November 2011 - syslog-ng - lists.balabit.hu

[PATCH 0/1]: value-pairs key rewriting for 3.4
by Gergely Nagy 21 Nov '11

21 Nov '11

The patch I'll be sending in a followup implements key rewriting for syslog-ng 3.4. I wrote about this quite a bit in the past, and this time, there are no functional changes - it's just the work I've done so far merged into a single patch. ...and updated a bit, because during the merge, I discovered that the transformations are not thread safe, so I took the opportunity to convert them to scratch buffers too. This, however, was done in a bit of a hurry, so I'm not entirely happy with the result. Nevertheless, I'm submitting it as a single patch, mostly so that it can be reviewed in its entirety. I don't think it's ripe for a merge yet, there's a bit of work left to done still, at least in the code part. The functionality itself is - I believe - solid by now. The former branch I worked on (feature/3.4/value-pairs/rekey) will be deleted soon, as it does not contain the latest fixes I applied during the commit merging process. -- |8]

1 4

Fwd: bug in syslog-ng 3.2 and 3.3
by Gergely Nagy 21 Nov '11

21 Nov '11

The mail below was originally sent to one of our internal addresses, but since it's a bug report against 3.2 and 3.3, it is better to have it posted here too (with original files attached): Da Mota Sam <da.mota.sam(a)gmail.com> wrote: > > Hi, > > I think I found a bug in syslog-ng starting from version 3.2. > > You will find in attachment the smallest configuration files for which > the bug appears. > These files must be placed in /etc/syslog-ng "to work". > > The problem seems to be in a bad handling of characters with accents. > > With the attached configuration files, when syslog-ng receives a > message containing just "1 é" > (for exemple by calling "logger '1 é') one should expect the creation > of a file /var/log/message_with_id_matched > This file isn't actually created. > > The given file pattern_rules.xml contains two patterns. If I remove > one of them, then I get the creation of the file > /var/log/message_with_id_matched, which makes me think that one of the > pattern shadows the other one. > > > About: > I got this erroneous behaviour with: > - syslog-ng 3.2.4 on debian wheezy (from debian packages) > - syslog-ng 3.2.4 on debian lenny (from syslog-ng source code) > - syslog-ng 3.2.4 on debian squeeze (from syslog-ng source code) > - syslog-ng 3.2.5 on debian squeeze (from syslog-ng source code) > - syslog-ng 3.3.1 on debian wheezy (using the packages of debian sid) > > the bug was not present on syslog-ng 3.1 on debian squeeze (from > debian packages) > > Could you please check that you get the same errors, and let me know about it? > (so I could bug report this to the debian team if it is not a syslog-ng bug). > > > Best regards, > -- > Samuel Da Mota -- |8]

1 0

Monitoring syslog-ng logserver
by Paul Muther 19 Nov '11

19 Nov '11

Greetings all, I have a question about monitoring syslog-ng itself. In the event that the log server stops listening or stops processing for messages for whatever reason is there a way to alert on hosts that messages are being queued/buffered? In a situation recently the log server syslog-ng process was running but not accepting log messages from remote hosts for some reason. As a result they all pilled up at the sources until the clients rolled over. It would be helpful to have an alert that it is happening but I can't find anything on monitoring the buffers. Thanks much, PM

2 1

patterndb
by Gianluca Tranelli 18 Nov '11

18 Nov '11

Good morning everybody, the time is very good here in Rome, but I don't want to talk abbout the weather but about patterndb that is driving me crazy. After reading all the administration guide v3.3, I found an example of using patterndb to log the duration of an ssh Linux and to log a new formatted message. I just copied the XML, ran update-patterndb but nothing happen. Do i miss something? Can someone post a complete working example on ssh? Patterndb is driving me crazy. Thank you in advance.

2 3

Query regarding syslog-ng
by Ankit Mahawar 18 Nov '11

18 Nov '11

Hi , In c++ we have a function syslog for logging data into the log file . Similar function can be used in syslog-ng for logging or there is a separate function I am totally new to syslog-ng. Thanks =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

2 3

Simple config question
by Miguel Alvarez 18 Nov '11

18 Nov '11

Hi, After being less than impressed with the stability of rsyslog, I just discovered syslog-ng and it looks really impressive but a bit overwhelming! I have a simple configuration with my existing rsyslog set up where it's performing normal system syslog responsibilities but also tagging other log files and then forwarding them to a centralized log server. The examples I've seen for syslog-ng are making my head swim so I was hoping someone would be able to point me in the right direction on how to do the same with syslog-ng. Thank you

5 12

syslog-ng fails to drop file handles and reopen on HUP signal
by Dave Rawks 17 Nov '11

17 Nov '11

Since 3.3.2 I've been seeing this weird behavior where syslog-ng fails to reload cleanly on a HUP. This has been particularly hard to troubleshoot since it appears as though when the reload fails it is causing both sshd and login to block; which I suspect is because /dev/log has disappeared. Luckily I do have nagios nrpe setup to allow me to remotely restart syslog-ng which alleviates the inability to login, but also makes it very hard to collect any troubleshooting information. Anyone else seeing any failures like this? I also sometimes see a a kernel error like one of the following on reload: Nov 17 10:30:02 app-bogus kernel: [ 3788.489852] syslog-ng[28520]: segfault at 7fd054022350 ip 00007fd054022350 sp 00007fffc93404e8 error 15 OR Nov 17 10:32:35 app-bogus kernel: [ 3941.605005] syslog-ng[29805] general protection ip:7fd05f0bcc4e sp:7fd05ac71240 error:0 in libsyslog-ng-3.3.2.so[7fd05f092000+7b000] I was really excited about the features this version of syslog-ng has brought with it, but I'm finding it WAY to unstable to use in production. Is there any information I could provide to help resolve these possibly related issues? -Dave

2 1

R: Re: R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

Sorry, but I need more help. I need to install syslog-ng in server mode and I'm not able to find the installer script. Thanks. >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 17/11/2011 12.10 >A: "andrea.meconi(a)libero.it"<andrea.meconi(a)libero.it> >Cc: "Syslog-ng users' and developers' mailing list"<syslog-ng(a)lists.balabit. hu> >Ogg: Re: [syslog-ng] R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >> How can I install the new service now? > >I would suggest reading our excellent administrator's guide, available >at: > http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3- guides/syslog-ng-ose-v3.3-guide-admin-en.html/bk01-toc.html > >-- >|8] > >

2 1

R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

How can I install the new service now? Thanks. >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 16/11/2011 22.32 >A: <syslog-ng(a)lists.balabit.hu> >Ogg: Re: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >> ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version >> ./syslog-ng: error while loading shared libraries: libsyslog-ng-3.3.2.so: >> cannot open shared object file: No such file or directory >> ameconi@ubuntu:/usr/local/sbin$ > >You also need to add /usr/local/lib to your library load path. The >easiest way is to add that dir to /etc/ld.so.conf. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

2 1

R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

Sorry! With this addendum into ld.so.conf ameconi@ubuntu:/etc$ more ld.so.conf include /etc/local/sbin include /etc/ld.so.conf.d/*.conf ameconi@ubuntu:/etc$ I can obtain the version information ameconi@ubuntu:/usr/local/sbin$ sudo syslog-ng --version syslog-ng 3.3.2 Installer-Version: 3.3.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose-- mainline--3.3#master#555a5cead6723132e6aa89f52365bb40582c8ecc Compile-Date: Nov 15 2011 17:55:58 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser, syslogformat Available-Modules: dbparser,syslogformat,basicfuncs,afsocket-notls,afuser, afmongodb,csvparser,afsocket,afprog,affile,confgen,convertfuncs,dummy Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: off ameconi@ubuntu:/usr/local/sbin$ >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 16/11/2011 22.32 >A: <syslog-ng(a)lists.balabit.hu> >Ogg: Re: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >> ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version >> ./syslog-ng: error while loading shared libraries: libsyslog-ng-3.3.2.so: >> cannot open shared object file: No such file or directory >> ameconi@ubuntu:/usr/local/sbin$ > >You also need to add /usr/local/lib to your library load path. The >easiest way is to add that dir to /etc/ld.so.conf. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0