- syslog-ng - lists.balabit.hu

[Bug 15] New: 2.0.6 is not compatible with previous version's config file
by bugzilla＠bugzilla.balabit.com 30 Dec '07

30 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=15 Summary: 2.0.6 is not compatible with previous version's config file Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: welz(a)fixe-post.de Type of the Report: bug Estimated Hours: 0.0 filter f_mail_count_incoming { program("postfix/smtp") and match("to=") and (match("@mydomain.de") or match("@MYDOMAIN.DE")) and not match("systemmeldung") and match("status=sent"); }; doesn't work since I upgraded from previos version (gentoo linux) However, when I change program("postfix/smtp") to program("postfix") it seems to work, but I have lots of rules and lots of computers, although you would say 12 is not much ;), and I wish to express that it would be absolutely helpful, if syntax changes could be mentioned in the changelog. Regards, Robert -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

Run 2 syslog-ng by defferent configurations
by Takenaka Kazuhiro 28 Dec '07

28 Dec '07

Hi all. I would like to run 2 syslog-ng instances in the same server and tried it, but encounterd a problem. I have some questions, please advise me something you know about this. Firstly, I run a syslog-ng 1.6.8 instance on Redhat EL4 update 5 by a install default configuration file. And then I run the other instance by the following configuration: ------------------------------------------------------------ source s_udp_9000 { udp(port(9000)); }; filter f_host_XXX { host ("[xX][xX][xX]11|172\.20\.100\.100"); }; destination d_udp_messages_XXX { file("/dbf/heartbeat/XXX.log" create_dirs(yes) perm(0640)); }; log { source(s_udp_9000); filter(f_host_XXX); destination(d_udp_messages_XXX); }; ------------------------------------------------------------ The operations proceeded as the following. # service syslog-ng start Starting system logger: [ OK ] # syslog-ng -p /var/run/syslog-ng-vip.pid -f syslog-ng-vip.conf Warning: No source refers to internal messages, they'll go to /dev/null My first question is : 1. Does syslog-ng 1.6.8 always handle internal messages ? I suspict it will cause odd behaviors on logging internal messages when multiple syslog-ng instances run on a server. Or are there some effective configurations to avoid this ? Next, I updated the version of syslog-ng to 2.0.4 and played same operations. No warnings were shown on the terminal. My second question is : 2. Can syslog-ng 2.0.4 ignore internal messages if the configurations specify that it shuld run so ? I think it means run multiple instances can run on a server safely. Or do some problems hide behind the silence ? =========================================================== I'd better to explain what makes me try such configurations I mentioned to help readers understand my demand. I plan to sent my servers' logs to a central syslog-ng server. To make my syslog-ng server a high avalable one, I decided to use Heartbeat as a HA manager to make a ACT/SBY syslog-ng cluster. I also decided to use shared disks so as to save external logs into them and make external log files be taken over on a failover by them. On the other hand, I intend to save central server's own logs into server's internal disks. I think it would be better to run 2 syslog-ng instances and assign one to handle internal logs and the other to handle external logs. The internal one shuld be managed by a rc script and the external should be managed by Heartbeat. The reason I think this way, or the reason I avoid handling all messages by one instance, is the following. Hearteat alway performs a stop operation on eash resources that Hearteat just attempt to failover. If Heartbeat manages the syslog-ng instance which handles all logs, and a failover is triggered by some reason except syslog-ng's own corruption, Heartbeat brings a stop to the syslog-ng instance. This means internal logging must stop in the very time some troubles occurs. It obviously is unpreferable. =========================================================== Sincerely. -- Takenaka Kazuhiro <takenaka.kazuhiro(a)oss.ntt.co.jp> NTT OSS Center

2 3

Solaris 9/SPARC patch for 2.0.6 (tests/unit/test_dnscache.c)
by Albert Chin 27 Dec '07

27 Dec '07

Solaris 9/SPARC needs sys/socket.h for AF_INET. Patch for tests/unit/test_dnscache.c attached. -- albert chin (china(a)thewrittenword.com)

2 1

[Bug 5] New: syslog-ng crashes when using fallback flag
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=5 Summary: syslog-ng crashes when using fallback flag Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: srainville(a)videotron.ca Type of the Report: --- Estimated Hours: 0.0 Tested on RHEL ES 4u5 32bit. Attached conf file. Used Nessus to scan system with all plugins enabled (even dangerous ones). Process quits but pid still exists. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 9] New: syslog-ng crashes when /etc/eventlog.conf exists
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=9 Summary: syslog-ng crashes when /etc/eventlog.conf exists Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447105 OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 >From bugs.debian.org: When /etc/eventlog.conf exists and contains "[hello]" (for example), syslog-ng segfaults at start. Here is the end of strace output: uname({sys="Linux", node="naruto", ...}) = 0 brk(0) = 0x8088000 brk(0x80a9000) = 0x80a9000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\0\0\0\f\0"..., 4096) = 1082 close(3) = 0 munmap(0xb7f7c000, 4096) = 0 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 rt_sigaction(SIGHUP, {0x804aae0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGTERM, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGINT, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGCHLD, {0x804ab00, [], 0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {0x804ab10, [], SA_ONESHOT}, NULL, 8) = 0 gettimeofday({1192688001, 803861}, NULL) = 0 open("/etc/eventlog.conf", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=8, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "[hello]\n", 4096) = 8 --- SIGSEGV (Segmentation fault) @ 0 (0) --- kill(12421, SIGSEGV) = 0 sigreturn() = ? (mask now []) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 12421 detached I did not find any documentation about /etc/eventlog.conf file. I have found this bug because such file was created by an unrelated application. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 1] New: syslog-ng crashes when /etc/eventlog.conf exists
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=1 Summary: syslog-ng crashes when /etc/eventlog.conf exists Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bazsi(a)balabit.hu Estimated Hours: 0.0 Hi ! When /etc/eventlog.conf exists and contains "[hello]" (for example), syslog-ng segfaults at start. Here is the end of strace output: uname({sys="Linux", node="naruto", ...}) = 0 brk(0) = 0x8088000 brk(0x80a9000) = 0x80a9000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=1082, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\f\0\0\0\f\0"..., 4096) = 1082 close(3) = 0 munmap(0xb7f7c000, 4096) = 0 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 rt_sigaction(SIGHUP, {0x804aae0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGTERM, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGINT, {0x804aaf0, [], 0}, NULL, 8) = 0 rt_sigaction(SIGCHLD, {0x804ab00, [], 0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {0x804ab10, [], SA_ONESHOT}, NULL, 8) = 0 gettimeofday({1192688001, 803861}, NULL) = 0 open("/etc/eventlog.conf", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=8, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f7c000 read(3, "[hello]\n", 4096) = 8 --- SIGSEGV (Segmentation fault) @ 0 (0) --- kill(12421, SIGSEGV) = 0 sigreturn() = ? (mask now []) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 12421 detached I did not find any documentation about /etc/eventlog.conf file. I have found this bug because such file was created by an unrelated application. -- System Information: Debian Release: lenny/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'stable'), (1, 'experimental') Architecture: i386 (i686) Kernel: Linux 2.6.22-2-686-bigmem (SMP w/2 CPU cores) Locale: LANG=fr_FR@euro, LC_CTYPE=fr_FR@euro (charmap=ISO-8859-15) Shell: /bin/sh linked to /bin/bash Versions of packages syslog-ng depends on: ii libc6 2.6.1-5 GNU C Library: Shared libraries Versions of packages syslog-ng recommends: ii logrotate 3.7.1-3 Log rotation utility -- no debconf information -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 10] New: Option mark() not working
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=10 Summary: Option mark() not working Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=425018 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 >From bugs.debian.org: syslog-ng.conf(5) states that mark(n) is not implemented yet but mark-lines are printed to syslog. mark(0) should disable that but gives an error during syntax-check. If one writes mark_freq() to config it works. So, at least the manpage should be updated. Second quirk: mark_freq(0) does not disable printing of mark-lines, instead it really floods the syslog with mark-lines. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 8] New: syslog-ng hangs writing to /dev/ttyN
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=8 Summary: syslog-ng hangs writing to /dev/ttyN Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=397650 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=4) --> (https://bugzilla.balabit.com/attachment.cgi?id=4) Patch to prevent hanging >From bugs.debian.org: (This is the same problem reported against syslog-ng in Gentoo at https://bugs.gentoo.org/show_bug.cgi?id=154465 -- this contains a patch which fixes the problem with a similar approach to that taken in sysklogd.) When syslog-ng writes to a tty under Linux, for example as a result of a usertty directive, the write syscall to /dev/ttyN can ocassionally block indefinitely. One situation when this occurs is when the user has set XOFF (perhaps with Ctrl-S or Scroll Lock). Aside from the fact that this obvious prevents any further log messages from being written, /dev/log's buffer eventually fills up causing other programs to block writing to /dev/log. In extremis, this can render a machine inaccesible when ssh, etc., all block preventing access. Reproducible: Always Steps to Reproduce: 1. Check that there is a usertty("*") directive for (say) kern.emerg logs 2. Ensure syslog-ng is running 3. On console, press Scroll Lock 4. Log something, e.g. logger -p kern.emerg 'Foo'. 5. Repeat #4 many times; eventually it will hang trying to log -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 7] New: Syslog-ng doesn' t send to *any* remote host when one of them isn't reachable
by bugzilla＠bugzilla.balabit.com 27 Dec '07

27 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=7 Summary: Syslog-ng doesn't send to *any* remote host when one of them isn't reachable Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=452249 OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 >From bugs.debian.org: Hi, I'm using syslog-ng to have a bunch of webservers log to remote syslog-servers. I have defined them on the webservers like this; destination remote_logging { tcp("10.10.10.1" port(1999)); }; destination remote_logging { tcp("10.10.10.2" port(1999)); }; Which works fine as long as both the remote servers are reachable. The moment one of them is unreachable, syslog-ng starts complaining about it in the logging: Nov 21 11:46:34 web01 syslog-ng[9892]: Connection broken to AF_INET(10.10.10.2:1999), reopening in 10 seconds But at this moment it doesn't log to the other remote syslog-ng server either, which makes the setup useless. I could not find a configuration-feature to prevent this from happening, am I overlooking something? thanks a lot, Roel. -- System Information: Debian Release: 3.1 Architecture: i386 (i686) Kernel: Linux 2.6.17-mp20070417 Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1) Versions of packages syslog-ng depends on: ii libc6 2.3.2.ds1-22sarge5 GNU C Library: Shared libraries an ii util-linux 2.12p-4sarge1 Miscellaneous system utilities -- no debconf information -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

unable to compile on AIX
by Anant Athavale 27 Dec '07

27 Dec '07

Dear List: I am unable to compile syslog-ng on AIX 5.3. I am using the following command to configure. configure EVTLOG_LIBS=-L/usr/local/lib EVTLOG_CFLAGS=-I/usr/local/include/eventlog --enable-static-linking --prefix=/usr/local/syslog-ng When I run make, I get the following error: Sorry for another post. I am giving the complete error here. ----------------------------------------------------------------------- Making all in src gcc -g -O2 -Wall -L/usr/local/lib -o syslog-ng main.o libsyslog-ng.a -static -lnsl -lrt -lfl -L/opt/freeware/lib -lglib-2.0 -lintl -liconv -L/usr/local/lib ld: 0711-340 SEVERE ERROR Symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyin in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyin in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. collect2: ld returned 12 exit status make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 2. Stop. ---------------------------------------------------------------------------- Please let me know, how to proceed. TIA. Regards, Anant Athavale.

2 1

cisco router logs..
by Anant Athavale 27 Dec '07

27 Dec '07

Dear List: I have configured my linux box to receive logs from cisco router over tcp. The log entries are coming, but instead of a newline character, * (star) is getting inserted into the log. So, log is becoming a single line output. Has anybody faced similar problem? How to resolve this? Regards, Anant Athavale.

2 1

unable to compile on AIX
by Anant Athavale 26 Dec '07

26 Dec '07

Dear List: I am unable to compile syslog-ng on AIX 5.3. I am using the following command to configure. configure EVTLOG_LIBS=-L/usr/local/lib EVTLOG_CFLAGS=-I/usr/local/include/eventlog --enable-static-linking --prefix=/usr/local/syslog-ng When I run make, I get the following error: ld SEVERE ERROR symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. Please suggest me, how to continue. Regards, Anant Athavale.

1 0

[Bug 11] New: Remove non-printable characters from log messages before writing them to disk
by bugzilla＠bugzilla.balabit.com 26 Dec '07

26 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=11 Summary: Remove non-printable characters from log messages before writing them to disk Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=354108 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: Among others, Perl's Sys::Syslog sends message buffers containing non-printable characters (mainly NUL characters - \000) to the local syslog daemon. sysklogd stops writing messages at the first NUL character and is therefore mainly unaffected by this. syslog-ng however, saves the complete buffer to the logfile. This behaviour might be of use to some (especially with non-ASCII character sets), but for most of us, it isn't too nice because it makes grep'ing harder (grep complains about binary file). It would therefore be nice if syslog-ng could at least strip trailing NUL characters from incoming log messages. It might be even nicer if an option was introduced to remove or replace non-printable characters from log messages. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 13] New: Drop older messages instead of new ones if needed
by bugzilla＠bugzilla.balabit.com 25 Dec '07

25 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=13 Summary: Drop older messages instead of new ones if needed Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=192054 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I would like to suggest that for a destination that is a pipe (or perhaps any destination that is not a local file) that the oldest messages are deleted to make room for newer messages, rather than the other way around, as is currently being done. This suggestion could perhaps be a configuration option for every destination driver, eg, destination xconsole { pipe("/dev/xconsole" owner("root") lose(oldest)); file("/var/log/xcons.log" owner("root") lose(newest)); }; with the default being backwards compatible with the current policy, ie, lose(newest). -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

Eric Savidan/France/Equant is out of the office. : Run 2 syslog-ng by defferent configurations
by eric.savidan＠orange-ftgroup.com 25 Dec '07

25 Dec '07

I will be out of the office starting 24/12/2007 and will not return until 02/01/2008.

1 0

Cisco Syslog: Wireless Controller Messages
by Ivey, Chris 22 Dec '07

22 Dec '07

Hello everyone, and happy holidays! I came across a weird issue with syslog-ng, and messages coming from the Cisco Wireless Controller devices. When I use ngrep to do a capture from the wire, the alert looks like this: <130> Dec 21 19:20:24.474 iapp_socket_task.c:580 IAPP-3-MSGTAG015: iappSocketTask: iappRecvPkt returned error However, after running through syslog-ng and getting to my syslog file it appears like this (numbers different, message the same): Dec 21 16:01:27 .839 iapp_socket_task.c:580 IAPP-3-MSGTAG015: iappSocketTask: iappRecvPkt returned error So, it appears as though syslog-ng is pulling the milliseconds from the alert (the .839 in the second example) and moving it to the 4th token spot, instead of leaving it attached. Anyone seen this behavior, and more importantly, what do we need to do to fix it? I am on syslog-ng version 1.6.11. Thanks in advance!!! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

2 1

Re: [syslog-ng] Cisco Syslog: Wireless Controller Messages
by G.W. Haywood 22 Dec '07

22 Dec '07

Hi there, On Sat, 22 Dec 2007 Ivey, Chris wrote: > ... it appears as though syslog-ng is pulling the milliseconds from > the alert (the .839 in the second example) and moving it to the 4th > token spot, instead of leaving it attached. Anyone seen this > behavior, and more importantly, what do we need to do to fix it? I > am on syslog-ng version 1.6.11. I wouldn't normally have answered this since I can't comment on the behaviour of 1.6.11 but it is possible that you won't get much other response over the holiday period. Your syslog-ng is rather old - I'm using syslog-ng 2.0.6 - so I guess the first thing for you to do is to try that too. Compliments of the season to all! -- 73, Ged.

1 0

Solaris 10/SPARC patches for 2.0.6
by Albert Chin 21 Dec '07

21 Dec '07

Attached are two patches for syslog-ng-2.0.6 on Solaris 10/SPARC with the Sun C compiler: 1. tests/unit/test_msgparse.c requires __STRING but assumes it exists. 2. LOG_AUTHPRIV is not available on this platform. -- albert chin (china(a)thewrittenword.com)

1 0

lsof shows open files which should be closed
by Nagy Daniel 21 Dec '07

21 Dec '07

Hello, Scenario: this is a log server which receives logs from variuos hosts via TCP. We use time macros, which create a new log file in every hour for each remote host. The problem is, that 'lsof -c syslog-ng' shows, that the logfiles of the previous hours are still open, which exhausts the number of file descriptors after a while. kill -HUP syslog-ng corrects this as a workaround. System: RHEL4 Syslog-ng: 2.0.5 compiled from source Relevant config parts: options { flush_lines(16); flush_timeout(1000); time_reopen (10); log_fifo_size (1000); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats_freq(0); time_sleep(20); time_reap(10); }; source s_net { tcp(max-connections(512)); }; destination d_freemail_pop3{ file("/data/syslog/FP-$YEAR$MONTH$DAY-$HOUR0000-$HOST.log" template ("$YEAR.$MONTH.$DAY $HOUR:$MIN:$SEC $TZOFFSET $HOST $MSG\n") template_escape(no) group("bar") perm(0660)); }; For example 'lsof -c syslog-ng' at 12:20 shows these entries as open (it shows more, there are examples only): syslog-ng 8314 root 10w REG 253,0 1840830 3965325 /data/syslog/TM-20071219-110000-mx08a.log syslog-ng 8314 root 249w REG 253,0 5521445 3965131 /data/bar/data/target/mail/TM-20071219-100000-mx07a.log (deleted) The second is also interesting. After some minutes of an hour change, a script moves the log to an other directory. That's why the path of the second line is changed. But is it still open by syslog-ng? Thanks, Daniel

3 13

Lost messages
by Andrew Séguin 21 Dec '07

21 Dec '07

Hello, I'm sorry if I'm missing something obvious, admittedly I've only had the chance to quickly search through the manuals and mailing list and not read them as deep as I'd like to, yet. I'm working in a project where we were considering replacing syslog to take advantage of reliable transmission over tcp. Performance is a factor for us, so we wrote a short program that simply loops and logs a counter and time stamp (to avoid "last message repeated x messages"). We ran it with syslog (saving locally to a file, and then sending remotely to another station which is logging to file) and got some reference numbers for the hardware/OS (Solaris 10). We then started the same test with syslog-ng. Performance didn't get to be an issue: under the pressure of the performance test, only some 5-600,000 lines are logged although 1,000,000 were sent! We tried a few tweaks to the configuration file for buffering (see below), but it hasn't helped unfortunately. Is there a way to avoid this problem? Will we encounter this same problem on the remote host (considering the remote/logging host is planned to be accepting messages from two servers with a lot of traffic) Thanks for any tips/info! Andrew Seguin ps: here is the configuration file we have used... # # Syslog-ng example configuration file for Solaris # # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.solaris,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Solaris 2.5.1 and below uses the STREAMS driver, above extends it # with doors. For 2.5.1 remove the door() option from the source declaration. # options { sync (0); log_fifo_size (65535); gc_idle_threshold(30); gc_busy_threshold(3000); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/tmp/messages-ng" log_fifo_size(60000)); }; filter filter_local6 { facility(local6); }; log { source(local); filter(filter_local6); destination(all); };

2 3

Using syslog-ng as a relay inject unexpected data
by Allen Bettilyon 21 Dec '07

21 Dec '07

Hello, I'm doing some pretty basic syslog forwarding using syslog-ng 1.6.2. Essentially, I've got the following: destination remoteHost { tcp("1.1.1.1 port 9999"); }; The forwarding is working correctly, however on the remote side all my log lines are prepended with a <number> tag. For example: Some log line turns into: <38>Some log line I've tried creating a custom template, but the <number> is always added to the log lines when the arrive at the remote host. Why is this happening and is there a way to turn it off? Thanks, - Allen Bettilyon

3 5

[Bug 4] New: Year not being parsed
by bugzilla＠bugzilla.balabit.com 20 Dec '07

20 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=4 Summary: Year not being parsed Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: justin.mr.smith(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=1) --> (https://bugzilla.balabit.com/attachment.cgi?id=1) Packet capture of logs being sent to server There seems to be an issue with the parsing of the logs being sent to syslog-ng server in a way that it is unable to parse out the year out of the udp packet being sent to it. After taking a packet capture of the log being sent yes indeed the year is in the packet. Configs: Ubuntu 7.10 - Syslog-ng 2.0.0 & 2.0.6 Sender: Linksys RV042,RV082 routers Packet Capture: Message: Dec 12 11:49:14 2007 RV042 RGFW-IN: BLOCK-RULES (TCP 69.xxx.xxx.xxx:1639->69.xxx.xxx.xxx:1433 on ixp1) [0,0] -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

Compilation Woes - RHEL 5 cont.
by Chuck 20 Dec '07

20 Dec '07

I decided to install the eventlog libs into the default location (prefix = /usr/local) and syslog-ng still won't find these libraries. Anyone get this compiled and installed on rhel 5 32-bit? -Chuck

4 5

Re: [syslog-ng] Compilation Woes - RHEL 5 cont.
by andy 20 Dec '07

20 Dec '07

Chuck wrote: > Cool thanks. I was able to install those w/o problems.. > Thanks, > CC > > On Dec 20, 2007 7:40 AM, andy <andy(a)zrmt.com> wrote: > >> Chuck wrote: >> >>> Nah, where did you find them? I must have overlooked them. >>> >>> -Chuck >>> >>> >>> On Dec 20, 2007 7:29 AM, andy <andy(a)zrmt.com> wrote: >>> >>> >>>> Chuck wrote: >>>> >>>> >>>>> I decided to install the eventlog libs into the default location >>>>> (prefix = /usr/local) and syslog-ng still won't find these libraries. >>>>> >>>>> Anyone get this compiled and installed on rhel 5 32-bit? >>>>> >>>>> -Chuck >>>>> _______________________________________________ >>>>> syslog-ng maillist - syslog-ng(a)lists.balabit.hu >>>>> https://lists.balabit.hu/mailman/listinfo/syslog-ng >>>>> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >>>>> >>>>> >>>>> >>>>> >>>> Chuck, >>>> >>>> I just found the syslog-ng and eventlog rpms and installed them. Is >>>> there a reason why you need to compile? >>>> >>>> Regards, >>>> >>>> Andy >>>> >>>> >>>> >> I've put them up at http://andy.zrmt.com. >> >> I can't remember where I originally got them.. but I'll update them as >> necessary.. >> >> Regards, >> >> Andy >> >> No problems. Andy

1 0

Compilation Woes on RHEL 5
by Chuck 20 Dec '07

20 Dec '07

I am trying to build syslog-ng 2.0.6 with eventlog installed into /usr/local/eventlog-0.2.5/. configure is complaining it can't find eventlog or pkg-config: checking for GLIB... yes checking for EVTLOG... no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? charger:/usr/local/src/syslog-ng-2.0.6 #which pkg-config I have tried adding the /usr/local/eventlog-0.2.5/lib path to /etc/ld.so.conf (and reconfiguring ld). charger:/usr/local/src/syslog-ng-2.0.6 #ldconfig -p | grep eventlog libevtlog.so.0 (libc6) => /usr/local/eventlog-0.2.5/lib/libevtlog.so.0 libevtlog.so (libc6) => /usr/local/eventlog-0.2.5/lib/libevtlog.so I have tried defining this in LD_LIBRARY_PATH. I have also tried explicitly setting LDFLAGS (for the libs) and CPPFLAGS (for the includes) in the environment I'n running configure from. I am unable to get configure to find these libraries. It also complains it can't find pkg-config, however this pkg-config is under /usr/bin and the shell I'm running this from has no problems findind it: charger:/usr/local/src/syslog-ng-2.0.6 #which pkg-config /usr/bin/pkg-config charger:/usr/local/src/syslog-ng-2.0.6 #pkg-config --version 0.21 I don't want to install the eventlog libraries directly under /lib or /usr/local/lib. Is there any way to do this? Thanks for any help, CC

1 0