- syslog-ng - lists.balabit.hu

Eric Savidan/France/Equant is out of the office. : Re: anybody using flags(fallback) ?
by eric.savidan＠orange-ftgroup.com 11 Feb '08

11 Feb '08

I will be out of the office starting 11/02/2008 and will not return until 18/02/2008. Pour tout problème sur bongrain et valrhona, veuillez contacter M. Abdelmounim Baroudi (02 23 28 64 96) Pour tout autre problème SB Alliance, veuillez contacter M. Hervé Samson (01 44 45 12 91) Pour tout autre problème urgent, veuillez contacter Mme Gwenola Wyckens (02 23 28 33 15)

1 0

Problems with short messages
by Guy Fleegman 11 Feb '08

11 Feb '08

Hello: We have a system that sends messages to syslog-ng (Latest version 2.0.8..but this has occurred on all 2.x versions so far) This is what is happening.... An application has a message that us too long for syslog.. .so it breaks the message into 2 separate syslog messages. The first one is a length seen in wireshark of 1066 bytes. The second packet is either 69 or 70 bytes and it it simply the leftover characters 0/n/n The problem is that the filter in my syslog-ng.conf file is not catching the second smaller messages Instead of going to the file i direct it to. It goes to the default file (which i do not want) What is causing this packet to not be processed by my filter? Attached is a copy of the relevant syslog-ng.conf data as well as the actual wireshark trace information Please advise and thanks ! -Chris syslog-ng.conf file source all_devices { udp(ip(0.0.0.0) port(514)); }; destination d_catch_all_others{ file("/var/log/syslog-ng-logs/everything_else.1" perm(0644) template(t_default)); }; destination d_pt_network_device{ file("/var/log/syslog-ng-logs/pt_network_device.1" perm(0644) template(t_default)); }; filter f_all_devices { not (host(1.2.3.4) or host(2.3.4.5)); }; filter f_pt_network_device{ (host1.2.3.4) or host(2.3.4.5)); }; log { source(all_devices); filter(f_all_devices); destination(d_catch_all_others); }; log { source(all_devices); filter(f_pt_network_device); destination(d_pt_network_device); }; here is the wireshark capture No. Time Source Destination Protocol Packet length Info 1 09:14:23.073515 1.2.3.4 9.8.7.6 Syslog 1066 LOCAL2.ERR: Feb 1 09:14:23 auditd: Feb 1 14:14:23 2008 GMT f_system a_hmon t_geninfo p_major pid: 1372 ruid: 0 euid: 0 pgid: 1372 fid: 0 logid: 0 cmd: 'monitord' domain: HMON edomain: HMON hostname: perfjupiterb.bwc.state.oh.us +|health monitor|MON_INFO|MAJOR|SYS|HMONINFO\n=Health Monitor data follows\n\nuptime_util:\t 32 days\t 5:59\nload_avg:\t 0.10\nmem_percent:\t 6.09\ncpu_percent:\t 0\ntcp_count:\t 19\nudp_count:\t 8\nproxy_info:\t syslogd \t1\nproxy_info:\t named \t7\nproxy_info:\t squid \t6\nproxy_info:\t ntpd \t2\nproxy_info:\t snmpp \t2\nproxy_info:\t pudp \t63\nproxy_info:\t entrelayd \t3\nproxy_info:\t dnsp \t2\nproxy_info:\t tcpgsp:(1425) \t2\nproxy_info:\t warder_auth \t5\nproxy_info:\t sshd \t2\ntcp_data:\t ESTABLISHED\t13\ntcp_data:\t TIME_WAIT\t6\ntcp_data:\t FIN_WAIT_1\t0\ntcp_data:\t FIN_WAIT_2\t0\ntcp_data:\t CLOSE_WAIT\t0\nipf_data:\t TCP Total\t\t0\nipf_data:\t UDP Total\t\t0\nipf_total:\t Frame 1 (1066 bytes on wire, 1066 bytes captured) Arrival Time: Feb 1, 2008 09:14:23.073515000 [Time delta from previous packet: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Packet Length: 1066 bytes Capture Length: 1066 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:syslog] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_12:b4:4a (00:0f:f8:12:b4:4a), Dst: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) Destination: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) Address: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_12:b4:4a (00:0f:f8:12:b4:4a) Address: Cisco_12:b4:4a (00:0f:f8:12:b4:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 1.2.3.4 (1.2.3.4), Dst: 9.8.7.6 (9.8.7.6) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1052 Identification: 0xa1db (41435) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: UDP (0x11) Header checksum: 0xf7a4 [correct] [Good: True] [Bad : False] Source: 1.2.3.4 (1.2.3.4) Destination: 9.8.7.6 (9.8.7.6) User Datagram Protocol, Src Port: syslog (514), Dst Port: syslog (514) Source port: syslog (514) Destination port: syslog (514) Length: 1032 Checksum: 0xf9d3 [correct] [Good Checksum: True] [Bad Checksum: False] Syslog message: LOCAL2.ERR: Feb 1 09:14:23 auditd: Feb 1 14:14:23 2008 GMT f_system a_hmon t_geninfo p_major pid: 1372 ruid: 0 euid: 0 pgid: 1372 fid: 0 logid: 0 cmd: 'monitord' domain: HMON edomain: HMON hostname: perfjupiterb.bwc.sta 1001 0... = Facility: LOCAL2 - reserved for local use (18) .... .011 = Level: ERR - error conditions (3) Message [truncated]: Feb 1 09:14:23 auditd: Feb 1 14:14:23 2008 GMT f_system a_hmon t_geninfo p_major pid: 1372 ruid: 0 euid: 0 pgid: 1372 fid: 0 logid: 0 cmd: 'monitord' domain: HMON edomain: HMON hostname: perfjupiterb.bwc.state.oh.u No. Time Source Destination Protocol Packet length Info 2 09:14:23.073537 1.2.3.4 9.8.7.6 Syslog 69 LOCAL2.ERR: Feb 1 09:14:23 0\n\n Frame 2 (69 bytes on wire, 69 bytes captured) Arrival Time: Feb 1, 2008 09:14:23.073537000 [Time delta from previous packet: 0.000022000 seconds] [Time since reference or first frame: 0.000022000 seconds] Frame Number: 2 Packet Length: 69 bytes Capture Length: 69 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:syslog] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_12:b4:4a (00:0f:f8:12:b4:4a), Dst: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) Destination: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) Address: CompaqHp_41:c6:af (00:0b:cd:41:c6:af) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_12:b4:4a (00:0f:f8:12:b4:4a) Address: Cisco_12:b4:4a (00:0f:f8:12:b4:4a) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 1.2.3.4 (1.2.3.4), Dst: 9.8.7.6 (9.8.7.6) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 55 Identification: 0xa1dc (41436) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 61 Protocol: UDP (0x11) Header checksum: 0xfb88 [correct] [Good: True] [Bad : False] Source: 1.2.3.4 (1.2.3.4) Destination: 9.8.7.6 (9.8.7.6) User Datagram Protocol, Src Port: syslog (514), Dst Port: syslog (514) Source port: syslog (514) Destination port: syslog (514) Length: 35 Checksum: 0xec1c [correct] [Good Checksum: True] [Bad Checksum: False] Syslog message: LOCAL2.ERR: Feb 1 09:14:23 0\n\n 1001 0... = Facility: LOCAL2 - reserved for local use (18) .... .011 = Level: ERR - error conditions (3) Message: Feb 1 09:14:23 0\n\n

3 3

anybody using flags(fallback) ?
by Balazs Scheidler 11 Feb '08

11 Feb '08

Hi, As I wrote earlier I'm in the process of redesigning syslog-ng internals, and some log statement flags are way more difficult to implement than with the previous model. These are: "final" -- I see the merit here, and even though it's more difficult to implement, it's worth it "fallback" -- as I see this can perfectly be substituted by a series of lost statement each with "final" flag. Using the final flag is also faster, as syslog-ng does not have to evaluate filters. What do you think? Does anyone use fallback in a way that is not possible using final? If you need more information on the flags above, it is described in the documentation: http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch08s03.html -- Bazsi

3 3

[Bug 12] New: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=87927
by bugzilla＠bugzilla.balabit.com 08 Feb '08

08 Feb '08

https://bugzilla.balabit.com/show_bug.cgi?id=12 Summary: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=87927 Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=87927 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'd like to be able to include a log source within another log source, e.g.: source local { internal(); unix-stream("/dev/log"); }; source all { source("local"); udp(ip(1.2.3.4) port(514)); }; -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

New 2.0.8 abort with use_dns(persist_only);
by Marc Wiatrowski 08 Feb '08

08 Feb '08

I had been running 2.0.7 fine. When I install and start the new 2.0.8 version I get the following error and fails to actually start if I use the the options use_dns(persist_only); and dns_cache_hosts(/etc/hosts); Syslog connection established; from='AF_INET(0.0.0.0:0)', to='AF_INET(192.168.176.3:514)' syslog-ng starting up; version='2.0.8' Incoming log entry; line='<134>id=firewall sn=00XXXXXXXX time="2008-02-05 08:34:52" fw=1.1.1.1 pri=6 c=1024 m=98 n=133049021 src=192.168.184.83:25753:HomePort proto=icmp/8 rcvd=52 \x0d\x0a' file dnscache.c: line 100 (dns_cache_key_hash): should not be reached Abort With the use_dns(no); option it runs fine. bug? thanks, marc

2 3

syslog-ng doesn't log anything with local configuration
by Uwe Galle 08 Feb '08

08 Feb '08

Hi, I am using openSUSE 10.3 with syslog-ng 1.6.12-33 with the following configuration file: # source s_file { internal(); }; destination d_file { file("/home/uga/Daten/system/system.msg"); }; log { source(s_file); destination(d_file); }; You see, it's really simple. ls -l displays for the file: -rw-rw-rw- 1 root root 0 2008-02-07 22:03 system.msg So system.msg is writable for all. But nothing is logged to the file, even after restart. The FAQ mentions a similar case (http://www.campin.net/syslog-ng/faq.html#dupe_sources) but the problem here are clearly duplicate sources in the directives. This is not the case here. Any ideas are very welcome. Thanks

3 3

syslog-ng & rewrite
by Balazs Scheidler 08 Feb '08

08 Feb '08

Hi, I've written a long blog post about my intentions regarding the rewriting functionality in syslog-ng. If you were interested in the anonimizing patches, be sure to check out. Also, the URL of my blog has changed, the old one redirects to the new one, but please update your bookmarks. The new address is: http://bazsi.blogs.balabit.com/ The RSS feed has not changed. -- Bazsi

1 0

Syslog-ng via TCP socket
by Lathrop_Steve＠emc.com 08 Feb '08

08 Feb '08

I don't see a similar issue in the archives and I went back to August 2006... I am trying to send a message following RFC3164 to a syslog-ng daemon reading from port 601 on a SLES-10 Linux machine. The format of the message is: <64>Feb 7 16:42:03 c4dev-lathrs1 TAG: smlSocket Test TCP syslog buffer msg The reason for me to send the message is to understand whether the message was delivered (not necessarily written to disk). When I send the message to a UDP port (514) on the machine, I can see the message just fine. When I send the exact same message to the TCP port, I see the receipt processing (via strace), but nothing shows up in the /var/log/messages file. The version of syslog-ng is 1.6.8 according to what is in /var/log/messages Any suggestions? The /etc/services file references 601 as being syslog-conn for both tcp and udp syslog-conn 601/tcp # Reliable Syslog Service syslog-conn 601/udp # Reliable Syslog Service The remote config file is: # # /etc/syslog-ng/syslog-ng.conf # # Automatically generated by SuSEconfig on Thu Feb 7 12:00:53 EST 2008. # # PLEASE DO NOT EDIT THIS FILE! # # you can modify /etc/syslog-ng/syslog-ng.conf.in instead # # # # File format description can be found in syslog-ng.conf(5) # and /usr/share/doc/packages/syslog-ng/syslog-ng.txt. # # # Global options. # options { long_hostnames(off); sync(0); perm(0640); stats(3600); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; # source src { # # include internal syslog-ng messages # note: the internal() soure is required! # internal(); # # the following line will be replaced by the # socket list generated by SuSEconfig using # variables from /etc/sysconfig/syslog: # unix-dgram("/dev/log"); # # uncomment to process log messages from network: # udp(ip("0.0.0.0") port(514)); tcp( ip("0.0.0.0") port(601) keep-alive(yes) ); }; # # Filter definitions # filter f_iptables { facility(kern) and match("IN=") and match("OUT="); }; filter f_console { level(warn) and facility(kern) and not filter(f_iptables) or level(err) and not facility(authpriv); }; filter f_newsnotice { level(notice) and facility(news); }; filter f_newscrit { level(crit) and facility(news); }; filter f_newserr { level(err) and facility(news); }; filter f_news { facility(news); }; filter f_mailinfo { level(info) and facility(mail); }; filter f_mailwarn { level(warn) and facility(mail); }; filter f_mailerr { level(err, crit) and facility(mail); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_acpid { match('^\[acpid\]:'); }; filter f_netmgm { match('^NetworkManager:'); }; filter f_messages { not facility(news, mail) and not filter(f_iptables); }; filter f_warn { level(warn, err, crit) and not filter(f_iptables); }; filter f_alert { level(alert); }; filter f_smlInfoNotice { level(info...notice); }; filter f_smlFacility { filter(f_local) and facility(user) and facility(auth) and facility(authpriv); }; filter f_smlCrit { level(crit); }; # # Most warning and errors on tty10 and on the xconsole pipe: # destination console { file("/dev/tty10" group(tty) perm(0620)); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole" group(tty) perm(0400)); }; log { source(src); filter(f_console); destination(xconsole); }; # Enable this, if you want that root is informed immediately, # e.g. of logins: # #destination root { usertty("root"); }; #log { source(src); filter(f_alert); destination(root); }; # # News-messages in separate files: # destination newscrit { file("/var/log/news/news.crit" owner(news) group(news)); }; log { source(src); filter(f_newscrit); destination(newscrit); }; destination newserr { file("/var/log/news/news.err" owner(news) group(news)); }; log { source(src); filter(f_newserr); destination(newserr); }; destination newsnotice { file("/var/log/news/news.notice" owner(news) group(news)); }; log { source(src); filter(f_newsnotice); destination(newsnotice); }; # # and optionally also all in one file: # (don't forget to provide logrotation config) # #destination news { file("/var/log/news.all"); }; #log { source(src); filter(f_news); destination(news); }; # # Mail-messages in separate files: # destination mailinfo { file("/var/log/mail.info"); }; log { source(src); filter(f_mailinfo); destination(mailinfo); }; destination mailwarn { file("/var/log/mail.warn"); }; log { source(src); filter(f_mailwarn); destination(mailwarn); }; destination mailerr { file("/var/log/mail.err" fsync(yes)); }; log { source(src); filter(f_mailerr); destination(mailerr); }; # # and also all in one file: # destination mail { file("/var/log/mail"); }; log { source(src); filter(f_mail); destination(mail); }; # # acpid messages in one file: # destination acpid { file("/var/log/acpid"); }; log { source(src); filter(f_acpid); destination(acpid); flags(final); }; # # NetworkManager messages in one file: # destination netmgm { file("/var/log/NetworkManager"); }; log { source(src); filter(f_netmgm); destination(netmgm); flags(final); }; # # Cron-messages in one file: # (don't forget to provide logrotation config) # #destination cron { file("/var/log/cron"); }; #log { source(src); filter(f_cron); destination(cron); }; # # Some boot scripts use/require local[1-7]: # destination localmessages { file("/var/log/localmessages"); }; log { source(src); filter(f_local); destination(localmessages); }; # # All messages except iptables and the facilities news and mail: # destination messages { file("/var/log/messages"); }; log { source(src); filter(f_messages); destination(messages); }; # # Firewall (iptables) messages in one file: # destination firewall { file("/var/log/firewall"); }; log { source(src); filter(f_iptables); destination(firewall); }; # # Warnings (except iptables) in one file: # destination warn { file("/var/log/warn" fsync(yes)); }; log { source(src); filter(f_warn); destination(warn); }; # # Enable this, if you want to keep all messages in one file: # (don't forget to provide logrotation config) # #destination allmessages { file("/var/log/allmessages"); }; #log { source(src); destination(allmessages); }; # sml TEST # log { source(src); filter(f_smlCrit); destination(smlFileDest) destination(smlTcpDest); }; #log { source(src); filter(f_smlCrit); destination(smlTcpDest); }; #log { source(src); filter(f_smlInfoNotice); destination(smlFileDest); }; destination smlFileDest { file("/var/log/smlDestination" fsync(yes)); }; #log { source(src); filter(f_smlInfoNotice); destination(smlFileDest); }; #log { source(src); filter(f_smlFacility); destination(smlFileDest); }; log { source(src); destination(smlFileDest); }; __________________ Stephen M. Lathrop mailto:lathrop_steve@emc.com EMC Corporation phone: (508) 305-8596 32 Coslin Drive internal: 824-48596 Southboro, MA 01772 fax: (508) 305-8474 www.emc.com Have-a-heck-of-a-day 4 under 4 apart

2 1

file driver not usable in version 1.6.12 & version 2.0.8 not installable
by Uwe Galle 08 Feb '08

08 Feb '08

Hi, I am working with openSUSE 10.3 what comes with version 1.6.12 preinstalled. I tried to use the file driver with this version but it didn't allow me to use it. First I tried the following syslog-ng.conf file: source s_file { file("/var/log/boot.msg"); }; destination d_file { file("/home/uga/Daten/test/syslog.log"); }; log {source (s_file); destination(d_file); }; When syslog-ng was started, it displayed the following error: Re-Starting syslog servicesError opening file /var/log/boot.msg for reading (Permission denied) Error initializing configuration, exiting. startproc: exit status of parent of /sbin/syslog-ng: 1 OK, I thought, this sounds like an OS problem. I investigated the file but didn't find any problem related to permissions. Then, I tried another file and added that after the first line: source s_file { file("/var/log/boot.msg"); }; source a_file { file("/var/log/apache2/access_log"); }; destination d_file { file("/home/uga/Daten/test/syslog.log"); }; log {source (s_file); destination(d_file); }; Now I got the error: Re-Starting syslog servicesError opening file /var/log/apache2/access_log for reading (Permission denied) Error initializing configuration, exiting. startproc: exit status of parent of /sbin/syslog-ng: 1 I saw that the error related to the first file has disappeared but reappeared with the second file. That let me suspect that this error is a bug that always causes an error with the last source file in the config file. To go sure I tried a third version: source s_file { file("/var/log/boot.msg"); }; source a_file { file("/var/log/apache2/access_log"); }; source x_file { file("/home/uga/Daten/test/test.msg"); }; destination d_file { file("/home/uga/Daten/test/syslog.log"); }; log {source (s_file); destination(d_file); }; I fact, the error still appears, but not with the first two and already tested files but with the last third and new file. Now I installed the last Open Source version 2.0.8. All steps finished without error but syslog-ng -V still shows "syslog-ng 1.6.12", even after reboot. I didn't find any entry in the FAQ related to these two problems so I want to ask you to help me. Thanks.

2 1

Re: [syslog-ng] syslog-ng doesn't log anything with local configuration
by infosec＠gmail.com 08 Feb '08

08 Feb '08

Couple thoughts, probably things that you've already looked at: 1. Was that log file created by syslog-ng or by you? If by you, check for a typo (since you don't have the full path in the 'ls -l' output it's good to be sure). 2. Are you sure syslog-ng is using this config file? Pass the flag and argument to force it to that file just in case. 3. Are you sure it's really starting? If it created that logfile then it must be, but good to be sure. Unresolved library dependencies would show up on the command ine but I don't know how you're starting it. If none of these help report back to the list, there's probably some other simple explanation. Oh and I'm assuming you didn't compile it yourself (since the version is 1.6.12-33), let us know if you built it yourself. -----Original Message----- From: Uwe Galle <uga(a)domestic.de> Subj: [syslog-ng] syslog-ng doesn't log anything with local configuration Date: Thu Feb 7, 2008 3:08 pm Size: 920 bytes To: syslog-ng(a)lists.balabit.hu Hi, I am using openSUSE 10.3 with syslog-ng 1.6.12-33 with the following configuration file: # source s_file { internal(); }; destination d_file { file("/home/uga/Daten/system/system.msg"); }; log { source(s_file); destination(d_file); }; You see, it's really simple. ls -l displays for the file: -rw-rw-rw- 1 root root 0 2008-02-07 22:03 system.msg So system.msg is writable for all. But nothing is logged to the file, even after restart. The FAQ mentions a similar case (http://www.campin.net/syslog-ng/faq.html#dupe_sources) but the problem here are clearly duplicate sources in the directives. This is not the case here. Any ideas are very welcome. Thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng 2.0 & 2.1 maintenance
by Balazs Scheidler 07 Feb '08

07 Feb '08

Hi, As there's a syslog-ng OSE 2.1 version available, the 2.0 branch is going to be put in strict maintenance mode, new bugfixes will first appear in the 2.1 version, 2.0 will receive only the less risky fixes and after sufficient testing in 2.1. Another question, I saw a couple of downloads for syslog-ng 2.1alpha1 release, but no feedback so far, I'd be interested in _any_ kind of success/failure reports, either syslog-ng or libdbi related. Thanks. -- Bazsi

1 0

Errorneous behaviour of syslog-ng v2.0.0 with logmessages in German
by Jewgenij.Belopilski＠alumni.TU-Berlin.DE 06 Feb '08

06 Feb '08

Hello, I use syslog-ng v2.0.0 and observe the following erroneous behaviour: If I specify a template for a target in syslog-ng.conf, a log-message, which contains letters specific to German language (Ä, ä, Ö, ö, Ü, ü), gets korrupted. Without specifying a template all works fine. The function in the source code, which corrupts log-messages is src/templates.c::log_template_format(...) Is this a bug? I appreciate each help.

1 0

Memory leaks...?
by Eiji Inatsu 05 Feb '08

05 Feb '08

Hi, My problem is that the memory usage of syslog-ngd increases continuously, and finally physical memory and swap spaces are exhausted. Is this a memory leak or not? My version # /usr/local/sbin/syslog-ng -V syslog-ng 2.0.2 My H/W and OS Solaris 10, sparc 64 This syslog-ng is running about 2 or 3 days until restarted. This host is central loghost and receives about 40GB data per day. Waiting for your reply. Thanks, -- // mailto: le.petit.planet(a)gmail.com

2 4

[Bug 18] New: random signal 6 in raise() from libc
by bugzilla＠bugzilla.balabit.com 05 Feb '08

05 Feb '08

https://bugzilla.balabit.com/show_bug.cgi?id=18 Summary: random signal 6 in raise() from libc Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: anders.henke(a)1und1.de Type of the Report: --- Estimated Hours: 0.0 On my central log server, syslog-ng 2.0.7 randomly aborts (signal 6); I haven't noticed this earlier (as syslog-ng is respawned from init), but according to 8 core dumps, it's always at the same function within libc; I wonder why only syslog-ng triggers this. # for I in core.syslog-ng.sig6.* ; do echo "# $I" ; echo quit | gdb /sbin/syslog-ng $I 2>&1 ; done > sig6 # grep raise sig6 #0 0x00007fea95e9a07b in raise () from /lib/libc.so.6 #0 0x00007f1cacf7807b in raise () from /lib/libc.so.6 #0 0x00007ffc4365d07b in raise () from /lib/libc.so.6 #0 0x00007f8f86a9407b in raise () from /lib/libc.so.6 #0 0x00007f45933aa07b in raise () from /lib/libc.so.6 #0 0x00007fcd9195007b in raise () from /lib/libc.so.6 #0 0x00007f01ea4bd07b in raise () from /lib/libc.so.6 #0 0x00007f83c135a07b in raise () from /lib/libc.so.6 Sample excerpt: # core.syslog-ng.sig6.16915 GNU gdb 6.4.90-debian Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "x86_64-linux-gnu"...Using host libthread_db library "/lib/libthread_db.so.1". Reading symbols from /lib/libnsl.so.1...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/librt.so.1...done. Loaded symbols for /lib/librt.so.1 Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/libpthread.so.0...done. Loaded symbols for /lib/libpthread.so.0 Reading symbols from /lib/ld-linux-x86-64.so.2...done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 Reading symbols from /lib/libnss_compat.so.2...done. Loaded symbols for /lib/libnss_compat.so.2 Reading symbols from /lib/libnss_nis.so.2...done. Loaded symbols for /lib/libnss_nis.so.2 Reading symbols from /lib/libnss_files.so.2...done. Loaded symbols for /lib/libnss_files.so.2 Failed to read a valid object file image from memory. Core was generated by `/sbin/syslog-ng -f /var/run/syslog-ng.conf.521 -F -p /var/run/syslog-ng.pid.521'. Program terminated with signal 6, Aborted. #0 0x00007fea95e9a07b in raise () from /lib/libc.so.6 (gdb) I'm running Debian Linux 4.0 (Etch) in 64-Bit-flavour. Syslog-NG 2.0.7 has been compiled using the supplied debian/rules file, except two changes: don't strip the symbol table from the binary and use --enable-debug. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

syslog-ng 2.0.8 has been released
by devel＠balabit.hu 04 Feb '08

04 Feb '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.8 SUMMARY : new stable release DATE : Jan 31, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.8) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.8 Thu, 31 Jan 2008 12:38:21 +0100 Bugfixes: * Fixed a regression in 2.0.7 that caused destination files not to be reopened when syslog-ng was reloaded. This causes potential problems with log rotation. * Fixed DNS cache size checking, persistent DNS cache entries were also counted against dns_cache_size() which might decrease cache space significantly when a large /etc/hosts file is in use. * Fixed a bug that caused the persistent DNS cache (e.g. /etc/hosts) to be reloaded for all name resolution requests. Other changes: * Fixed sample configuration file for RedHat. * Some portability changes in loggen. * Added cygwin packaging files to contrib/cygwin-packaging. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

3 2

[Bug 17] New: segfault in msg_send_internal_message
by bugzilla＠bugzilla.balabit.com 01 Feb '08

01 Feb '08

https://bugzilla.balabit.com/show_bug.cgi?id=17 Summary: segfault in msg_send_internal_message Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: anders.henke(a)1und1.de Type of the Report: bug Estimated Hours: 0.0 On my central log server, syslog-ng 2.0.7 randomly segfaults (signal 11); I haven't noticed this earlier (as syslog-ng is respawned from init), but according to 19 core dumps, it's always at the same position: # core.syslog-ng.sig11.16453 GNU gdb 6.4.90-debian Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "x86_64-linux-gnu"...Using host libthread_db library "/lib/libthread_db.so.1". Reading symbols from /lib/libnsl.so.1...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/librt.so.1...done. Loaded symbols for /lib/librt.so.1 Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/libpthread.so.0...done. Loaded symbols for /lib/libpthread.so.0 Reading symbols from /lib/ld-linux-x86-64.so.2...done. Loaded symbols for /lib64/ld-linux-x86-64.so.2 Reading symbols from /lib/libnss_compat.so.2...done. Loaded symbols for /lib/libnss_compat.so.2 Reading symbols from /lib/libnss_nis.so.2...done. Loaded symbols for /lib/libnss_nis.so.2 Reading symbols from /lib/libnss_files.so.2...done. Loaded symbols for /lib/libnss_files.so.2 Failed to read a valid object file image from memory. Core was generated by `/sbin/syslog-ng -f /var/run/syslog-ng.conf.519 -F -p /var/run/syslog-ng.pid.519'. Program terminated with signal 11, Segmentation fault. #0 0x00000000004051d7 in msg_send_internal_message (prio=43, msg=0x0) at messages.c:59 59 m = log_msg_new(buf, strlen(buf), NULL, LP_INTERNAL | LP_LOCAL, NULL); (gdb) I'm running Debian Linux 4.0 (Etch) in 64-Bit-flavour. Syslog-NG 2.0.7 has been compiled using the supplied debian/rules file, except two changes: don't strip the symbol table from the binary and use --enable-debug. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

syslog-ng OSE 2.1alpha1
by Balazs Scheidler 31 Jan '08

31 Jan '08

Hi, As posted on my blog, I've released syslog-ng OSE 2.1alpha1, the first GPLd release that features native syslog-to-SQL capability. You can download the source code for OSE 2.1 from: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/ You'll need a patched libdbi/libdbi-drivers package also available at the download location and you have accessibility for all SQL servers that have an driver in libdbi. We've successfully tested MySQL, PostgreSQL, SQLite and Oracle, others will probably work, but are untested. The code in this "alpha" release has already been tested in the context of the commercial syslog-ng product, so I don't expect too much problems once it builds and starts. The configure script and the Makefiles might still have some surprises though. To configure the SQL destination, please read the current Administrator's Guide for syslog-ng, the chapter on SQL is here: http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch08s02.html#r… -- Bazsi

1 0

Win syslog-agent PRI
by Tiago Gomes da Silva Mendo 31 Jan '08

31 Jan '08

>On Mon, 2008-01-28 at 11:05 +0000, Tiago Gomes da Silva Mendo wrote: >> Hi, >> >> >> >> I have syslog-ng-premium-edition (2.1.8) on an Debian etch and >> multiple linuxs sending syslog messages to this server, using >> diferents PRIs. >> >> The problem is with the windows agent (2.1.4). In the windows agent I >> have an message format like this: "<182>$DATE $HOST $EVENT_SOURCE: >> $MSG", but at the server the received PRI is not 182. >> >> At the server I get messages with the correct PRI when the syslog-ng >> agent is restarted: >> >> >> >> "Jan 28 10:57:41 10.176.25.108 LogRelay: Application started", with >> local6 and info, but every message I send through syslog-ng agent >> arrives at the server with user/notice (PRI 13). > >Are you reading messages from files or you are sending out the EventLog >records? > >If my assumption is true, then the difference between the LogRelay entry >and the other messages is that the LogRelay entry is coming from the >EventLog, and the others come from files, right? > >I ask my collegue to look into this. > >-- >Bazsi You are rigth. The messages from the eventlog containers are getting to the server with the right PRI, but the ones from the files don't. Thanks

5 11

[Bug 6] New: syslog-ng dies after cron.daily
by bugzilla＠bugzilla.balabit.com 31 Jan '08

31 Jan '08

https://bugzilla.balabit.com/show_bug.cgi?id=6 Summary: syslog-ng dies after cron.daily Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=427791 OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 >From bugs.debian.org: Syslog-ng is dying repeatedly after logrotate runs. I believe that in most cases it continues to log to the original file, despite it having been rotated, though I am not 100% sure of this. Where it does continue running, it dies when the 2nd rotate occurs, where the logfile is gzipped. When trying to reproduce it manually, sending kill -HUP causes syslog-ng to die shortly after it gets a new PID. I am able to consistently reproduce this. No data is written to the new logfile until I manually restart syslog-ng For now, as a workaround, I have altered the post-rotate command to restart syslog-ng rather than reload. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

syslog-ng dnscache.c patch
by Steven McDougall 30 Jan '08

30 Jan '08

We enabled dns caching with a configuration like dns_cache_hosts(/etc/hosts), and found that syslog-ng was re-reading the hosts file every time it needed to resolve a host name. This patch fixed it. diff -ru syslog-ng-2.0.6/src/dnscache.c syslog-ng-2.0.6-patch/src/dnscache.c --- syslog-ng-2.0.6/src/dnscache.c 2007-04-19 15:37:16.000000000 -0400 +++ syslog-ng-2.0.6-patch/src/dnscache.c 2008-01-26 19:45:31.000000000 -0500 @@ -168,7 +168,9 @@ if (hosts) { gchar buf[4096]; - + + dns_cache_hosts_mtime = st.st_mtime; + while (fgets(buf, sizeof(buf), hosts)) { gchar *p, *ip;

2 1

preparing for 2.0.8
by Balazs Scheidler 28 Jan '08

28 Jan '08

Hi, I'm preparing a 2.0.8 release, but I'd like to avoid past mistakes with recent releases, thus I'd be very grateful if some of you could test the current snapshot. There are two patches that I haven't received real feedback yet, the others are so trivial that I doubt they'd cause problems. The candidates that should be tested are below. I've also included a description how I think the patches should be tested, to make it easier for you to perform testing: SIGHUP did not reopen files as needed for logrotation, fixed that (a8b9878ab38b10d24df7b773c8c580d341b22383) * the problem this patch fixes is that syslog-ng did not properly reopen destination files, it kept them opened and wrote into them even if a SIGHUP was sent to it * this was a regression in 2.0.7 and didn't affect earlier versions * to test whether the fix was ok, you should start the new version of syslog-ng, generate a continous stream of messages (for instance with loggen), and send rotate the output files using logrotate, or by hand * if syslog-ng starts a new file after rotation, then the fix was ok * if syslog-ng writes to the new file, or crashes or behaves oddly in any other was, then the fix was bad. and: fixed checking the DNS cache size limit 40f999eaff5fdb217656ab6af03e336e8e703cbf * the problem was related to the support for a persistent set of DNS cache entries (dns-cache-hosts() option) * if the hosts file specified for dns-cache-hosts() contained over dns-cache-size() entries, syslog-ng quickly dumped core right after the reception of the first message * to test this, please enable dns-cache-hosts(), populate the file with over 1007 ip->name mappings * start syslog-ng, generate some messages and check whether: * syslog-ng behaves correctly (no crash, no other odd behaviour) * syslog-ng does not try to resolve the names that are already in the dns-cache, you can check this by adding an entry that has no DNS record and check whether syslog-ng successfully resolves the name (keep_hostname(no), use_dns(yes), dns_cache(persist-only)) I've now checked that the latest snapshot (syslog-ng-2.0.7+20080128.tar.gz) contains both of these patches. Both patches run the regression test suite well, but as you know real world testing is the only thing that matters at the end. I'm going to release 2.0.8 this week, any kind of help on the patches above would help a lot. Thanks in advance. -- Bazsi

1 0

Win syslog-agent PRI
by Tiago Gomes da Silva Mendo 28 Jan '08

28 Jan '08

Hi, I have syslog-ng-premium-edition (2.1.8) on an Debian etch and multiple linuxs sending syslog messages to this server, using diferents PRIs. The problem is with the windows agent (2.1.4). In the windows agent I have an message format like this: "<182>$DATE $HOST $EVENT_SOURCE: $MSG", but at the server the received PRI is not 182. At the server I get messages with the correct PRI when the syslog-ng agent is restarted: "Jan 28 10:57:41 10.176.25.108 LogRelay: Application started", with local6 and info, but every message I send through syslog-ng agent arrives at the server with user/notice (PRI 13). Any ideas?

2 1

[patch] Fixes for 2.0.7 on not ipv6 aware systems
by Corinna Vinschen 28 Jan '08

28 Jan '08

Hi, I'm maintaining syslog-ng as part of the Cygwin net distro. Today I tried to build 2.0.7 and came across a couple of problems, which were mostly due to the fact that the current Cygwin release 1.5.25 is not ipv6 aware. While this is rectified in Cygwin's CVS, the current release is still based on older code. Below you find a patch which solves the following problems: - Two functions in src/afsocket.c use AF_INET6 even if ENABLED_IPV6 is not defined. - The new loggen tool has a typo in usage(), printing -i instead of -I for the interval arg. - loggen has a bug in the option handling. Due to a missing colon in the option string, it crashes when using the -s option. - loggen uses getaddrinfo/freeaddrinfo even on systems on which HAVE_GETADDRINFO is undefined. I created replacement code using gethostbyname/gertservbyname on systems lacking getaddrinfo. ChangeLog and diff below. Another problem I have is this: Given that loggen is in the tests subdir, I'm wondering if it's correct that loggen is installed to ${bindir} when running `make install'. Is that really supposed to happen or should `make install' skip loggen? Thanks, Corinna * src/afsocket.c (afsocket_sd_process_connection): Allow building with tcp_wrappers if AF_INET6 is unknown. (afsocket_dd_format_stats_name): Guard AF_INET6 case with ENABLE_IPV6. * tests/loggen/loggen.c diff -rup syslog-ng-2.0.7/src/afsocket.c syslog-ng-2.0.7-1/src/afsocket.c --- syslog-ng-2.0.7/src/afsocket.c 2007-11-26 09:26:38.000000000 +0100 +++ syslog-ng-2.0.7-1/src/afsocket.c 2008-01-07 18:38:31.088449800 +0100 @@ -359,7 +359,11 @@ gboolean afsocket_sd_process_connection(AFSocketSourceDriver *self, GSockAddr *peer_addr, gint fd) { #if ENABLE_TCP_WRAPPER - if (peer_addr && (peer_addr->sa.sa_family == AF_INET || peer_addr->sa.sa_family == AF_INET6)) + if (peer_addr && (peer_addr->sa.sa_family == AF_INET +#if ENABLE_IPV6 + || peer_addr->sa.sa_family == AF_INET6 +#endif + )) { struct request_info req; @@ -693,9 +697,11 @@ afsocket_dd_format_stats_name(AFSocketDe case AF_INET: driver_name = !!(self->flags & AFSOCKET_STREAM) ? "tcp" : "udp"; break; +#if ENABLE_IPV6 case AF_INET6: driver_name = !!(self->flags & AFSOCKET_STREAM) ? "tcp6" : "udp6"; break; +#endif } g_snprintf(stats_name, sizeof(stats_name), "%s(%s)", diff -rup syslog-ng-2.0.7/tests/loggen/loggen.c syslog-ng-2.0.7-1/tests/loggen/loggen.c --- syslog-ng-2.0.7/tests/loggen/loggen.c 2008-01-03 07:29:56.000000000 +0100 +++ syslog-ng-2.0.7-1/tests/loggen/loggen.c 2008-01-07 19:42:46.720451400 +0100 @@ -147,7 +147,7 @@ usage() " --stream, or -S Use stream socket (TCP and unix-stream)\n" " --dgram, or -D Use datagram socket (UDP and unix-dgram)\n" " --size, or -s Specify the size of the syslog message\n" - " --interval, or -i <sec> Number of seconds to run the test for\n"); + " --interval, or -I <sec> Number of seconds to run the test for\n"); exit(0); } @@ -176,9 +176,9 @@ main(int argc, char *argv[]) int opt; #if HAVE_GETOPT_LONG - while ((opt = getopt_long(argc, argv, "r:I:ixsSDh", syslog_ng_options, NULL)) != -1) + while ((opt = getopt_long(argc, argv, "r:I:ixs:SDh", syslog_ng_options, NULL)) != -1) #else - while ((opt = getopt(argc, argv, "r:I:ixsSDh")) != -1) + while ((opt = getopt(argc, argv, "r:I:ixs:SDh")) != -1) #endif { switch (opt) @@ -211,6 +211,7 @@ main(int argc, char *argv[]) } if (!unix_socket) { +#if HAVE_GETADDRINFO struct addrinfo hints; struct addrinfo *res, *rp; @@ -250,6 +251,53 @@ main(int argc, char *argv[]) fprintf(stderr, "Error connecting to target server: %s\n", strerror(errno)); return 2; } +#else + struct hostent *host; + struct servent *serv = NULL; + struct sockaddr_in saddr; + + if (argc - optind < 2) + { + fprintf(stderr, "No target server specified\n"); + usage(); + } + + host = gethostbyname (argv[optind]); + if (!host) + { + fprintf(stderr, "Name lookup error"); + return 2; + } + memcpy (&saddr.sin_addr, host->h_addr_list[0], host->h_length); + serv = getservbyname (argv[optind + 1], + sock_type == SOCK_STREAM ? "tcp" : "udp"); + if (!serv) + { + char *c; + + saddr.sin_port = htons (strtol (argv[optind + 1], &c, 10)); + if (c == argv[optind + 1]) + { + fprintf(stderr, "Service lookup error"); + return 2; + } + } + else + saddr.sin_port = serv->s_port; + saddr.sin_family = AF_INET; + sock = socket (AF_INET, sock_type, 0); + if (sock != -1 + && connect(sock, (struct sockaddr *) &saddr, sizeof saddr) == -1) + { + close (sock); + sock = -1; + } + if (sock == -1) + { + fprintf(stderr, "Error connecting to target server: %s\n", strerror(errno)); + return 2; + } +#endif } else { -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 15

Bug in 2.0.7's use_dns(persist_only) and large host files
by Steve Bernacki 27 Jan '08

27 Jan '08

Environment: CentOS 5 and Syslog-ng 2.0.7 (current snapshot) Relevant syslog-ng.conf snippet: === options { use_dns(persist_only); dns_cache_hosts("/etc/hosts"); }; === If you point syslog-ng to an /etc/hosts file that has more than 1007 entries, upon receiving its first message, syslog-ng will throw the following assertion: # ./syslog-ng -Fed syslog-ng starting up; version='2.0.7' Incoming log entry; line='<38>well hello' file dnscache.c: line 99 (dns_cache_key_hash): should not be reached Aborted Workaround: In syslog-ng.conf, set dns_cache_size() to a value greater than the number of entries in your /etc/hosts file. Fix: See the attached patch; it should apply cleanly to any version of 2.0.7, and perhaps older versions as well. Steve -- Steve Bernacki, Jr To date, the Pan-Massachusetts Challenge has raised 204 million dollars for cancer research. Get involved! http://www.pmc.org/ diff -ur syslog-ng-2.0.7/src/dnscache.c syslog-ng-2.0.7-patch/src/dnscache.c --- syslog-ng-2.0.7/src/dnscache.c 2008-01-03 06:59:18.000000000 -0500 +++ syslog-ng-2.0.7-patch/src/dnscache.c 2008-01-27 09:24:52.000000000 -0500 @@ -271,7 +271,7 @@ } g_hash_table_replace(cache, &entry->key, entry); - if (g_hash_table_size(cache) > dns_cache_size) + if (!persistent && g_hash_table_size(cache) > dns_cache_size) { /* remove oldest element */ g_hash_table_remove(cache, &cache_first.next->key);

2 1

Fail safe test fot syslog-ng
by dstuxo 27 Jan '08

27 Jan '08

Hi everyone, I am using syslog-ng in a system which is supposed to be fail safe to avoid data loss. However I encountered an unexpected delay and messages are lost.. To test it I am proceeding like this: syslog-ng-config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); } ... destination d_cron { file("/var/log/cron"); }; ... logger -t tester -p cron.info "power failure test" & tail -f /var/log/cron Waiting aprox. 2 seconds then I power down. The previous command shows the message, but after reboot it is lost. I supposed that it's happening due the fact that the buffers are not flushed to disk. So I tried strace on syslog-ng process. No read/write syscall for the message is made.. Another case is with a cycle of messages: for i in `seq 1 1000`;do logger -t tester -p cron.info "power failure test: $i";echo ">> $i";done After 3-4 seconds all messages are written. But not before that time... I know about the fsync(yes) option and I tried it, but with high load of messages It doesn't work proper (syslog-ng.config becomes corrupted and messages are also lost) There is something I am missing here? Configuration option, maybe? Regards

4 9