and syslog-ng 2.0.9-1 from unstable branch (in stable is still version 2.0.0) Yes, you need to send the HUP signal to syslog-ng in order to reopen log files. This is the way UNIX works. (the application does not know about the deletion of a logfile) -- Bazsi ------------------------------ Message: 4 Date: Thu, 24 Jul 2008 10:28:06 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] Usertty sending messages to all user and without login also To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1216888086.8130.10.camel(a)bzorp.balabit> Content-Type: text/plain On Wed, 2008-07-23 at 13:39 +0530, Anurag Agarwal wrote: > Hello everybuddy, > > I am using syslog-ng and used usertty in destination. I am using a user > 'test' as destination. But other users can also see the message on their > console e.g root and other users. Please help as this is creating a > problem and NG not working as desired. > OS: Solaris 10 > It does work for me. Can you show us the relevant portions of your configuration file? I tried with this: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/var/log/messages"); }; log { source(local); destination(all); }; destination all_users { usertty("bazsi"); }; filter alert_emerg { level(err..emerg); }; log { source(local); filter(alert_emerg); destination(all_users); }; It correctly printed err..emerg messages on my tty, and not on others. The relevant portion of the code is here: #if HAVE_MODERN_UTMP if (ut->ut_type == USER_PROCESS && ((self->username->len == 1 && self->username->str[0] == '*') || (self->username->len <= sizeof(ut->ut_user) && memcmp(self->username->str, ut->ut_user, self->username->len) == 0))) #else if ((self->username->len == 1 && self->username->str[0] == '*') || (self->username->len <= sizeof(ut->ut_name) && memcmp(self->username->str, ut->ut_name, self->username->len) == 0)) #endif I don't see how this condition could match for everyone. Even if the wtmp format is different and ut->ut_name would contain a bogus value, the expected breakage would be to not display anywhere, not to display everywhere. -- Bazsi ------------------------------ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest, Vol 39, Issue 20 *****************************************

2 1

Usertty sending messages to all user and without login also
by Anurag Agarwal 24 Jul '08

24 Jul '08

Hello everybuddy, I am using syslog-ng and used usertty in destination. I am using a user 'test' as destination. But other users can also see the message on their console e.g root and other users. Please help as this is creating a problem and NG not working as desired. OS: Solaris 10 Anurag

2 1

Re: [syslog-ng] Using regexp in match()
by Jan Kreps 24 Jul '08

24 Jul '08

> > I'm trying to setup central syslog-ng server for my Exchange servers. On > windows servers I use Epilog agent (brother of Snare) forwarding tracking > logs to central syslog. > > Say the format is: filed1\011field2\011, so fields in String are separated > by '\011'. > > > > I tried: > > > > filter f_parse { > > match("([^\\011]*)\\011([^\\011]*)\\011"); > > }; > > > Is this your last filter? The message remembers the matches of the last > filter only so you have to ensure that this regexp is executed last. Thanks for your answer Bazsi. Finally i got it. Obviously I have used bad regexp. Exchange tracking log uses tabs as delimiters. But when I saved $MSG string to text log, tabs was changed to '\011'. So now I changed my regexp to use tabs as delimiters: filter f_parsing { match("([^\t]*)\t([^\t]*)\t"); }; This works like charm and saves first two tab delimited fields (date and time in this case) to $1 and $2. I will wrote some HOWTO when i finish the configuration completely. Thaks for your time. Jan

3 4

Re : Re : Re : Syslogd + Syslog-ng
by olivier "madmax"rolland 23 Jul '08

23 Jul '08

Could you send us a partial copy of your syslog-ng configuration? ----- Message d'origine ---- De : Leandro Ferreira da Silva <ferreira(a)iqm.unicamp.br> À : syslog-ng(a)lists.balabit.hu Envoyé le : Mardi, 22 Juillet 2008, 21h35mn 02s Objet : Re: [syslog-ng] Re : Re : Syslogd + Syslog-ng The messages is send to server, the problem is the server that can't take the messages. I'm using FreeBSD 7.0 release. > You can try to launch syslogd in the debug mode and look if your > messages from the client are really rend to the syslog-ng server. > What OS do you use? > ----- Message d'origine ---- > De : Leandro Ferreira da Silva <ferreira(a)iqm.unicamp.br> > À : "olivier "madmax"rolland" <madmax2010fr(a)yahoo.fr> > Envoyé le : Mardi, 22 Juillet 2008, 19h54mn 28s > Objet : Re: Re : [syslog-ng] Syslogd + Syslog-ng > > The syslogd is correctly configured with *.* @server, > I can say this because the following command is logging at server. > tcpdump -nn -i re0 host "machine" and udp port 514 > > The problem is that in some machines I can't install syslog-ng, so > these machines have to send their logs through syslogd to the server > that is using the syslog-ng. > Any help? > > > First of all I'm not sure that with *.* your syslogd is able to work, > > you might user *.debug in order to log all messages from debug to the > > maximal level of logging. Secondly if your computer or server is in a > > domain you might test the remote logging as > > *.debug @server.domain_name > > > > ----- Message d'origine ---- > > De : Leandro Ferreira da Silva <ferreira(a)iqm.unicamp.br > <mailto:ferreira@iqm.unicamp.br>> > > À : syslog-ng(a)lists.balabit.hu <mailto:syslog-ng@lists.balabit.hu> > > Envoyé le : Mardi, 22 Juillet 2008, 0h22mn 35s > > Objet : [syslog-ng] Syslogd + Syslog-ng > > > > Dear Friends. > > > > I have some problems.. =P > > I'm building a log server, I installed the syslog-ng at the server. The > > clients has the common syslogd. > > How Can I do for the syslog-ng receive the messages from syslogd? > > > > The configuration of syslogd. > > # uncomment this to enable logging to a remote loghost named loghost > > *.* @loghost > > > > Is this possible? > > I need to configure of this form, because I can't install and configure > > the syslog-ng in all my machines. > > > > Thanks for all.. > > > > Leandro Ferreira > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > > > ------------------------------------------------------------------------ > > Envoyé avec Yahoo! Mail > > > <http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/…>. > > Une boite mail plus intelligente. > > > ------------------------------------------------------------------------ > Envoyé avec Yahoo! Mail > <http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/…>. > Une boite mail plus intelligente. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

3 3

Re : Re : Re : Re : Syslogd + Syslog-ng
by olivier "madmax"rolland 23 Jul '08

23 Jul '08

Is syslogd running on your central server? In this case you have to disable syslogd logging from remote (using -s option) . personally in order to recieve logs from syslogd clients i use this config: source s_sys { udp(ip(0.0.0.0) port(514)); }; filter f_sys { level(info..emerg) and not facility(mail); }; destination d_sys {file("/foo/full$DAY.log");}; log { source(s_sys); filter(f_sys) ; destination(d_sys) ;}; ----- Message d'origine ---- De : Leandro Ferreira da Silva <ferreira(a)iqm.unicamp.br> À : Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Envoyé le : Mercredi, 23 Juillet 2008, 14h14mn 29s Objet : Re: [syslog-ng] Re : Re : Re : Syslogd + Syslog-ng The configuration is the standart, I only do the follow changes. # sources source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); udp(); internal(); file("/dev/klog"); }; I add this, source r_src { udp(ip("client.domain") port(514)); }; I add this, destination gafanhoto_messages { file("/var/log/gafanhoto/messages" owner("root") group("wheel") perm(0640)); }; I add this, log { source(r_src); destination(gafanhoto_messages); }; When I start the syslog-ng.. scorpion# /usr/local/etc/rc.d/syslog-ng start Starting syslog_ng. Error binding socket; addr='AF_INET(client.domain:514)', error='Can\'t assign requested address (49)' Error initializing source driver; source='r_src' Could you send us a partial copy of your syslog-ng configuration? ----- Message d'origine ---- De : Leandro Ferreira da Silva <ferreira(a)iqm.unicamp.br> À : syslog-ng(a)lists.balabit.hu Envoyé le : Mardi, 22 Juillet 2008, 21h35mn 02s Objet : Re: [syslog-ng] Re : Re : Syslogd + Syslog-ng The messages is send to server, the problem is the server that can't take the messages. I'm using FreeBSD 7.0 release. > You can try to launch syslogd in the debug mode and look if your > messages from the client are really rend to the syslog-ng server. > What OS do you use? > ----- Message d'origine ---- > De : Leandro Ferreira da Silva <ferreira(a)iqm.unicamp.br> > À : "olivier "madmax"rolland" <madmax2010fr(a)yahoo.fr> > Envoyé le : Mardi, 22 Juillet 2008, 19h54mn 28s > Objet : Re: Re : [syslog-ng] Syslogd + Syslog-ng > > The syslogd is correctly configured with *.* @server, > I can say this because the following command is logging at server. > tcpdump -nn -i re0 host "machine" and udp port 514 > > The problem is that in some machines I can't install syslog-ng, so > these machines have to send their logs through syslogd to the server > that is using the syslog-ng. > Any help? > > > First of all I'm not sure that with *.* your syslogd is able to work, > > you might user *.debug in order to log all messages from debug to the > > maximal level of logging. Secondly if your computer or server is in a > > domain you might test the remote logging as > > *.debug @server.domain_name > > > > ----- Message d'origine ---- > > De : Leandro Ferreira da Silva <ferreira(a)iqm.unicamp.br > <mailto:ferreira@iqm.unicamp.br>> > > À : syslog-ng(a)lists.balabit.hu <mailto:syslog-ng@lists.balabit.hu> > > Envoyé le : Mardi, 22 Juillet 2008, 0h22mn 35s > > Objet : [syslog-ng] Syslogd + Syslog-ng > > > > Dear Friends. > > > > I have some problems.. =P > > I'm building a log server, I installed the syslog-ng at the server. The > > clients has the common syslogd. > > How Can I do for the syslog-ng receive the messages from syslogd? > > > > The configuration of syslogd. > > # uncomment this to enable logging to a remote loghost named loghost > > *.* @loghost > > > > Is this possible? > > I need to configure of this form, because I can't install and configure > > the syslog-ng in all my machines. > > > > Thanks for all.. > > > > Leandro Ferreira > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > > > ------------------------------------------------------------------------ > > Envoyé avec Yahoo! Mail > > > <http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/…>. > > Une boite mail plus intelligente. > > > ------------------------------------------------------------------------ > Envoyé avec Yahoo! Mail > <http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/…>. > Une boite mail plus intelligente. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html ________________________________ Envoyé avec Yahoo! Mail. Une boite mail plus intelligente. ________________________________ ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

Re: [syslog-ng] Re : Re : Syslogd + Syslog-ng
by Leandro Ferreira da Silva 22 Jul '08

22 Jul '08

The messages is send to server, the problem is the server that can't take the messages. I'm using FreeBSD 7.0 release. > You can try to launch syslogd in the debug mode and look if your > messages from the client are really rend to the syslog-ng server. > What OS do you use? > ----- Message d'origine ---- > De : Leandro Ferreira da Silva <ferreira(a)iqm.unicamp.br> > À : "olivier "madmax"rolland" <madmax2010fr(a)yahoo.fr> > Envoyé le : Mardi, 22 Juillet 2008, 19h54mn 28s > Objet : Re: Re : [syslog-ng] Syslogd + Syslog-ng > > The syslogd is correctly configured with *.* @server, > I can say this because the following command is logging at server. > tcpdump -nn -i re0 host "machine" and udp port 514 > > The problem is that in some machines I can't install syslog-ng, so > these machines have to send their logs through syslogd to the server > that is using the syslog-ng. > Any help? > > > First of all I'm not sure that with *.* your syslogd is able to work, > > you might user *.debug in order to log all messages from debug to the > > maximal level of logging. Secondly if your computer or server is in a > > domain you might test the remote logging as > > *.debug @server.domain_name > > > > ----- Message d'origine ---- > > De : Leandro Ferreira da Silva <ferreira(a)iqm.unicamp.br > <mailto:ferreira@iqm.unicamp.br>> > > À : syslog-ng(a)lists.balabit.hu <mailto:syslog-ng@lists.balabit.hu> > > Envoyé le : Mardi, 22 Juillet 2008, 0h22mn 35s > > Objet : [syslog-ng] Syslogd + Syslog-ng > > > > Dear Friends. > > > > I have some problems.. =P > > I'm building a log server, I installed the syslog-ng at the server. The > > clients has the common syslogd. > > How Can I do for the syslog-ng receive the messages from syslogd? > > > > The configuration of syslogd. > > # uncomment this to enable logging to a remote loghost named loghost > > *.* @loghost > > > > Is this possible? > > I need to configure of this form, because I can't install and configure > > the syslog-ng in all my machines. > > > > Thanks for all.. > > > > Leandro Ferreira > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > > > ------------------------------------------------------------------------ > > Envoyé avec Yahoo! Mail > > > <http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/…>. > > Une boite mail plus intelligente. > > > ------------------------------------------------------------------------ > Envoyé avec Yahoo! Mail > <http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/…>. > Une boite mail plus intelligente.

1 0

[Fwd: Re: Re : Syslogd + Syslog-ng]
by Leandro Ferreira da Silva 22 Jul '08

22 Jul '08

1 0

Syslogd + Syslog-ng
by Leandro Ferreira da Silva 21 Jul '08

21 Jul '08

Dear Friends. I have some problems.. =P I'm building a log server, I installed the syslog-ng at the server. The clients has the common syslogd. How Can I do for the syslog-ng receive the messages from syslogd? The configuration of syslogd. # uncomment this to enable logging to a remote loghost named loghost *.* @loghost Is this possible? I need to configure of this form, because I can't install and configure the syslog-ng in all my machines. Thanks for all.. Leandro Ferreira

1 0

syslog-ng-2.1beta1 on NetBSD 3.0, duplicate suppression docs?
by Ed Ravin 20 Jul '08

20 Jul '08

I encountered two problems building syslog-ng-2.1beta1 on NetBSD 3.0: 1) I needed to patch loggen.c (stole this patch from a FreeBSD site, apparently it happens on that OS too) --- tests/loggen/loggen.c.orig 2008-01-13 00:04:22.000000000 -0800 +++ tests/loggen/loggen.c 2008-03-26 08:27:43.000000000 -0700 @@ -226,7 +226,9 @@ memset(&hints, 0, sizeof(hints)); hints.ai_family = AF_UNSPEC; hints.ai_socktype = sock_type; +#ifdef AI_ADDRCONFIG hints.ai_flags = AI_ADDRCONFIG; +#endif hints.ai_protocol = 0; if (getaddrinfo(argv[optind], argv[optind + 1], &hints, &res) != 0) { ------------------------------------- 2) I built syslog-ng with --enable-tcp-wrappers, which needlessly put "-lwrap" on the LIBS line in the Makefiles for programs that did not actually use TCP wrappers. This causes link-time errors, since libwrap requires you to declare two symbols in your program. The fix was to run this in the source directory: find tests/ -name Makefile -exec perl -p -i -e 's/-lwrap//' {} ";" ------------------------------------- I also have a couple of observations/questions: 3) It turns out I really wanted syslog-ng2.1beta2, but although that was announced as released, only the beta1 tarball is actually on the source download site. I had to go to the snapshots. The above fixes were also needed for the beta2 sources. ------------------------------------- 4) I'm looking for info on how to use the duplicate suppression option - it doesn't seem to be in the docs included in the source. Can someone give me a quick summary? This was (IMHO) the only extant flaw in syslog-ng and I'm looking forward to trying it out! Thanks, -- Ed

3 5

Odd behavior with very small log_fifo_size()
by Joe Shaw 20 Jul '08

20 Jul '08

Hi, I was doing a little bit of testing with syslog-ng today, and I think that with a very small log_fifo_size() it was dropping messages but not telling me. If I set my log_fifo_size to 1, here are the results: [jshaw@ars1dev7 ~/syslog-ng-2.0.9/tests/loggen]$ ./loggen -r 1000000 -s 1024000 -I 60 localhost 2000 average rate = 96.48 msg/sec, count=5789 [jshaw@ars1dev7 ~/syslog-ng-2.0.9/tests/loggen]$ ls -lh /ita/jshaw/messages -rw------- 1 jshaw ita 101M Jul 1 13:30 /ita/jshaw/messages However, 1024000 * 5789 = 5.9 GB Grepping for drop messages in the output file: [jshaw@ars1dev7 ~/syslog-ng-2.0.9/tests/loggen]$ grep -i drop /ita/jshaw/messages returns nothing. I have stats_freq(5) in my config file, and that messages file is the only output. I do have other statistical lines, which imply to me that no messages are dropped: Jul 1 13:49:52 s_local@ars1dev7 syslog-ng[6344]: Log statistics; processed='center(queued)=6045', processed='center(received)=6045', processed='destination(d_file)=6045', processed='source(s_local)=6045' But it seems clear to me that they are -- or loggen is lying. With more normal log_fifo_sizes (100, 2000) the throughput rates from loggen are lower and the file sizes match. Any ideas? Thanks, Joe

3 5