June 2009 - syslog-ng - lists.balabit.hu

Perl FIFO eating CPU
by Clayton Dukes 21 Jun '09

21 Jun '09

Hiya Folks! I know this isn't necessarily the purview of this group but I thought I'd ask anyways since there are so many smart people here :-) I have syslog-ng feeding to a pipe which my perl script reads from, does some filtering/deduplication of messages, and then inserts into a mysql db. For some reason, the perl script is running between 85-100% cpu at all times (mysql cpu is ok). I'm receiving roughly 1-2 messages per second on my test server, but plan to use this for a production box that will receive much more (around 50 mps) Is there some perl magic I can do to lower the cpu utilization? caching, etc? I'm happy to share my script, but a large portion of it depends on variables set from within my program (php-syslog-ng) so it won't run on outside systems (unless, of course, you install my software :-)) Thanks! -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

2 1

Time slice destination files
by Martin Holste 20 Jun '09

20 Jun '09

The indexing system I'm writing will work best if it can read in syslog-ng logs as regular files (as opposed to fifos, sockets or SQL). In order to have multiple indexing workers going at the same time, I'm finding it easiest if the output from syslog-ng can be divided into chunks like this: destination d_file { file("/tmp/slices/$R_UNIXTIME.${.classifier.rule_id}" template(t_db_parsed)); }; The workers index the chunks as syslog-ng spits them into the slices buffer directory. This works pretty well, but I'm limited to tuning only between one second intervals provided by $R_UNIXTIME, or minute, hour, etc. intervals by concatenating other time macros together. Is there some way I could get syslog-ng to spit out something lke 5 second slices? Also, will syslog-ng know to close the file handle on a log slice when the $R_UNIXTIME second has elapsed? Thanks, Martin

2 3

Syslog-ng 3.0.2 statistics
by Aaron Robel 19 Jun '09

19 Jun '09

Hello, My apologies in advance, this is my first posting and I'm quite the rook' when it comes to Linux and Syslog-ng. I keep wondering why this is my project. I have a 4 server syslog deployment with 3 front end "relay" boxes and 1 backend archive box all within a virtualized SLES environment. Recently I noticed that the relay's together are averaging about 2500 messages per second (mps). The majority of the messages are coming from a single relay, about 2000 mps. Yet the archive box is only averaging about 400 mps. Since we are running 3.0.2 I decided to turn up the stats_level to (1). I don't see any drops to the about 150 file destinations that I've built. What does stamp, processed, stored, etc.. mean? I couldn't find any detailed documentation about the different statistics. Why am I getting such a large discrepency between "stamp" and "processed" in the log stats? Finally, since I'm sending the email does anyone see an issue with the way I've got the flow control set up in the global options? Here are my stats in question off my archive box: processed='src.udp(s_network#0)=22020892', stamp='src.udp(s_network#0)=1245249328' Here's the global's off the archive box: options { time_sleep(10); log_fetch_limit(250); log_fifo_size(2000); use_dns(no); keep_timestamp(yes); dns_cache(no); long_hostnames(off); flush_lines(2000); flush_timeout(200); perm(0644); stats_freq(1800); stats_level(1); time_reopen(10); create_dirs(yes); dir_perm(755); }; Thanks!

4 9

rate-limit
by Julien lecubin 19 Jun '09

19 Jun '09

hi list, what's the best way with syslog-ng to control the number of syslog mail notifications coming from a machine ? I'm currently using perl script to send notification but sometime it just floods my mail (some 600 mails in 5 minutes for a single event) I want to rate limit it to only 1 mail in 5 minute per host or message. /etc/syslog-ng/syslog-ng.conf : ----------------------------- [...] destination d_mail { program("perl /usr/local/bin/mail_log_mailsend.pl $MSG "); }; [...] filter f_notify_by_mail {level(emerg,alert,crit); }; [...] log { source(s_network); filter(f_notify_by_mail); destination(d_mail); }; mail_log_sendmail.pl -------------------- use MIME::Lite; while (<>) { # $_ contains the Log my $body = "Mail from Syslog-ng $_ "; my $msg = MIME::Lite->new ( From =>'syslog-ng(a)my_domain.fr', To =>'service.informatique(a)my_domain.fr', Subject =>'[SYSLOG-NG] Avertissement', Type =>'multipart/related'); $msg -> attach (Type => 'text/html', Data => qq {$body}); MIME::Lite->send('smtp','imap', Timeout=>60); $msg -> send or die "Impossible to send mail!"; } Is there's a notification_interval control (as i use in nagios) i can add in my syslog config file ? I didn't found anything in the man page (maybe i'm reading like a frog) Anyone have any clues / examples to show ? tks, julien Lecubin -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Julien LECUBIN Institut de Mecanique Celeste et de Calcul des Ephemerides CNRS UMR 8028 - Observatoire de Paris 77, avenue Denfert Rochereau 75014 PARIS tel : 01.40.51.22.80 fax : 01.46.33.28.34 julien.lecubin(a)imcce.fr | service.informatique(a)imcce.fr - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2 2

Handle multiple encoding from multiple sources
by David Perret 19 Jun '09

19 Jun '09

Hello, I'm trying to understand how syslog-ng handle charset encoding. I've seen that : - without the "encoding("charset")" keyword in the source it just writes to the output what it gets from the input. - with the "encoding("charset")" keyword in the source it converts what it gets from the output from "charset" to UTF-8. What is the best way to handle logs from different charset? Do I really have to create a different source per charset used ? Is there any way to say that I always want the input's charset to be converted to UTF-8 before writing my logs ? Thanks David

2 1

syslog-ng 3.0 seem to chop some of the long lines off
by Joe Hansen 19 Jun '09

19 Jun '09

We're seeing lines in /var/log/messages that are chopped off. They should look like this: v\:* { BEHAVIOR: url(#default#VML) } o\:* { BEHAVIOR: url(#default#VML) } w\:* { BEHAVIOR: url(#default#VML) } .shape { BEHAVIOR: url(#default#VML) } st1\:* { BEHAVIOR: url(#default#ieooui) } @font-face { font-family: MS Mincho; } @font-face { font-family: Tahoma; } @font-face { font-family: Calibri; } @font-face { font-family: Verdana; } @font-face { font-family: Consolas; } @font-face { font-family: MS Sans Serif; } @font-face { font-family: @MS Mincho; } @page Section1 {size: 595.3pt 841.9pt; margin: 72.0pt 90.0pt 72.0pt 90.0pt; } A:link { mso-style-priority: 99 } SPAN.MSOHYPERLINK { mso-style-priority: 99 } A:visited { mso-style-priority: 99 } SPAN.MSOHYPERLINKFOLLOWED { mso-style-priority: 99 } P.MSOPLAINTEXT { mso-style-priority: 99 } LI.MSOPLAINTEXT { mso-style-priority: 99 } DIV.MSOPLAINTEXT { mso-style-priority: 99 } P { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR0 { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR00 { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR000 { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR0000 { mso-style-priority: 99 } P.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman" } LI.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman" } DIV.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman" } A:link { COLOR: blue; TEXT-DECORATION: underline } SPAN.MsoHyperlink { COLOR: blue; TEXT-DECORATION: underline } A:visited { COLOR: purple; TEXT-DECORATION: underline } SPAN.MsoHyperlinkFollowed { COLOR: purple; TEXT-DECORATION: underline } P.MsoPlainText { FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: Consolas } LI.MsoPlainText { FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: Consolas } DIV.MsoPlainText { FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: Consolas } P { FONT-SIZE: 12pt; MARGIN-LEFT: 0cm; MARGIN-RIGHT: 0cm; FONT-FAMILY: "Times New Roman"; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto } SPAN.plaintextchar { FONT-FAMILY: Consolas } SPAN.plaintextchar0 { FONT-FAMILY: Consolas } SPAN.plaintextchar00 { FONT-FAMILY: Consolas } SPAN.plaintextchar000 { FONT-FAMILY: Consolas } SPAN.plaintextchar0000 { FONT-FAMILY: Consolas } SPAN.EmailStyle24 { COLOR: windowtext; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle25 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle26 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: Tahoma; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle27 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle28 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle29 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle30 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle31 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle32 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle33 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle34 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle35 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle36 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle37 { COLOR: #1f497d; FONT-FAMILY: Calibri; mso-style-type: personal } SPAN.EmailStyle38 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle39 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle40 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: Tahoma; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle41 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle42 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: Tahoma; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle43 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle44 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle45 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle46 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle47 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle48 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle49 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle50 { COLOR: #1f497d; FONT-FAMILY: Calibri; mso-style-type: personal } SPAN.EmailStyle51 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle52 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle53 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle54 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle55 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle56 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle57 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle58 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle59 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle60 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle61 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle62 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle63 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle64 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle65 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle66 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle67 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle68 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal-reply } DIV.Section1 { page: Section1 } OL { MARGIN-BOTTOM: 0cm } UL { MARGIN-BOTTOM: 0cm } Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info(a)callcentres.net"" <info(a)callcentres.net> ,to=To: ""Graeme Ross"" <gross(a)mobileemail.vodafone.com.au>,subject=Turn-key call centre for lease. Launceston, Tasmania","worker/CPSendWork.cpp:858" But they look like this: Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info(a)callcentres.net"" <info(a)callcentres.net> Anyone seen this? Thanks __________________________________________________________________ Yahoo! Canada Toolbar: Search from anywhere on the web, and bookmark your favourite sites. Download it now http://ca.toolbar.yahoo.com.

2 1

Re: [syslog-ng] syslog-ng 3.0 seem to chop some of the long lines off
by Joe Hansen 18 Jun '09

18 Jun '09

More info on this issue: We found that if the source message has "\n\r" this behavior happens. Does anyone know if this is by design or listed in the RFC anywhere? Thanks, Joe --- On Wed, 6/17/09, Joe Hansen <yrmf250(a)yahoo.com> wrote: From: Joe Hansen <yrmf250(a)yahoo.com> Subject: [syslog-ng] syslog-ng 3.0 seem to chop some of the long lines off To: syslog-ng(a)lists.balabit.hu Received: Wednesday, June 17, 2009, 7:10 PM We're seeing lines in /var/log/messages that are chopped off. They should look like this: #yiv1493839580 v\:* { } #yiv1493839580 o\:* { } #yiv1493839580 w\:* { } #yiv1493839580 .shape { } #yiv1493839580 st1\:* { } _filtered #yiv1493839580 { font-family:MS Mincho;} _filtered #yiv1493839580 { font-family:Tahoma;} _filtered #yiv1493839580 { font-family:Calibri;} _filtered #yiv1493839580 { font-family:Verdana;} _filtered #yiv1493839580 { font-family:Consolas;} _filtered #yiv1493839580 { font-family:MS Sans Serif;} _filtered #yiv1493839580 { font-family:Mincho;} _filtered #yiv1493839580 {margin:72.0pt 90.0pt 72.0pt 90.0pt;} #yiv1493839580 A:link { } #yiv1493839580 SPAN.MSOHYPERLINK { } #yiv1493839580 A:visited { } #yiv1493839580 SPAN.MSOHYPERLINKFOLLOWED { } #yiv1493839580 P.MSOPLAINTEXT { } #yiv1493839580 LI.MSOPLAINTEXT { } #yiv1493839580 DIV.MSOPLAINTEXT { } #yiv1493839580 P { } #yiv1493839580 SPAN.PLAINTEXTCHAR { } #yiv1493839580 SPAN.PLAINTEXTCHAR0 { } #yiv1493839580 SPAN.PLAINTEXTCHAR00 { } #yiv1493839580 SPAN.PLAINTEXTCHAR000 { } #yiv1493839580 SPAN.PLAINTEXTCHAR0000 { } #yiv1493839580 P.MsoNormal { FONT-SIZE:12pt;MARGIN:0cm 0cm 0pt;FONT-FAMILY:"Times New Roman";} #yiv1493839580 LI.MsoNormal { FONT-SIZE:12pt;MARGIN:0cm 0cm 0pt;FONT-FAMILY:"Times New Roman";} #yiv1493839580 DIV.MsoNormal { FONT-SIZE:12pt;MARGIN:0cm 0cm 0pt;FONT-FAMILY:"Times New Roman";} #yiv1493839580 A:link { COLOR:blue;TEXT-DECORATION:underline;} #yiv1493839580 SPAN.MsoHyperlink { COLOR:blue;TEXT-DECORATION:underline;} #yiv1493839580 A:visited { COLOR:purple;TEXT-DECORATION:underline;} #yiv1493839580 SPAN.MsoHyperlinkFollowed { COLOR:purple;TEXT-DECORATION:underline;} #yiv1493839580 P.MsoPlainText { FONT-SIZE:10.5pt;MARGIN:0cm 0cm 0pt;FONT-FAMILY:Consolas;} #yiv1493839580 LI.MsoPlainText { FONT-SIZE:10.5pt;MARGIN:0cm 0cm 0pt;FONT-FAMILY:Consolas;} #yiv1493839580 DIV.MsoPlainText { FONT-SIZE:10.5pt;MARGIN:0cm 0cm 0pt;FONT-FAMILY:Consolas;} #yiv1493839580 P { FONT-SIZE:12pt;MARGIN-LEFT:0cm;MARGIN-RIGHT:0cm;FONT-FAMILY:"Times New Roman";} #yiv1493839580 SPAN.plaintextchar { FONT-FAMILY:Consolas;} #yiv1493839580 SPAN.plaintextchar0 { FONT-FAMILY:Consolas;} #yiv1493839580 SPAN.plaintextchar00 { FONT-FAMILY:Consolas;} #yiv1493839580 SPAN.plaintextchar000 { FONT-FAMILY:Consolas;} #yiv1493839580 SPAN.plaintextchar0000 { FONT-FAMILY:Consolas;} #yiv1493839580 SPAN.EmailStyle24 { COLOR:windowtext;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle25 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle26 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:Tahoma;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle27 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle28 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle29 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle30 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle31 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle32 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle33 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle34 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle35 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle36 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle37 { COLOR:#1f497d;FONT-FAMILY:Calibri;} #yiv1493839580 SPAN.EmailStyle38 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle39 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle40 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:Tahoma;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle41 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle42 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:Tahoma;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle43 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle44 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle45 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle46 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle47 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle48 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle49 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle50 { COLOR:#1f497d;FONT-FAMILY:Calibri;} #yiv1493839580 SPAN.EmailStyle51 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle52 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle53 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle54 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle55 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle56 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle57 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle58 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle59 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle60 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle61 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle62 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle63 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle64 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle65 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle66 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle67 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle68 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 DIV.Section1 { } #yiv1493839580 OL { MARGIN-BOTTOM:0cm;} #yiv1493839580 UL { MARGIN-BOTTOM:0cm;} Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info(a)callcentres.net"" <info(a)callcentres.net> ,to=To: ""Graeme Ross"" <gross(a)mobileemail.vodafone.com.au>,subject=Turn-key call centre for lease. Launceston, Tasmania","worker/CPSendWork.cpp:858" But they look like this: Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info(a)callcentres.net"" <info(a)callcentres.net> Anyone seen this? Thanks The new Internet Explorer® 8 - Faster, safer, easier. Optimized for Yahoo! Get it Now for Free! -----Inline Attachment Follows----- ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html __________________________________________________________________ The new Internet Explorer® 8 - Faster, safer, easier. Optimized for Yahoo! Get it Now for Free! at http://downloads.yahoo.com/ca/internetexplorer/

1 0

syslog-ng OSE 2.1.4 released
by Balazs Scheidler 16 Jun '09

16 Jun '09

Hi, I've released syslog-ng OSE 2.1.4 with the following changes: 2.1.4 Tue, 17 Mar 2009 13:35:00 +0100 Bugfixes: * Fixed a possible DoS condition triggered by a destination port unreachable ICMP packet received from a UDP destination. syslog-ng started eating all available memory and CPU until it crashed if this happened. * Fixed the rate at which files regular were read using the file() source. * Report connection breaks as a write error instead of reporting POLLERR as the write error path reports more sensible information in the logs. The release is available at: https://www.balabit.com/network-security/syslog-ng/opensource-logging-syste… -- Bazsi

4 5

Stripping the original hostname /ip from the syslog message
by Shashank Vinchurkar 12 Jun '09

12 Jun '09

Hi, We have a setup where multiple syslog-ng servers send logs to a central syslog-ng server. Finally this central syslog-ng server sends the consolidated logs to an outside server. The outside server can be any server accepting standard syslog messages. The first group of servers are running in the internal network and don't have any hostname associated with them. Also the ip address is internal and does not make sense to outside world. My requirement is that the outside server should only see the ip address of the syslog-ng server which consolidates the messages from these syslog-ng servers. But I always see the ip address of the syslog-ng server which originated the message. Is there anyway to get rid of this? I tried playing with the keep_hostname, long_hostname, chain_hostname and bad_hostname options but I still see the ip address of the originating server. Thanks in advance for the help. -Shashank

3 5

Backslash before quote
by Pennington, Philip 11 Jun '09

11 Jun '09

Syslog-ng version 2. Can anyone please explain the purpose of the backslash being added before each quote in syslog output ? Is there any way to disable this feature ? Is this flags(noparse) ? Is there any other way to do it (other than stripping it out on an output process)? Regards Philip =============================================================================== Please access the attached hyperlink for an important electronic communications disclaimer: http://www.credit-suisse.com/legal/en/disclaimer_email_ib.html ===============================================================================

3 4