- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Running script for checking syslog-ng status
by Henry Xu 27 May '11

27 May '11

Hi All, Yes, the "supervising syslog-ng" process starts by default. I did tests and killed the syslog-ng process when the supervising process is running. But seems it didn't work.The new syslog-ng process didn't start, and the supervising process stopped as well. What's wrong? Best, Henry ------------------------------ Message: 3 Date: Thu, 26 May 2011 23:47:51 +0200 From: Gergely Nagy <algernon(a)balabit.hu> Subject: Re: [syslog-ng] Running script for checking syslog-ng status To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <874o4hdth4.fsf(a)luthien.mhp> Content-Type: text/plain Matthew Hall <mhall(a)mhcomputing.net> writes: > On Thu, May 26, 2011 at 10:49:08AM +0200, Gergely Nagy wrote: >> It was also brought to my attention, that syslog-ng has a built-in >> supervisor, that will restart it in case it crashes. This can be >> enabled by starting syslog-ng with the --process-mode=safe-background >> command-line argument. >> >> (What do you know? I never knew this was there! One learns something >> new every day!) > > Gergely, > > I thought the supervisor was on by default. Am I mistaken to believe > this? You are correct.

2 1

Multiple Interface interaction with syslogng
by Pramod Pillai 27 May '11

27 May '11

Hi I am using Solaris box which has multiple IP interface cards. When I run syslogng client ( instance ) it picks up one of the available IP for use. I want the syslogng to pick up the IP which I want. By this way on the syslong-ng server I will have the correct IP address. EX: The box has following IP address. 10.232.1.1 10.232.1.2 10.232.1.3 10.232.1.4 I want the syslogn-ng to pick up "10.232.1.3". There by the syslog-ng server instance will always print the source IP as "10.232.1.3" Regards Pramod

2 1

Running script for checking syslog-ng status
by Henry Xu 26 May '11

26 May '11

Hi All, Does syslog-ng have a running script that check the syslog-ng running status? If it crashed or stopped running,this script can make sure to start a new syslog-ng process. This morning,the syslog-ng on my server crashed,and somehow resulted in the server halt. Thanks. Best, Henry

4 5

[PATCH] tfjson: Support either json-c or json-glib.
by Gergely Nagy 25 May '11

25 May '11

Add the ability to build the module with either json-c, or json-glib (version 0.12 or later). If both are present, we'll prefer json-c. Requested-by: Peter Czanik <czanik(a)balabit.hu> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 19 ++++++++++-- modules/tfjson/tfjson.c | 73 ++++++++++++++++++++++++++++++++++++++--------- 2 files changed, 75 insertions(+), 17 deletions(-) diff --git a/configure.in b/configure.in index 9c03b65..87de97f 100644 --- a/configure.in +++ b/configure.in @@ -25,7 +25,8 @@ EVTLOG_MIN_VERSION="0.2.12" OPENSSL_MIN_VERSION="0.9.8" LIBDBI_MIN_VERSION="0.8.0" IVYKIS_MIN_VERSION="0.18" -JSON_MIN_VERSION="0.7" +JSON_C_MIN_VERSION="0.7" +JSON_GLIB_MIN_VERSION="0.12" PCRE_MIN_VERSION="6.1" dnl *************************************************************************** @@ -563,7 +564,10 @@ fi dnl *************************************************************************** dnl json headers/libraries dnl *************************************************************************** -PKG_CHECK_MODULES(JSON, json >= $JSON_MIN_VERSION,, JSON_LIBS="") +PKG_CHECK_MODULES(JSON, json >= $JSON_C_MIN_VERSION, JSON_TYPE="C", JSON_LIBS="") +if test "x$JSON_TYPE" = "x"; then + PKG_CHECK_MODULES(JSON, json-glib-1.0 >= $JSON_GLIB_MIN_VERSION, JSON_TYPE="glib", JSON_LIBS="") +fi dnl *************************************************************************** dnl pcre headers/libraries @@ -813,7 +817,7 @@ if test "x$enable_json" = "xauto"; then enable_json="yes" fi elif test "x$enable_json" = "xyes" -a -z "$JSON_LIBS"; then - AC_MSG_ERROR(Cannot find json-c version >= $JSON_MIN_VERSION: is pkg-config in path?) + AC_MSG_ERROR(Cannot find json-c version >= $JSON_C_MIN_VERSION or json-glib-1.0 >= $JSON_GLIB_MIN_VERSION: is pkg-config in path?) fi if test "x$enable_systemd" = "xauto"; then @@ -964,6 +968,15 @@ AC_DEFINE_UNQUOTED(ENABLE_PCRE, `enable_value $enable_pcre`, [Enable PCRE suppor AC_DEFINE_UNQUOTED(ENABLE_ENV_WRAPPER, `enable_value $enable_env_wrapper`, [Enable environment wrapper support]) AC_DEFINE_UNQUOTED(ENABLE_SYSTEMD, `enable_value $enable_systemd`, [Enable systemd support]) +case "$JSON_TYPE" in + "C") + AC_DEFINE_UNQUOTED(HAVE_JSON_C, 1, [Have json-c]) + ;; + "glib") + AC_DEFINE_UNQUOTED(HAVE_JSON_GLIB, 1, [Have json-glib]) + ;; +esac + AM_CONDITIONAL(ENABLE_ENV_WRAPPER, [test "$enable_env_wrapper" = "yes"]) AM_CONDITIONAL(ENABLE_SYSTEMD, [test "$enable_systemd" = "yes"]) AM_CONDITIONAL(ENABLE_SSL, [test "$enable_ssl" = "yes"]) diff --git a/modules/tfjson/tfjson.c b/modules/tfjson/tfjson.c index 07fc76e..7155f15 100644 --- a/modules/tfjson/tfjson.c +++ b/modules/tfjson/tfjson.c @@ -25,7 +25,15 @@ #include "cfg.h" #include "value-pairs.h" +#include "config.h" + +#ifdef HAVE_JSON_C #include <json.h> +#endif + +#ifdef HAVE_JSON_GLIB +#include <json-glib/json-glib.h> +#endif static gboolean tf_json_prepare(LogTemplateFunction *self, LogTemplate *parent, @@ -35,6 +43,8 @@ tf_json_prepare(LogTemplateFunction *self, LogTemplate *parent, { ValuePairs *vp; + g_type_init (); + vp = value_pairs_new_from_cmdline (parent->cfg, argc, argv, error); if (!vp) return FALSE; @@ -45,6 +55,7 @@ tf_json_prepare(LogTemplateFunction *self, LogTemplate *parent, return TRUE; } +#if HAVE_JSON_C static gboolean tf_json_foreach (const gchar *name, const gchar *value, gpointer user_data) { @@ -57,16 +68,57 @@ tf_json_foreach (const gchar *name, const gchar *value, gpointer user_data) return FALSE; } -static struct json_object * -tf_json_format_message(ValuePairs *vp, LogMessage *msg) +static void +tf_json_append(GString *result, ValuePairs *vp, LogMessage *msg) +{ + struct json_object *json; + + json = json_object_new_object(); + + value_pairs_foreach(vp, tf_json_foreach, msg, 0, json); + + g_string_append(result, json_object_to_json_string (json)); + json_object_put(json); +} +#endif + +#if HAVE_JSON_GLIB +static gboolean +tf_json_foreach (const gchar *name, const gchar *value, gpointer user_data) { - struct json_object *root; + JsonBuilder *builder = (JsonBuilder *)user_data; + + json_builder_set_member_name(builder, name); + json_builder_add_string_value(builder, value); + + return FALSE; +} + +static void +tf_json_append(GString *result, ValuePairs *vp, LogMessage *msg) +{ + JsonBuilder *builder; + JsonGenerator *gen; + gchar *str; + + builder = json_builder_new(); + json_builder_begin_object(builder); + + value_pairs_foreach(vp, tf_json_foreach, msg, 0, builder); + + json_builder_end_object(builder); + + gen = json_generator_new(); + json_generator_set_root(gen, json_builder_get_root(builder)); + str = json_generator_to_data(gen, NULL); - root = json_object_new_object(); - value_pairs_foreach (vp, tf_json_foreach, msg, 0, root); + g_object_unref(gen); + g_object_unref(builder); - return root; + g_string_append(result, str); + g_free(str); } +#endif static void tf_json_call(LogTemplateFunction *self, gpointer state, GPtrArray *arg_bufs, @@ -77,14 +129,7 @@ tf_json_call(LogTemplateFunction *self, gpointer state, GPtrArray *arg_bufs, ValuePairs *vp = (ValuePairs *)state; for (i = 0; i < num_messages; i++) - { - LogMessage *msg = messages[i]; - struct json_object *json; - - json = tf_json_format_message(vp, msg); - g_string_append(result, json_object_to_json_string (json)); - json_object_put(json); - } + tf_json_append(result, vp, messages[i]); } static void -- 1.7.2.5

4 4

dropped udp packets and help with config
by Zeek Anow 24 May '11

24 May '11

Something really wrong with syslog-ng or my config. I'm dropping way too many packets. I will admit that my configuration is probably really a large part of the problem and would appreciate it if someone could take a look at it and offer some suggestions. There is another thread going about a similar problem on a similar platform. We recently upgraded to Solaris 10 from Solaris 9 and I don't recall us dropping that many packets before. And we also upgraded from a very older Sylog-ng version to 3.1.2. I am basing the dropped packets on the udp stats, not syslog-ng stats. Syslog-ng stats has NO dropped packets. UDP udpInDatagrams -4599313 udpInErrors - 0 udpOutDatagrams - 3421 udpOutErrors - 0 tcpInErrs - 0 udpNoPorts -2587612 udpInCksumErrs - 0 udpInOverflows -95806254 The above is a 3 hour sample and it is from our syslog server that does not get that much traffic. ____________________________ Here is the current version info: Solaris 10, syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit //var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Oct 25 2010 23:56:18 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: on Enable-Sun-Door: on Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on _____________________________ Below is a very small sampling of our syslog-ng.conf. We are filtering on about 1400 devices most of which are Firewalls and routers. The IPs in the following sample have been made up. One of my questions is "Does the number of devices we are filtering on make a difference? (1400)" We have several sites and use just one version of the syslogng.conf file. It is a lot easier to maintain one copy:)) Also notice the format: ("^10\.123\.10\.133$") for the filters. All 1400 are in that format. I was hoping this would help a little but don't really know for sure:)) The source statementbelow "...external_Future_tcp" has not yet been implemented. Since we are dropping so many packets, I was going to try configuring the devices to log TCP instead of UDP. @version: 3.0 # Created: 01 March 2011 #----------------[ GLOBAL OPTIONS ]------------------------- options { create_dirs(yes); use_dns(no); time_reopen(10); time_reap(360); keep_timestamp(yes); }; #---------------------[ SOURCES ]--------------------------- source s_local { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_external { udp(); }; source s_external_tcp { tcp(max-connections(50) port(514)); }; source s_external_Future_tcp { tcp(max-connections(1400) port(1470)); }; #---------------------[ DESTINATION ]--------------------------- destination d_local { file("/var/adm/messages" perm(0655) dir_perm(0655)); }; destination d_network_file { file("/logs/$YEAR/$MONTH/$DAY/network.log" perm(0655) dir_perm(0655)); }; destination d_bacsit { udp("10.11.13.114" port(2514) spoof-source(yes)); }; destination d_network_syslogd { udp("10.11.13.116" port(1514) spoof-source(yes)); }; destination d_firewall_file { file("/logs/$YEAR/$MONTH/$DAY/firewall/$HOST.log" perm(0655) dir_perm(0655)); }; destination d_mrv_file { file("/logs/$YEAR/$MONTH/$DAY/mrv.log" perm(0655) dir_perm(0655)); }; destination d_mail_file { file("/logs/$YEAR/$MONTH/$DAY/mail/$HOST.log" perm(0655) dir_perm(0655)); }; destination d_f567_file { file("/logs/$YEAR/$MONTH/$DAY/f5s/$HOST.log" perm(0655) dir_perm(0655)); }; #---------------------[ FILTERS ]--------------------------- filter f_f567 { host("^10\.123\.10\.133$") or # Host B host("^10\.100\.10\.200$") or # Host A host("^10\.115\.10\.246$") or # Host C host("^10\.121\.10\.102$") or # Host D host("^10\.117\.10\.99$"); # Host F }; filter f_mrv { host("^10\.68\.69\.100$") or # host("^10\.100\166\.10$") or # }; . . . and so on #---------------------[ LOGS ]--------------------------- log { source(s_local); destination(d_local); }; log { source(s_external); filter(f_f567); destination(d_f5_file); }; log { source(s_external); source(s_external_tcp); filter(f_firewall); destination(d_bacsit); }; log { source(s_external); filter(f_network); destination(d_bacsit); }; log { source(s_external); source(s_external_tcp); filter(f_firewall); destination(d_combo_file); }; log { source(s_external); filter(f_mail); destination(d_mail_file); }; ....and so on I'm grateful for all help and suggestions. Thanks!!

5 5

[ANN] syslog-ng module collection
by Gergely Nagy 23 May '11

23 May '11

Hi! A while ago, there was talk about creating a repository for third party and not-yet-merged syslog-ng modules, and today, I'm happy to say that I finally found a little time to make it happen! Before going much further, I'd like to tell where it is available from: http://git.madhouse-project.org/syslog-ng/module-collection/ And git://git.madhouse-project.org/syslog-ng/module-collection.git, respectively. A mirror on git.balabit.hu will be set up at a later point. I plan to make Debian packages available too, once syslog-ng 3.3 becomes available in Debian (experimental, or otherwise). The collection at the moment consists of my SMTP destination driver, ported to the latest syslog-ng 3.3 API (and should work with 3.4 too, although I didn't have time to test with that yet). With that out, let me explain why this 'collection' was created: * It is easier for users to use. No need to compile the whole of syslog-ng, perhaps with patches applied, merged and whatsoever. Just download the module collection sources, ./configure && make && make install, and you're done! Though, one still needs syslog-ng 3.3 and associated libraries (ivykis [installed by syslog-ng 3.3 by default], glib and eventlog), along with whatever the module collection needs (libesmtp at the moment). * It is easier for me. Because I don't have to rebase my sources to the latest syslog-ng sources, I don't have to care about stuff outside of the module itself. I can run any compatible version of syslog-ng, and the collection will just work. This makes it a lot easier for me to develop. Not to mention that this way, I can compile the module for syslog-ng 3.3 and 3.4 from the same source! * We can collect other modules easier. In case other third-party modules surface, it's easy to wire them into the collection, and voila, we'll have a nice distribution of unofficial modules! -- |8]

1 0

Re: [syslog-ng] Help: Meeting problems when writing to Oracle using syslog-ng 3.2.4
by Henry Xu 22 May '11

22 May '11

Hi, Anyone can help resolve this? I changed oracle database version from 10g to 11g.There's no such error message appeared in the message log file,but no data was write into the syslog table(the table can be created). Is there something wrong with my configuration? Thanks very much. Best, Henry From: Henry Xu [mailto:bxu@italkbb.com] Sent: Saturday, May 14, 2011 10:45 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Help: Meeting problems when writing to Oracle using syslog-ng 3.2.4 Hi All, I am trying to use syslog-ng writing to Oracle directly. However,I encountered the following errors: Error running SQL query; type='oracle', host='208.77.1.99', port='', user='service0', database='XE', error='3113: OR A-03113: end-of-file on communication channel\x0a', query='CREATE TABLE syslog (datetime varchar2(16), hostname varchar2(32), app varchar2(32), pid varchar2( 8), message varchar2(4000))' But when I checked the Oracle database,the table syslog already created.I don't know why the syslog-ng gave such error message and why it didn't write to Oracle using INSERT SQL. Here are my syslog-ng version info: syslog-ng 3.2.4 Installer-Version: 3.2.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline-- 3.2#master#ef7b91e4a1b1f9628c66138b4ae83de7e4c697c6 Compile-Date: May 13 2011 15:42:29 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off Here is my syslog-ng.conf content: ############################################################################ # # Default syslog-ng.conf file which collects all local logs into a # single file called /var/log/messages. # @version: 3.2 @include "scl.conf" options { stats_freq(3600); keep_hostname(yes); flush_lines(16); log_fifo_size(16384); }; source s_local { system(); internal(); }; source s_network { udp(); }; destination d_local { file("/var/log/messages"); }; destination d_net { file("/var/log/syslog-ng_network"); }; destination d_oracle_syslog { sql(type(oracle) host("208.77.1.99") username("service0") password("acstest") database("XE") table("syslog") columns("datetime varchar2(16)", "hostname varchar2(32)", "app varchar2(32)", "pid varchar2(8)", "message varchar2(4000)") values("$R_DATE", "$HOST", "$PROGRAM", "$PID", "$MSG") indexes("datetime", "hostname", "app", "pid", "message") ); }; log { source(s_network); destination(d_net); }; log { source(s_local); # uncomment this line to open port 514 to receive messages #source(s_network); destination(d_local); }; #log { # source(s_network); # destination(d_oracle_syslog); #}; source s_src { unix-stream("/dev/log"); file("/proc/kmsg"); internal(); }; log { source(s_src); destination(d_oracle_syslog); }; ============================================================================ =============================== Anyone can give some suggestions? Really appreciate your help! Best, Henry

2 1

value-pairs and sdata
by Balazs Scheidler 22 May '11

22 May '11

hi, we had a conversation with Algernon a couple of weeks ago how mongodb should handle value collisions which arise when both the SDATA and the .SDATA.<id>.<param> values are to be added to the document. As a reminder, mongodb strips the initial dot, and subsequent dots are used to break down values as subdocuments. This means that at the top level both SDATA as value and SDATA as a document are present. I found out the following solution, which is a change in how mongodb currently works. I'd like to do this before releasing 3.3beta. Feedback is welcome. * the SDATA macro is not included in rfc5424, selected-macros, but can be explicitly specified by key(), pair() and it's still included in all-macros * a new "sdata" scope is introduced which expands to the .SDATA.<id>.<param> values, but the SDATA is not included either. * nv-pairs is split: nv-pairs contains values which have no leading dot, dot-nv-pairs only contains the ones that have leading dots. all-nv-pairs contain both. This way, SDATA macro is only included if someone really wants it, thus collision is much less likely. Also, I'd like to replace the initial dot in mongodb to initial underscore, this way eliminating the possibility of collisions completely. I've a half baked patch, but nothing complete yet. However I'd really like to push the beta version out ASAP, and this one is keeping it back. Thanks for any comments. -- Bazsi

2 7

[git] syslog-ng git tree is rebased
by Balazs Scheidler 22 May '11

22 May '11

Hi, Just thought I'd send out a notification, that because of the last couple of mongodb/libmongo-client changes, I've removed a couple of commits, that I've already pushed out, and thus I've rebased the master branch. If you have a local git clone, you can always get back to track by rebasing your tree against the new master, or if you have no local patches, simply: $ git fetch $ git reset --hard origin/master Sorry for the trouble. -- Bazsi

1 0

Logging only if phrase found
by Sebastian Deißner 20 May '11

20 May '11

Hi @all, i am using syslog-ng for logging into mysql. **************************** options { chain_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination d_mysql { program("/usr/bin/mysql --user=syslogfeeder --password=SuperPassWord syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes)); }; destination messages { file("/var/log/messages"); }; log { source(src);destination(messages); destination(d_mysql); }; **************************** I want to have only the entries in my log database, that contain a specific phrase, for example all the entries with "...connect..." Is this possible with syslog-ng? tnx Sebastian

3 4

problem with windows agent and windows 2008
by Giovanni Mancuso 12 May '11

12 May '11

Hi, I have a problem with syslog-ng windows agent. I installed the client in a Windows 2003 machine and it works very well. I try to install the same client in a windows 2008 SP2 machine, but it send ONLY the startup/shutdown of the agent. It doesn't send other log (for ezample the windows event logs). I try to run the agent in debug mode (with /E) but i don't find useful information. Any ideas? Thank

2 1

syslog-ng Insider - May 2011
by Peter Czanik 12 May '11

12 May '11

Dear syslog-ng users, This is the 3rd issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news. Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com <mailto:documentation@balabit.com> FEATURED NEWS syslog-ng OSE 3.3 development ----------------------------- The previous month did not see a new syslog-ng 3.3 alpha or beta release, but development still went on. There were many important bugfixes and performance improvements. Also, most of the patches from the community were merged, including value-pairs(), mongo-db updates and JSON support. There is now a feature freeze in effect, so new features go now into the freshly opened syslog-ng 3.4 repository. The current version can be checked out out from git, which has regular updates at http://git.balabit.hu/?p=bazsi/syslog-ng-3.3.git;a=summary The mailing list archive with some more patches: http://lists.balabit.hu/pipermail/syslog-ng/ Blog about the feature freeze: http://bazsi.blogs.balabit.com/2011/05/syslog-ng-3-3-feature-freeze-3-4-bra… Blog series on web GUIs for syslog-ng ------------------------------------- Web based GUIs for syslog-ng is a hot topic recently, so a new blog series was started. This month I'll cover a new challenger: ELSA, which has patterndb at its heart.If you have any suggestions what else to cover, please let us know! ELSA: https://czanik.blogs.balabit.com/2011/05/elsa-web-interface-for-syslog-ng-a… Support the syslog-ng project with your testimonial! ---------------------------------------------------- We send syslog-ng T-Shirts for the best use-cases and testimonials. We are especially interested in how you use syslog-ng: your environment, performance metrics, the UNIX platforms that you use and anything that you deem interesting about your setup. This is your possibility to influence the syslog-ng development process and to help the syslog-ng project. http://www.balabit.com/testimonials/send OTHER SHORT NEWS * Maintenance policy update for syslog-ng OSE: http://bazsi.blogs.balabit.com/2011/05/maintenance-policy-update-for-syslog… * Algernon's syslog-ng status update: http://algernon.blogs.balabit.com/2011/05/veni-vidi-vici/ NEW RELEASES * new 3.2 OSE bugfix release: http://lists.balabit.hu/pipermail/syslog-ng/2011-May/016576.html RECENT WHITEPAPERS * How to establish a distributed syslog architecture in heterogeneous environment with syslog-ng Premium Edition? http://www.balabit.com/support/documentation/syslog-ng-v4.0-whitepaper-dist… * Get familiar with the advantages of using syslog-ng Premium Edition to collect system log (syslog) messages into an SQL database, such as Oracle or MySQL. http://www.balabit.com/support/documentation/syslog-ng-v4.0-whitepaper-sysl… ARCHIVE http://insider.blogs.balabit.com/ -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

[PATCH] afmongodb: Fix a possible crash during configuration.
by Gergely Nagy 12 May '11

12 May '11

During configuration, if the user specified value-pairs(), the driver would crash, because it tried to free a NULL structure. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/afmongodb.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index 68594d7..422058e 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -148,7 +148,8 @@ afmongodb_dd_set_value_pairs(LogDriver *d, ValuePairs *vp) { MongoDBDestDriver *self = (MongoDBDestDriver *)d; - value_pairs_free (self->vp); + if (self->vp) + value_pairs_free (self->vp); self->vp = vp; } -- 1.7.2.5

2 3

[PATCH] value-pairs: Use MESSAGE instead of MSG.
by Gergely Nagy 12 May '11

12 May '11

MESSAGE is the canonical name of the key, not MSG. Using MSG in the rfc3164 scope will result in both MSG and MESSAGE being present if nv-pairs is being used aswell. Using the canonical name, only MESSAGE will end up in the set, which is exactly what we'd like. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/value-pairs.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/lib/value-pairs.c b/lib/value-pairs.c index f88a486..7a09812 100644 --- a/lib/value-pairs.c +++ b/lib/value-pairs.c @@ -76,7 +76,7 @@ static ValuePairSpec rfc3164[] = { "HOST" }, { "PROGRAM" }, { "PID" }, - { "MSG" }, + { "MESSAGE" }, { "DATE", "R_DATE" }, { 0 }, }; -- 1.7.2.5

2 1

syslog-ng 3.2.4 has been released
by devel＠balabit.hu 11 May '11

11 May '11

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.2.4 SUMMARY : new stable release DATE : May 11, 2011 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.2.4) has been released. For latest fixes in the 3.2.x branch you are recommended to upgrade to this version. CHANGES: 3.2.4 Thu, 05 May 2011 23:10:52 +0200 Highlights: This maintenance release fixes some looser ends in the last published release, 3.2.3. There's one more important bugfix here, which is triggered by PCRE newer than 8.12. Bugfixes: * Fixed build problems on Solaris & AIX. * A bug was found in the pcre implementation for subst(). If the "global" flag is specified and pcre returns an error, an infinite loop is created, consuming memory in the process. It is triggered by PCRE 8.12, but could potentially affect older versions too. * Fixed a potential use of uninitialized memory in the configuration file parser, no bug was triggered but gcc 4.6 reported it via a warning. Other changes: * Fixed most (but not all) compilation warnings when compiling with gcc 4.6 Credits: syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Sandor Geller (Morgan Stanley) Balazs Scheidler (BalaBit) Micah Anderson Jose Oliveira (Fedora) Thanks for your efforts, it is appreciated. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

Configuring Syslog-ng client to start on a specific IP
by Pramod Pillai 09 May '11

09 May '11

Hi I am using Solaris box and it has multiple IP interfaces. I need to force the syslog-ng client to run on a specific interface card i.e on a specific IP. How can I do that. Each interface card is configured to run on different subnet and they can't talk to each other. ( for security reasons ) Hence when I run my syslog-ng client I end up running on the interface where I login. I want to change it. I want the syslog-client to create a socket on the interface ( IP ) which I specify ( in the config file ). Regards Pramod

2 1

Re: [syslog-ng] [PATCH RFC] Use cap_syslog when it is available (v3)
by Gergely Nagy 08 May '11

08 May '11

(forwarding the original mail, as it looks like it never made to the list) Serge Hallyn <serge.hallyn(a)canonical.com> writes: > (A-ha - great idea from Andrew - we *can* figure out whether the > kernel knows about CAP_SYSLOG, using the bounding set API) > > If cap_syslog exists, the kernel will complain (once) that we only > have cap_sys_admin. Additionally, using cap_syslog instead of > cap_sys_admin significantly lowers the unneeded privs we are > using. > > Changelog: > v2: At startup, detect whether libcap knows about CAP_SYSLOG. > (Thanks to Gergely Nagy for pointing out that case) > v3: Andrew Morgan pointed out a nice way to detect whether > the kernel has CAP_SYSLOG. Thanks, Andrew! > > Signed-off-by: Serge Hallyn <serge.hallyn(a)ubuntu.com> > --- > lib/gprocess.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++- > lib/gprocess.h | 2 +- > modules/affile/affile.c | 4 +++ > syslog-ng/main.c | 10 ++------ > 4 files changed, 55 insertions(+), 9 deletions(-) > > diff --git a/lib/gprocess.c b/lib/gprocess.c > index d9a2dfb..f9bda7b 100644 > --- a/lib/gprocess.c > +++ b/lib/gprocess.c > @@ -98,6 +98,7 @@ static gint startup_result_pipe[2] = { -1, -1 }; > static gint init_result_pipe[2] = { -1, -1 }; > static GProcessKind process_kind = G_PK_STARTUP; > static gboolean stderr_present = TRUE; > +static int have_capsyslog = FALSE; > > /* global variables */ > static struct > @@ -210,6 +211,14 @@ g_process_cap_modify(int capability, int onoff) > if (!process_opts.caps) > return TRUE; > > +#ifdef CAP_SYSLOG > + /* > + * if libcap or kernel doesn't support cap_syslog, then resort to > + * cap_sys_admin > + */ > + if (capability == CAP_SYSLOG && !have_capsyslog) > + capability = CAP_SYS_ADMIN; > +#endif > caps = cap_get_proc(); > if (!caps) > return FALSE; > @@ -416,7 +425,7 @@ g_process_set_working_dir(const gchar *cwd) > * capability set. The process will change its capabilities to this value > * during startup, provided it has enough permissions to do so. > **/ > -void > +static void > g_process_set_caps(const gchar *caps) > { > if (!process_opts.caps) > @@ -879,6 +888,43 @@ g_process_change_dir(void) > } > > /** > + * g_process_setup_caps(void) > + * > + * NOTE: polling /proc/kmsg requires cap_sys_admin, otherwise it'll always > + * indicate readability. Enabling/disabling cap_sys_admin on every poll > + * invocation seems to be too expensive. So I enable it for now. > + */ > +void > +g_process_setup_caps(void) > +{ > + int ret; > + gchar * capsstr = "cap_net_bind_service,cap_net_broadcast,cap_net_raw," > + "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " > + "cap_sys_admin=ep"; > +#ifdef CAP_SYSLOG > + cap_t caps; > + > + /* Check whether cap_syslog exists. If not, get cap_sys_admin, else get > + * cap_syslog */ > + caps = cap_from_text("cap_syslog=p"); > + if (caps) { > + cap_free(caps); > + /* libcap knows it, does the kernel? */ > + ret = prctl(PR_CAPBSET_READ, CAP_SYSLOG); > + if (ret != -1) { > + /* kernel knows cap_syslog! Use it */ > + capsstr = "cap_net_bind_service,cap_net_broadcast,cap_net_raw," > + "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " > + "cap_syslog=ep"; > + have_capsyslog = TRUE; > + } > + } > +#endif > + > + g_process_set_caps(capsstr); > +} > + > +/** > * g_process_send_result: > * @ret_num: exit code of the process > * > diff --git a/lib/gprocess.h b/lib/gprocess.h > index cda35b0..4ad0866 100644 > --- a/lib/gprocess.h > +++ b/lib/gprocess.h > @@ -66,7 +66,7 @@ void g_process_set_chroot(const gchar *chroot); > void g_process_set_pidfile(const gchar *pidfile); > void g_process_set_pidfile_dir(const gchar *pidfile_dir); > void g_process_set_working_dir(const gchar *cwd); > -void g_process_set_caps(const gchar *caps); > +void g_process_setup_caps(void); > void g_process_set_argv_space(gint argc, gchar **argv); > void g_process_set_use_fdlimit(gboolean use); > void g_process_set_check(gint check_period, gboolean (*check_fn)(void)); > diff --git a/modules/affile/affile.c b/modules/affile/affile.c > index a713bfc..358a083 100644 > --- a/modules/affile/affile.c > +++ b/modules/affile/affile.c > @@ -59,7 +59,11 @@ affile_open_file(gchar *name, gint flags, > if (privileged) > { > g_process_cap_modify(CAP_DAC_READ_SEARCH, TRUE); > +#ifdef CAP_SYSLOG > + g_process_cap_modify(CAP_SYSLOG, TRUE); > +#else > g_process_cap_modify(CAP_SYS_ADMIN, TRUE); > +#endif > } > else > { > diff --git a/syslog-ng/main.c b/syslog-ng/main.c > index 7e81f2f..5e62c1f 100644 > --- a/syslog-ng/main.c > +++ b/syslog-ng/main.c > @@ -167,13 +167,9 @@ main(int argc, char *argv[]) > > g_process_set_argv_space(argc, (gchar **) argv); > > - /* NOTE: polling /proc/kmsg requires cap_sys_admin, otherwise it'll always > - * indicate readability. Enabling/disabling cap_sys_admin on every poll > - * invocation seems to be too expensive. So I enable it for now. */ > - > - g_process_set_caps("cap_net_bind_service,cap_net_broadcast,cap_net_raw," > - "cap_dac_read_search,cap_dac_override,cap_chown,cap_fowner=p " > - "cap_sys_admin=ep"); > + /* Set up the minimal privilege we'll need */ > + g_process_setup_caps(); > + > ctx = g_option_context_new("syslog-ng"); > g_process_add_option_group(ctx); > msg_add_option_group(ctx); -- |8]

2 4

[PATCH] afmongodb: Fix a possible crash during configuration.
by Gergely Nagy 08 May '11

08 May '11

During configuration, if the user specified value-pairs(), the driver would crash, because it tried to free a NULL structure. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/afmongodb.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index 68594d7..422058e 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -148,7 +148,8 @@ afmongodb_dd_set_value_pairs(LogDriver *d, ValuePairs *vp) { MongoDBDestDriver *self = (MongoDBDestDriver *)d; - value_pairs_free (self->vp); + if (self->vp) + value_pairs_free (self->vp); self->vp = vp; } -- 1.7.2.5

1 0

3.3.0alpha2(git) escape \ with postgresql 9.0.4
by Hendrik Visage 05 May '11

05 May '11

Hi there (1) Thanks for the default value in the afsql ;) (2)warning seen: Running SQL query; query='INSERT INTO SystemEvents (ID, ReceivedAt, DeviceReportedTime, Facility, Priority, FromHost, Message, InfoUnitID, SysLogTag, CustomerID, NTSeverity, Importance, EventSource, EventUser, EventCategory, EventID, EventBinaryData, MaxAvailable, CurrUsage, MinUsage, MaxUsage, EventLogType, GenericFileName, SystemID) VALUES (DEFAULT, \'2011-05-05T16:45:58+02:00\', \'2011-05-05T16:45:58+02:00\', \'5\', \'3\', \'pint02\', \' 5 16:27:23 pint02 syslog-ng[1788]: I/O error occurred while writing; fd=\'\'23\'\', error=\'\'Can\\\'\'t assign requested address (227)\'\'\', \'1\', \'May \', NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL)' WARNING: nonstandard use of \\ in a string literal LINE 1: ... '2011-05-05T16:45:58+02:00', '5', '3', 'pint02', ' 5 16:27:... ^ HINT: Use the escape string syntax for backslashes, e.g., E'\\'.

2 1

[Bug 119] New: Compiling syslog-ng 3.2.3 with gcc 4.6: warnings
by bugzilla＠bugzilla.balabit.com 04 May '11

04 May '11

https://bugzilla.balabit.com/show_bug.cgi?id=119 Summary: Compiling syslog-ng 3.2.3 with gcc 4.6: warnings Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Hi, This is a small report about the 42 warnings produced by gcc 4.6 when compiling syslog-ng 3.2.3 without SSL and SQL support. The target linux distribution was Fedora 16 (currently very similar to the Fedora 15 Beta). The complete build logs can be browsed here: * http://kojipkgs.fedoraproject.org/packages/syslog-ng/3.2.3/1.fc16/data/logs… * http://kojipkgs.fedoraproject.org/packages/syslog-ng/3.2.3/1.fc16/data/logs… Warnings count by type: Num : gcc_warning_type ------------------------------------- 2 : -Wcpp 1 : -Wimplicit-function-declaration 2 : -Wstrict-aliasing 18 : -Wuninitialized 9 : -Wunused-but-set-variable 10 : -Wunused-result ------------------------------------- Output of wget -q -O - http://kojipkgs.fedoraproject.org/packages/syslog-ng/3.2.3/1.fc16/data/logs… | grep "\[-W": ---------- misc.c:382:9: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] misc.c:420:18: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] misc.c:422:18: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] logrewrite.c:72:11: warning: variable 'regexp_error' set but not used [-Wunused-but-set-variable] gprocess.c:920:12: warning: ignoring return value of 'write', declared with attribute warn_unused_result [-Wunused-result] gprocess.c:873:14: warning: ignoring return value of 'chdir', declared with attribute warn_unused_result [-Wunused-result] gprocess.c:881:13: warning: ignoring return value of 'getcwd', declared with attribute warn_unused_result [-Wunused-result] filter-expr-grammar.c:3538:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] block-ref-grammar.c:2943:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] cfg-grammar.c:4073:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] pragma-grammar.c:3063:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] rewrite-expr-grammar.c:3117:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] parser-expr-grammar.c:2958:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afsocket.c:95:13: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] afunix.c:138:9: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] afunix.c:149:14: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] afunix.c:151:14: warning: ignoring return value of 'chown', declared with attribute warn_unused_result [-Wunused-result] afinet.c:349:17: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] afinet.c:465:36: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] afinet.c:466:36: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstrict-aliasing] afsocket-grammar.c:5597:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afsocket.c:1080:29: warning: 'source' may be used uninitialized in this function [-Wuninitialized] affile.c:47:9: warning: variable 'saved_caps' set but not used [-Wunused-but-set-variable] affile.c:109:15: warning: ignoring return value of 'fchown', declared with attribute warn_unused_result [-Wunused-result] affile.c:111:15: warning: ignoring return value of 'fchown', declared with attribute warn_unused_result [-Wunused-result] affile-grammar.c:3734:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afprog-grammar.c:3455:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] afuser-grammar.c:2916:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] csvparser.c:348:3: warning: implicit declaration of function 'log_column_parser_free_method' [-Wimplicit-function-declaration] csvparser-grammar.c:3055:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] syslog-format.c:664:9: warning: variable 'sd_param_len' set but not used [-Wunused-but-set-variable] patternize.c:85:2: warning: #warning "openssl seems to be missing on your system, UUID generation will be disabled in pdbtool patternize" [-Wcpp] patternize.c:85:2: warning: #warning "openssl seems to be missing on your system, UUID generation will be disabled in pdbtool patternize" [-Wcpp] dbparser-grammar.c:2929:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] patterndb.c:421:12: warning: variable 'class_tag' set but not used [-Wunused-but-set-variable] patterndb.c:421:12: warning: variable 'class_tag' set but not used [-Wunused-but-set-variable] dummy-grammar.c:2950:12: warning: 'yyerror_range[0xffffffffcccccccbu].level' may be used uninitialized in this function [-Wuninitialized] loggen.c:183:12: warning: ignoring return value of 'fgets', declared with attribute warn_unused_result [-Wunused-result] loggen.c:350:17: warning: 'pos_seq' may be used uninitialized in this function [-Wuninitialized] loggen.c:329:21: warning: 'pos_timestamp2' may be used uninitialized in this function [-Wuninitialized] loggen.c:328:21: warning: 'pos_timestamp1' may be used uninitialized in this function [-c] loggen.c:215:1: warning: 'linelen' may be used uninitialized in this function [-Wuninitialized] ---------- Note: The warning "csvparser.c:348:3: warning: implicit declaration of function 'log_column_parser_free_method' [-Wimplicit-function-declaration]" appears to already be eliminated by a recent commit. Would it be possible to have some of these warnings eliminated? In particular the ones of the -Wuninitialized type? jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

3.2.4 to be released in the coming days
by Balazs Scheidler 04 May '11

04 May '11

Hi, Since the release of 3.2.3 spurred some activity around the 3.2.x branch again, I accumulated some changes that either fix build related issues and fixes for a bug or two. I'm going to prepare a release later today, or latest tomorrow, so if you have an 3.2.x related issue, it's best to speak up now, so that I can perhaps fix it before doing a release. Thanks, -- Bazsi

1 0

Integrating syslog-ng on Solaris 10
by Pramod Pillai 04 May '11

04 May '11

Hi On Solaris machine the legacy logging is done by SMF system-log. And there are many Solaris SMF which depends on system-log SMF. If I want to integrate syslog-ng to Solaris box , should I disable system-log SMF ? But disabling "system-log" will cause few legacy SMF to go down. I can't have system-log SMF and syslog-ng enabled at the same time since it would result in logging twice. Can any one suggest alternative approach for integrating syslog-ng to Solaris box. Regards Pramod

5 4

[list admin] discussion of patches
by Balazs Scheidler 03 May '11

03 May '11

Hi, I intend to make the development of syslog-ng even more transparent and this means that more and more patches and development related questions needs to be discussed. See for instance the last e-mail about linking options. The big question is whether these discussions should be moved to a separate list, or rather it should stay here. I don't have a definitive view, as I read both development and non-development discussions, but I guess there are others on this list, who couldn't care less about linking options, patches and whatnot. But even for a user, seeing what kind of features are development, might be useful information, even if the code itself is less interesting. For me, it is more convinient as it is now. The question is how you, the other list members think about it? Please share your thoughts. Thanks. -- Bazsi

6 5

Setting facility/priority in 2.1.4?
by Ray Van Dolson 03 May '11

03 May '11

[ Wasn't subscribed to the list -- apologies if this ends up getting posted twice. ] I have a source (a FIFO/pipe) which I am re-emitting to another syslog-ng server via TCP. How do I define what facility and priority the data from this source is transmitted with? What is the default (daemon.info?)? This is syslog-ng 2.1.4 (old I know). Thanks, Ray

2 2

Solaris 10 UDP overflows, message drops
by Mishou Michael 03 May '11

03 May '11

All, I've done a lot of reading, and I can't figure out what I can do to this config in order to fix the UDP drops due to udpInOverflows on netstat -s. Here are some statistics relating to the amount of traffic we receive via syslog-ng, it's pretty busy but in reading I'm finding that some folks are doing much more. These stats are based on a ~30 second window of traffic during peak times, but variance due to time is not so much in our environment. I used tcpdump with a bpf to capture only inbound udp/514, so this is what the interface is seeing in the way of syslog. Elapsed: 00:00:34 Packets: 200000 Avg. packets/sec: 5836.546 Avg. packet size: 303.182 bytes Bytes: 60636477 Avg. bytes/sec: 1769537.884 Avg. MBit/sec: 14.156 So, about 6k messages per second. Here are the drop numbers over a time sample (done right after a process restart, you can see the buffer takes a moment to fill up [64 MB so_rcvbuf]): # while true; do echo -en "$(date) :: "; netstat -s | grep udpInOverflows | head -n 1 | sed 's|.*=||'; sleep 10; done Fri Apr 15 14:12:46 GMT 2011 :: 472517477 Fri Apr 15 14:12:56 GMT 2011 :: 472517477 Fri Apr 15 14:13:06 GMT 2011 :: 472517477 Fri Apr 15 14:13:16 GMT 2011 :: 472517477 Fri Apr 15 14:13:26 GMT 2011 :: 472543152 Fri Apr 15 14:13:36 GMT 2011 :: 472592800 Fri Apr 15 14:13:46 GMT 2011 :: 472638848 Fri Apr 15 14:13:56 GMT 2011 :: 472684407 So that's about 5k overflows a second, which jives with our calculations, suggesting we're getting only ~10% of our messages logged to disk. I inherited a config with _very_ many filter statements, but have decided to cut all that out to see if my performance problems in the way of udp drops continue (they do). I've attached a sanitized config to this message, all the stuff here concerns this config running (even though I thought eliminating the filters would really help, it didn't). We're running Solaris 10 SPARC. The syslog-ng version is: # /usr/local/sbin/syslog-ng -V syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainli ne--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Oct 25 2010 23:56:18 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: on Enable-Sun-Door: on Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on The following options are set for the OS: # ndd /dev/udp udp_max_buf 1073741824 # ndd /dev/udp udp_recv_hiwat 65536 Some options lines from the config based on what I've seen: * note the TCP stuff can be safely ignored, it's legacy from some testing but isn't currently seeing traffic * all 3 udp sources set with so_rcvbuf(67108864) (64 MB) options { # things I've changed/tweaked flush_lines(1000); flush_timeout(20); log_fifo_size (67108864); log_msg_size(8192); chain_hostnames(yes); # end my changes <snip> }; So I'm totally stumped. I can set the buffers with so_rcvbuf() to 1 GB, it still doesn't matter, they eventually fill up and I start losing packets. I'm hoping that someone can point me to some tweaks I can do to get the numbers of drops down or eliminated. Is it unreasonable to expect to be able to process this many messages per second via UDP? Maybe that's the problem. I might experiment some with default syslog to see if it can write this many messages without drops...this doesn't seem like an insane amount of traffic. But perhaps my expectations are unrealistic, that's what I'm hoping someone can tell me. Regards, --Mike

11 37