- syslog-ng - lists.balabit.hu

2.0.7 contrib/rhel-packaging/syslog-ng.conf typos
by Joe Fegan 26 Jan '08

26 Jan '08

Hi, The example syslog-ng.conf in contrib/rhel-packaging of 2.0.7 has some syntax errors and this patch fixes them. I also noticed that this syslog-ng.conf configures syslog-ng to take over logging of messages from remote machines, but not logging of local messages. I think this mix is odd; it should either take over from syslogd altogether or not at all. This patch resolves that mix by commenting out the remote config. The idea is that installing syslog-ng will not interfere with syslogd up front, but will give you hints on how to do it later if you want. Please consider part or all of this patch for upstream. Joe. _________________________________________________________________ Windows Vista + Windows Live. Open up your digital life. Get Windows Live free. http://get.live.com

4 5

integration and release
by Balazs Scheidler 26 Jan '08

26 Jan '08

hi, Sorry for having been able to dedicate only a small portion of my time to syslog-ng, things have been rough recently. I'm going to integrate pending patches in the coming days and think about the more complex issues (time_sleep, disk flush time etc). Thanks for the patience. -- Bazsi

1 0

Syslog-ng too many open files
by Pedro Rafael Alves Simoes 26 Jan '08

26 Jan '08

Hello, I'm receiving many messages on my syslog-ng like this: syslog-ng[20419]: Error opening file for writing; filename="...", error='Too many open files (24)' syslog-ng[20419]: Error accepting new connection; error='Too many open files (24)' In lsof output, the syslog-ng daemon has many files opened and when I try to login from other console or change to root account, it gets blocked. I've increased the sysctl fs.file-max to 300000 but the problem persists. Any ideas what's going wrong?

4 3

Re: [syslog-ng] Syslog-ng too many open files
by Pedro Rafael Alves Simoes 25 Jan '08

25 Jan '08

> ------------------------------ > > Message: 3 > Date: Thu, 24 Jan 2008 12:41:36 +0000 > From: Joe Fegan <joe_fegan(a)hotmail.com> > Subject: Re: [syslog-ng] Syslog-ng too many open files > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <BAY111-W20A021959661E71A0B78C39B380(a)phx.gbl> > Content-Type: text/plain; charset="windows-1256" > > > What version of syslog-ng is this? Is it 2.0.7? > > Could it be the same issue recently reported as "syslog-ng 2.0.7 major problem?" > in the list archives, where syslog-ng 2.0.7 does not close old files after SIGHUP? > 300,000 is a lot of files... > I'm using Syslog-ng 2.0.0-1 in a Debian Etch Linux. > ------------------------------ > > Message: 4 > Date: Thu, 24 Jan 2008 12:46:53 -0000 > From: "Geller, Sandor $IT$" <Sandor.Geller(a)morganstanley.com> > Subject: Re: [syslog-ng] Syslog-ng too many open files > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <14F0A35F6E466D48BF11108F4E09E68C0970D239(a)LNWEXMB58.msad.ms.com> > Content-Type: text/plain; charset="us-ascii" > > Hi, > > > Hello, > > > > I'm receiving many messages on my syslog-ng like this: > > > > syslog-ng[20419]: Error opening file for writing; filename="...", > > error='Too many open files (24)' > > syslog-ng[20419]: Error accepting new connection; error='Too many open > > files (24)' > > Try raising the per-process number of open files. Please refer to > ulimit. > > > In lsof output, the syslog-ng daemon has many files opened and when I > > try to login from other console or change to root account, it gets > > blocked. > > > > I've increased the sysctl fs.file-max to 300000 but the > > problem persists. > > This raises the per-system limit only. per-process limits still > apply as well as the maximum (maybe 4096, I'm not sure) is hardcoded > into the kernel, so without recompiling you r kernel you can't exceed > this limitation. When you said that's hardcoded, you mean that I have to change the source code or it's configurable via make config? > > > Any ideas what's going wrong? > > Without seeing more details (syslog-ng version number, configuration, > approximate number of clients, client configs) we could only guess. > > Regards, > > Sandor > -------------------------------------------------------- > > NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. > >

2 1

increasing number of TCP connections from same number of remote hosts
by Nagy Daniel 25 Jan '08

25 Jan '08

Hi, It's syslog-ng v2.0.7 on RHEL4, compiled from source. The system is a log server, it receives logs via TCP from various clients. After restarting syslog-ng, netstat -t shows that each remote host open only one TCP connection to the server, which is normal. The problem is, that the number of established TCP connections is increasing constantly, but the number of clients is the same. For example netstat -t --numeric-ports | grep fmx23 now shows: tcp 0 0 barapp1:514 fmx23.freemail.privat:52391 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:50852 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:50172 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:59367 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:50979 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:55828 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:53013 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:50038 ESTABLISHED Why is that? AFAIK there should be only one established connection per client. Is it a server or client problem? Thanks, Daniel

2 4

udp 514 collision?
by Richard Morgan 24 Jan '08

24 Jan '08

Hi all- We're running syslog-ng in relay mode on a server which collects the udp syslogs from generic syslogd on a number of Linux and Solaris hosts in a single location. All the hosts around the collector are able to send logs to the collector, via 514/udp, and the logs are relayed on to our master server successfully. The problem comes on the relay host itself. We want to run syslog-ng as independently as possible and not have it replace the local syslogd. So, the local syslogd should send its logs via 514/udp to the syslog-ng instance. On RHEL4, it seems that the generic syslogd is showing as bound to 514/udp and any messages that the local syslogd would send on to syslog-ng are lost. Remember, this is all happening on the same host. Any syslog messages from other hosts arrive at the syslog-ng relay and are swiftly relayed on to the master server. # netstat -an | grep 514 tcp 0 0 149.174.133.19:514 0.0.0.0:* LISTEN tcp 0 0 149.174.133.19:9605 IP.FOR.SYSLOG-NG.MASTER:9514 ESTABLISHED (I think this piece is the problem:) udp 0 0 0.0.0.0:514 0.0.0.0:* udp 0 0 149.174.133.19:514 0.0.0.0:* syslog-ng Config bits: ------------------------------------------------------ source s_remote { tcp(localip(149.174.133.19) port(514)); udp(localip(149.174.133.19) port(514)); }; destination d_relay { tcp("IP.FOR.SYSLOG-NG.MASTER" port(9514)); }; log { source(s_remote); destination(d_relay); }; ------------------------------------------------------- Any ideas? Richard -------------------------------------------------------- Richard R. Morgan | richard at northerncrown.com --------------------------------------------------------

2 1

compilation problem
by Siwei Zhang 23 Jan '08

23 Jan '08

Hi there, I am trying to compile the syslog-ng-2.0.7 on CentOS 5 but failed with the following errors. Could someone help please? Thanks. Kevin SZ checking for LIBNET... which: no libnet-config in (/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin) no checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... yes checking whether to enable spoof source support... no checking whether to enable IPv6 support... yes checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... no configure: error: Cannot find GLib library version >= 2.2: is pkg-config in path? -bash-3.1$

4 4

HUP to syslog-ng does not close files
by Beirne Konarski 22 Jan '08

22 Jan '08

I'm upgrading from syslog-ng 2.0rc3 to 2.0.7. One thing that no longer works is when I send syslog-ng a hangup signal the currently open files aren't closed and reopened when the config file is reread. I verified this by running an lsof on syslog-ng and I see that it has files open that say "Deleted" next to the filename in the lsof output. If I send syslog-ng a hangup signal without deleting I files I do see a log entry that the config file is being reread. Because of all this I have had to change the restart line in the logrotate configuration from "syslog reload" to "syslog restart". Is this expected? Thanks, Beirne

2 1

Resolving host IPs on the central log server
by Steve Bernacki 21 Jan '08

21 Jan '08

My setup is pretty simple: I have a number of local syslog-ng "collectors" feeding into one central syslog-ng server. All systems are running syslog-ng 2.0.7. I'd like to optimize the collectors for speed and thus not attempt to resolve hostnames there, but rather pass the syslog message raw to the central log server who then performs the IP->DNS translation and writes the message to disk. I've experimented with the various dns_* options to no avail, as it seems like syslog-ng wants to either resolve the hostname at the collector, or not at all. Am I missing something simple here, or is this not possible with 2.0.7? Thanks for your help. Steve -- Steve Bernacki, Jr To date, the Pan-Massachusetts Challenge has raised 204 million dollars for cancer research. Get involved! http://www.pmc.org/

3 2

syslog-ng 2.0.7 major problem
by Balazs Scheidler 21 Jan '08

21 Jan '08

Hi, I've been biten by a non-trivial change in the 2.0.x branch again, so there's a quite severe problem in 2.0.7: - it does not close and reopen files when a SIGHUP is received. This causes problems for log rotation, especially if the files are compressed after rotation. The problematic patch is this: http://git.balabit/cgi-bin/gitweb.cgi?p=syslog-ng/syslog-ng--mainline--2.0.… I've pushed an experimental patch to fix the issue: http://git.balabit/cgi-bin/gitweb.cgi?p=syslog-ng/syslog-ng--mainline--2.0.… I'm goint to be much stricter to myself when deciding whether to include a patch to the 2.0.x branch in the nearfuture. Sorry for the problem. -- Bazsi

4 6

Re: [syslog-ng] Date and Host in Syslog Format Need Swapping
by infosec＠gmail.com 18 Jan '08

18 Jan '08

According to basic syslog message formatting rules the hostname in that message *is* indeed "2008", unfortunately. Either use bad_hostnames("2008") or set keep_hostnames() to no or false (or whatever the negative is) and use DNS to get the hostnames. To understand why "2008" is the hostname read the page called something like "about syslog" linked off the syslog-ng FAQ. -----Original Message----- From: <wiskbroom(a)hotmail.com> Subj: [syslog-ng] Date and Host in Syslog Format Need Swapping Date: Wed Jan 16, 2008 12:46 pm Size: 440 bytes To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Hello: I have an appliance that I've configured to send logs to syslog, but it is sending to a file named 2008.log instead of $FULLHOST.log None of the other logs that I am getting contain the year, but for some reason, this one is. Below is a sample of the log itself. Jan 16 15:31:06 2008 [192.168.100.1] Is it possible to ignore the YEAR and make output go to $FULLHOST.log ? Thank you, .vp --- attachment noname 1.txt ---

6 14

[Bug 16] New: program destination driver no longer sends TAG to STDIN in 2. 0.6
by bugzilla＠bugzilla.balabit.com 17 Jan '08

17 Jan '08

https://bugzilla.balabit.com/show_bug.cgi?id=16 Summary: program destination driver no longer sends TAG to STDIN in 2.0.6 Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: llarian(a)llarian.net Type of the Report: --- Estimated Hours: 0.0 After an upgrade from 1.6.11 to 2.0.6, it appears that the program destination driver no longer sends the priority/facility tag to stdout, despite the docs saying it transfers using the wire protocol of syslog. The following is the output of a perl script that does nothing but log stdin: Jan 15 15:46:57 192.168.105.10/206.208.46.253 10054: Jan 15 15:46:55.948 PST: %SYS-5-CONFIG_I: Configured from console by dylanv on vty0 (192.168.113.34) 1.6.11 prefixes this with the correct <45> output. Is this expected behavior and is there a way to get it to send the raw syslog packet to the program destination? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

Excessive Log Statistics
by Baxter, Scott 14 Jan '08

14 Jan '08

I apologize for this spam in advance as this may have been addressed in the past. How can I suppress the following frequent logging: syslog-ng[28465]: Log statistics; dropped='tcp(AF_INET(10.101.205.188:10514))=0', processed='center(queued)=179', processed='center(received)=44', processed='destination(d_auth)=0', processed='destination(d_cron)=42', processed='destination(d_mlal)=0', processed='destination(remote)=9', processed='destination(d_mlop)=0', processed='destination(d_mesg)=86', processed='destination(d_mlrt)=0', processed='destination(d_cons)=0', processed='destination(d_mail)=42', processed='source(s_sys)=44' Charles Schwab|T E C H N O L O G Y I N N O V A T I O N _____________________________________ Scott W Baxter Sr. Staff Phone: (602) 977-4565 UNIX Certification and Engineering Cell: 602-793-3909 Charles Schwab & Co., Inc. Phoenix Data Center 4750A E Francisco Dr. 01-435 Phoenix, Arizona 85044 scott.baxter(a)schwab.com Member:SIPC ________________________________________________ All email sent to this address will be received by the Charles Schwab & Co., Inc. corporate email system and is subject to archival and review by someone other than the recipient.

3 2

Re: [syslog-ng] Upgrade from 1.6.11 to 2.0.7: Gotchas?
by Ivey, Chris 14 Jan '08

14 Jan '08

Thanks, Bazsi! I was wondering if there is anything documented on the upgrade path, or if there is anything documented on the downgrade if the upgrade is not successful. I like to have documents to fall back on, when I try to do something for the first time. :o) Thanks!!! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Sunday, January 13, 2008 3:10 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Upgrade from 1.6.11 to 2.0.7: Gotchas? On Fri, 2008-01-11 at 08:03 -0600, Ivey, Chris wrote: > Folks, > I need to upgrade my syslog-ng from 1.6.11 to 2.0.7 since we > now are using devices with high resolution timestamps. As I inherited > these machines, and had not worked with syslog-ng prior to getting > them, I was wondering if anyone could let me know if there were any > gotchas for the upgrade. Can I upgrade in place? Do I need to make > backups of any files? Things of this nature. Thanks, all! > You can upgrade in place, the 2.0 version is upward compatible with 1.6.x, however as it is a complete rewrite, I'd suggest you to run the configuration file on a 2.0 first to see if it parses ok. Once the configuration file is processed by the new version then most probably it will work well. You can upgrade in place as if you encounter problems you can always go back to 1.6.x without pain. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog-ng roadmap for 2.1 & 2.2
by Balazs Scheidler 13 Jan '08

13 Jan '08

Hi, I have published some details about our plans on syslog-ng 2.1 and 2.2 on my blog, please read this port for more details: http://bazsi.blogspot.com/2008/01/syslog-ng-roadmap-21-22.html As described there I'm going to open two syslog-ng OSE branches at about the same time: syslog-ng OSE 2.1: * destined to get the PE features that we decided to be open-sourced: SQL destination * no real development process as most changes are already released in the Premium Edition * once released, 2.0 is becoming a strict maintenance branch, nothing but bugfixes syslog-ng OSE 2.2: * developed in parallel with the PE version * the new features that we planned in the PE and we decided to open-source right from the start will be released in this branch, these are: * support for the new IETF syslog protocol * sequence numbering of messages * message parsing/rewriting I hope to get syslog-ng 2.1 out of the door real soon now, the git repository is already opened: http://git.balabit.hu/?p=bazsi/syslog-ng-2.1.git;a=summary I'm going to put together a "beta" release of syslog-ng OSE 2.1 in the nearfuture. I'm expecting syslog-ng 2.2 to be opened in the coming weeks, our plans are to release syslog-ng PE 2.2 in Q1-Q2 2008. -- Bazsi

1 0

Upgrade from 1.6.11 to 2.0.7: Gotchas?
by Ivey, Chris 13 Jan '08

13 Jan '08

Folks, I need to upgrade my syslog-ng from 1.6.11 to 2.0.7 since we now are using devices with high resolution timestamps. As I inherited these machines, and had not worked with syslog-ng prior to getting them, I was wondering if anyone could let me know if there were any gotchas for the upgrade. Can I upgrade in place? Do I need to make backups of any files? Things of this nature. Thanks, all! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

2 1

Re: [syslog-ng] SEC and syslog
by infosec＠gmail.com 11 Jan '08

11 Jan '08

I use the program destination because I log to files by date and sometimes a host system with a bad date screws things up. With program I'll see every message once and only once, see it right away and not have to worry about the pipe. I could see going with a pipe if you wanted to be able to restart syslog regularly (like if you had a mem leak or something), but program() is quick, reliable and easy. -----Original Message----- From: "Solis, Alex $EMC$" <axsolis(a)cps-ems.com> Subj: [syslog-ng] SEC and syslog Date: Thu Jan 10, 2008 8:30 am Size: 873 bytes To: <syslog-ng(a)lists.balabit.hu> I have been using syslog-ng and logdog.pl (http://caspian.dotconf.net/menu/Software/LogDog/) for quite some time but now want to move to SEC because of its thresholding and suppression features. I noticed that SEC can monitor files and does not necessarily need a FIFO pipe. I also noticed that syslog-ng can send logs directly to a program using the program() feature. My question is which is the best way to implement the syslog-ng to SEC conduit? Should I create a pipe and ask SEC to monitor that because its efficient? Should I simply ask SEC to monitor syslog-ng's destination file even though files are rotated every night? Or should I use syslog-ng's program() feature to send messages to SEC. I guess all will work but which is the best option. Thanks for any insight. Alex --- attachment noname 1.html --- --- message truncated ---

3 2

SEC and syslog
by Solis, Alex (EMC) 10 Jan '08

10 Jan '08

I have been using syslog-ng and logdog.pl (http://caspian.dotconf.net/menu/Software/LogDog/) for quite some time but now want to move to SEC because of its thresholding and suppression features. I noticed that SEC can monitor files and does not necessarily need a FIFO pipe. I also noticed that syslog-ng can send logs directly to a program using the program() feature. My question is which is the best way to implement the syslog-ng to SEC conduit? Should I create a pipe and ask SEC to monitor that because its efficient? Should I simply ask SEC to monitor syslog-ng's destination file even though files are rotated every night? Or should I use syslog-ng's program() feature to send messages to SEC. I guess all will work but which is the best option. Thanks for any insight. Alex

1 0

make fails with syslog-ng 2.0.6 --enable-source-spoof
by David Rice 08 Jan '08

08 Jan '08

I'm having problems with the make when installing syslog-ng 2.0.6 on Solaris 10 x86 The error is the following *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /tmp/syslog- ng-2.0.6/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib solbuild tgzbuild'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /tmp/syslog-ng-2.0.6 *** Error code 1 make: Fatal error: Command failed for target `all' I'm using the following for the config script ./configure --enable-spoof-source --enable-dynamic-linking CC=gcc LDFLAGS=-L/usr/local/lib I need the -enable-spoof-source to pass to another syslog device upstream. Thanks in advance for the help

2 4

syslog-ng 2.0.7 has been released
by devel＠balabit.hu 08 Jan '08

08 Jan '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.7 SUMMARY : new stable release DATE : Jan 8, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.7) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.7 Thu, 03 Jan 2008 07:01:59 +0100 Bugfixes: * Fixed UNIX domain socket destinations on Solaris. * Fixed flow-control behaviour for follow-mode source files. * Added the "mark" keyword to be an alias of "mark_freq" for compatibility with syslog-ng 1.6. * Fixed message loss in destination files during configuration reloads if syslog-ng is heavily loaded. * Fixed a possible segmentation fault in the dns-cache-host() file parsing code for improperly formatted host files. * Fixed possible "Insufficient buffer space" errors in the STREAMS driver. * Fixed the starvation of the timer used to reap unused destination files, which could cause some files never to be closed under heavy load. * Fixed ISO timestamp parsing for timestamps that have no timezone information or have a too long fraction of a second portion. * Added a workaround for possible deadlocks on /proc/kmsg and user terminals. * Fixed program name parsing that caused problems for TAG values that include the '/' character. This problem was introduced by 2.0.6. Other changes: * The fsync() option was implemented. * Added support for file sources that do not exist at startup. * Added support the "--persist-file" configuration option. * Added support for timestamps used by some LinkSys routers. * Added loggen tool to generate syslog messages at the specified rate. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/

1 0

UDP Works, TCP Does Not
by Baxter, Scott 07 Jan '08

07 Jan '08

All, I am new to syslog-ng and want to use it for tcp remote logging, (without ssh at this time). I am testing from a Solaris 10 box, sending logging files to another Solaris 10 box. It sends them via udp just fine. But when I change that to TCP, no logging. Not finding much on the internet around this subject. If anybody has any info regarding this, please send my way. Thanks, Scott

2 2

rewrite log messages
by M. Braun syslog-ng 06 Jan '08

06 Jan '08

Hi, is there a way to make syslog-ng rewrite a log message before it is written to disk, e.g. to remove all sender and recipient fields the mail server did log? MB

3 2

datetime stamp of syslog-ng...
by Anant Athavale 02 Jan '08

02 Jan '08

Dear List, I am redirecting a system log of one server to a centralized log server running syslog-ng. When we redirect, syslog-ng adds its own datetime stamp before the actual log entry for each line. Due to this, one of the log processing software does not recognize the format and does not generate any reports. If I remove those 4 fields (Month Name, Date, Year and IP address) for ex: Jan 2 2008 10.10.10.10 (here 10.10.10.10 is the IP address of the system whose logs are getting stored in central log server) that log processing software works as expected and generates report. Is it possible that, I can block those fields getting recorded. If yes, how? and if not, what is the alternative? Regards, Anant Athavale.

2 4

[BUG] non-existing program destinations
by Ortwin Glück 31 Dec '07

31 Dec '07

Hi, I discovered a problem in syslog-ng-2.0.6. In my Gentoo installation there were some default program destinations configured: destination mail-alert { program("/usr/local/bin/syslog-mail"); }; destination mail-alert-perl { program("/usr/local/bin/syslog-mail-perl"); }; But these programs do not exist in my installation. strace shows that syslog-ng is looping while trying to start these processes: --- SIGCHLD (Child exited) @ 0 (0) --- sigreturn() = ? (mask now []) close(6) = 0 fcntl64(13, F_GETFL) = 0x1 (flags O_WRONLY) fcntl64(13, F_SETFL, O_WRONLY|O_NONBLOCK) = 0 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 127}], WNOHANG) = 19922 close(7) = 0 pipe([6, 7]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7ca2708) = 19927 --- SIGCHLD (Child exited) @ 0 (0) --- sigreturn() = ? (mask now []) close(6) = 0 fcntl64(7, F_GETFL) = 0x1 (flags O_WRONLY) fcntl64(7, F_SETFL, O_WRONLY|O_NONBLOCK) = 0 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 127}], WNOHANG) = 19924 close(8) = 0 pipe([6, 8]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7ca2708) = 19928 --- SIGCHLD (Child exited) @ 0 (0) --- sigreturn() = ? (mask now []) close(6) = 0 fcntl64(8, F_GETFL) = 0x1 (flags O_WRONLY) fcntl64(8, F_SETFL, O_WRONLY|O_NONBLOCK) = 0 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 127}], WNOHANG) = 19926 close(13) = 0 pipe([6, 13]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7ca2708) = 19929 Sending it a HUP makes the situation even worse (I think it just starts another loop) and syslog-ng consumes considerable CPU time after that. syslog-ng ought to check if the file exists before trying clone(). Maybe also a warning would help to spot the config problem (there is none, even with the -d flag). But like this it is really hard to find the problem. Cheers Ortwin Glück

2 1

Can TAG field be terminated by space?
by Tsurusawa Takeshi 31 Dec '07

31 Dec '07

Hi, I'm using syslog-ng-2.0.5 and trying to store syslog messages into a DB table with a TAG field column. But when TAG fileld is terminated with space character(' ') in syslog message, syslog-ng parser returns as TAG field not only TAG field but also some extra strings end with a colon(':') in CONTENT field. For example, if MSG part is "program abc: message...", syslog-ng returns "program abc" as a TAG field. According to the section 4.1.3 of RFC3164, a space character can also terminate a TAG field. The TAG is a string of ABNF alphanumeric characters that MUST NOT exceed 32 characters. Any non-alphanumeric character will terminate the TAG field and will be assumed to be the starting character of the CONTENT field. Most commonly, the first character of the CONTENT field that signifies the conclusion of the TAG field has been seen to be the left square bracket character ("["), a colon character (":"), or a space character. Is it possible to change this behavior of syslog-ng? Thanks in advance. -- Tsurusawa Takeshi <tsuru(a)grid.nii.ac.jp>

3 6