- syslog-ng - lists.balabit.hu

incorrect firewall logs with syslogng-2.0.0 [security error?]
by Jacek Kalinski 12 Mar '08

12 Mar '08

Hello, After upgradeing from syslogng-1.6.11 to 2.0.0 I've got a strange messages in /var/log/messages file: Nov 29 08:14:05 denise WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 11:10:19 denise PT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 Nov 29 16:42:16 denise W=0 RES=0x00 RST URGP=0 Nov 29 21:37:15 denise 116 ID=34901 DF PROTO=TCP SPT=3584 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0 These are truncated iptables logs. Because in firewall.log file are simmilar entries to truncated one, I think full file should be: Nov 29 11:10:19 denise firewallp=INVALID:1 a=DROP IN=eth1 OUT= MAC=00:30:4f:36:2b:dc:00:04:9a:2c:7f:20:08:00 SRC=193.41.230.81 DST=xxx.xxx.xxx.x LEN=576 TOS=0x00 PREC=0x00 TTL=117 ID=3495 PROTO=TCP SPT=443 DPT=34536 WINDOW=16985 RES=0x00 ACK URGP=0 (xxx.xxx.xxx.x is a real server IP address - one 'x' is one digit) Config file with interesting lines: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(root); dir_group(root); owner(root); group(root); }; source local { unix-stream("/dev/log" max_connections(300)); file("/proc/kmsg"); # udp(ip(0.0.0.0) port(514)); internal(); }; # ..... # authpriv.none;cron.none;mail.none;news.none -/var/log/messages filter f_2 { not facility(news); }; filter f_3 { not facility(local5); }; filter f_4 { not facility(local6); }; filter f_5 { not facility(authpriv); }; filter f_6 { not facility(cron); }; filter f_7 { not facility(mail); }; filter f_notlocal7 { not facility(local7); }; filter f_notfirewall { not match("firewallp="); }; destination d_2 { file("/var/log/messages" create_dirs(yes)); }; log { source(local); filter(f_2); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_notimapd); filter(f_notpopa3d); filter(f_notnamed); filter(f_notfirewall); destination(d_2); }; #..... # firewallp.* -/var/log/firewall.log filter f_16 { level(warning) and match("firewallp="); }; destination d_12 { file("/var/log/firewall.log" create_dirs(yes)); }; log { source(local); filter(f_16); destination(d_12); }; #..... Do you know where could be an error? It is a production server so I can't debug syslog-ng on this machine (sorry). NOTE: the only truncated lines I can find are iptables (AFAIR they are logged by /proc/kmesg) entries. All other lines are complete. And it is probably a critical error in security. PS: simple statistics line from syslog-ng: Nov 30 00:00:06 denise syslog-ng[32682]: Log statistics; dropped='pipe(/dev/tty12)=0', processed='center(queued)=758289', processed='center(received)=369020', processed='destination(d_maillogimapd)=4245', processed='destination(d_5)=1', processed='destination(d_4)=0', processed='destination(d_3)=14259', processed='destination(d_2)=14259', processed='destination(d_13)=0', processed='destination(d_1)=6000', processed='destination(d_12)=6000', processed='destination(d_11)=369020', processed='destination(d_10)=36', processed='destination(d_8)=0', processed='destination(d_maillogpopa3d)=103224', processed='destination(d_7)=241245', processed='destination(d_6)=0', processed='source(local)=369020' I think you see that it could be a little hard to debug (with so many messages parsed by syslog-ng) ;) Jacek

3 6

[Bug 20] New: crash on SIGHUP if an optional log file input source is not present
by bugzilla＠bugzilla.balabit.com 12 Mar '08

12 Mar '08

https://bugzilla.balabit.com/show_bug.cgi?id=20 Summary: crash on SIGHUP if an optional log file input source is not present Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sayler(a)cs.duke.edu Type of the Report: bug Estimated Hours: 0.0 It looks like optional files break kill -HUP I have this in my configuration file pipe("/root/na/log/na.log" optional(yes)); Core was generated by `/usr/research/home/sayler/syslog-ng-2.0.8+20080303/src/syslog-ng -p /var/run/sy'. Program terminated with signal 11, Segmentation fault. #0 0x0805f1d5 in log_reader_get_pos (self=0x0) at logreader.c:506 506 res = lseek(self->fd->fd, 0, SEEK_CUR); (gdb) bt #0 0x0805f1d5 in log_reader_get_pos (self=0x0) at logreader.c:506 #1 0x08056a9f in affile_sd_deinit (s=0x8094a38, cfg=0x808f900, persist=0x8150db8) at affile.c:247 #2 0x08053bc2 in log_source_group_deinit (s=0x8094ac8, cfg=0x808f900, persist=0x8150db8) at sgroup.c:79 #3 0x080545d6 in log_center_deinit_component (key=0x8094b10 "s_all", value=0x8094ac8, self=0x8090260) at center.c:188 #4 0x08060642 in g_hash_table_foreach () #5 0x080549f1 in log_center_deinit (s=0x8090260, cfg=0x808f900, persist=0x8150db8) at center.c:281 #6 0x0804c800 in cfg_deinit (cfg=0x808f900, persist=0x8150db8) at cfg.c:218 #7 0x0804cd8a in cfg_reload_config ( fname=0x808b640 "/etc/syslog-ng/syslog-ng.conf", cfg=0x808f900) at cfg.c:383 #8 0x0804af1e in main_loop_run (cfg=0xbfa15638) at main.c:169 #9 0x0804b5cd in main (argc=5, argv=0xbfa156f4) at main.c:434 (gdb) list 501 off_t 502 log_reader_get_pos(LogReader *self) 503 { 504 off_t res; 505 506 res = lseek(self->fd->fd, 0, SEEK_CUR); 507 508 if (res >= 0) 509 return res - self->ofs; 510 return res; ... (gdb) print self $1 = (LogReader *) 0x0 (gdb) up #1 0x08056a9f in affile_sd_deinit (s=0x8094a38, cfg=0x808f900, persist=0x8150db8) at affile.c:247 247 cur_pos = log_reader_get_pos((LogReader *) self->reader); (gdb) list 242 if (persist) 243 { 244 gchar str[32]; 245 off_t cur_pos; 246 247 cur_pos = log_reader_get_pos((LogReader *) self->reader); 248 g_snprintf(str, sizeof(str), "%" G_GINT64_FORMAT, (gint64) cur_pos); 249 250 persist_config_add_survivor(persist, affile_sd_format_persist_name(self), str); 251 } (gdb) print self $2 = (AFFileSourceDriver *) 0x8094a38 (gdb) print (self A syntax error in expression, near `'. (gdb) print *self $3 = {super = {super = {ref_cnt = 1, pipe_next = 0x8094ac8, init = 0x80567c3 <affile_sd_init>, deinit = 0x8056a7f <affile_sd_deinit>, queue = 0x80538c3 <log_pipe_forward_msg>, free_fn = 0x8056b38 <affile_sd_free>, notify = 0x80565df <affile_sd_notify>}, optional = 1, drv_next = 0x0}, filename = 0x808f530, reader = 0x0, reader_options = {source_opts = { init_window_size = 100, window_size = 100}, options = 0, padding = 0, prefix = 0x0, msg_size = 8192, follow_filename = 0x8094aa0 "/root/na/log/na.log", follow_freq = -1, fetch_limit = 10, zone_offset = -1, keep_timestamp = 1, bad_hostname = 0x0}, flags = 1} -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

Syslog-ng losing messages on solaris 10
by AndyH＠nominet.org.uk 12 Mar '08

12 Mar '08

Hi, I've been running 2.0.6 on Solaris 10 and it all seemed to be working fine. On a new application I have found that it loses messages. This application sends 3-7000 messages/sec. Part of these messages contains a unique ID which increments. When I run the syslogd as supplied with Solaris 10 then all messages get logged, but when I use syslog-ng then it loses messages. On a Sun V210 I see these messages message overflow on /dev/log minor #6 -- is syslogd(1M) running? message overflow on /dev/log minor #6 -- is syslogd(1M) running? message overflow on /dev/log minor #6 -- is syslogd(1M) running? on the console, and eventually there is a hardware reset and the server reboots. I have tried running syslogd to just pass messages on to syslog-ng and this doesn't cause the hardware reset, but still loses some messages. I have also tried the time_sleep and log_fetch_limit options with no success. I have noticed that syslogd is multi-threaded but syslog-ng is only single threaded. Is this what is causing these messages to get missed? Are there any plans for a threaded version? Anyone have any ideas as to how to get all messages logged with syslog-ng? Regards Andy

2 10

Mail Alert
by John Duraisw 11 Mar '08

11 Mar '08

Hello, I am doing the following intercept stuff, and everything seems to be working fine. What I want to do is, in the subject line I want to parse the hostname. Could you guys help me with this. Thanks, -john destination mail-alert { program("/usr/local/bin/syslog-mail.sh"); }; filter f_config_alert { ( ( host("host1") or host("host2") or host("host3") or host("host4") ) and match("Configured from console") ); }; # Send alert when some Genius configure something log { source(s_net); source(s_system); filter(f_config_alert); destination(mail-alert); }; [root@central-logger ~]# more /usr/local/bin/syslog-mail.sh #!/bin/sh RECIPIENTS"john(a)abc.com" while read line; do echo $line | /bin/mail -s "Config Change notification for $1" $RECIPIENTS done

1 0

Mail Alert
by John Duraisw 11 Mar '08

11 Mar '08

Hello, I am doing the following intercept stuff, and everything seems to be working fine. What I want to do is, in the subject line I want to parse the hostname. Could you guys help me with this. Thanks, -john destination mail-alert { program("/usr/local/bin/syslog-mail.sh"); }; filter f_config_alert { ( ( host("host1") or host("host2") or host("host3") or host("host4") ) and match("Configured from console") ); }; # Send alert when some Genius configure something log { source(s_net); source(s_system); filter(f_config_alert); destination(mail-alert); }; [root@central-logger ~]# more /usr/local/bin/syslog-mail.sh #!/bin/sh RECIPIENTS"john(a)abc.com" while read line; do echo $line | /bin/mail -s "Config Change notification for $1" $RECIPIENTS done

1 0

syslog-ng and log4j
by Sigurður Bjarnason 10 Mar '08

10 Mar '08

Hi All My first time on this list so be gentle J I have questions about syslog-ng and log4j. I am using syslog-ng as central server with syslog-ng on clients forwarding logs to the central server and I have notice that logs from java ( log4j ) are being dropped under heavy load, so I did some investigating and found out that log4j only send on UDP rather then TCP like all other logs . Is it possible to get log4j to send logs over TCP by sending logs from java to socket or otherwise, I would guess that log4j is not capable of sending logs to TCP since I have tried to take the udp section out of the syslog-ng config and then no logs are received from java L Can please someone tell me what my options are here, I really need to get logs from java over to the central server without this drop since these are the most critical logs on my system . Regards Siggi

2 3

Leap Year
by hi ro 06 Mar '08

06 Mar '08

Hi, Do you have any problem about Leap Year? Thanks hiro _________________________________________________________________ Hotmailユーザの半数近くが使用しています。Windows Liveメッセンジャー。 http://messenger.live.jp/

3 2

Parallel Use of syslog-ng with syslogd (Linux RH ES4)
by Diffenderfer, Randy 04 Mar '08

04 Mar '08

Folks, I haven't yet done the research here by RTFS'ing, so I apologize in advance for uninformed posting... :-) I'm looking at syslog-ng as a syslogd replacement in our shop. I'd like to determine in advance if there is a reasonable way to run these in parallel. In particular, are there supplied hooks to routines equivalent to syslog(3) in the C library? I understand that I can shut down syslogd and bring up syslog-ng listening to /dev/log, and things will be transparent to production code. I envision an environment where I have the RH syslogd listening to /dev/log, and syslog-ng listening to /dev/log-ng. Using perl and C routines, can I integrate my production code with minimal alterations to selectively use the new facility? Thanks for any advice, rnd

2 1

Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4
by Ivey, Chris 03 Mar '08

03 Mar '08

Sandor/ScottO, Thanks for the information that it works properly on old releases. If I could trouble you guys for *how* you made it work, that would be great. I did some testing using my personal Linux machine (FC5), and I could not get the application to install (could not find all the needed preliminaries). If you want to PM me for this, that would be fine, since I am sure the rest of the list does not need to be exposed to my lack of knowledge. (( For what it's worth - I inherited these machines, had nothing to do with the original setup/configuration, and now find myself as the owner/admin of an application I don't know much about. )) Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage On Mon, Mar 3, 2008 at 4:42 AM, Geller, Sandor (IT) <Sandor.Geller(a)morganstanley.com <mailto:Sandor.Geller@morganstanley.com> > wrote: Hi, > Folks, > I need to upgrade syslog-ng running on my 2 servers, > which are running Fedora Core 4. Is it possible to put 2.0.x > onto a machine running FC4? I was looking around this morning > for this information, and can't find anything that says "yay" > or "nay". Thanks! It should just work (TM). I'm using syslog-ng 2.0 on very old OS releases, all you might need is to install its requirements: eventlog, libnet, glib and optionally tcp-wrappers. Regards, Sandor -------------------------------------------------------- Agreed, fwiw, I have it working just fine on FC3.

2 1

Syslog-ng 2.0.x on Fedora Core 4
by Ivey, Chris 03 Mar '08

03 Mar '08

Folks, I need to upgrade syslog-ng running on my 2 servers, which are running Fedora Core 4. Is it possible to put 2.0.x onto a machine running FC4? I was looking around this morning for this information, and can't find anything that says "yay" or "nay". Thanks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

3 2

Problem with installation
by vempati Ramprasad 29 Feb '08

29 Feb '08

Hi frnds, When Iam trying to do a make on syslog-ng,Iam getting the following error.Could you let me know,how do I resolve this problem.Iam in desperate need for this. My configuration is : Redhat Linux : 3.2.2-5 Kernel : 2.4.31 eventlog-0.2.7.tar.gz syslog-ng-2.0.8.tar.gz. gcc version : 3.2.2 When I do "make" in syslog-ng directory....(After ./configure step) Iam getting the following error. "In file included from /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:61: parse error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:591: parse error before ')' token /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:624: parse error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/root/rams/syslog-ng-2.0.8/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/rams/syslog-ng-2.0.8' make: *** [all] Error 2 [root@ramprasad syslog-ng-2.0.8]#" Please help me. -ramprasad. Rgds, Ramprasad Vempati

2 1

Syslog-ng 2.0.x on FC4?
by Ivey, Chris 25 Feb '08

25 Feb '08

Folks, I need to upgrade my syslog-ng running on my 2 servers, which are running Fedora Core 4. Is it possible to put 2.0.x onto a machine running FC4? I was looking around this morning for this information, and can't find anything that says "yay" or "nay". Thanks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

1 0

syslog partialy ignores the firewall filter...
by eial＠cs.bgu.ac.il 24 Feb '08

24 Feb '08

I've setup an firewall and I want to log the rejects to a separate log file, I've done that but I've not been able to drop the messages from dmesg, here is my conf file # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo,v 1.7 2007/08/02 04:52:18 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux # contributed by Michael Sterrett options { chain_hostnames(off); sync(0); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; source src { unix-stream("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; #firewall filter f_firewall { match("Rejected: "); }; filter f_no_firewall { not match("Rejected: "); }; destination firewall { file("/var/log/iptables.log" owner("root") group("adm") perm(0640)); }; log { source(src); filter(f_firewall); destination(firewall); flags(final); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; # ...if you intend to use /dev/console for programs like xconsole # you can comment out the destination line above that references /dev/tty12 # and uncomment the line below. #destination console_all { file("/dev/console"); }; log { source(src); filter(f_no_firewall); destination(messages); }; log { source(src); destination(console_all); }; how can I fix it? thanks

3 3

time_sleep() and inadvertent admission control
by John Morrissey 22 Feb '08

22 Feb '08

About a year ago, I noticed heavy CPU consumption during certain workloads (many processes sending a small number of log messages per process, such as a busy Postfix machine) due to io_iter spinning very rapidly on poll(). We kludged around it by adding the time_sleep() directive, to add an artificial delay at the end of the io_iter loop and prevent the loop from rolling over too quickly: http://marc.info/?l=syslog-ng&m=114009552929622&w=2 We started using time_sleep(30) across all of our machines, since that delay value didn't seem to cause any problems for our workloads and we wanted to keep the configuration uniform. We noticed recently that time_sleep() exhibits some inadvertent admission control behavior. When poll() indicates that the listener socket has activity (new connections), syslog-ng seems to accept() only once on it, allowing one new connection per poll(). As a result, it only allows: 1000 / time_sleep() connections per second. Accordingly, with time_sleep(30), only 33 connections would be allowed every second. This became problematic when we added a logger into our qmail-pop3d chain. Normally, qmail-pop3d is invoked thusly: qmail-popup $HOSTNAME auth_pop qmail-pop3d ./Maildir/ qmail-popup starts, pops its args, and then exec()s what's left over. By default, qmail's POP3 daemon doesn't log user information, so we added a very simple syslogging script to this exec chain, like so: qmail-popup $HOSTNAME auth_pop qmail-loguser qmail-pop3d ./Maildir/ [jwm@periscope:pts/0 ~> cat qmail-loguser #!/bin/sh logger -t $(basename $0) -- "${HOME##*/} from $TCPREMOTEIP on $TCPLOCALIP" exec "$@" This was disastrous under load, since the admission control behavior caused by time_sleep() made logger(1) block, quickly causing the machine to run out of memory. I realize time_sleep() is a kludge, but more advanced dynamic tuning to replace it seems like it would be error-prone and difficult to troubleshoot when things go wrong. I would also argue that time_sleep() is meant to prevent spinning on poll() and its effect was not intended for *new connections*, since new connections did not cause the original problem of excessive CPU consumption. time_sleep() unnecessarily throttles new connections, which in workloads like qmail's are critical to scalability. For example, syslog-ng still consumes only ~2% of a dual 2.8GHz Xeon machine's CPUs even with this rapid-connection qmail workload. Instead, would it make sense for syslog-ng to accept() on the listener FD (it would need to be marked as non-blocking; I haven't looked into the ramifications if it isn't already) until there are no more new connections waiting, perhaps with a hard ceiling if starvation of other FDs is a worry? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

4 7

Why syslog-ng'config permission change ?
by hi ro 22 Feb '08

22 Feb '08

Hi, I installed syslog-ng. At that time, syslog-ng.conf's permission was 644. I let A user (not root) to update syslog-ng.conf, so I changed permission to 666. But I reboot the Server, then syslog-ng.conf's permission returned 644. Why ? Thanks hiro _________________________________________________________________ 出会いがない、と嘆いているあなたにぴったりの恋人探し！まずは無料検索！ http://match.jp.msn.com/channel/index.aspx?avo=1&trackingid=1034447

4 4

syslog-ng does not resume log when disk is full at first, and then disk space available
by Andrej Lobovski 21 Feb '08

21 Feb '08

Hi. I have a problem, with syslog-ng 2.0.0-1etch1 on debian 4. It is like this: - syslog-ng fills /var/log/syslog with messages - then /var partition becomes full and I get "No space left on device (28)" error written in /var/log/syslog (tail -f on this file), which is expected - then I make some disk space available on /var partition, BUT syslog-ng does not resume writing in /var/log/syslog at all Am I missing any options in /etc/syslog-ng/syslog-ng.conf ? Thank you very much Andrej Podgorsek _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

5 15

bugzilla down
by Balazs Scheidler 20 Feb '08

20 Feb '08

hi, I've just been told that bugzilla.balabit.com is currently down. I hope it can be fixed tomorrow. For the time being, just send bugreports to this list. Sorry for the outage. -- Bazsi

1 0

Syslog-ng sometime dies at 04:02
by Peter Michael Calum 20 Feb '08

20 Feb '08

Hi I have installed syslog-ng on RHEL 5 as an RPM (syslog-ng-2.0.8-1.fc8.i386.rpm). It runs fine except for this problem : Every night at 04:02 som script runs and make a reload of the configuration. This comes out with some errors in the messages file, but the real problem is, that syslog-ng sometime stops running at this time. I'm running syslog-ng together with php-syslog-ng Hope anyone can help rgds, Peter Calum Denmark Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))' My configuration file : options { sync (0); chain_hostnames(on); stats(43200); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; source s_everything { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_everything); destination(d_mysql); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; # vim:set ai ts=4 sw=4 sts=4 et:

5 19

Problem on RHEL4
by Abid Ghufran 17 Feb '08

17 Feb '08

Hello, While trying to compile syslog-ng from I am getting the following error. I have seen that many others have had the same problem but I could not find any solution. I am installing on RHEL4 and have used all the latest requisities for syslog-ng as follows: bison-2.3eventlog-0.2.5flex-2.5.34glib-2.14.6libnetpkg-config-0.20syslog-ng-2.0.8tcp_wrappers_7.6I would appreciate if someone could help me with this problem. Thanks and regards, Abid Ghufran. =============================================== make all-recursivemake[1]: Entering directory `/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8'Making all in srcmake[2]: Entering directory `/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src'gcc -g -O2 -Wall -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamiclibsyslog-ng.a(misc.o)(.text+0x3a9): In function `resolve_hostname':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/misc.c:191: undefined reference to `g_assert_warning'libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logmsg.c:110: undefined reference to `g_assert_warning'libsyslog-ng.a(logmsg.o)(.text+0x2b6): In function `log_msg_ref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logmsg.c:575: undefined reference to `g_assert_warning'libsyslog-ng.a(logmsg.o)(.text+0x342): In function `log_msg_unref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logmsg.c:589: undefined reference to `g_assert_warning'libsyslog-ng.a(logmsg.o)(.text+0x1132): In function `log_msg_ack_block_end':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logmsg.c:726: undefined reference to `g_return_if_fail_warning'libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logpipe.c:38: undefined reference to `g_assert_warning'libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logpipe.c:47: undefined reference to `g_assert_warning'libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/center.c:90: undefined reference to `g_assert_warning'libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/center.c:132: undefined reference to `g_assert_warning'libsyslog-ng.a(templates.o)(.text+0x2de): In function `log_template_ref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/templates.c:191: undefined reference to `g_assert_warning'libsyslog-ng.a(templates.o)(.text+0x396):/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/templates.c:202: more undefined references to `g_assert_warning' followcollect2: ld returned 1 exit statusmake[2]: *** [syslog-ng] Error 1make[2]: Leaving directory `/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src'make[1]: *** [all-recursive] Error 1make[1]: Leaving directory `/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8'make: *** [all] Error 2 _________________________________________________________________ Free games, great prizes - get gaming at Gamesbox. http://www.searchgamesbox.com

2 1

Reference counter width of log messages and group/user handling
by Roger J. Meier 14 Feb '08

14 Feb '08

Hi all, These patches fix two segmentation fault and abort signal problems which we encountered in our use case of syslog-ng 2.0.8. Patch 1: "syslog-ng-2.0.8-refcounter.diff". If specifying more than about 256 "destination" directives inside one log directive, then the reference counter of a log message wraps. The reference counter width of LogMessage is expanded from 8 bit to unsigned int (32 bit). Reason: The reference counter wraps after 256 increments, which causes an abort() call when decrementing the reference counter below 0 at a later time. The additional 3 bytes per message in memory seem to be affordable. Patch 2: "syslog-ng-2.0.8-group.diff". Handling of "-g" and "-u" options is not mutual exclusive: If group is specified on the command line, but not the user, then the user is a NULL pointer. Calling initgroups() with a null pointer segfaults in our case. And once again, many thanks to Bazsi for the syslog-ng software. -- Roger -- --------------------------------------------------------------- addr://Kasinostrasse 30, CH-5001 Aarau fon://++41 62 823 9355 http://www.terreactive.com fax://++41 62 823 9356 --------------------------------------------------------------- Wir sichern Ihren Erfolg. terreActive AG --------------------------------------------------------------- --- syslog-ng-2.0.8-orig/src/logmsg.h 2008-01-26 16:15:14 +0100 +++ syslog-ng-2.0.8/src/logmsg.h 2008-02-08 13:58:48 +0100 @@ -77,7 +77,7 @@ typedef struct _LogMessage { - guint8 ref_cnt; + guint ref_cnt; guint8 flags; guint8 pri; guint8 num_re_matches; --- syslog-ng-2.0.8-orig/src/main.c 2007-12-27 11:55:59 +0100 +++ syslog-ng-2.0.8/src/main.c 2008-02-08 18:31:49 +0100 @@ -287,7 +287,8 @@ if (uid || gid || run_as_user) { setgid(gid); - initgroups(run_as_user, gid); + if (run_as_user) + initgroups(run_as_user, gid); setuid(uid); } return 1;

2 2

Re: [syslog-ng] Problems with short messages
by Guy Fleegman 13 Feb '08

13 Feb '08

I see what you are saying... I don't think the length of a packet either 1024 or 69 bytes in length is causing the problem. The problem is that the second frame (the 69 byte one) is not going to the appropriate file. It is going to the default "catch all" file instead of the one it should be. If you look at the actual packet code... I believe the applications part of the header is missing on the 69 byte packet. Would this cause syslog-ng to dump the packet into the default catch all file as opposed to the one specified by IP? Please advise and thanks, Chris -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Monday, February 11, 2008 4:04 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Problems with short messages On Sun, 2008-02-10 at 08:03 -0500, Guy Fleegman wrote: > The first packet is only 1066 bytes long... and the second one is 69. > I thought that the default log msg size was 8192...so i was not > thinking that adjusting that in either direction would make a > difference.... should it? If it's over your desired length, then you don't need to adjust that. The problem is that if you're using the UDP transport, messages terminated by the datagram borders, e.g. each message is a separate frame. Syslog-ng will happily process UDP frames over 1024 bytes (even thought the RFC says that's the limit), so change the sender to send it out with a single frame. -- Bazsi

3 2

usertty
by Anurag Agarwal 12 Feb '08

12 Feb '08

Hello everybuddy, I am using syslog-ng and used usertty in destination. I am using a user 'test' as destination. But other users can also see the message on their console e.g root and other users. Please help as this is creating a problem and NG not working as desired. OS: Solaris 10 Anurag aggarwal GSM: +91-9811511699 mailto:anurag.agarwal@telsima.com Skype: anuraganuj Yahoo IM: anuraganuj

1 0

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. : EricSavidan/France/Equant is out of the office. : EricSavidan/France/Equant isout of the office. : Re:anybody usingflags(fallback) ?
by eric.savidan＠orange-ftgroup.com 11 Feb '08

11 Feb '08

I will be out of the office starting 11/02/2008 and will not return until 18/02/2008. Pour tout problème sur bongrain et valrhona, veuillez contacter M. Abdelmounim Baroudi (02 23 28 64 96) Pour tout autre problème SB Alliance, veuillez contacter M. Hervé Samson (01 44 45 12 91) Pour tout autre problème urgent, veuillez contacter Mme Gwenola Wyckens (02 23 28 33 15)

1 0

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. : EricSavidan/France/Equant is out of the office. : Re:anybody usingflags(fallback) ?
by eric.savidan＠orange-ftgroup.com 11 Feb '08

11 Feb '08

I will be out of the office starting 11/02/2008 and will not return until 18/02/2008. Pour tout problème sur bongrain et valrhona, veuillez contacter M. Abdelmounim Baroudi (02 23 28 64 96) Pour tout autre problème SB Alliance, veuillez contacter M. Hervé Samson (01 44 45 12 91) Pour tout autre problème urgent, veuillez contacter Mme Gwenola Wyckens (02 23 28 33 15)

1 0

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. : Re:anybody using flags(fallback) ?
by eric.savidan＠orange-ftgroup.com 11 Feb '08

11 Feb '08

I will be out of the office starting 11/02/2008 and will not return until 18/02/2008. Pour tout problème sur bongrain et valrhona, veuillez contacter M. Abdelmounim Baroudi (02 23 28 64 96) Pour tout autre problème SB Alliance, veuillez contacter M. Hervé Samson (01 44 45 12 91) Pour tout autre problème urgent, veuillez contacter Mme Gwenola Wyckens (02 23 28 33 15)

1 0