syslog-ng

Download

syslog-ng@lists.balabit.hu

January 2015

15 participants
12 discussions

Reason why syslog-ng service dies frequently
by Nguyen Trung Hieu 05 Jan '15

05 Jan '15

Dear team I have instaled syslog-ng version 3.5.4.1 on Centos 6.5 32 bit for 4 months, recently it dies very frequently, after I restart service it only work for some hours then die again. I have checked but still don't know why. Can anyone help me on this. Thank you. Below is log from my Centos box, I also attached my syslog-ng config file. [root@centos65-x86 ~]# syslog-ng -V syslog-ng 3.5.4.1 Installer-Version: 3.5.4.1 Revision: ssh+git://algernon@git.balabit /var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.5#master#4090ee62163780ae68a0c83cfdc23998c904fe97 Compile-Date: Aug 6 2014 11:49:42 Available-Modules: syslogformat,linux-kmsg-format,affile,csvparser,confgen,afamqp,system-source,afsql,dbparser,afstomp,afsocket,afsocket-notls,afmongodb,cryptofuncs,afprog,afuser,basicfuncs Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: off [root@centos65-x86 ~]# cat /etc/issue CentOS release 6.5 (Final) Kernel \r on an \m [root@centos65-x86 ~]# service syslog-ng status syslog-ng dead but subsys locked [root@centos65-x86 ~]# [root@centos65-x86 ~]# [root@centos65-x86 ~]# ll /var/lock/subsys/syslog-ng -rw------- 1 root root 0 Dec 31 15:06 /var/lock/subsys/syslog-ng [root@centos65-x86 ~]# [root@centos65-x86 ~]# [root@centos65-x86 ~]# ps -ef | grep syslog-ng root 15347 15312 0 09:23 pts/0 00:00:00 grep syslog-ng [root@centos65-x86 ~]# date Thu Jan 1 09:23:49 ICT 2015 [root@centos65-x86 ~]# tail -1 /var/log/messages Dec 31 18:06:47 centos65-x86 syslog-ng[5457]: Log statistics; processed='src.internal(s_local#2)=18', stamp='src.internal(s_local#2)=1420023407', processed='source(s_network)=0', processed='source(s_local)=18', dropped='dst.sql(d_sql_syslog_temp_table#0,oracle,,,PTUD_SYSLOG,SLG_LOG_TEMP)=76155', stored='dst.sql(d_sql_syslog_temp_table#0,oracle,,,PTUD_SYSLOG,SLG_LOG_TEMP)=91', processed='src.none()=0', stamp='src.none()=0', processed='source(s_snmptrapd)=0', processed='global(payload_reallocs)=20575', processed='global(msg_clones)=0', processed='destination(d_sql_snmp_temp_table)=7697', processed='destination(d_sql_syslog_temp_table)=1420079', dropped='dst.sql(d_sql_snmp_temp_table#0,oracle,,,PTUD_SYSLOG,SLG_LOGS_SNMPTRAP_TEMP)=0', stored='dst.sql(d_sql_snmp_temp_table#0,oracle,,,PTUD_SYSLOG,SLG_LOGS_SNMPTRAP_TEMP)=0', processed='center(queued)=1435491', processed='destination(d_local)=18', processed='global(sdata_updates)=55857', processed='center(received)=18', processed='destination(d_snmptrap)=7697' [root@centos65-x86 ~]# sestatus SELinux status: disabled [root@centos65-x86 ~]# cat /etc/sysconfig/selinux # This file controls the state of SELinux on the system. # SELINUX= can take one of these three values: # enforcing - SELinux security policy is enforced. # permissive - SELinux prints warnings instead of enforcing. # disabled - No SELinux policy is loaded. SELINUX=disabled # SELINUXTYPE= can take one of these two values: # targeted - Targeted processes are protected, # mls - Multi Level Security protection. SELINUXTYPE=targeted [root@centos65-x86 ~]# service iptables status iptables: Firewall is not running. -- Best regards! ------ Nguyen Trung Hieu Mobile: +84904031032

3 4

Re: [syslog-ng] syslog-ng always using default permissions
by Jim Hendrick 04 Jan '15

04 Jan '15

Cool. Just read this. Sent from my Verizon Wireless 4G LTE smartphone -------- Original message -------- From: Andrey Smetanin <Andrey.Smetanin(a)commerx.ca> Date:12/30/2014 10:07 AM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] syslog-ng always using default permissions SOLVED!! I was editing " /etc/syslog-ng/syslog-ng.conf", while my compiled version was using: " /usr/local/etc/syslog-ng.conf" Apparently, I had two packages installed, one from yum and another one compiled manually. When I made changes to "/usr/local/etc/syslog-ng.conf" files were created with the right permissions. Andrey Smetanin | Technical Consultant | Commerx Computer Systems Inc. 2880 Argentia Road, Unit 1, Mississauga, ON L5N 7X8 O: 905.542.9400 x201 | M: 647.894.6096 | F: 905.542.9410 andrey.smetanin(a)commerx.ca YOUR I.T. SOLUTIONS PARTNER -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Andrey Smetanin Sent: December-30-14 9:51 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] syslog-ng always using default permissions Here is the version: ----------------------------------------------------------------------------------- [root@logmonitor ~]# syslog-ng -V syslog-ng 3.6.1 Installer-Version: 3.6.1 Revision: Compile-Date: Dec 12 2014 15:08:34 Available-Modules: afsocket,syslogformat,afsocket-notls,affile,afprog,afuser,afamqp,afmongodb,csvparser,confgen,system-source,linux-kmsg-format,basicfuncs,cryptofuncs,dbparser,afstomp,pseudofile,graphite Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off ---------------------------------------------------------------------- Sorry, didn’t understand the last question about “later release”. Is there any way to see in the logs, debug messages...whatever...in which syslog-ng is making the decision what permissions to use? When I run debug mode all I can see is the messages about compiling config file.. You can see below, where I started syslog-ng in debug verbose mode, waited for a first log message and shut it down with CTL+C : ---------------------------------------------------------------------------------------------- [root@logmonitor ~]# systemctl stop syslog-ng [root@logmonitor ~]# ps aux | grep syslog-ng root 14070 0.0 0.0 110208 900 pts/0 R+ 09:34 0:00 grep --color=auto syslog-ng [root@logmonitor ~]# syslog-ng -vFed [2014-12-30T09:34:38.103631] Starting to read include file; filename='/usr/local/etc/scl.conf', depth='1' [2014-12-30T09:34:38.103935] Global value changed; define='scl-root', value='/usr/local/share/include/scl' [2014-12-30T09:34:38.103966] Global value changed; define='include-path', value='/usr/local/etc:/usr/local/share/include' [2014-12-30T09:34:38.104013] Starting to read include file; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' [2014-12-30T09:34:38.104431] Module loaded and initialized successfully; module='system-source' [2014-12-30T09:34:38.104447] Finishing include; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' [2014-12-30T09:34:38.104510] Starting to read include file; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' [2014-12-30T09:34:38.104603] Reading path for candidate modules; path='/usr/local/lib/syslog-ng' [2014-12-30T09:34:38.104659] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afsocket.so', module='afsocket' [2014-12-30T09:34:38.104900] Registering candidate plugin; module='afsocket', context='source', name='unix-stream', preference='0' [2014-12-30T09:34:38.104911] Registering candidate plugin; module='afsocket', context='destination', name='unix-stream', preference='0' [2014-12-30T09:34:38.104919] Registering candidate plugin; module='afsocket', context='source', name='unix-dgram', preference='0' [2014-12-30T09:34:38.104927] Registering candidate plugin; module='afsocket', context='destination', name='unix-dgram', preference='0' [2014-12-30T09:34:38.104934] Registering candidate plugin; module='afsocket', context='source', name='tcp', preference='0' [2014-12-30T09:34:38.104941] Registering candidate plugin; module='afsocket', context='destination', name='tcp', preference='0' [2014-12-30T09:34:38.104968] Registering candidate plugin; module='afsocket', context='source', name='tcp6', preference='0' [2014-12-30T09:34:38.104982] Registering candidate plugin; module='afsocket', context='destination', name='tcp6', preference='0' [2014-12-30T09:34:38.104990] Registering candidate plugin; module='afsocket', context='source', name='udp', preference='0' [2014-12-30T09:34:38.104997] Registering candidate plugin; module='afsocket', context='destination', name='udp', preference='0' [2014-12-30T09:34:38.105004] Registering candidate plugin; module='afsocket', context='source', name='udp6', preference='0' [2014-12-30T09:34:38.105017] Registering candidate plugin; module='afsocket', context='destination', name='udp6', preference='0' [2014-12-30T09:34:38.105024] Registering candidate plugin; module='afsocket', context='source', name='syslog', preference='0' [2014-12-30T09:34:38.105031] Registering candidate plugin; module='afsocket', context='destination', name='syslog', preference='0' [2014-12-30T09:34:38.105044] Registering candidate plugin; module='afsocket', context='source', name='network', preference='0' [2014-12-30T09:34:38.105053] Registering candidate plugin; module='afsocket', context='destination', name='network', preference='0' [2014-12-30T09:34:38.105060] Registering candidate plugin; module='afsocket', context='source', name='systemd-syslog', preference='0' [2014-12-30T09:34:38.105136] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='syslog-ng-crypto.so', module='syslog-ng-crypto' [2014-12-30T09:34:38.105333] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='syslogformat.so', module='syslogformat' [2014-12-30T09:34:38.105488] Registering candidate plugin; module='syslogformat', context='format', name='syslog', preference='0' [2014-12-30T09:34:38.105504] Registering candidate plugin; module='syslogformat', context='parser', name='syslog-parser', preference='0' [2014-12-30T09:34:38.105558] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afsocket-notls.so', module='afsocket-notls' [2014-12-30T09:34:38.105727] Registering candidate plugin; module='afsocket-notls', context='source', name='unix-stream', preference='0' [2014-12-30T09:34:38.105737] Registering candidate plugin; module='afsocket-notls', context='destination', name='unix-stream', preference='0' [2014-12-30T09:34:38.105744] Registering candidate plugin; module='afsocket-notls', context='source', name='unix-dgram', preference='0' [2014-12-30T09:34:38.105751] Registering candidate plugin; module='afsocket-notls', context='destination', name='unix-dgram', preference='0' [2014-12-30T09:34:38.105758] Registering candidate plugin; module='afsocket-notls', context='source', name='tcp', preference='0' [2014-12-30T09:34:38.105765] Registering candidate plugin; module='afsocket-notls', context='destination', name='tcp', preference='0' [2014-12-30T09:34:38.105781] Registering candidate plugin; module='afsocket-notls', context='source', name='tcp6', preference='0' [2014-12-30T09:34:38.105789] Registering candidate plugin; module='afsocket-notls', context='destination', name='tcp6', preference='0' [2014-12-30T09:34:38.106087] Registering candidate plugin; module='afsocket-notls', context='source', name='udp', preference='0' [2014-12-30T09:34:38.106096] Registering candidate plugin; module='afsocket-notls', context='destination', name='udp', preference='0' [2014-12-30T09:34:38.106102] Registering candidate plugin; module='afsocket-notls', context='source', name='udp6', preference='0' [2014-12-30T09:34:38.106109] Registering candidate plugin; module='afsocket-notls', context='destination', name='udp6', preference='0' [2014-12-30T09:34:38.106115] Registering candidate plugin; module='afsocket-notls', context='source', name='syslog', preference='0' [2014-12-30T09:34:38.106121] Registering candidate plugin; module='afsocket-notls', context='destination', name='syslog', preference='0' [2014-12-30T09:34:38.106134] Registering candidate plugin; module='afsocket-notls', context='source', name='network', preference='0' [2014-12-30T09:34:38.106142] Registering candidate plugin; module='afsocket-notls', context='destination', name='network', preference='0' [2014-12-30T09:34:38.106148] Registering candidate plugin; module='afsocket-notls', context='source', name='systemd-syslog', preference='0' [2014-12-30T09:34:38.106214] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='affile.so', module='affile' [2014-12-30T09:34:38.106454] Registering candidate plugin; module='affile', context='source', name='file', preference='0' [2014-12-30T09:34:38.106470] Registering candidate plugin; module='affile', context='source', name='pipe', preference='0' [2014-12-30T09:34:38.106497] Registering candidate plugin; module='affile', context='destination', name='file', preference='0' [2014-12-30T09:34:38.106527] Registering candidate plugin; module='affile', context='destination', name='pipe', preference='0' [2014-12-30T09:34:38.106611] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afprog.so', module='afprog' [2014-12-30T09:34:38.106846] Registering candidate plugin; module='afprog', context='source', name='program', preference='0' [2014-12-30T09:34:38.106857] Registering candidate plugin; module='afprog', context='destination', name='program', preference='0' [2014-12-30T09:34:38.106908] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afuser.so', module='afuser' [2014-12-30T09:34:38.107058] Registering candidate plugin; module='afuser', context='destination', name='usertty', preference='0' [2014-12-30T09:34:38.107116] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afamqp.so', module='afamqp' [2014-12-30T09:34:38.107301] Registering candidate plugin; module='afamqp', context='destination', name='amqp', preference='0' [2014-12-30T09:34:38.107367] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afmongodb.so', module='afmongodb' [2014-12-30T09:34:38.107665] Registering candidate plugin; module='afmongodb', context='destination', name='mongodb', preference='0' [2014-12-30T09:34:38.107756] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='csvparser.so', module='csvparser' [2014-12-30T09:34:38.107907] Registering candidate plugin; module='csvparser', context='parser', name='csv-parser', preference='0' [2014-12-30T09:34:38.107965] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='confgen.so', module='confgen' [2014-12-30T09:34:38.108141] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='system-source.so', module='system-source' [2014-12-30T09:34:38.108161] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='linux-kmsg-format.so', module='linux-kmsg-format' [2014-12-30T09:34:38.108319] Registering candidate plugin; module='linux-kmsg-format', context='format', name='linux-kmsg', preference='0' [2014-12-30T09:34:38.108359] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='basicfuncs.so', module='basicfuncs' [2014-12-30T09:34:38.108525] Registering candidate plugin; module='basicfuncs', context='template-func', name='grep', preference='0' [2014-12-30T09:34:38.108536] Registering candidate plugin; module='basicfuncs', context='template-func', name='if', preference='0' [2014-12-30T09:34:38.108544] Registering candidate plugin; module='basicfuncs', context='template-func', name='or', preference='0' [2014-12-30T09:34:38.108551] Registering candidate plugin; module='basicfuncs', context='template-func', name='echo', preference='0' [2014-12-30T09:34:38.108870] Registering candidate plugin; module='basicfuncs', context='template-func', name='length', preference='0' [2014-12-30T09:34:38.108879] Registering candidate plugin; module='basicfuncs', context='template-func', name='substr', preference='0' [2014-12-30T09:34:38.108887] Registering candidate plugin; module='basicfuncs', context='template-func', name='strip', preference='0' [2014-12-30T09:34:38.108894] Registering candidate plugin; module='basicfuncs', context='template-func', name='sanitize', preference='0' [2014-12-30T09:34:38.108901] Registering candidate plugin; module='basicfuncs', context='template-func', name='lowercase', preference='0' [2014-12-30T09:34:38.108908] Registering candidate plugin; module='basicfuncs', context='template-func', name='uppercase', preference='0' [2014-12-30T09:34:38.108915] Registering candidate plugin; module='basicfuncs', context='template-func', name='replace-delimiter', preference='0' [2014-12-30T09:34:38.108922] Registering candidate plugin; module='basicfuncs', context='template-func', name='padding', preference='0' [2014-12-30T09:34:38.108929] Registering candidate plugin; module='basicfuncs', context='template-func', name='+', preference='0' [2014-12-30T09:34:38.108942] Registering candidate plugin; module='basicfuncs', context='template-func', name='-', preference='0' [2014-12-30T09:34:38.108950] Registering candidate plugin; module='basicfuncs', context='template-func', name='*', preference='0' [2014-12-30T09:34:38.108957] Registering candidate plugin; module='basicfuncs', context='template-func', name='/', preference='0' [2014-12-30T09:34:38.108964] Registering candidate plugin; module='basicfuncs', context='template-func', name='%', preference='0' [2014-12-30T09:34:38.108971] Registering candidate plugin; module='basicfuncs', context='template-func', name='ipv4-to-int', preference='0' [2014-12-30T09:34:38.108978] Registering candidate plugin; module='basicfuncs', context='template-func', name='indent-multi-line', preference='0' [2014-12-30T09:34:38.108985] Registering candidate plugin; module='basicfuncs', context='template-func', name='context-length', preference='0' [2014-12-30T09:34:38.108992] Registering candidate plugin; module='basicfuncs', context='template-func', name='env', preference='0' [2014-12-30T09:34:38.109035] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='cryptofuncs.so', module='cryptofuncs' [2014-12-30T09:34:38.109261] Registering candidate plugin; module='cryptofuncs', context='template-func', name='uuid', preference='0' [2014-12-30T09:34:38.109373] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='dbparser.so', module='dbparser' [2014-12-30T09:34:38.109739] Registering candidate plugin; module='dbparser', context='parser', name='db-parser', preference='0' [2014-12-30T09:34:38.109821] Reading shared object for a candidate module; path='/usr/local/lib/syslog-ng', fname='afstomp.so', module='afstomp' [2014-12-30T09:34:38.109988] Registering candidate plugin; module='afstomp', context='destination', name='stomp', preference='0' [2014-12-30T09:34:38.110050] Reading shared object for a candidate module; path='/usr/lo

4 3