May 2010 - syslog-ng - lists.balabit.hu

Tests using loggen - not receiving all the packets
by Clayton Dukes 14 May '10

14 May '10

Hi Folks, I'm trying to run a test to check insert rates. If I run this command: ./loggen -r 5000 -D -I 10 127.0.0.1 514 The output shows: average rate = 5441.60 msg/sec, count=54420, time=10.007, msg size=256, bandwidth=1360.40 kB/sec But, my stats don't show that many messages received: syslog-ng[6660]: Log statistics; dropped=\'pipe(/dev/xconsole)=0\', processed=\'center(queued)=24232\', processed=\'center(received)=8077, processed=\'destination(df_logzilla)=8077\' As you can see, it sent 55k messages, but I only received 8k. Am I doing something wrong? Here are my options in the syslog-ng config: options { long_hostnames(off); log_msg_size(8192); flush_lines(1); log_fifo_size(16384); time_reopen(10); use_dns(yes); dns_cache(yes); use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); perm(0644); stats_freq(60); }; -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

7 23

syslog-ng poll results
by Fekete Robert 14 May '10

14 May '10

Hi, About two months ago we started to run periodic polls on our website to learn more about how you use syslog-ng. The results of the first two polls are already available on the website and on my blog at http://robert.blogs.balabit.com/2010/05/syslog-ng-poll-results.html and the third question is online as well. Thank you very much for voting! Regards, Robert

1 0

[Bug 82] New: Buffered messages are lost on SIGHUP signal
by bugzilla＠bugzilla.balabit.com 12 May '10

12 May '10

https://bugzilla.balabit.com/show_bug.cgi?id=82 Summary: Buffered messages are lost on SIGHUP signal Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Windows Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: urbestfriend(a)gmail.com Type of the Report: --- Estimated Hours: 0.0 I'm using version 2.0.10 syslog-ng version. I ran a simple test with filter f_myprog { program(zpem); }; destination my_dest { unix-stream("/dev/mylog" template("$MSGONLY\n") template_escape(no) log_fifo_size(1000) ); }; log { source(src); filter(f_myprog); destination(my_dest); }; When destination is not available ( server is stopped) and if I issue SIGHUP signal , all buffered messages are lost and I dont receive any messages when destination comes back online But if I dont issue SIGHUP when destination is down , it works well and I'm able to receive messages when destination comes up.Ideally with log_fifo_size(), I would expect the messages to be buffered across reloads, but this is not the case in the version which I am using. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

How to turn logging into the .log files
by Wagner Pereira 11 May '10

11 May '10

Hi, all. When I installed Syslog-ng, I configured it to log all the device's activities into the .log files. It worked well for some weeks. In the last week, I tried to use Logzilla ( former PhP-Syslog-ng) but I can't successful, then I removed Logzilla yesterday. After I removed Logzilla, I noticed that all the activities are been recorded into the /var/log/messages file and no longer into the .log files I've created for this purpose, originally. What should I configure to turn logging in those .log files? I already have the syslog-ng.conf configured properly. Thanks in advance. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Tel. (11) 3091-8901

2 8

nested/derived source statements?
by Jan Schaumann 10 May '10

10 May '10

Hello, Ie, I have source s_tcp6 { tcp6(log_fetch_limit(25) port(601)); } source s_tcp4 { tcp(log_fetch_limit(25) port(601)); }; and I would like to have another source s_tcp { s_tcp4; s_tcp6; }; but no matter what I try, I get syntax errors. Is it not possible to have nested/derived source statements? -Jan

3 5

$DAY Macro not RFC Compliant
by Michael Starks 10 May '10

10 May '10

I have a situation where I am trying to construct a RFC3164-compliant message from component parts of a non-compliant message. The non-compliant message expresses the day as dd, and if the day is before the tenth of the month, it is 0d. I thought it would be better to use the syslog-ng $DAY macro, but I learned that it also does the same thing. The RFC, however, requires two-digit days to be expressed as " d" (space digit) when the day is before 10. I then thought that perhaps I could just rewrite the day as expressed by the original message, which is actually my preference, using a rewrite rule. As a test, I tried this: rewrite r_test{ subst("07", " 7", value("${PARSER.DD}")); }; This attempted to change "07" to " 7" in PARSER.DD, which has been successfully extracted in a former parser. And of course I attempt to use it in a log statement (some names have been changed for demonstration purposes): log { source(s_source); parser(p_parser); filter(f_filter); destination(d_destination); rewrite(r_test);}; So my questions are: 1. Why is the $DAY macro not RFC3164-compliant? Is that a design choice? Was it simply never meant to be? 2. Why doesn't the rewrite rule work? I know PARSER.DD has been successfully extracted because I can use it in a destination. Thanks in advance. -Michael Starks

2 2

[PATCH] make 'syslog-ng -s' stay in the foreground
by Corey Hickey 10 May '10

10 May '10

Hi, I recently upgraded to syslog-ng 3.1.1 and noticed messages like this appearing on terminals owned by root: 2010 May 7 06:25:21 fire Daemon exited gracefully, not restarting; exitcode='0' This is triggered by a daily logrotate cron job that runs 'syslog-ng -s' before sending the daemon a SIGHUP. It seems that 'syslog-ng -s' will daemonize and fork; the child process runs the syntax check and exits immediately, and then the parent process sends the above message via syslog(LOG_CRIT,...). I can work around it by using 'syslog-ng -sF', but I also hacked up a small patch to force the process to be in the foreground when -s is specified. Is this useful? If not, I'll send a patch to Debian to use 'syslog-ng -sF' instead. Thanks, Corey diff -ur syslog-ng-3.1.1.orig/src/gprocess.c syslog-ng-3.1.1/src/gprocess.c --- syslog-ng-3.1.1.orig/src/gprocess.c 2009-12-15 05:00:28.000000000 -0800 +++ syslog-ng-3.1.1/src/gprocess.c 2010-05-08 19:30:12.000000000 -0700 @@ -1134,14 +1134,18 @@ /** * g_process_start: + * @force_foreground: force process mode to foreground * * Start the process as directed by the options set by various * g_process_set_*() functions. **/ void -g_process_start(void) +g_process_start(gboolean force_foreground) { pid_t pid; + + if (force_foreground) + process_opts.mode = G_PM_FOREGROUND; g_process_detach_tty(); g_process_change_limits(); diff -ur syslog-ng-3.1.1.orig/src/gprocess.h syslog-ng-3.1.1/src/gprocess.h --- syslog-ng-3.1.1.orig/src/gprocess.h 2009-11-25 11:47:45.000000000 -0800 +++ syslog-ng-3.1.1/src/gprocess.h 2010-05-08 19:28:55.000000000 -0700 @@ -70,7 +70,7 @@ void g_process_set_use_fdlimit(gboolean use); void g_process_set_check(gint check_period, gboolean (*check_fn)(void)); -void g_process_start(void); +void g_process_start(gboolean force_foreground); void g_process_startup_failed(guint ret_num, gboolean may_exit); void g_process_startup_ok(void); void g_process_finish(void); diff -ur syslog-ng-3.1.1.orig/src/main.c syslog-ng-3.1.1/src/main.c --- syslog-ng-3.1.1.orig/src/main.c 2010-03-14 10:22:50.000000000 -0700 +++ syslog-ng-3.1.1/src/main.c 2010-05-08 19:28:55.000000000 -0700 @@ -417,7 +417,7 @@ /* in this case we switch users early while retaining a limited set of * credentials in order to initialize/reinitialize the configuration. */ - g_process_start(); + g_process_start(syntax_only); rc = initial_init(&cfg); if (rc)

2 1

syslog-ng can not work with oracle backend
by Dmitry Sedov 10 May '10

10 May '10

Hello! I took stable binary rpm with open source syslog-ng version 3.0.6 on balabit.hu and install it on rhel 4u7. For some reason it does not want to work with oracle backend. I try next bekend description in syslog-ng.conf: destination d_oracle_syslog { sql(type(oracle) username("login") password("password") database("database") table("table") columns("DATE varchar2(24)", "facility number(2)", "LEVEL number(1)", "host varchar2(128)", "program varchar2(64)", "pid number(8)", "message varchar2(1024)") indexes( "DATE","facility","host") ); }; And after start syslog-ng post in /var/log/messages notes about failure: Apr 30 18:35:47 vm-dc-syslog syslog-ng[9815]: No such DBI driver; type='oracle' Apr 30 18:35:47 vm-dc-syslog syslog-ng[9815]: No such DBI driver; type='oracle' Apr 30 18:35:47 vm-dc-syslog syslog-ng[9815]: No such DBI driver; type='oracle' After this issue appear, I compile libdbi and libdbi-drivers version 0.8.3. But it did not help: syslog-ng continue write "No such DBI driver; type='oracle'". And the same happens with the syslog-ng versions 3.1.1 and 3.1.0. I install syslog-ng with binary rpm's from www.balabit.com. Tell me, please, how I may fix this issue. Regards, Dmitry Sedov.

3 6

Want to down load NCsysng-1.6.7-1.pkg.gz
by sasanka.sahu＠wipro.com 10 May '10

10 May '10

want to download NCsysng-1.6.7-1.pkg.gz but the package is NOT available on the site ( http://www.campin.net/download/NCsysng-1.6.7-1.pkg.gz <http://www.campin.net/download/NCsysng-1.6.7-1.pkg.gz> ) so please provide me the exact link for downloading the same . Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

Rediecting logs
by abhay singh 10 May '10

10 May '10

Hi All, I have made changes in syslog-ng.conf to redirect logs coming from other server to some specified log file and in some format source s_external { udp(port(514)); }; source s_stunnel { tcp(ip(127.0.0.1) port(514)); }; destination s_external { file("/mydir/syslogs/$HOST_syslog.log" \ owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes)); }; destination s_stunnel { file("/mydir/syslogs/$HOST/syslog.log" \ owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(s_external); destination(s_external); }; log { source(s_stunnel); destination(s_stunnel); }; But my log file is being created with name "syslog.log" and not as "<hostnmae/ip>_syslog.log" neither $HOST directory made, what may be the issue? Globle options are option{ long_hostname(off); sync(0); } -- Regards.. Abhay Singh.. 91-98804-55587 Sr. Software Engineer. Robust Designs India Pvt Ltd. Bangalore

5 6