- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support
by Hahusseau, Thomas 05 Mar '09

05 Mar '09

I changed it in the source and now the compilation crashed for cfg-grammar.y :( :( -----Message d'origine----- De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de Xavier Lapie Envoyé : jeudi 5 mars 2009 12:12 À : Syslog-ng users' and developers' mailing list Objet : Re: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support On Thu, Mar 05, 2009 at 10:50:29AM +0100, Xavier Lapie wrote: > On Thu, Mar 05, 2009 at 10:44:03AM +0100, Hahusseau, Thomas wrote: > > Yeah I enable the debug mode and open the core file with gdb. I can see a > > huge backtrace with a lot of "index out of range" error inside. If you I can > > attach the backtrace on this mailing list. I found something which could solve your problem. The tls context is not initialized when used in client mode, there is a typo in the cfg-grammar.y file. Just go to the line 899 and replace ENABLE_TLS by ENABLE_SSL. -- Xavier ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support
by Hahusseau, Thomas 05 Mar '09

05 Mar '09

Yeah I enable the debug mode and open the core file with gdb. I can see a huge backtrace with a lot of "index out of range" error inside. If you I can attach the backtrace on this mailing list. -----Message d'origine----- De : Xavier Lapie [mailto:bana@docisland.org] Envoyé : jeudi 5 mars 2009 10:30 À : Hahusseau, Thomas Objet : Re: [syslog-ng] Syslog-ng 3.0.1 seg fault with TLS support On Thu, Mar 05, 2009 at 09:39:46AM +0100, Hahusseau, Thomas wrote: > > The seg fault is on the client side and occurred only when I enable the TLS > encryption (it works well with clean transmission). Anyone could help me to > fix that problem? If you need some additional information just let me know. Hi, Did you enable debugging code and what does gdb tell you about the crash ? -- Xavier

2 2

Syslog-ng 3.0.1 seg fault with TLS support
by Hahusseau, Thomas 05 Mar '09

05 Mar '09

Hi, I have a bad segmentation fault when I'm trying to launch syslog-ng version 3.0.1 on Mandriva 2009 used a as a syslog-ng client. I wan't that the messages are forwarded to another syslog-ng host in an encrypted way with TLS. I use a PEM formatted CA certificate on my client. And a self signed certificate (from the same CA) on the "server". The seg fault is on the client side and occurred only when I enable the TLS encryption (it works well with clean transmission). Anyone could help me to fix that problem? If you need some additional information just let me know. Thomas Hahusseau

1 0

permission denied ater adding a file as source-driver
by gatfi sami 04 Mar '09

04 Mar '09

Hi it is me again no one had answered my previous questions until now but i 'll never loose hope so here is another one I am killing my self to add a file as a source driver in syslog-ng repeat i installed 1.6.12-76.2 in open suse 11.0 i used > source my_src { > > #internal(); > > #file("/var/log/apache2/error_log"); > #perm(0666); > > #unix-dgram("/dev/log"); *see i tried alot of thing before i asked you* > file("/var/lib/mysql/mysqld.log"); > > > > > }; and here is the error Shutting down syslog services done Re-Starting syslog servicesError opening file /var/lib/mysql/mysqld.log for r*eading (Permission denied)* Error initializing configuration, exiting. I also tried to change the file's permission by the way is this the best way to log mysql arror log to a syslog client thks

2 1

Which macros are available for filtering ?
by Vincent Panel 04 Mar '09

04 Mar '09

On a test machine, I've set up syslog-ng with a filter which looks like this : filter filter1 { match(".+" VALUE ("MACRO")); }; I've tried many MACROS and it seems only a few of them are not empty (easy to spot using this regex). The most surprising is that several documented macros are empty : for instance, MSGHDR and MSG (MSG should be the same than MESSAGE, but looks like it's not). Is it a bug ? Thanks,

2 2

creating new facility help the beginner ( me i am sinking)
by gatfi sami 03 Mar '09

03 Mar '09

hey over here i 2009/2/28 gatfi sami <pfegatfi.sami(a)gmail.com> > hi i am a student > > i installed 1.6.12-76.2 in open suse 11.0 > > > > i am asked to create a new costumised facility ( newfacility ) in bothe > syslog-ng cient and server for exemple so > Errorlog syslog:newfacility ( in /etc/apache2/mod_log.conf. config) > > is it possible > > another thing please > > if not > > i use local 1 (Errorlog syslog:local1) and it work > > if i send mysql error log also in local1 > > can i seperate them in different destination ( file )on my syslogserver. > > i discovered that local1 uses * unix-dgram("/dev/log") *wich one of the soource availble in syslog-ng plz if i am saying wron gthings let somone correct me whay i do not use unix-dgram("/dev/log"); directly here what i tried and it did not work /etc/apache2/mod_log_config.conf Errorlog unix-dgram("/dev/log"); and in /etc/syslog-ng/syslog-ng source my_src{ unix-dgram("/dev/log"); } destination my_dest { udp("192.168.1.66" port(514)); }; log {source(my_src); destibation (my_dest)}; in other way how can i use this unix-dgram() thxs * * >

1 0

db-parser explained
by Balazs Scheidler 03 Mar '09

03 Mar '09

Hi, I've tried to summarize what the new db-parser() infrastructure does inside syslog-ng in a blog post, here: http://bazsi.blogs.balabit.com/ If you are insterested in using logs for anything more than merely storing it, please read the article. :) -- Bazsi

1 0

syslog-ng takes 100% CPU(RHEL 5)
by Yoshinobu Ushida 03 Mar '09

03 Mar '09

Dear Bazsi-san, Thank you for the reply. > The link for the libdbi package that you need is: Thank you very much. > But the real question is whether your experienced 100% CPU usage is the > same as the fix in 2.1.3. Can you post an strace of the running process > as it is eating your CPU? I post result of an strace.(following) Actually a lot of results were output. I post a part. But I don't understand whether the result of strace is helpful. Please teach if there is an option of strace that I should use. Best Regards, Yoshinobu [root@abc-dbelog tmp]# date Tue Mar 3 14:37:15 JST 2009 [root@abc-dbelog tmp]# top top - 14:38:54 up 43 min, 2 users, load average: 1.47, 1.69, 1.19 Tasks: 116 total, 3 running, 112 sleeping, 0 stopped, 1 zombie Cpu(s): 70.3%us, 28.7%sy, 0.0%ni, 0.0%id, 0.0%wa, 0.0%hi, 1.0%si, 0.0%st Mem: 1002888k total, 649304k used, 353584k free, 33820k buffers Swap: 2031608k total, 0k used, 2031608k free, 417064k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 3243 nobody 25 0 2860 1028 780 R 96.3 0.1 13:44.22 syslog-ng 2444 root 15 0 63644 21m 8208 S 2.0 2.2 1:37.41 Xorg 3288 root 16 0 2164 1096 828 S 1.0 0.1 0:04.91 top 1 root 15 0 2036 680 580 S 0.0 0.1 0:00.37 init #the rest is omitted. [root@abc-dbelog tmp]# strace -p 3243 Process 3243 attached - interrupt to quit open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 39213}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 39728}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 40197}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 41142}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 41623}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 42082}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 43016}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 43485}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 43948}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 47301}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 47879}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 48362}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 49305}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 49755}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 50208}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 51143}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 51627}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 52090}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 53030}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 53510}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 53978}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 54909}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 77672}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 78431}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 126560}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 127445}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 128096}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 129853}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 130491}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 131094}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 132336}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 132916}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 133524}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 134748}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 135348}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 135815}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 139123}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 139621}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 140099}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 141042}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 141529}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 142001}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 142946}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 143732}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 144220}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 145174}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 145675}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 146132}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 169567}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 170223}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 194044}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 268568}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 269240}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 269882}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 271113}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 271764}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 272372}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 273582}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 274220}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 274825}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 276032}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 276533}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 278996}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 279994}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 280481}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 280951}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 281882}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 282337}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 282800}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 283733}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 284402}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 284936}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 285965}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 286454}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 286928}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 310466}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 311108}, NULL) = 0 #the rest is omitted. -- Yoshinobu Ushida <y-ushida(a)nttpc.co.jp>

1 0

Re: [syslog-ng] File descriptor leaks with 3.0.1
by chris packham 02 Mar '09

02 Mar '09

On Mon, 2009-03-02 at 09:33 +1300, chris packham wrote: > On Sat, 2009-02-28 at 14:56 +0100, Balazs Scheidler wrote: > > On Fri, 2009-02-27 at 11:02 +1300, chris packham wrote: > > > Ping. Any interest in this? > > > > > > Should I submit something into bugzilla? Write a test case? Send the > > > patch as a separate email? > > > > I've already integrated this. Sorry for having taken so long. I was > > distracted by other things. > > I completely understand. Just wanted to make sure I hadn't missed a > reply that was waiting for me to do something. > Also just for my own future reference. Is it OK for these to go straight to the list or would you prefer that a bugzilla entry is created with the patch attached to it?

2 1

Configuration question, logging to db not working.
by Liam Kirsher 01 Mar '09

01 Mar '09

Hi -- I am /almost/ there, logging to Postgres database. However, I've discovered a puzzling and problematic behavior.This is probably just some simple misunderstanding on my part, since this is my first foray into syslog-ng. I am logging to two different db tables. Which table I log to is determined by a regexp filter. The value is either root.ut_access or root.geocode. I can get either one to work, but not both at the same time. If I comment out the log entry for the geocode, then ut_access works. However, if both log entries exist, only the gecocode_access_log table gets a new row. Nothing is logged to the ut_access_log table! (Both messages are logged to d_obsidian destination file, however.) I've attached my config file. Any tips would be greatly appreciated!!! Liam ---------------------------------- @version:3.0 # syslog-ng configuration file. options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" program_override("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(5000) max-connections(1000)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; destination d_obsidian { file("/var/log/django/$PROGRAM/$R_YEAR$R_MONTH$R_DAY.log"); }; destination d_ut_access { sql( type(pgsql) host("localhost") username("postgres") password("xxxxxx") database("prodlogs") table("ut_access_log") columns("datetime", "query_time", "host", "program", "pid", "request_id", "level", "ip", "phone_id", "phone_type", "software_version", "client_version", "query_string", "art_id", "session_id", "lat", "lng") values("$R_ISODATE", "${UT.QTIME}", "$HOST", "$PROGRAM", "$PID", "${UT.REQUEST_ID}", "$LEVEL", "${UT.IP}", "${UT.PHONE_ID}", "${UT.PHONE_TYPE}", "${UT.SOFTWARE_VERSION}", "${UT.CLIENT_VERSION}", "${UT.QUERY_STRING}", "${UT.ART_ID}", "${UT.SESSION_ID}", "${UT.LAT}", "${UT.LNG}") indexes("datetime", "host", "program", "ip", "phone_id") ); }; destination d_geocode { sql( type(pgsql) host("localhost") username("postgres") password("xxxxxx") database("prodlogs") table("geocode_access_log") columns("datetime", "querytime", "host", "program", "pid", "request_id", "level", "ip", "name", "place", "lat", "lng") values("$R_ISODATE", "${GEO.QTIME}", "$HOST", "$PROGRAM", "$PID", "${GEO.REQUEST_ID}", "$LEVEL", "${GEO.IP}", "${GEO.NAME}", "${GEO.PLACE}", "${GEO.LAT}", "${GEO.LNG}") indexes("datetime", "host", "program", "pid", "ip", "name", "place") ); }; parser p_ut_access { csv-parser( columns("UT.QTIME", "UT.IP", "UT.REQUEST_ID", "UT.CATEGORY", "UT.MYLEVEL", "UT.PHONE_ID", "UT.PHONE_TYPE", "UT.SOFTWARE_VERSION", "UT.CLIENT_VERSION", "UT.QUERY_STRING", "UT.ART_ID", "UT.SESSION_ID", "UT.LAT", "UT.LNG") delimiters(",") quote-pairs('""') flags(escape-double-char, strip-whitespace) ); }; parser p_geocode { csv-parser( columns("GEO.QTIME", "GEO.IP", "GEO.REQUEST_ID", "GEO.CATEGORY", "GEO.MYLEVEL", "GEO.NAME", "GEO.PLACE", "GEO.LAT", "GEO.LNG") delimiters(",") quote-pairs('""') flags(escape-double-char, strip-whitespace) ); }; #filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; filter f_obsidian { program("^obsidian$") and level(info); }; filter f_ut_access { filter(f_obsidian) and message("root\.ut_access"); }; filter f_geocode { filter(f_obsidian) and message("root\.geocode"); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_sys); filter(f_ut_access); parser(p_ut_access); destination(d_ut_access); }; ### With this log entry commented out, logging to d_ut_access works. But if I uncomment it, nothing is logged to d_ut_access! ### What am I missing? #log { #source(s_sys); #filter(f_geocode); #parser(p_geocode); #destination(d_geocode); #}; log { source(s_sys); filter(f_obsidian); destination(d_obsidian); }; -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

2 7

Re: [syslog-ng] File descriptor leaks with 3.0.1
by chris packham 01 Mar '09

01 Mar '09

On Sat, 2009-02-28 at 14:56 +0100, Balazs Scheidler wrote: > On Fri, 2009-02-27 at 11:02 +1300, chris packham wrote: > > Ping. Any interest in this? > > > > Should I submit something into bugzilla? Write a test case? Send the > > patch as a separate email? > > I've already integrated this. Sorry for having taken so long. I was > distracted by other things. I completely understand. Just wanted to make sure I hadn't missed a reply that was waiting for me to do something.

1 0

creating new facility
by gatfi sami 28 Feb '09

28 Feb '09

hi i am a student i installed 1.6.12-76.2 i am asked to create a new costumised facility ( newfacility ) in bothe syslog-ng cient and server for exemple so Errorlog syslog:newfacility ( in /etc/apache2/mod_log.conf.config) is it possible another thing please if not i use local 1 (Errorlog syslog:local1) if i send mysql error log also in local1 can i seperate them in different destination ( file )on my syslogserver. thkx

1 0

[Bug 35] New: syslog-ng crashes with a certain .conf
by bugzilla＠bugzilla.balabit.com 28 Feb '09

28 Feb '09

https://bugzilla.balabit.com/show_bug.cgi?id=35 Summary: syslog-ng crashes with a certain .conf Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: tek(a)serverop.de Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=13) --> (https://bugzilla.balabit.com/attachment.cgi?id=13) example syslog-ng.conf that produces the segfault If syslog-ng is started ./syslog-ng -f /etc/syslog-ng/syslog-ng.conf --pidfile=/tmp/foo.pid then it will segfault: Feb 28 00:13:50 basra kernel: syslog-ng[2974]: segfault at bf418ffc ip b7ca9cc3 sp bf419000 error 6 in libc-2.8.so[b7c01000+130000] If the 31th line is uncommented, syslog-ng starts just fine. # ./syslog-ng -V syslog-ng 3.0.1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#93a342dae3a2b0cb15811d0c34ea7f58b3fba14e Compile-Date: Feb 27 2009 23:56:41 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Re: [syslog-ng] File descriptor leaks with 3.0.1
by chris packham 28 Feb '09

28 Feb '09

Ping. Any interest in this? Should I submit something into bugzilla? Write a test case? Send the patch as a separate email? On Tue, 2009-02-17 at 09:58 +1300, chris packham wrote: > On Mon, 2009-02-16 at 15:52 +1300, chris packham wrote: > > Also seems to be present in the latest version checked out from the git repo but I'll do some more digging. > > > > I've confirmed that this does indeed happen on the latest version from > the git repo. I've attached a patch that addresses this. Looks like the > 'include' implementation assumes that yy_switch_to_buffer closes the old > file (which flex 2.5.33 doesn't, I haven't tried other versions). > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html >

2 1

[patch] only stat dns_cache_hosts file once in a second
by ILLES, Marton 28 Feb '09

28 Feb '09

Hi, I was doing today some performance tests where use_dns(yes) and persistent dns cache (dns_cache_hosts) were configured and I got awful results. When I disabled dns_cache_hosts the message rate doubled. After a quick check I realized that for every message a dns cache lookup was performed which stat()-ed my dns_cache_hosts file. However it does not make much sense to check the file for modification so often, I guess once a second is enough most of the cases. In my test configuration I received msgs over syslog() source and sent to an empty destination. The server was a 2way quad-core 1.9GHz Opteron box running 32bit syslog-ng and messsages were generated with loggen. >From an average 80,000-90,000 msg/s using the fix I could do 220,000-230,000 msg/s. Interesting that on my laptop (dual-core 2.4GHz Intel 64bit) the performance gain was smaller from 90,000 to 100,000 msg/s. I am still wondering about this big difference, specially because my laptop has higher frequency CPU... Anyhow the patch could be found in my git repo, Bazsi please apply. git://git.balabit.hu/marci/syslog-ng-3.0.git M -- Key fingerprint = F78C 25CA 5F88 6FAF EA21 779D 3279 9F9E 1155 670D

2 1

Re: [syslog-ng] syslog-ng Digest, Vol 46, Issue 31
by 牛田　善信 28 Feb '09

28 Feb '09

Dear Bazsi-san, Thank you for the reply. >what kind of binaries are you using? PE/OSE binaries supplied by >BalaBit, or you are using binaries from another source? I am using what downloaded from rpmsearch. It is following URL. http://rpm.pbone.net/index.php3/stat/4/idpl/10055325/com/syslog-ng-2.1.1-5.… And, I used syslog-ng-2.1.3-1 supplied by balabit. I have done the question with indefinite purpose of me. My final purpose is to get rid of CPU use rate 100%. Could you direct the best possible method that I should do? Best Regards, Yoshinobu

2 1

Re: [syslog-ng] File descriptor leaks with 3.0.1
by chris packham 28 Feb '09

28 Feb '09

On Mon, 2009-02-16 at 15:52 +1300, chris packham wrote: > Also seems to be present in the latest version checked out from the git repo but I'll do some more digging. > I've confirmed that this does indeed happen on the latest version from the git repo. I've attached a patch that addresses this. Looks like the 'include' implementation assumes that yy_switch_to_buffer closes the old file (which flex 2.5.33 doesn't, I haven't tried other versions).

2 1

high memory usage (swapping)
by Otto Berger 27 Feb '09

27 Feb '09

Hi, today i got a weird cenario: i rebooted our syslog-ng server and forgot to start the syslog-ng daemon. So far so (not) good. One of our webservers which sends his logs via UDP to the syslog-server became suddenly very slow. It is reproducable: whenever i stop the central syslog-server the sender-servers syslog-ng-process gets a very high memory usage (4GB!) within seconds... The log-traffic on this server is about 30MB/day... UDP is a connection-less protocol isnt? ;) The configuration of the sender-server: ----- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination a_udp { udp( "example.com" port(514) ); }; #log { source(s_sys); destination (a_udp); }; ----- sender: syslog-ng 2.1.3 reciever: syslog-ng 2.1.2 someone got an idea on this issue? Otto

2 2

Load balancing using $SEC
by Vincent Panel 27 Feb '09

27 Feb '09

Hi, I'm trying to do some kind of load-balancing using syslog-ng. I'm willing to write to 2 different files named "syslog1" and "syslog2". The first one would get all messages received by syslog whose timestamp have a second ending with 0, 1, 2, 3 or 4. Syslog 2 would get all messages whose second ends with 5, 6, 7, 8 or 9. For instance, if I get those messages : Feb 27 00:00:03 blabla1 Feb 27 00:00:04 blabla2 Feb 27 00:00:05 blabla3 Feb 27 00:00:06 blabla4 The first two messages would end up in syslog1 and the last 2 messages would end up in syslog2 However, I was not able to do this because : * filtering is not possible on any date-related macro (I don't know why, but only MSG and MSGHDR macros seem populated at that point in time) * I can't apply a rewrite rule on $SEC * I can't apply any function to the $SEC macro in the destination statement, or I don't know how to do it Do you think it's still possible to achieve what I want with syslog-ng ? Vincent

1 0

creating new custumised facility
by gatfi sami 26 Feb '09

26 Feb '09

Hi i am getting started with syslog can i add a new facility different from ( mail ... local0 to 7) what i did til now is sending every thing (src) to a syslog server via udp #########" client syslog > filter myfil1 { facility(local1); };# let only local1 = error log apache > > destination loghost { > udp("192.168.1.66" port(514)); > }; > log { > source(src); > > filter(myfil1); > destination(loghost); > }; > ###Server syslog source src { > # > # include internal syslog-ng messages > # note: the internal() soure is required! > # > # internal(); > > # > # the default log socket for local logging: > # > # unix-dgram("/dev/log"); > > # > # uncomment to process log messages from network: > # > #udp(ip("0.0.0.0") port(514)); > udp(port(514)); > > > }; > source src { > # > # include internal syslog-ng messages > # note: the internal() soure is required! > # > # internal(); > > # > # the default log socket for local logging: > # > # unix-dgram("/dev/log"); > > # > # uncomment to process log messages from network: > # > #udp(ip("0.0.0.0") port(514)); > udp(port(514)); > > > }; > and sent Apache erreor to syslog :local1 /mod_log_config.conf Errorlog syslog:local1 ************** what i tried and didnot work is adding /var/log/apache2/errorlog as sorce because of permession denial and using unix-stream unix-dgram pipe ( i created file with) mkififo between apache and syslog nothing so sorry if i am bothering but my questions are 1 can i add a new facility like local1 and collect on it apapche error log if no is Errorlog syslog: local1 the *best* way with a filter on local1 2 does local1in my case contain only appache error log 3 if there is another way be my gest i am hering Sorry am not good in eglish

1 0

Syslog-ng refuses to create directories on Linux
by John Chajecki 24 Feb '09

24 Feb '09

We have been running a syslog server on a Solaris server for some time. The server collects syslogs from a number of sources and places the log data into separate files for each system according to the host IP address and date. Recently, we have begun migrating the facility to a Linux server running Novell SuSE Linux 10. (SLES10) 64bit. We are running syslog-ng version 2.0.9-6.1 for the 64bit platform which I obtained from OpenSuSE and that is supposed to be compatible with SLES10. The problem is that although I am using essentially the same config file I am getting my log filled with: Feb 24 14:55:04 itssyslog syslog-ng[10090]: Error opening file for writing; filename='/media/syslog/HOSTS/192.168.1.146', error='Permission denied (13)' The directories /media, /media/syslog and /media/syslog/HOSTS have permissions of 0640. This is what happens in strace: open("/var/run/syslog-ng.pid", O_WRONLY|O_CREAT|O_TRUNC|O_NOCTTY, 0600) = 7 write(7, "10090", 5) = 5 close(7) = 0 open("/dev/null", O_RDONLY) = 7 dup2(7, 0) = 0 close(7) = 0 open("/dev/null", O_WRONLY) = 7 dup2(7, 1) = 1 dup2(7, 2) = 2 close(7) = 0 setsid() = 10090 poll([{fd=3, events=POLLIN}, {fd=4, events=POLLIN}], 2, 0) = 0 uname({sys="Linux", node="itssyslog", ...}) = 0 open("/var/log/messages", O_WRONLY|O_NONBLOCK|O_APPEND|O_CREAT|O_NOCTTY, 0640) = 7 fcntl(7, F_GETFD) = 0 fcntl(7, F_SETFD, FD_CLOEXEC) = 0 fchown(7, 0, 4294967295) = 0 fchown(7, 4294967295, 0) = 0 fchmod(7, 0640) = 0 poll([{fd=7, events=POLLOUT, revents=POLLOUT}, {fd=3, events=POLLIN}, {fd=4, eve nts=POLLIN}], 3, 29983) = 1 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1323, ...}) = 0 write(7, "Feb 24 14:16:50 itssyslog syslog"..., 83) = 83 poll([{fd=3, events=POLLIN}, {fd=4, events=POLLIN, revents=POLLIN}], 2, 29983) = 1 recvfrom(4, "<22>Feb 24 14:12:24 192.168.193."..., 8192, 0, {sa_family=AF_INET, sin_port=htons(61643), sin_addr=inet_addr("192.168.1.146")}, [16]) = 155 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1323, ...}) = 0 brk(0x5be000) = 0x5be000 brk(0x5df000) = 0x5df000 open("/media/syslog/HOSTS/192.168.1.146/2009/02/24/192.168.1.146.log", O_WRONLY| O_NONBLOCK|O_APPEND|O_CREAT|O_NOCTTY, 0640) = -1 ENOENT (No such file or directory) stat("/media", {st_mode=S_IFDIR|0640, st_size=4096, ...}) = 0 stat("/media/syslog", {st_mode=S_IFDIR|0640, st_size=4096, ...}) = 0 stat("/media/syslog/HOSTS", {st_mode=S_IFDIR|0640, st_size=4096, ...}) = 0 stat("/media/syslog/HOSTS/192.168.1.146", 0x7fff7eb5c400) = -1 ENOENT (No such file or directory) mkdir("/media/syslog/HOSTS/192.168.1.146", 0640) = -1 EACCES (Permission denied) recvfrom(4, 0x583fe0, 8192, 0, 0x7fff7eb5c780, 0x7fff7eb5c80c) = -1 EAGAIN (Resource temporarily unavailable) poll([{fd=3, events=POLLIN}, {fd=4, events=POLLIN}], 2, 0) = 0 ..... For some reason, the syslog-ng daemon tries to create the directory structure but fails with the Permission denied error. itssyslog:/var/log # The daemon is running as root: ps -ef |grep syslog-ng root 10077 1 0 14:15 ? 00:00:00 /sbin/syslog-ng I have tried creating a directory structure manually and I have no problem creating, writing to and removing the directories. Just to test, I created another directory stucture /syslog/HOSTS with permissions 0777. I restarted the syslog-ng service but I got the same error. I also ran the syslog-ng executable manually as root, but still got the same problem. What's stopping syslog-ng from creating the directory structure? Does it perhaps run in a chroot jail by default? As I mentioned, this worked fine on the Solaris system. John.

2 3

syslog-ng takes 100% CPU(RHEL 5)
by Yoshinobu Ushida 24 Feb '09

24 Feb '09

Hello, We are running syslog-ng-2.1.1-5.el5 on a RHEL5. The problem in HP-UX was heard fixed and I want to do the upgrade. but,libdbi8.so.0() is necessary for 2.1.3. This is not found. Where is libdbi8.so.0()? Please tell me. I am sorry in clumsy English. I hope help.

2 1

Kevin Gorski/IS/NEU is out of the office.
by K.Gorski＠neu.edu 23 Feb '09

23 Feb '09

I will be out of the office starting Mon 02/23/2009 and will not return until Mon 03/02/2009. I will respond to your message when I return Thursday morning.

1 0

3.01 Starting system logger: Error resolving user; user='root'
by Tim Boyer 17 Feb '09

17 Feb '09

I've compiled and installed 3.0.1. I'm seeing something surface that was a reported bug in the 2.1 era. Perhaps it's the same patch? [root@princeton syslog-ng-3.0.1]# service syslog-ng start Starting system logger: Error resolving user; user='root' syntax error in /etc/syslog-ng.conf at line 61. [FAILED] root exists, of course, and it doesn't matter which username I put there - good or bad, they all fail. -- Tim Boyer Denman Tire Corporation

2 2

file source driver questions
by Michael Hocke 17 Feb '09

17 Feb '09

Hi, I have an application here that does not use syslog but writes all log messages straight into a file. I want to use syslog-ng to pick up the entries of that file and send them over to my log repository via syslog. I am running 3.0.1 and the config looks as follows: * Client side (radserver): source s_accounting { file ("/opt/CSCOar/logs/accounting.log" follow_freq (1) program_override ("radius") flags (no-parse)); }; destination d_archive { udp ("a.b.c.d"); }; log { source (s_accounting); destination (d_archive); }; * Server side (a.b.c.d): source s_udp { udp (); }; destination d_radius { file ("/usr/local/var/log/remote/$HOST_FROM/ accounting.log" template ("$MSGONLY\n")); }; filter f_radius { host ("radserver") and facility (kern); }; log { source (s_udp); filter (f_radius); destination (d_radius); flags (final); }; That works but there are a couple of minor things. - By default all messages coming from the file source driver are tagged with the kern facility. I was not able to find this in the documentation but the source code (cfg-grammar.y) revealed that the file driver accepts the options "facility()" and "level()" to change this behavior. source s_accounting { file ("/opt/CSCOar/logs/accounting.log" follow_freq (1) program_override ("radius") flags (no-parse) facility (local7)); }; fixed that problem. - Empty lines seem to be ignored and not transmitted. The entries: "La la blah blah Hi There good-bye" end up as "La la blah blah Hi There good-bye" in my log file on the server side. Is there a way to enable that? Thanks! - Michael

2 2