October 2016 - syslog-ng - lists.balabit.hu

ES destination node or SLB ?
by Scot Needy 06 Oct '16

06 Oct '16

If I can put a 3 node ES cluster behind an SLB does it make sense to do that for a syslog-ng destination?

1 0

Elastic Search destination with x-pack
by Scot Needy 06 Oct '16

06 Oct '16

Hi, Installed the x-pack to secure my ES instance and Kibana but noticed there does not seem to be any docs on how to handle ES authentication in from syslog-ng.conf. I might be missing it. Looking at https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-… <https://www.balabit.com/documents/syslog-ng-ose-latest-guides/en/syslog-ng-…> Thanks

2 6

Ubuntu 16 unmet dependencies - won't install
by Clayton Dukes 03 Oct '16

03 Oct '16

Hi Guys, Did something change recently with http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/xUb… (or am I just overworked and missing something obvious?) I am unable to install now from a fresh OS: root@foo[~]: # apt-get install syslog-ng-core # (also tried syslog-ng syslog-ng-core here) Reading package lists... Done Building dependency tree Reading state information... Done Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation: The following packages have unmet dependencies: syslog-ng : Depends: syslog-ng-mod-sql but it is not going to be installed Depends: syslog-ng-mod-mongodb but it is not going to be installed Depends: syslog-ng-mod-json but it is not going to be installed Recommends: syslog-ng-mod-journal but it is not going to be installed Recommends: syslog-ng-mod-smtp but it is not going to be installed Recommends: syslog-ng-mod-amqp but it is not going to be installed Recommends: syslog-ng-mod-geoip but it is not going to be installed Recommends: syslog-ng-mod-redis but it is not going to be installed Recommends: syslog-ng-mod-stomp but it is not going to be installed Recommends: syslog-ng-mod-riemann but it is not going to be installed Recommends: syslog-ng-mod-graphite but it is not going to be installed Recommends: syslog-ng-mod-python but it is not going to be installed Recommends: syslog-ng-mod-java but it is not going to be installed Recommends: syslog-ng-mod-java-common-lib but it is not going to be installed Recommends: syslog-ng-mod-elastic but it is not going to be installed Recommends: syslog-ng-mod-hdfs but it is not going to be installed Recommends: syslog-ng-mod-kafka but it is not going to be installed Recommends: syslog-ng-mod-http but it is not going to be installed Recommends: syslog-ng-mod-curl but it is not going to be installed Recommends: syslog-ng-mod-kvformat but it is not going to be installed Recommends: syslog-ng-mod-add-contextual-data but it is not going to be installed syslog-ng-core : Depends: syslog-ng-mod-journal but it is not going to be installed E: Unable to correct problems, you have held broken packages. [cid:image001.png@01D21B13.4E86C770] Clayton Dukes / Founder and CTO http://www.logzilla.net<http://www.logzilla.net/>

3 4

ERROR:lib/dnscache.c:112:dns_cache_key_hash: code should not be reached
by Claus Albøge 01 Oct '16

01 Oct '16

Hi, I have noticed that syslog-ng exits from time to time, with the following error: ERROR:lib/dnscache.c:112:dns_cache_key_hash: code should not be reached Trying to run syslog-ng from gdb show the following: # gdb --args /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-80.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/sbin/syslog-ng...Reading symbols from /usr/lib/debug/usr/sbin/syslog-ng.debug...done. done. (gdb) run Starting program: /usr/sbin/syslog-ng -F -p /var/run/syslogd.pid [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". [New Thread 0x7ffff1e8a700 (LWP 18743)] [New Thread 0x7ffff1689700 (LWP 18748)] [New Thread 0x7ffff0e88700 (LWP 18893)] [New Thread 0x7fffe3fff700 (LWP 18956)] [New Thread 0x7fffe37fe700 (LWP 18959)] [New Thread 0x7fffe2ffd700 (LWP 18960)] [New Thread 0x7fffe27fc700 (LWP 18961)] [New Thread 0x7fffe1ffb700 (LWP 18962)] [Thread 0x7ffff1689700 (LWP 18748) exited] [Thread 0x7fffe27fc700 (LWP 18961) exited] [Thread 0x7fffe3fff700 (LWP 18956) exited] [New Thread 0x7fffe3fff700 (LWP 19114)] [New Thread 0x7fffe27fc700 (LWP 19136)] [New Thread 0x7ffff1689700 (LWP 19137)] [Thread 0x7fffe27fc700 (LWP 19136) exited] [Thread 0x7ffff1e8a700 (LWP 18743) exited] [New Thread 0x7ffff1e8a700 (LWP 19338)] [New Thread 0x7fffe27fc700 (LWP 19339)] [Thread 0x7fffe27fc700 (LWP 19339) exited] [Thread 0x7ffff1e8a700 (LWP 19338) exited] [New Thread 0x7ffff1e8a700 (LWP 19566)] [New Thread 0x7fffe27fc700 (LWP 19567)] [Thread 0x7ffff1e8a700 (LWP 19566) exited] [Thread 0x7fffe37fe700 (LWP 18959) exited] [New Thread 0x7ffff1e8a700 (LWP 19731)] [New Thread 0x7fffe37fe700 (LWP 19732)] [Thread 0x7fffe27fc700 (LWP 19567) exited] [Thread 0x7fffe1ffb700 (LWP 18962) exited] [New Thread 0x7fffe1ffb700 (LWP 19984)] [New Thread 0x7fffe27fc700 (LWP 19985)] ** ERROR:lib/dnscache.c:112:dns_cache_key_hash: code should not be reached Program received signal SIGABRT, Aborted. [Switching to Thread 0x7ffff1689700 (LWP 19137)] 0x00007ffff5fb05f7 in raise () from /lib64/libc.so.6 Missing separate debuginfos, use: debuginfo-install bzip2-libs-1.0.6-13.el7.x86_64 elfutils-libelf-0.163-3.el7.x86_64 elfutils-libs-0.163-3.el7.x86_64 eventlog-0.2.13-4.el7.x86_64 glib2-2.42.2-5.el7.x86_64 glibc-2.17-106.el7_2.8.x86_64 ivykis-0.36.2-2.el7.x86_64 json-c-0.11-4.el7_0.x86_64 keyutils-libs-1.5.8-3.el7.x86_64 krb5-libs-1.13.2-12.el7_2.x86_64 libattr-2.4.46-12.el7.x86_64 libcap-2.22-8.el7.x86_64 libcom_err-1.42.9-7.el7.x86_64 libgcc-4.8.5-4.el7.x86_64 libgcrypt-1.5.3-12.el7_1.1.x86_64 libgpg-error-1.12-3.el7.x86_64 libnet-1.1.6-7.el7.x86_64 libselinux-2.2.2-6.el7.x86_64 libuuid-2.23.2-26.el7_2.3.x86_64 openssl-libs-1.0.1e-51.el7_2.5.x86_64 pcre-8.32-15.el7_2.1.x86_64 systemd-libs-219-19.el7_2.13.x86_64 tcp_wrappers-libs-7.6-77.el7.x86_64 xz-libs-5.1.2-12alpha.el7.x86_64 zlib-1.2.7-15.el7.x86_64 (gdb) (gdb) bt #0 0x00007ffff5fb05f7 in raise () from /lib64/libc.so.6 #1 0x00007ffff5fb1ce8 in abort () from /lib64/libc.so.6 #2 0x00007ffff70426d5 in g_assertion_message () from /lib64/libglib-2.0.so.0 #3 0x00007ffff704276a in g_assertion_message_expr () from /lib64/libglib-2.0.so.0 #4 0x00007ffff7b62cc4 in dns_cache_key_hash (e=<optimized out>) at lib/dnscache.c:112 #5 0x00007ffff700c4fc in g_hash_table_remove_internal () from /lib64/libglib-2.0.so.0 #6 0x00007ffff7b67584 in resolve_sockaddr_to_inet_or_inet6_hostname (host_resolve_options=0x651754, saddr=0x7fffec3840d0, result_len=0x7ffff1686370) at lib/host-resolve.c:332 #7 resolve_sockaddr_to_hostname (result_len=result_len@entry=0x7ffff1686370, saddr=0x7fffec3840d0, host_resolve_options=0x651754) at lib/host-resolve.c:343 #8 0x00007ffff7b6c03a in log_source_mangle_hostname (self=self@entry=0x1cdf400, msg=msg@entry=0x7fffe4ec6da0) at lib/logsource.c:156 #9 0x00007ffff7b6c280 in log_source_queue (s=0x1cdf400, msg=0x7fffe4ec6da0, path_options=0x7ffff1686550, user_data=<optimized out>) at lib/logsource.c:266 #10 0x00007ffff7b6ca0a in log_pipe_queue (path_options=<optimized out>, msg=<optimized out>, s=<optimized out>) at lib/logpipe.h:339 #11 log_pipe_forward_msg (self=<optimized out>, path_options=<optimized out>, msg=<optimized out>) at lib/logpipe.h:302 #12 log_pipe_queue (path_options=<optimized out>, msg=<optimized out>, s=<optimized out>) at lib/logpipe.h:343 #13 log_pipe_forward_msg (self=<optimized out>, path_options=<optimized out>, msg=<optimized out>) at lib/logpipe.h:302 #14 log_pipe_queue (path_options=<optimized out>, msg=0x7fffe4ec6da0, s=0x7fffe4ec6da0) at lib/logpipe.h:343 #15 log_source_post (self=self@entry=0x1cdf400, msg=msg@entry=0x7fffe4ec6da0) at lib/logsource.c:249 #16 0x00007ffff7b6b179 in log_reader_handle_line (aux=0x7ffff1686600, length=<optimized out>, line=<optimized out>, self=0x1cdf400) at lib/logreader.c:320 #17 log_reader_fetch_log (self=self@entry=0x1cdf400) at lib/logreader.c:381 #18 0x00007ffff7b6b299 in log_reader_work_perform (s=0x1cdf400) at lib/logreader.c:88 #19 0x00007ffff7b7307d in _work (self=<optimized out>) at lib/mainloop-io-worker.c:52 #20 0x00007ffff655dc67 in iv_work_thread_do_work () from /lib64/libivykis.so.0 #21 0x00007ffff655cfc3 in iv_run_tasks () from /lib64/libivykis.so.0 #22 0x00007ffff655f7dc in iv_main () from /lib64/libivykis.so.0 #23 0x00007ffff655dab4 in iv_work_thread () from /lib64/libivykis.so.0 #24 0x00007ffff6560270 in iv_thread_handler () from /lib64/libivykis.so.0 #25 0x00007ffff6344dc5 in start_thread () from /lib64/libpthread.so.0 #26 0x00007ffff6071ced in clone () from /lib64/libc.so.6 # grep dns /etc/syslog-ng/syslog-ng.conf use_dns (no); Not sure what its trying to resolve. # syslog-ng -V syslog-ng 3.8.1 Installer-Version: 3.8.1 Revision: Module-Directory: //usr/lib64/syslog-ng Module-Path: //usr/lib64/syslog-ng Available-Modules: disk-buffer,sdjournal,afstomp,json-plugin,cryptofuncs,graphite,cef,kvformat,add-contextual-data,dbparser,pseudofile,csvparser,syslogformat,confgen,afsocket,afuser,date,linux-kmsg-format,system-source,basicfuncs,afamqp,affile,afprog Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: off Please let me know, if more info is needed. /Claus A

4 9