- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Help
by Chaitanya Sangawar 28 May '10

28 May '10

I tried to use init.d script from a rpm version on solaris but for some reason it doesn't execute as is n I can't get it started as daemon. When I run syslog-ng, it works one time. I will go through the site also. Where can I get pre compiled version aren't they vad only for a month? Thanks, Chaitanya S Sent from HTC ________________________________ From: Patrick H. <syslogng(a)feystorm.net> Sent: Thursday, 27 May 2010 1:15 AM To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Help I loathe compiling on solaris, and try to avoid it wherever possible. If the only reason youre not using the pre-compiled package is the lack of init script, then it'd be easier to get an init script than compile a new syslog-ng. If anything, you can just yank the init script from the source and use it with the pre-compiled version. If youre using solaris 10, then the proper way is to use the SMF manifests. A good source is http://hub.opensolaris.org/bin/view/Community+Group+smf/manifests and there's one for syslog-ng listed there. Sent: Wednesday, May 26, 2010 1:30:25 PM From: Chaitanya Sangawar <CS0048029(a)TechMahindra.com><mailto:CS0048029@TechMahindra.com> To: syslog-ng(a)lists.balabit.hu<mailto:syslog-ng@lists.balabit.hu> <syslog-ng(a)lists.balabit.hu><mailto:syslog-ng@lists.balabit.hu> Subject: [syslog-ng] Help Hello All, I am not sure if this is a forum where I can post some help I would require but would appreciate if it is. I have been trying to install syslog-ng open source on Solaris since quite sometime and now I am almost giving up. After installing I would have presumed to have /etc/init.d/syslog-ng file created but it wasn’t. Also now I am not able to do “make” to syslog-ng , observing the following error. Can anyone help me why this is happening? Is it related to PATH / PKG_CONFIG_PATH or something ? Something or the other is happening and always ending up not able to complete the installation. # echo $PATH /usr/bin:/usr/sbin:/usr/ccs/bin:/usr/sbin:/usr/bin:/usr/bin:/usr/sbin:/opt/local/bin:/usr/local/bin:/opt/local/scripts/common:/usr/dt/bin:/usr/openwin/bin:/usr/ucb:/usr/bin/nsr:/usr/sbin/nsr:/usr/ccs/bin:/usr/local/bin:/usr/sfw/bin:/usr/lib:/usr/lib:/usr/local/lib:/usr/local/bin:/usr/sfw/bin:/usr/sfw/bin echo $PKG_CONFIG_PATH /usr/local/lib/pkgconfig/:/usr/lib/pkgconfig/:/usr/sfw/bin make make all-recursive Making all in src lex cfg-lex.l "cfg-lex.l":line 263: Error: missing translation value *** Error code 1 make: Fatal error: Command failed for target `cfg-lex.c' Current working directory /opt/syslog-ng-3.0.4/src *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib debian tgz2build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /opt/syslog-ng-3.0.4 *** Error code 1 make: Fatal error: Command failed for target `all' ============================================================================================================================Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally and http://tim.techmahindra.com/Disclaimer.html internally within Tech Mahindra.============================================================================================================================ ________________________________ ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html ============================================================================================================================Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra.============================================================================================================================

2 4

Help
by Chaitanya Sangawar 26 May '10

26 May '10

Hello All, I am not sure if this is a forum where I can post some help I would require but would appreciate if it is. I have been trying to install syslog-ng open source on Solaris since quite sometime and now I am almost giving up. After installing I would have presumed to have /etc/init.d/syslog-ng file created but it wasn't. Also now I am not able to do "make" to syslog-ng , observing the following error. Can anyone help me why this is happening? Is it related to PATH / PKG_CONFIG_PATH or something ? Something or the other is happening and always ending up not able to complete the installation. # echo $PATH /usr/bin:/usr/sbin:/usr/ccs/bin:/usr/sbin:/usr/bin:/usr/bin:/usr/sbin:/opt/local/bin:/usr/local/bin:/opt/local/scripts/common:/usr/dt/bin:/usr/openwin/bin:/usr/ucb:/usr/bin/nsr:/usr/sbin/nsr:/usr/ccs/bin:/usr/local/bin:/usr/sfw/bin:/usr/lib:/usr/lib:/usr/local/lib:/usr/local/bin:/usr/sfw/bin:/usr/sfw/bin echo $PKG_CONFIG_PATH /usr/local/lib/pkgconfig/:/usr/lib/pkgconfig/:/usr/sfw/bin make make all-recursive Making all in src lex cfg-lex.l "cfg-lex.l":line 263: Error: missing translation value *** Error code 1 make: Fatal error: Command failed for target `cfg-lex.c' Current working directory /opt/syslog-ng-3.0.4/src *** Error code 1 The following command caused the error: failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib debian tgz2build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /opt/syslog-ng-3.0.4 *** Error code 1 make: Fatal error: Command failed for target `all' ============================================================================================================================Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra.============================================================================================================================

2 1

Re: [syslog-ng] Program destination seems to block
by Evan Rempel 17 May '10

17 May '10

OK, I finally got back to this. The strace is too large to send to this list, approx 1MB. I'm not an strace expert, but it looks like the source is polled, but once the output can not be written to, the source is no longer read, even though the poll shows data is available. 14:56:42.508034 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508067 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508099 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508133 poll([{fd=4, events=POLLIN}, {fd=5, events=0}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 4, 304) = 1 ([{fd=3, revents=POLLIN}]) <0.000005> 14:56:42.508180 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508214 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508246 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508279 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508311 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508344 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508376 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508416 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508449 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508481 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000005> 14:56:42.508514 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508546 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> 14:56:42.508579 write(5, "-rwxr-xr-x 1 root root 925 Jun 30 2009 mk_cmds\n", 55) = -1 EAGAIN (Resource temporarily unavailable) <0.000004> This just repeats over and over again. Thanks for looking at this. Balazs Scheidler wrote: > On Wed, 2010-04-14 at 14:04 -0700, Evan Rempel wrote: >> Balazs Scheidler wrote: >>> On Wed, 2010-04-14 at 13:18 -0700, Evan Rempel wrote: >>>> A little background. >>>> >>>> There is a "server" syslog-ng process that accepts messages from the network and >>>> sends the messages to a variety of destinations. For this report, I am only interested >>>> in one destination that happens to be a pipe. >>>> >>>> There is a "slave" syslog-ng process that reads from the pipe that the "server" writes to, >>>> and writes to a program destination. >>>> >>>> The program reads the standard in, and does "something". >>>> All works well. >>>> >>>> At some point our application (we know why and don't want to discuss it) application stops >>>> reading standard in for a while (1,000,000 lines over an hour). We expect that the memory >>>> footprint of syslog-ng "slave" to grow during this time but it does not. Instead, the >>>> memory footprint of the syslog-ng "server" grows. When our application starts reading >>>> its standard in again, the memory footprint of the syslog "slave" grows very quickly, >>>> and all messages reach the destination. >>>> >>>> I think that the syslog-ng "slave" get blocked on the program destination in a way that >>>> prevents it from reading its source, resulting in the upstream syslog-ng "server" having >>>> to buffer all of the messages. >>>> >>>> There is no flow control anywhere, and both syslog-ng instances have log_fifo_size(8000000) >>>> for all of the destinations. >>>> >>>> Anyone have any suggestions? >>> Hmm, either the slave syslog-ng really blocks (but I don't know any >>> similar bugs right now), or flow control is enabled. >>> >>> There was a bug that caused flow-control to be enabled, if any of the >>> flags was used. Do you have fallback enabled? >> No, the only flags in the "slave" is no-parse. >> >> >>> Can you post the exact versions of syslog-ng you are using? >> 3.0.5 OSE >> >> >>> Also, you could confirm if the slave instance really blocks, or it has >>> just stalled one of its sources. You could do that by attaching to the >>> slave process using strace for a little while. >>> >>> 1) first check what fd is being used between master/slave (lsof -p >>> <pid>) >>> 2) then check via strace if that fd is being polled for POLLIN or not >>> >>> If it is not polled, then flow-control is somehow enabled, if syslog-ng >>> is not polling but waiting somewhere, then it might be blocked as you >>> suggest. >>> >>> Anyway, the list of open file descriptors and the strace dump could help >>> in tracking down both cases. >> >> Not to be lazy here, but I am not going to get to this for weeks, really busy >> at my site right now. >> >> Here is a program that can turn on/off the reading of standard in by using >> kill -USR1 <PID> >> kill -USR2 <PID> >> >> >> --------------- >> #!/usr/bin/perl >> >> my $read = 0; >> >> $SIG{USR1} = sub { $read = 1 }; >> $SIG{USR2} = sub { $read = 0 }; >> >> while ( not eof(STDIN)) { >> if ( $read == 1 ) { >> $line = <STDIN>; >> print $line; >> } else { >> sleep 1; >> } >> } >> --------------- >> >> So hopefully you can reproduce this this really easy at your end. >> >> If I don't hear back, in a few weeks I'll get to this. > > I've tried it with 3.1.1, 3.0.6 and finally 3.0.5 and all behaved > properly. Memory size grew until it couldn't write to the test program, > of course only until the FIFO size filled up. > > Once I let the program go with a SIGUSR1 it started sending messages, > the drop count stayed the same. Flow-control was not enabled. > > -- Evan Rempel erempel(a)uvic.ca Senior Systems Administrator 250.721.7691 Unix Services, University Systems, University of Victoria -- Evan Rempel erempel(a)uvic.ca Senior Systems Administrator 250.721.7691 Unix Services, University Systems, University of Victoria

1 0

syslog file is empty
by Андрей 16 May '10

16 May '10

I'm using syslog-ng to collect logs from different devices and everything is Ok - all log files and directories are created and being written, except syslog log files - they are just empty (e.g. /var/log/hostname/syslog size is zero). Here is my config: monitoring:~# cat /etc/syslog-ng/syslog-ng.conf @version: 3.0 # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. Originally written by anonymous (I can't find his name) # Revised, and rewrited by me (SZALAY Attila <sasa(a)debian.org>) # First, set some global options. options { long_hostnames(off); flush_lines(0); use_dns(persist_only); dns_cache_hosts(/etc/hosts); use_fqdn(no); owner("root"); group("adm"); perm(0655); keep_hostname(yes); }; ######################## # Sources ######################## # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # source s_src { unix-dgram("/dev/log"); internal(); file("/proc/kmsg" program_override("kernel")); udp(ip(192.168.10.2) port(514)); }; # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # #source s_net { tcp(ip(127.0.0.1) port(1000) authentication(required) encrypt(allow)); }; ######################## # Destinations ######################## # First some standard logfile # destination d_auth { file("/var/log/$HOST/auth.log" suppress(15)); }; destination d_cron { file("/var/log/$HOST/cron.log" suppress(15)); }; destination d_daemon { file("/var/log/$HOST/daemon.log" suppress(15)); }; destination d_kern { file("/var/log/$HOST/kern.log" suppress(15)); }; destination d_lpr { file("/var/log/$HOST/lpr.log" suppress(15)); }; destination d_mail { file("/var/log/$HOST/mail.log" suppress(15)); }; destination d_syslog { file("/var/$HOST/log/syslog" suppress(15)); }; destination d_user { file("/var/log/$HOST/user.log" suppress(15)); }; destination d_uucp { file("/var/log/$HOST/uucp.log" suppress(15)); }; destination d_radius { file("/var/log/$HOST/radius.log" suppress(15)); }; # This files are the log come from the mail subsystem. # destination d_mailinfo { file("/var/log/$HOST/mail/mail.info" suppress(15)); }; destination d_mailwarn { file("/var/log/$HOST/mail/mail.warn" suppress(15)); }; destination d_mailerr { file("/var/log/$HOST/mail/mail.err" suppress(15)); }; # Logging for INN news system # destination d_newscrit { file("/var/log/$HOST/news/news.crit" suppress(15)); }; destination d_newserr { file("/var/log/$HOST/news/news.err" suppress(15)); }; destination d_newsnotice { file("/var/$HOST/log/news/news.notice" suppress(15)); }; # Some `catch-all' logfiles. # destination d_debug { file("/var/log/$HOST/debug" suppress(15)); }; destination d_error { file("/var/log/$HOST/error" suppress(15)); }; # The root's console. # #destination d_console { usertty("root");}; # Virtual console. # #destination d_console_all { file("/dev/tty10"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination d_xconsole { pipe("/dev/xconsole"); }; # Send the messages to an other host # #destination d_net { tcp("127.0.0.1" port(1000) authentication(on) encrypt(on) log_fifo_size(1000)); }; # Debian only #destination d_ppp { file("/var/log/ppp.log"); }; ######################## # Filters ######################## # Here's come the filter options. With this rules, we can set which # message go where. filter f_dbg { level(debug); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_err { level(err); }; filter f_crit { level(crit .. emerg); }; filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; filter f_error { level(err .. emerg) ; }; filter f_auth { facility(auth, authpriv) and not filter(f_debug); }; filter f_cron { facility(cron) and not filter(f_debug); }; filter f_daemon { facility(daemon) and not filter(f_debug); }; filter f_kern { facility(kern) and not filter(f_debug); }; filter f_lpr { facility(lpr) and not filter(f_debug); }; filter f_local { facility(local0, local1, local3, local4, local5, local6, local7) and not filter(f_debug); }; filter f_mail { facility(mail) and not filter(f_debug); }; filter f_news { facility(news) and not filter(f_debug); }; filter f_syslog3 { facility(syslog) and not filter(f_debug); }; filter f_user { facility(user) and not filter(f_debug); }; filter f_uucp { facility(uucp) and not filter(f_debug); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; #filter f_ppp { facility(local2) and not filter(f_debug); }; filter f_radius { facility(local1) and not filter(f_debug); }; #filter f_console { level(warn .. emerg); }; ######################## # Log paths ######################## log { source(s_src); filter(f_auth); destination(d_auth); }; log { source(s_src); filter(f_cron); destination(d_cron); }; log { source(s_src); filter(f_daemon); destination(d_daemon); }; log { source(s_src); filter(f_kern); destination(d_kern); }; log { source(s_src); filter(f_lpr); destination(d_lpr); }; log { source(s_src); filter(f_syslog3); destination(d_syslog); }; log { source(s_src); filter(f_user); destination(d_user); }; log { source(s_src); filter(f_uucp); destination(d_uucp); }; log { source(s_src); filter(f_radius); destination(d_radius); }; log { source(s_src); filter(f_mail); destination(d_mail); }; #log { source(s_src); filter(f_mail); filter(f_info); destination(d_mailinfo); }; #log { source(s_src); filter(f_mail); filter(f_warn); destination(d_mailwarn); }; #log { source(s_src); filter(f_mail); filter(f_err); destination(d_mailerr); }; log { source(s_src); filter(f_news); filter(f_crit); destination(d_newscrit); }; log { source(s_src); filter(f_news); filter(f_err); destination(d_newserr); }; log { source(s_src); filter(f_news); filter(f_notice); destination(d_newsnotice); }; #log { source(s_src); filter(f_cnews); destination(d_console_all); }; #log { source(s_src); filter(f_cother); destination(d_console_all); }; #log { source(s_src); filter(f_ppp); destination(d_ppp); }; log { source(s_src); filter(f_debug); destination(d_debug); }; log { source(s_src); filter(f_error); destination(d_error); }; #log { source(s_src); filter(f_console); destination(d_console_all); # destination(d_xconsole); }; #log { source(s_src); filter(f_crit); destination(d_console); }; # All messages send to a remote site # #log { source(s_src); destination(d_net); }; Everything seems to be Ok in config, what's wrong? Later I used 2.x version of syslog-ng and everything worked. -- С уважением, Андрей.

3 2

Tests using loggen - not receiving all the packets
by Clayton Dukes 14 May '10

14 May '10

Hi Folks, I'm trying to run a test to check insert rates. If I run this command: ./loggen -r 5000 -D -I 10 127.0.0.1 514 The output shows: average rate = 5441.60 msg/sec, count=54420, time=10.007, msg size=256, bandwidth=1360.40 kB/sec But, my stats don't show that many messages received: syslog-ng[6660]: Log statistics; dropped=\'pipe(/dev/xconsole)=0\', processed=\'center(queued)=24232\', processed=\'center(received)=8077, processed=\'destination(df_logzilla)=8077\' As you can see, it sent 55k messages, but I only received 8k. Am I doing something wrong? Here are my options in the syslog-ng config: options { long_hostnames(off); log_msg_size(8192); flush_lines(1); log_fifo_size(16384); time_reopen(10); use_dns(yes); dns_cache(yes); use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); perm(0644); stats_freq(60); }; -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

7 23

syslog-ng poll results
by Fekete Robert 14 May '10

14 May '10

Hi, About two months ago we started to run periodic polls on our website to learn more about how you use syslog-ng. The results of the first two polls are already available on the website and on my blog at http://robert.blogs.balabit.com/2010/05/syslog-ng-poll-results.html and the third question is online as well. Thank you very much for voting! Regards, Robert

1 0

[Bug 82] New: Buffered messages are lost on SIGHUP signal
by bugzilla＠bugzilla.balabit.com 12 May '10

12 May '10

https://bugzilla.balabit.com/show_bug.cgi?id=82 Summary: Buffered messages are lost on SIGHUP signal Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Windows Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: urbestfriend(a)gmail.com Type of the Report: --- Estimated Hours: 0.0 I'm using version 2.0.10 syslog-ng version. I ran a simple test with filter f_myprog { program(zpem); }; destination my_dest { unix-stream("/dev/mylog" template("$MSGONLY\n") template_escape(no) log_fifo_size(1000) ); }; log { source(src); filter(f_myprog); destination(my_dest); }; When destination is not available ( server is stopped) and if I issue SIGHUP signal , all buffered messages are lost and I dont receive any messages when destination comes back online But if I dont issue SIGHUP when destination is down , it works well and I'm able to receive messages when destination comes up.Ideally with log_fifo_size(), I would expect the messages to be buffered across reloads, but this is not the case in the version which I am using. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

How to turn logging into the .log files
by Wagner Pereira 11 May '10

11 May '10

Hi, all. When I installed Syslog-ng, I configured it to log all the device's activities into the .log files. It worked well for some weeks. In the last week, I tried to use Logzilla ( former PhP-Syslog-ng) but I can't successful, then I removed Logzilla yesterday. After I removed Logzilla, I noticed that all the activities are been recorded into the /var/log/messages file and no longer into the .log files I've created for this purpose, originally. What should I configure to turn logging in those .log files? I already have the syslog-ng.conf configured properly. Thanks in advance. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Tel. (11) 3091-8901

2 8

nested/derived source statements?
by Jan Schaumann 10 May '10

10 May '10

Hello, Ie, I have source s_tcp6 { tcp6(log_fetch_limit(25) port(601)); } source s_tcp4 { tcp(log_fetch_limit(25) port(601)); }; and I would like to have another source s_tcp { s_tcp4; s_tcp6; }; but no matter what I try, I get syntax errors. Is it not possible to have nested/derived source statements? -Jan

3 5

$DAY Macro not RFC Compliant
by Michael Starks 10 May '10

10 May '10

I have a situation where I am trying to construct a RFC3164-compliant message from component parts of a non-compliant message. The non-compliant message expresses the day as dd, and if the day is before the tenth of the month, it is 0d. I thought it would be better to use the syslog-ng $DAY macro, but I learned that it also does the same thing. The RFC, however, requires two-digit days to be expressed as " d" (space digit) when the day is before 10. I then thought that perhaps I could just rewrite the day as expressed by the original message, which is actually my preference, using a rewrite rule. As a test, I tried this: rewrite r_test{ subst("07", " 7", value("${PARSER.DD}")); }; This attempted to change "07" to " 7" in PARSER.DD, which has been successfully extracted in a former parser. And of course I attempt to use it in a log statement (some names have been changed for demonstration purposes): log { source(s_source); parser(p_parser); filter(f_filter); destination(d_destination); rewrite(r_test);}; So my questions are: 1. Why is the $DAY macro not RFC3164-compliant? Is that a design choice? Was it simply never meant to be? 2. Why doesn't the rewrite rule work? I know PARSER.DD has been successfully extracted because I can use it in a destination. Thanks in advance. -Michael Starks

2 2

[PATCH] make 'syslog-ng -s' stay in the foreground
by Corey Hickey 10 May '10

10 May '10

Hi, I recently upgraded to syslog-ng 3.1.1 and noticed messages like this appearing on terminals owned by root: 2010 May 7 06:25:21 fire Daemon exited gracefully, not restarting; exitcode='0' This is triggered by a daily logrotate cron job that runs 'syslog-ng -s' before sending the daemon a SIGHUP. It seems that 'syslog-ng -s' will daemonize and fork; the child process runs the syntax check and exits immediately, and then the parent process sends the above message via syslog(LOG_CRIT,...). I can work around it by using 'syslog-ng -sF', but I also hacked up a small patch to force the process to be in the foreground when -s is specified. Is this useful? If not, I'll send a patch to Debian to use 'syslog-ng -sF' instead. Thanks, Corey diff -ur syslog-ng-3.1.1.orig/src/gprocess.c syslog-ng-3.1.1/src/gprocess.c --- syslog-ng-3.1.1.orig/src/gprocess.c 2009-12-15 05:00:28.000000000 -0800 +++ syslog-ng-3.1.1/src/gprocess.c 2010-05-08 19:30:12.000000000 -0700 @@ -1134,14 +1134,18 @@ /** * g_process_start: + * @force_foreground: force process mode to foreground * * Start the process as directed by the options set by various * g_process_set_*() functions. **/ void -g_process_start(void) +g_process_start(gboolean force_foreground) { pid_t pid; + + if (force_foreground) + process_opts.mode = G_PM_FOREGROUND; g_process_detach_tty(); g_process_change_limits(); diff -ur syslog-ng-3.1.1.orig/src/gprocess.h syslog-ng-3.1.1/src/gprocess.h --- syslog-ng-3.1.1.orig/src/gprocess.h 2009-11-25 11:47:45.000000000 -0800 +++ syslog-ng-3.1.1/src/gprocess.h 2010-05-08 19:28:55.000000000 -0700 @@ -70,7 +70,7 @@ void g_process_set_use_fdlimit(gboolean use); void g_process_set_check(gint check_period, gboolean (*check_fn)(void)); -void g_process_start(void); +void g_process_start(gboolean force_foreground); void g_process_startup_failed(guint ret_num, gboolean may_exit); void g_process_startup_ok(void); void g_process_finish(void); diff -ur syslog-ng-3.1.1.orig/src/main.c syslog-ng-3.1.1/src/main.c --- syslog-ng-3.1.1.orig/src/main.c 2010-03-14 10:22:50.000000000 -0700 +++ syslog-ng-3.1.1/src/main.c 2010-05-08 19:28:55.000000000 -0700 @@ -417,7 +417,7 @@ /* in this case we switch users early while retaining a limited set of * credentials in order to initialize/reinitialize the configuration. */ - g_process_start(); + g_process_start(syntax_only); rc = initial_init(&cfg); if (rc)

2 1

syslog-ng can not work with oracle backend
by Dmitry Sedov 10 May '10

10 May '10

Hello! I took stable binary rpm with open source syslog-ng version 3.0.6 on balabit.hu and install it on rhel 4u7. For some reason it does not want to work with oracle backend. I try next bekend description in syslog-ng.conf: destination d_oracle_syslog { sql(type(oracle) username("login") password("password") database("database") table("table") columns("DATE varchar2(24)", "facility number(2)", "LEVEL number(1)", "host varchar2(128)", "program varchar2(64)", "pid number(8)", "message varchar2(1024)") indexes( "DATE","facility","host") ); }; And after start syslog-ng post in /var/log/messages notes about failure: Apr 30 18:35:47 vm-dc-syslog syslog-ng[9815]: No such DBI driver; type='oracle' Apr 30 18:35:47 vm-dc-syslog syslog-ng[9815]: No such DBI driver; type='oracle' Apr 30 18:35:47 vm-dc-syslog syslog-ng[9815]: No such DBI driver; type='oracle' After this issue appear, I compile libdbi and libdbi-drivers version 0.8.3. But it did not help: syslog-ng continue write "No such DBI driver; type='oracle'". And the same happens with the syslog-ng versions 3.1.1 and 3.1.0. I install syslog-ng with binary rpm's from www.balabit.com. Tell me, please, how I may fix this issue. Regards, Dmitry Sedov.

3 6

Want to down load NCsysng-1.6.7-1.pkg.gz
by sasanka.sahu＠wipro.com 10 May '10

10 May '10

want to download NCsysng-1.6.7-1.pkg.gz but the package is NOT available on the site ( http://www.campin.net/download/NCsysng-1.6.7-1.pkg.gz <http://www.campin.net/download/NCsysng-1.6.7-1.pkg.gz> ) so please provide me the exact link for downloading the same . Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

Rediecting logs
by abhay singh 10 May '10

10 May '10

Hi All, I have made changes in syslog-ng.conf to redirect logs coming from other server to some specified log file and in some format source s_external { udp(port(514)); }; source s_stunnel { tcp(ip(127.0.0.1) port(514)); }; destination s_external { file("/mydir/syslogs/$HOST_syslog.log" \ owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes)); }; destination s_stunnel { file("/mydir/syslogs/$HOST/syslog.log" \ owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(s_external); destination(s_external); }; log { source(s_stunnel); destination(s_stunnel); }; But my log file is being created with name "syslog.log" and not as "<hostnmae/ip>_syslog.log" neither $HOST directory made, what may be the issue? Globle options are option{ long_hostname(off); sync(0); } -- Regards.. Abhay Singh.. 91-98804-55587 Sr. Software Engineer. Robust Designs India Pvt Ltd. Bangalore

5 6

[Bug 81] New: feature request: nested source statements
by bugzilla＠bugzilla.balabit.com 06 May '10

06 May '10

https://bugzilla.balabit.com/show_bug.cgi?id=81 Summary: feature request: nested source statements Product: syslog-ng Version: 3.0.x Platform: Other OS/Version: FreeBSD Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jschauma(a)netmeister.org Type of the Report: --- Estimated Hours: 0.0 Ie, I have source s_tcp6 { tcp6(log_fetch_limit(25) port(601)); } source s_tcp4 { tcp(log_fetch_limit(25) port(601)); }; and I would like to have another source s_tcp { s_tcp4; s_tcp6; }; but no matter what I try, I get syntax errors. Is it not possible to have nested/derived source statements? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Questions regarding Syslog-ng
by Dyne Lai 05 May '10

05 May '10

Dear Syslog-ng developers, I am very interested and impressed with the many features of Syslog-ng as compared to Syslogd and would consider implement it in my servers. However, I do have some questions regarding Syslog-ng that I would like to enquiry as below. 1) Is it possible for both Syslogd and Syslog-ng to co-exist and run concurrently in a single server? The rational for this question is due to support reason and security reason that will require the presence of Syslogd even though it can be replaced by Syslog-ng. Thank you for the time! Best Regards, Dyne Lai

2 1

error in documentation
by Patrick H. 04 May '10

04 May '10

Found another error in the documentation (version 3.1). The docs list "stats_reset" as a valid config option, yet trying to use it results in a syntax error on start, and cfg-lex.l in the source has nothing about it. Guessing this was removed and the docs never got updated.

2 1

Re: [syslog-ng] log_disk_fifo_size() option available in syslog-ng 3.1.1 ?
by Ilas, Yann 03 May '10

03 May '10

Thank you for that fast answer. I'm so sad now :-( As I found an error into the doc, did I win a license of the "Premium Edition" ? :-) ...Joke :-) Regards, Yann > Hi, > > disk-based buffering is currently not available in the Open Source Edition, only > in the Premium Edition, but it seems that the description of the option has > accidentally remained in the OSE admin guide. > > Thank you for noticing it, and my apologies for the mistake. > I will remove it from the docs and update it on the web. > > Regards, > > Robert > > Ilas, Yann wrote: > >> Hello, >> >> I tried to use the disk-based buffering as described in the document "The >> syslog-ng Open Source Edition 3.1 Administrator.pdf" but I have a syntax >> error when I start the process. >> I used this configuration for the destination part of my configuration file >> : >> destination d_tcp { >> tcp("10.1.2.3" port(1999) log_disk_fifo_size(4194304)); }; >> >> When I remove "log_disk_fifo_size" of my configuration, everything is OK and >> syslog-ng doesn't complain. >> Did I miss something ? >> >> Regards, >> >> Yann >> >> >> >> >> ------------------------------------------------------------------------ >> >> ____________________________________________________________________________ __ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> >> FAQ: http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

log_disk_fifo_size() option available in syslog-ng 3.1.1 ?
by Ilas, Yann 03 May '10

03 May '10

Hello, I tried to use the disk-based buffering as described in the document "The syslog-ng Open Source Edition 3.1 Administrator.pdf" but I have a syntax error when I start the process. I used this configuration for the destination part of my configuration file : destination d_tcp { tcp("10.1.2.3" port(1999) log_disk_fifo_size(4194304)); }; When I remove "log_disk_fifo_size" of my configuration, everything is OK and syslog-ng doesn't complain. Did I miss something ? Regards, Yann

2 1

Syslog-ng Agent for Windows 3.1 " Customizing file messages"
by John MacDonald 28 Apr '10

28 Apr '10

I am trying to follow the following procedure: Procedure 3.18. Customizing file messages 1. Start the configuration interface of the syslog-ng Agent for Windows application. 2. Select syslog-ng Agent Settings, right-click on File Sources and select Properties. 3. Type the message format into the Message Template field. You can use date- and file-related macros (see Section 3.6.2, "Macros available in the syslog-ng Agent" (p. 26) for a list of macros). The message customized here is included in the server-specific templates using the MESSAGE macro. By default, the following is sent about file messages: $FILE_NAME: $FILE_MESSAGE. 4. Select Apply, then OK. To activate the changes, restart the syslog-ng Agent service. My issue is on File Sources>Properties there isn't a Message Template field. Can you tell me if there is another procedure for this? Thanks. John

2 1

syslig-ng Agent for Windows supported OS
by John MacDonald 27 Apr '10

27 Apr '10

Issue resolved I was running the run installer. John

1 0

syslig-ng Agent for Windows supported OS
by John MacDonald 27 Apr '10

27 Apr '10

I am trying to configure the Windows Syslog-Ng agent on Windows 2003 R2 and Windows 2008 Standard. The installer will run and a Service is installed, but I do not have any of the features or configuration options. Can you tell me if the Operating Systems listed above are supported? I am using version syslog-ng-agent-setup-3.1.0-amd64.msi Thanks. John

1 0

filter after source or indifferent?
by Giovanni Mancuso 27 Apr '10

27 Apr '10

Hi, i have a question about syslog-ng configuration. I configure my log path in this way: log { source(s_funambol); destination(d_network); filter(f_funambol); }; And it doesn't work. If i configure the log path in this way: log { source(s_funambol); filter(f_funambol); destination(d_network); }; It works. Is it normal? Is required that the filter goes after the source? Thanks

2 1

Re: [syslog-ng] Process stored logs
by noel anderson 26 Apr '10

26 Apr '10

Thanks patrick. This raises another question, how can I Quantify processed logs. Like what is been processed/ un-processed/ lost. Thanks, Noel (hsxtrt) Date: Thu, 22 Apr 2010 11:26:59 -0600 From: "Patrick H." <syslogng(a)feystorm.net> Subject: Re: [syslog-ng] Process stored logs To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <4BD086E3.3030200(a)feystorm.net> Content-Type: text/plain; charset="iso-8859-1" The log_fifo_size variable controls how many messages the output buffer will hold. So if server Z is relaying to A, and A goes down, Z will start storing messages in this buffer. Unfortunately there is no way to say 'if destination A fails, log to destination A2 (which may be a file output or something) instead'. The premium version does support disk-based buffering though, so that if log_fifo_size fills up, it'll start writing out to a disk based file instead. Sent: Thursday, April 22, 2010 12:13:40 AM From: noel anderson <nascentcatalyst(a)yahoo.com> To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Process stored logs > I'm building an infra across the geo's to collect logs at a central repository. I have set up syslog-ng in 3 geo's (say for e.g X, Y, Z) to collect logs form servers in respective Geo. A forurth server (say for eg. A) where the logs are forwarded from the 3 log servers to aggregate all the logs from all GEO's. > > The problem where I fail to understand is, if my aggregator server (A) goes down, how do i process my stored logs on (X,) (Y), (Z), so that i do not loose any logs during my downtime. > > Is it possible to process backlog of logs on the server or do i have to change my infra so that i do not loose these logs? > > Thanks > Noel (hsxtrt)

2 1

Re: [syslog-ng] syslog-ng 3.1.1 "cuts" of the first charater of the Apache error log when forwarding
by filip.nollet＠bayercropscience.com 26 Apr '10

26 Apr '10

Hi again First of all, I already used syslog-ng before, but I had no idea it was doing parsing, so this is normal :p I changed my configuration to use the no_parse function in the source driver of the webserver on which the syslog-ng client forwards the messages to the syslog server. This does the trick. I don't even have to change the configuration on the target syslog server which greatly reduces configuration file changes. Thx for the answer! Filip > Hi, > > > I have a weird problem with syslog-ng. I am setting up a syslog-ng > client on an Apache server which forward both access and error log > to a central syslog-ng server. > > First of all please note that you're trying to deal with > non-standard-compliant messages. syslog-ng tries to parse the incoming > log lines trying various known syslog formats. > > > The access log on the source has entries like this: > > 10.3.154.20 - - [23/Apr/2010:13:55:25 +0200] "GET /images/userLo... > > and this becomes like this on the syslog server: > > servername 10.3.154.20: - - [23/Apr/2010:13:55:25 +0200] "GET /images/use > > The first syslog-ng (which receives the apache log) parses the line. > There is no syslog header found so it falls back to the legacy format. > There is neither priority code nor timestamp so the IP address becomes > the program name. That's why you see it logger on the second server. > > > All ok with this one, but with the error log I get this on the webserver: > > [Fri Apr 23 13:55:25 2010] [error] [client 10.3.154.20] File doe... > > but this on the syslog server: > > servername Apr 23 13:55:25 2010] [error] [client 10.3.154.20] File do... > > > > Where is the [ character at the beginning of the timestamp gone????? > > As above, this line isn't a syslog message at all. From syslog's > perspective it's more or less random junk. The trailing '[' causes > that there is no program name at all and the parser thinks the > following string up to the closing ']' is the pid like in normal logs > eg. programname[pid] > > I don't see how could this "pid" appear on the receiving side with > only the closing brace. Please show your configs and the captured > network packet too. > > In general when an app doesn't speak syslog formats and there is no > option to format its logs properly then using the no-parse option (on > all syslog-ng servers the log passes through) or writing a small app > which reformats the logs and feeds to syslog-ng is the way to go. > > Regards, > > Sandor > ________________________________________________________________________ The information contained in this e-mail is for the exclusive use of the intended recipient(s) and may be confidential, proprietary, and/or legally privileged. Inadvertent disclosure of this message does not constitute a waiver of any privilege. If you receive this message in error, please do not directly or indirectly use, print, copy, forward, or disclose any part of this message. Please also delete this e-mail and all copies and notify the sender. Thank you. For alternate languages please go to http://bayerdisclaimer.bayerweb.com ________________________________________________________________________

1 0