April 2009 - syslog-ng - lists.balabit.hu

syslog-ng PID not getting set correctly
by Ngim, Hyrum CTR ADCF/Arrowpoint 04 May '09

04 May '09

We are running the sunfreeware 3.0.1 version of syslog-ng. I'm noticing that the PID is not being set correctly. I saw a bug report but it's not the same as what I'm seeing: https://bugzilla.balabit.com/show_bug.cgi?id=23 Here is what I am experiencing: # ps -ef | grep syslog root 1662 1 0 07:42:05 ? 0:00 /usr/local/sbin/syslog-ng root 1663 1662 0 07:42:05 ? 0:00 /usr/local/sbin/syslog-ng # cat /var/run/syslog-ng.pid 1663 Shouldn't the PID be 1662? I've also seen inconsistencies when I use the svcadm commands to disable/enable/refresh the syslog-ng service. Many times it won't stop the service properly and the /var/run/syslog-ng.pid file remains in /var/run. When I try to restart syslog-ng, it won't restart until I run an svcadm disable syslog-ng, remove the /var/run/syslog-ng.pid file, then run svcadm enable syslog-ng. Thanks In Advance for any help.

3 3

[Bug 44] New: name of the file and content of the file contains different timestamp
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=44 Summary: name of the file and content of the file contains different timestamp Product: syslog-ng Version: 3.0.x Platform: All OS/Version: All Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: ruiyen(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 Friendly reminder that this bug needs to be fixed. I can help you with this if you can let me know which source file to look at. >From https://lists.balabit.hu/pipermail/syslog-ng/2009-February/012567.html 2009/2/15 Balazs Scheidler <bazsi at balabit.hu> > On Thu, 2009-02-12 at 09:52 +0800, Charles Chan wrote: > > I use time_zone instead timezone,configuration like this > > =========================================================== > > template apache_template { template("$DAY-$HOUR $S_DAY-$S_HOUR > > $R_DAY-$R_HOUR $MSGONLY\n"); template_escape(no); }; > > destination us_int_apache > > { file("/disk2/apache_logs/$YEAR-$MONTH-$DAY/$HOST.apache.log" > > timezone("PST8PDT") template(apache_template)); }; > > ============================================================ > > service can start,but the problem still exists. > > the file is stored in the /disk2/apache_logs/2009-02-12 > > generated log is: > > 11-17 11-17 11-17 222.69.201.23 - - - [11/Feb/2009:17:37:03 -0800] > > "GET /atmgateway.client.html ................... > > two date string still difference. I use syslog-ng 3.0.1 OSE version,is > > this OSE version problem? > > The PE and OSE versions are the same in this regard. Apart from the > concrete differences listed on our website, I work hard to keep the two > versions in sync. > > So let me try to understand your problem a bit deeper... Sorry for not > having done so previously. Sometimes I just reply without really > thinking through problems in the question. > > hmm.. as I see your problem seems to be that the name of the file and > the _content_ of the file contains a different timestamp. Right? > > This is intentional. > > When expanding the macros in the name of the files, syslog-ng _always_ > uses the server-side, local timezone. The timezone used in the content > of the file can be controlled using the time_zone() option. > > Currently there's no way to control the filename zone offset. The > reasoning behind that was that I already found the timezone related > configuration options too complex, and I didn't see the need so far. > I felt that agregating logs based on the _received timestamp_ is more > trustworthy (because clients are free to specify a timestamp they > feel-like), and that is in local timezone anyway. Also, noone else has > complained previously :) > > That said, I'm willing to add another option to control the timezone > used when expanding the filename, if you really think that solves your > problem. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 2

[Bug 21] New: call shutdown() before closing a socket
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=21 Summary: call shutdown() before closing a socket Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bazsi(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 syslog-ng should call shutdown() before closing a socket to ensure the contents of the socket buffer are emptied. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 23] New: MySQL default configuration causes error on 'pid' column
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=23 Summary: MySQL default configuration causes error on 'pid' column Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: mark(a)la-croix.net Type of the Report: bug Estimated Hours: 0.0 When configuring a MySQL destination, the default 'pid' column type is INT. However, if a message comes through with no PID, the SQL command tries to insert an empty quoted string, which causes an error in MySQL 5.0. Example error: Error running SQL query; type='mysql', host='!MY_DB_HOST!', port='', user='syslog-ng', database='syslog-ng', error='1366: Incorrect integer value: \'\' for column \'pid\' at row 1', query='INSERT INTO !MY_LOG_CLIENT_HOST!_2008_09_23 (date, facility, level, host, program, pid, message) VALUES (\'2008-09-23 12:24:35\', \'1\', \'5\', \'!MY_LOG_CLIENT!\', \'root\', \'\', \'test\')' The message is coming from a TCP source from which a large percentage of messages have no PID associated. The workaround is to explicitly set the PID column to VARCHAR so it can handle empty strings, but it would be nice to see the empty PID case gracefully handled. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 9

[Bug 34] New: After sighup master doe not write to logs, but clients think the server is writing to the logs
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=34 Summary: After sighup master doe not write to logs, but clients think the server is writing to the logs Product: syslog-ng Version: 2.1.x Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: michael(a)crowdscience.com QAContact: michael(a)crowdscience.com Type of the Report: --- Estimated Hours: 0.0 We encountered a problem when a sighup is sent to syslo-ng as part of our process to rotate the log file on the syslog-ng master. After the signal is sent and the log file has been rotated syslog-ng creates a new log file, but does not write to it. During this time the syslog-ng clients think that the master is up and continue to send their messages to the server (ie not queuing the messages locally). This resulted in a period of time where messages where not logged and required a stop and start of the syslog-ng service to get the messages logging again. The server is running Solaris Nevada snv_67 X86. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 28] New: syslog-ng 2.0.9 is cpu bound after bootup on FreeBSD 7. 1-RELEASE
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=28 Summary: syslog-ng 2.0.9 is cpu bound after bootup on FreeBSD 7.1-RELEASE Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: syslog-ng(a)ee.lbl.gov Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=6) --> (https://bugzilla.balabit.com/attachment.cgi?id=6) syslogd lines from /etc.conf I'm using the FreeBSD syslog-ng2 package (2.0.9_2) under 7.1-RELEASE (see rc.conf.txt attachment). I find that syslog-ng is cpu bound following a reboot. This problem occurs on both i386 and amd64 installs. Either stopping and starting ("/etc/rc.d/syslogd restart") or reloading ("kill -HUP `cat /var/run/syslog.pid`") results in normal operation. I used ktrace and it poll() is called followed by four calls to gettimeofday() (see ktrace.txt attachment). gcore and gdb show the loop to be inside glib (see gdb.txt attachment). lsof shows the file descriptor that /dev/console should be on has been revoked (see lsof.txt attachment). I believe something happens early during the bootup process that causes /dev/console to be reconfigured. I think that devd is running when syslog-ng starts up. Forcing the syslogd started to happen after syscons doesn't help. Note: In order to get syslog-ng to work with /etc/rc.d/syslogd the startup script must be tweaked (see syslogd.patch.txt attachment). My syslog-ng.conf is attached (syslog-ng.conf.txt) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[Bug 24] New: .pid file not set correctly (STOP not working)
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=24 Summary: .pid file not set correctly (STOP not working) Product: syslog-ng Version: unspecified Platform: Other OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: man(a)inspektsecurity.com Type of the Report: --- Estimated Hours: 0.0 Hi. in installed syslog-ng 3.0.1 PE (syslog-ng-premium-edition-3.0.1-linux-i386.run). The installation is on a CentOS 5 system (RedHat spin-off). Although the program itself works fine, the RC scripts STOP command does not work. I traced the problem down to the .pid file not being set correctly. According to the RC script the .pid file shoud be in: PIDFILE=$SYSLOGNG_PREFIX/var/run/syslog-ng.pid resulting in the below when running STOP/RESTART ------------ [root@test-server:~] /etc/init.d/syslog-ng restart -n Restarting syslog-ng: -n Stopping syslog-ng: -n Starting syslog-ng: Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (98)' Error initializing source driver; source='tcp_input_syslog', id='tcp_input_syslog#0' Error initializing message pipeline; failed ------------- I found out that the pid file set is actually: /var/run/syslogd.pid So changing the RC script to: PIDFILE=/var/run/syslogd.pid seems to work. br /Marc -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

syslog-ng 3.0.1, open source edition, fails write to MySQL DB
by Arnold Wang 29 Apr '09

29 Apr '09

I have installed syslog-ng 3.0.1, open source edition, binary package in RHEL 5.3 system. I'm having trouble to have it writing to MySQL DB using native driver. The current configuration file looks like: # Write the logs to MySQL DB destination dd_mysql { sql(type(mysql) host("localhost") username("syslogadmin") password("syslogadmin") database("syslog") table("logs") columns("host", "facility", "priority", "level", "tag", "datetime", "program", "msg", "seq") values("$HOST", "$FACILITY", "$PRIORITY", "$LEVEL", "$TAG", "$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC", "$PROGRAM", "$MSG", "$SEQ") indexes("seq")); # program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" # template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg, seq) # VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG', '$SEQ' );\n") # template-escape(yes)); }; It works if I use the program driver, as currently commented out. The table is configured as following, using the schema defined by php-syslog-ng 2.9.8m. +----------+---------------------+------+-----+---------+----------------+ | Field | Type | Null | Key | Default | Extra | +----------+---------------------+------+-----+---------+----------------+ | id | bigint(20) unsigned | NO | PRI | NULL | auto_increment | | host | varchar(128) | YES | MUL | NULL | | | facility | varchar(10) | YES | MUL | NULL | | | priority | varchar(10) | YES | MUL | NULL | | | level | varchar(10) | YES | | NULL | | | tag | varchar(10) | YES | | NULL | | | datetime | datetime | YES | MUL | NULL | | | program | varchar(15) | YES | MUL | NULL | | | msg | text | YES | | NULL | | | seq | bigint(20) unsigned | NO | MUL | 0 | | | counter | int(11) | NO | | 1 | | | fo | datetime | YES | | NULL | | | lo | datetime | YES | | NULL | | +----------+---------------------+------+-----+---------+---------------- What is the problem? Thanks in advance for the help.

3 4

Removing Prefixes from Syslog-ng Messages
by adam.j.brendamour＠accenture.com 29 Apr '09

29 Apr '09

Hello all, I am having issues with syslog-ng adding prefixes to my messages. I currently have a syslog-ng agent sending messages from a log source to a syslog-ng central server. I am then sending the messages from the central server to a 3rd party event management program. Is there a way to forward an unchanged syslog-ng message from the relay server? For example: Message arriving from source: Apr 16 09:31:07 psrdev47 10.56.9.12 - - [16/Apr/2009:09:31:02 -0700] "GET / HTTP/1.1" 302 427 "-" "-" Message being forwarded from server: Apr 16 09:31:07 10.56.2.77 125 <0>1 2009-04-16T09:31:02-07:00 psrdev47 - - - - 10.56.9.12 - - [16/Apr/2009:09:31:02 -0700] "GET / HTTP/1.1" 302 427 "-" "-" How can I configure the syslog-ng server to relay this unchanged message to our destination? Apr 16 09:31:07 psrdev47 10.56.9.12 - - [16/Apr/2009:09:31:02 -0700] "GET / HTTP/1.1" 302 427 "-" "-" Thanks for your help! Regards, Adam This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

3 4

setting facility/level of source log messages ?
by bana＠docisland.org 29 Apr '09

29 Apr '09

Hi, I often meet the case where I need to centralize some purely applicative log messages (ie they don't even have a PRI header). So syslog-ng sets a default facility and severity for these messages, like kern facility and emergency severity for a source file with a "no-parse" option. Is there a clean way to change these default values by modifying the configuration file ? (and not using a source program() nor a tail | logger trick). I've already written a quick and dirty patch for my needs, but it would be great to have a native way of doing the same thing (I may have missed something in the documentation). Best Regards. -- Xavier

2 9