November 2012 - syslog-ng - lists.balabit.hu

[Bug 198] New: debug-info fails to extract info from libsyslog-ng-crypto.so
by bugzilla＠bugzilla.balabit.com 18 Jan '13

18 Jan '13

https://bugzilla.balabit.com/show_bug.cgi?id=198 Summary: debug-info fails to extract info from libsyslog-ng- crypto.so Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: svensken(a)jla.rutgers.edu Type of the Report: bug Estimated Hours: 0.0 The syslog-ng package fails to build on Centos6 using mock with version 3.3.6 source code and a syslog-ng-3.2.5-3.el6 spec file. The problem seems to involve the debug info package, provided by rpm-4.8.0-27.el6.x86_64 and rpm-build-4.8.0-27.el6.x86_64 Seemingly, debug info cannot be extracted from libsyslog-ng-crypto.so, whether the .so or the 'debugedit' binary is doing something incorrectly. Here's the relevant part of the build log: --------- ... + /usr/lib/rpm/find-debuginfo.sh --strict-build-id /builddir/build/BUILD/syslog-ng-3.3.6 extracting debug info from /builddir/build/BUILDROOT/syslog-ng-3.3.6-2.ru6.x86_64/usr/bin/pdbtool extracting debug info from /builddir/build/BUILDROOT/syslog-ng-3.3.6-2.ru6.x86_64/usr/bin/loggen extracting debug info from /builddir/build/BUILDROOT/syslog-ng-3.3.6-2.ru6.x86_64/lib64/libsyslog-ng-3.3.6.so extracting debug info from /builddir/build/BUILDROOT/syslog-ng-3.3.6-2.ru6.x86_64/lib64/syslog-ng/libcsvparser.so extracting debug info from /builddir/build/BUILDROOT/syslog-ng-3.3.6-2.ru6.x86_64/lib64/syslog-ng/libdbparser.so extracting debug info from /builddir/build/BUILDROOT/syslog-ng-3.3.6-2.ru6.x86_64/lib64/syslog-ng/libsyslog-ng-crypto.so error: Bad exit status from /var/tmp/rpm-tmp.BZBLBe (%install) Bad exit status from /var/tmp/rpm-tmp.BZBLBe (%install) RPM build errors: Child returncode was: 1 ... --------- Throwing "%define debug_package %{nil}" into the spec will make the rpm build without errors. So it looks like the script "/usr/lib/rpm/find-debuginfo.sh" is failing to 'extract debug info' from "libsyslog-ng-crypto.so" The lack of an error message is no surprise; here's the function (inside find-debuginfo.sh) that's actually doing the debug info extraction: --------- 202 echo "extracting debug info from $f" 203 id=$(/usr/lib/rpm/debugedit -b "$RPM_BUILD_DIR" -d /usr/src/debug \ 204 -i -l "$SOURCEFILE" "$f") || exit 205 if [ -z "$id" ]; then 206 echo >&2 "*** ${strict_error}: No build ID note found in $f" 207 $strict && exit 2 208 fi --------- I tried modifying it, and found that the "exit" function is never even reached, since (as it turns out) /usr/lib/rpm/debugedit returns "Segmentation fault" when run on libsyslog-ng-crypto.so... Running /usr/lib/rpm/debugedit on the libraries that seem to be working (e.g. libcsvparser.so and libdbparser.so) without extra arguments returns no errors, however. I've found that the library itself, libsyslog-ng-crypto.so, seems to have a debug info format different from the other libraries' that succeeded in the build. As I understand it, the following command will display the debug info for a shared library: `readelf -w /path/to/library.so` It seems that the libcsvparser.so and libdbparser.so libraries both use an ".eh_frame section" to store their debug info, while libsyslog-ng-crypto.so seems to put its info into a ".debug_info section" (with hex line numbers of some sort), with an empty ".eh_frame section" section. I noticed that this crypto library was added fairly recently in the change logs, so perhaps it uses a newish format for its debug-info that is not yet supported by the debugedit binary, which is owned by rpm-build-4.8.0-27.el6.x86_64 Could there be a problem on my end, or is this an issue with the library itself? Could it be both? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

SYSLOG-NG 3.4 exiting without any error print
by Deepak Gaur 28 Dec '12

28 Dec '12

Hello, I have cross-compiled syslog-ng for ARM target but it is exiting without showing any error code (on target). I am attaching strace output (syslog.txt). If anyone can help me out # syslog-ng -V syslog-ng 3.4.0alpha3 Installer-Version: 3.4.0alpha3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.4#master#709ab1252920063e6d4d0d610ad5c1ee5ebdfb75 Compile-Date: Nov 27 2012 14:59:53 Available-Modules: syslogformat,afsocket-notls,afuser,basicfuncs,confgen,dbparser,tfuuid,afmongodb,afsocket-tls,afprog,afsocket,affile,csvparser Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: on ATTACHMENT syslog.txt

2 2

[Bug 42] New: capabilities, chown, chmod
by bugzilla＠bugzilla.balabit.com 20 Dec '12

20 Dec '12

https://bugzilla.balabit.com/show_bug.cgi?id=42 Summary: capabilities, chown, chmod Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zbyniu(a)pld-linux.org Type of the Report: bug Estimated Hours: 0.0 Let's take a look at syslog-ng-3.0.1/src/affile.c lines 60-83 1. CAP_SYS_ADMIN is needed only for /proc/kmsg, it is added w/o check 2. CAP_DAC_READ_SEARCH should be added only if open fail with errno 13 2a. CAP_DAC_OVERRIDE should be added only if open fail with errno 13 and with CAP_DAC_READ_SEARCH set 3. fchown needs CAP_CHOWN unconditionaly 4. fchmod needs CAP_FOWNER if file owner != euid (root here) 5. all caps should be restored summary: - CAP_SYS_ADMIN and CAP_DAC_OVERRIDE are set always even if unnecessary, and permanently - owner, group and perm doesn't work -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 10

syslog-ng OSE 3.4 Administrator Guide draft update
by Fekete Róbert 07 Dec '12

07 Dec '12

Hi, My colleague, Ancsur Sebestyen had some time this week to work on the 3.4 admin guide a bit. Still far from being finished or up-to-date, the following new stuff has been documented since the first draft: * The tfhash template function * The JSON parser * The --disable-json compile option * The @PCRE@ patterndb parser * Bug 204: dbparser docs not clear for @NUMBER@ * Bug 205 Docs for macro MSGHDR incorrect * The LOGHOST macro * The syslog-ng-ctl reload option is included in the syslog-ng-ctl man page Also, the links to the docs have changed. The new ones are: HTML: https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-gui… Single-page HTML: https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-gui… PDF: https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-gui… As always, any feedback is welcome. Robert Fekete

2 1

[PATCH] system(): Use follow-freq(1) on FreeBSD prior to 9.1
by Gergely Nagy 07 Dec '12

07 Dec '12

FreeBSD prior to 9.1 does not have a kqueue-pollable /dev/klog, so syslog-ng would fall back to using timers, except that follow-freq() is explicitly set to zero, also diabling timer-based polling. This has the effect of making syslog-ng not read from /dev/klog at all. To work around the issue, on FreeBSD prior to 9.1, use follow-freq(1) for /dev/klog when using the system() source. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- scl/system/generate-system-source.sh | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/scl/system/generate-system-source.sh b/scl/system/generate-system-source.sh index 708a7a4..34cc009 100755 --- a/scl/system/generate-system-source.sh +++ b/scl/system/generate-system-source.sh @@ -74,7 +74,17 @@ EOF cat <<EOF unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); -file("/dev/klog" follow-freq(0) program-override("kernel") flags(no-parse)); +EOF + case "$osversion" in + 7.*|8.*|9.0*) + ffreq=1 + ;; + *) + ffreq=0 + ;; + esac + cat <<EOF +file("/dev/klog" follow-freq($ffreq) program-override("kernel") flags(no-parse)); EOF ;; GNU/kFreeBSD) -- 1.7.10.4

2 1

writing error to a mounted drive
by Frank Scalzo 03 Dec '12

03 Dec '12

: Error opening file for writing; filename='/var/log/hosts/XXXX/XXXXX', error='Permission denied (13)' I made the directory hosts inside /var/log/ and before I mounted the drive to the path /var/log/hosts files would write just fine but when I mounted the drive in that path I get the permissions denied error. running on redhat REHL 6and syslog-NG 3.2 OSE

2 1

[PATCH] [patterndb] fix a missing XML semantic check in PDBLoader
by balint.kovacs＠balabit.com 03 Dec '12

03 Dec '12

From: Balint Kovacs <blint(a)blint.hu> pattnerndb has failed to check if we are within a rule when trying to add tags and values, so a patterndb xml containing these elements outside of a rule element would cause syslog-ng (and pdbtool) to segfault Signed-off-by: Balint Kovacs <blint(a)blint.hu> --- modules/dbparser/patterndb.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/modules/dbparser/patterndb.c b/modules/dbparser/patterndb.c index 004d6b7..d2349f6 100644 --- a/modules/dbparser/patterndb.c +++ b/modules/dbparser/patterndb.c @@ -1154,10 +1154,20 @@ pdb_loader_text(GMarkupParseContext *context, const gchar *text, gsize text_len, } else if (state->in_tag) { + if (!state->in_rule) + { + *error = g_error_new(1, 0, "Unexpected <tag> element, must be within a rule"); + return; + } pdb_message_add_tag(state->current_message, text); } else if (state->value_name) { + if (!state->in_rule) + { + *error = g_error_new(1, 0, "Unexpected <value> element, must be within a rule"); + return; + } if (!state->current_message->values) state->current_message->values = g_ptr_array_new(); -- 1.7.9.5

2 1

syslog uses wrong and weird hostnames
by Daniel Neubacher 28 Nov '12

28 Nov '12

Hello there, My syslog-ng is logging fine from 700 servers but a few times per day it is logging into a wrong folder which is created by the $HOST variable. Normally syslog should use a hostname like host-1.worker.foobar.com but a few times a day it creates a folder names like: 4.22 p6-allrouter? p6-localnet p6-mc? p6-mcastpref p6-mcastpref? host-1.worker.foobar.xcom and other weird names... It only logs one or two lines and then uses the right folder again. Does anyone have a clue where I have to look for the problem? Here are the option line from the server and the client: Client: @version: 3.3 options { threaded(yes); use_dns(yes); use_fqdn(yes); dns_cache(yes); dns_cache_size(16384); dns_cache_expire(3600); dns_cache_expire_failed(10); log_msg_size(256000); log_fifo_size(100000); normalize_hostnames(yes); check_hostname(yes); bad_hostname("^gconfd$"); create_dirs(yes); owner("root"); group("root"); perm(0640); time_reopen(30); }; Server: options { threaded(yes); owner("root"); group("root"); perm(0660); dir_owner("root"); dir_group("root"); dir_perm(0770); create_dirs(yes); chain_hostnames(no); normalize_hostnames(yes); check_hostname(yes); keep_hostname(no); use_fqdn(yes); dns_cache(yes); dns_cache_size(16384); dns_cache_expire(3600); dns_cache_expire_failed(60); log_msg_size(256000); log_fifo_size(1000000); }; Destination example: destination d_syslog { file("/log/syslog/${R_YEAR}/${R_MONTH}/${R_DAY}/$HOST/$PROGRAM"); }; -- Daniel Neubacher, Network Administrator daniel.neubacher(a)xing.com<mailto:daniel.neubacher@xing.com> XING AG Gaensemarkt 43, 20354 Hamburg, Germany Tel. +49 40 419131-28, Fax +49 40 419131-11 Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 98807 Exec. Board (Vorstand): Dr. Stefan Groß-Selbeck (Vorsitzender), Dr. Thomas Vollmoeller, Ingo Chu, Dr. Helmut Becker, Jens Pape Chairman of the Supervisory Board (Aufsichtsratsvorsitzender): Dr. Neil Sunderland This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden and may be unlawful.

2 3

SYSLOG-NG 3.4 exiting with error code 2
by Deepak Gaur 27 Nov '12

27 Nov '12

Hello, I have cross-compiled syslog-ng for ARM target but it is exiting without showing any error code (on target). I am attaching strace output (syslog.txt). If anyone can help me out # syslog-ng -V syslog-ng 3.4.0alpha3 Installer-Version: 3.4.0alpha3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.4#master#709ab1252920063e6d4d0d610ad5c1ee5ebdfb75 Compile-Date: Nov 27 2012 14:59:53 Available-Modules: syslogformat,afsocket-notls,afuser,basicfuncs,confgen,dbparser,tfuuid,afmongodb,afsocket-tls,afprog,afsocket,affile,csvparser Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: on STRACE OUTPUT ------------------------ strace syslog-ng execve("/sbin/syslog-ng", ["syslog-ng"], [/* 15 vars */]) = 0 brk(0) = 0x13000 uname({sys="Linux", node="192.168.119.78", ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x4001d000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/tls/v5l/fast-mult/half/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/tls/v5l/fast-mult/half", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/tls/v5l/fast-mult/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/tls/v5l/fast-mult", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/tls/v5l/half/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/tls/v5l/half", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/tls/v5l/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/tls/v5l", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/tls/fast-mult/half/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/tls/fast-mult/half", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/tls/fast-mult/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/tls/fast-mult", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/tls/half/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/tls/half", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/tls/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/tls", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/v5l/fast-mult/half/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/v5l/fast-mult/half", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/v5l/fast-mult/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/v5l/fast-mult", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/v5l/half/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/v5l/half", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/v5l/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/v5l", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/fast-mult/half/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/fast-mult/half", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/fast-mult/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/fast-mult", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/half/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib/half", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/home/tbfsh/target//lib/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = -1 ENOENT (No such file or directory) stat64("/home/tbfsh/target//lib", 0x8ec40470) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=10371, ...}) = 0 mmap2(NULL, 10371, PROT_READ, MAP_PRIVATE, 3, 0) = 0x4001e000 close(3) = 0 open("/lib/libsyslog-ng-3.4.0alpha3.so", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\3407\1\0004\0\0\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1513316, ...}) = 0 mmap2(NULL, 496856, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x40026000 mprotect(0x40093000, 28672, PROT_NONE) = 0 mmap2(0x4009a000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6c) = 0x4009a000 mmap2(0x4009f000, 1240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4009f000 close(3) = 0 open("/lib/libnsl.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0004/\0\0004\0\0\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=98605, ...}) = 0 mmap2(NULL, 116464, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x400a0000 mprotect(0x400b2000, 28672, PROT_NONE) = 0 mmap2(0x400b9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x11) = 0x400b9000 mmap2(0x400bb000, 5872, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x400bb000 close(3) = 0 open("/lib/libgmodule-2.0.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0@\r\0\0004\0\0\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=18254, ...}) = 0 mmap2(NULL, 45268, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x400bd000 mprotect(0x400c0000, 28672, PROT_NONE) = 0 mmap2(0x400c7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2) = 0x400c7000 close(3) = 0 open("/lib/libgthread-2.0.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0000\5\0\0004\0\0\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=7368, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40021000 mmap2(NULL, 36912, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x400c9000 mprotect(0x400ca000, 28672, PROT_NONE) = 0 mmap2(0x400d1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0x400d1000 close(3) = 0 open("/lib/librt.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\300\26\0\0004\0\0\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=39970, ...}) = 0 mmap2(NULL, 57872, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x400d3000 mprotect(0x400d9000, 28672, PROT_NONE) = 0 mmap2(0x400e0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5) = 0x400e0000 close(3) = 0 open("/lib/libglib-2.0.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\270D\1\0004\0\0\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1762078, ...}) = 0 mmap2(NULL, 1584268, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x400e2000 mprotect(0x4025c000, 28672, PROT_NONE) = 0 mmap2(0x40263000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x179) = 0x40263000 close(3) = 0 open("/lib/libevtlog.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\300\20\0\0004\0\0\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=23326, ...}) = 0 mmap2(NULL, 49472, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x40265000 mprotect(0x40269000, 28672, PROT_NONE) = 0 mmap2(0x40270000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3) = 0x40270000 close(3) = 0 open("/lib/libpcre.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\250\16\0\0004\0\0\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=177343, ...}) = 0 mmap2(NULL, 200880, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x40272000 mprotect(0x4029b000, 28672, PROT_NONE) = 0 mmap2(0x402a2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x28) = 0x402a2000 close(3) = 0 open("/lib/libdl.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\34\t\0\0004\0\0\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=15728, ...}) = 0 mmap2(NULL, 41136, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x402a4000 mprotect(0x402a6000, 28672, PROT_NONE) = 0 mmap2(0x402ad000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1) = 0x402ad000 close(3) = 0 open("/lib/libpthread.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\330B\0\0004\0\0\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=126565, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40022000 mmap2(NULL, 123376, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x402af000 mprotect(0x402c3000, 28672, PROT_NONE) = 0 mmap2(0x402ca000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x13) = 0x402ca000 mmap2(0x402cc000, 4592, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x402cc000 close(3) = 0 open("/lib/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\330Q\1\0004\0\0\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1498068, ...}) = 0 mmap2(NULL, 1217048, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x402ce000 mprotect(0x403eb000, 28672, PROT_NONE) = 0 mmap2(0x403f2000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x11c) = 0x403f2000 mmap2(0x403f5000, 8728, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x403f5000 close(3) = 0 open("/lib/libiconv.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\230\22\0\0004\0\0\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0644, st_size=1061246, ...}) = 0 mmap2(NULL, 1048764, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x403f8000 mprotect(0x404f0000, 28672, PROT_NONE) = 0 mmap2(0x404f7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf7) = 0x404f7000 close(3) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40023000 mmap2(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x404f9000 set_tls(0x404f94a0, 0x40025674, 0x404fb5c8, 0x40025048, 0x40025048) = 0 mprotect(0x404f7000, 4096, PROT_READ) = 0 mprotect(0x403f2000, 8192, PROT_READ) = 0 mprotect(0x402ca000, 4096, PROT_READ) = 0 mprotect(0x402ad000, 4096, PROT_READ) = 0 mprotect(0x402a2000, 4096, PROT_READ) = 0 mprotect(0x40270000, 4096, PROT_READ) = 0 mprotect(0x40263000, 4096, PROT_READ) = 0 mprotect(0x400e0000, 4096, PROT_READ) = 0 mprotect(0x400d1000, 4096, PROT_READ) = 0 mprotect(0x400c7000, 4096, PROT_READ) = 0 mprotect(0x400b9000, 4096, PROT_READ) = 0 mprotect(0x4009a000, 8192, PROT_READ) = 0 mprotect(0x11000, 4096, PROT_READ) = 0 mprotect(0x40024000, 4096, PROT_READ) = 0 munmap(0x4001e000, 10371) = 0 set_tid_address(0x404f9048) = 577 set_robust_list(0x404f9050, 12) = 0 rt_sigaction(SIGRTMIN, {0x402b31e8, [], SA_SIGINFO|0x4000000}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {0x402b2cb8, [], SA_RESTART|SA_SIGINFO|0x4000000}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0 brk(0) = 0x13000 brk(0x34000) = 0x34000 gettimeofday({973374482, 838271}, NULL) = 0 open("/proc/stat", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x4001e000 read(3, "cpu 507 0 15055 364178 0 13 4 0"..., 1024) = 355 read(3, "", 1024) = 0 close(3) = 0 munmap(0x4001e000, 4096) = 0 open("/proc/stat", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x4001e000 read(3, "cpu 507 0 15055 364205 0 13 4 0"..., 1024) = 355 read(3, "", 1024) = 0 close(3) = 0 munmap(0x4001e000, 4096) = 0 ioctl(0, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B115200 opost isig icanon echo ...}) = 0 ioctl(0, TIOCNOTTY) = 0 setsid() = 577 setrlimit(RLIMIT_NOFILE, {rlim_cur=4*1024, rlim_max=4*1024}) = 0 pipe([3, 4]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x404f9048) = 578 close(4) = 0 read(3, "2\n", 6) = 2 close(3) = 0 exit_group(2) = ? +++ exited with 2 +++ -------------------------------------------------------------------------------- What could be the issue? Deepak Gaur

2 4

Queue size in syslog-ng?
by Abhijeet R 23 Nov '12

23 Nov '12

Hi all, In my setup, I send logs from all the servers to a central syslog server. This syslog-ng server also has a destination on a different port which is picked up by logstash's input block. (consider it just a consumer to those messages). What if this consumer goes down? How big is the queue? Is that configurable? How do I make sure that none of the messages are missed for the time the consumer is down? -- Cheers, Abhijeet R http://blog.abhijeetr.com

7 7