September 2018 - syslog-ng - lists.balabit.hu

Packet loss.
by vijay amruth 13 Sep '18

13 Sep '18

Hello everyone, we’ve been experiencing packet loss on syslog-ng collectors (these are open stack VMs), lately we have increased ingestion and that refelcted packet loss ( especially UDP). Tuning parameters didn’t help. If anyone here on the list has experienced a similar issue please share your resolution or work around. We are at 3.9.1, we are planning to update to 3.17.x for better data handling/other bug fixes. As an alternate approach we have increased the VM capacity ( no of VMs). If there is any that I missed, please point. Any thoughts? Thank you, Vijay Amrut. -- Thanks, Vijay Amrut.

3 4

Crash on syslog-ng 3.8.1
by xen rkar 12 Sep '18

12 Sep '18

Hi, Looking to see if this is a know issue, cause i have been unsucessful in find an exact match of the signature anywhere in the forums. Regards, rkar #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x76c5775c in __GI_abort () at abort.c:79 #2 0x76f537a8 in iv_fatal (fmt=0x76f750dc "iv_timer_unregister: timer index %d > %d") at ../../../../syslog-ng-3.8.1/lib/ivykis/src/iv_fatal.c:57 #3 0x76f53f4c in iv_timer_unregister (_t=0x17e5284) at ../../../../syslog-ng-3.8.1/lib/ivykis/src/iv_timer.c:305 #4 0x76f53fb8 in iv_run_timers (st=st@entry=0x17a50c0) at ../../../../syslog-ng-3.8.1/lib/ivykis/src/iv_timer.c:148 #5 0x76f55ad8 in iv_main () at ../../../../syslog-ng-3.8.1/lib/ivykis/src/iv_main_posix.c:107 #6 0x76f24524 in main_loop_run () at ../syslog-ng-3.8.1/lib/mainloop.c:497 #7 0x000113e0 in main (argc=70624, argv=0x7ea96054) at ../syslog-ng-3.8.1/syslog-ng/main.c:289

2 1

syslog-ng never frees RAM
by Jose Angel Santiago 10 Sep '18

10 Sep '18

Hi, I'm using syslog-ng 3.16.1 with wildcard-file as source (let's call it "syslog-agent), which sends log messages to another syslog-ng acting as a relay. I've noticed that syslog-agent instances RAM consumption keeps increasing until they leave no free memory in the cluster (each server has 64G of RAM). In my use case, new folders & files are created constantly under base-dir folder, but every 2 days obsolete folders & files are deleted. I assumed that syslog-ng would free some RAM every time those folders & files are deleted, but it doesn't, not even if I run a syslog-ng-ctl reload operation. log-fifo-size value is 345000, so I assume it can't be a buffer situation since 345000 messages can't occupy 40-50 GB of memory. I've performed the following test to reproduce the situation in small scale: - Launch a syslog-agent with a wildcard-file source reading from "/tmp/test/" base-dir. syslog-agent RAM usage is about 125M. - Run a simple script to create complex folder hierarchy under /tmp/test and some files with 5000 log messages to read from. - Wait until syslog-agent RAM usage gets 1GB - Stop script execution and wait until syslog-agent has send all logs to relay. - Delete everything under /tmp/test and execute syslog-ng-ctl reload operation - 24 hours after, syslog-agent RAM usage still is 1GB I've used heaptrack tool as a try to find a memory leak in syslog-ng, you can see in the attached image that iv_list_empty function in iv_list.h file is where most of the RAM usage is. How do I get syslog-ng to free RAM? Or is it a memory leak? Thanks in advance. -- | Jose Angel Santiago [image: Logo_signature2.png] <http://www.stratio.com/> Vía de las dos Castillas, 33, Ática 4, 3ª Planta 28224 Pozuelo de Alarcón, Madrid, Spain +34 918 286 473 | www.stratio.com <https://twitter.com/stratiobd> <https://www.linkedin.com/company/stratiobd> <https://www.youtube.com/c/StratioBD>

3 7

(no subject)
by R.Naveen Naidu 08 Sep '18

08 Sep '18

Hi, I need a help to choose the syslog-ng package for Linux. What are the things need to consider when choosing the latest syslog-ng to Linux? Actually, I wanted to cross-compile the syslog-ng and load into the customized Linux version *4.1.35rt41* The current latest syslog-ng version is* 3.17.2* from below site and planning to use this. https://github.com/balabit/syslog-ng/releases -- Thanks & Regards Naveen

3 8

problems compiling 3.17.2 on Ubuntu 16.0.4 with java
by Russell Fulton 04 Sep '18

04 Sep '18

I am trying to build syslog-ng with java and json support on Ubuntu 16.0.4. I can’t use prepackaged version because ubuntu have decided that one must not have both rsyslog (which is our corporate standard) and syslog-ng (which I need for its pattern matching in an application) on the same machine. Installing one package removes the other. As well as the standard build tools I have installed these packages via apt: jsoncpp, jre and gradle. Simply running ./configure ran through but did not find java (i.e. java and java-module were both set to no). I added —enable java and configure terminated complaining that it could not find java. I dug into the configure script and found that it was executing “which javac” and “javah” both of which failed. I changed JAVAC to “java” and the configure script then completed with both java and java module enabled. Running make then failed builder@secgendev02:~/src/syslog-ng-3.17.2$ make mkdir -p modules/java/syslog-ng-core/classes GEN modules/java/syslog-ng-core/classes/org/syslog_ng/LogMessage.class Unrecognized option: -d Error: Could not create the Java Virtual Machine. Error: A fatal exception has occurred. Program will exit. Makefile:20740: recipe for target 'modules/java/syslog-ng-core/classes/org/syslog_ng/LogMessage.class’ failed I am guessing that the version of java the jre package installed is not compatible with the configure script. builder@secgendev02:~/src/syslog-ng-3.17.2$ java -version openjdk version "1.8.0_181" OpenJDK Runtime Environment (build 1.8.0_181-8u181-b13-0ubuntu0.16.04.1-b13) OpenJDK 64-Bit Server VM (build 25.181-b13, mixed mode) I know that configure checks the java version so I am somewhat surprised… Any Ideas on what to try next? Russell

2 1