- syslog-ng - lists.balabit.hu

Trying to build RPM
by Andrew Kerr 09 Oct '07

09 Oct '07

Hi folks, I've downloaded the source for syslog-ng 2.0.5 and am trying to build an RPM. When I try, I get a missing dependency with libevtlog-devel. I did compile and install eventlog-0.2.5, as well as adding /usr/local/lib to /etc/ld.so.conf. Even if I just try configuring syslog-ng, I get a similar error: 'No package eventlog' found. Thanks

2 1

E-mail alert from Syslog-NG!
by Wilson Lai 08 Oct '07

08 Oct '07

Dear ALL, Would there be any tool to check the severity of the log message and alert me by mail once receiving the event log message with “error” severity? Thanks. Regards, Wilson Lai System Engineer IT Dept., SJM Office ( : (853)2978585 Mobile ( : (853)66506709 Email +: : wilsonlai(a)macausjm.com

2 1

syslog-ng git changes
by Balazs Scheidler 07 Oct '07

07 Oct '07

Hi, The git repository of syslog-ng has moved to a new location: git://git.balabit.hu/bazsi/syslog-ng-2.0.git/ We've also set up gitweb to make it easier to browse/check syslog-ng changes, it is available at: http://git.balabit.hu/ The VCS instructions on the webpage has been updated to indicate the change. -- Bazsi

2 1

Evaluation for no. of sessions handled by Syslog-ng!
by Wilson Lai 03 Oct '07

03 Oct '07

Dear ALL, If I have 100 servers and 100 network devices which want to collect all the logs to a Syslog-Ng Centralized server, would It be possible that the Syslog-NG could handle such numerous sessions? I am using the MYSQL DB. Thanks. Regards, Wilson Lai System Engineer IT Dept., SJM Office ( : (853)2978585 Mobile ( : (853)66506709 Email +: : wilsonlai(a)macausjm.com

2 1

What packages need?‏
by hi ro 01 Oct '07

01 Oct '07

Hi, What packages does it need to compile syslog-ng?Is it the same package when to make RPM? (bison, flex, gcc-c++, pkgconfig, glib2-devel, libevtlog-devel)(It needs only libc to compile eventlog, doesn't it?) And if it's not necessary to connect database, does it need to install libdbi8? Thankshiro _________________________________________________________________ マイクロソフトの最新次世代ブラウザIE7にMSN版ならではの便利な機能をプラス http://promotion.msn.co.jp/ie7/

1 0

Syslog-ng 1.6.11 from HP porting center
by Uwe Martin 28 Sep '07

28 Sep '07

Hello, I installed the syslog_ng-1.6.11-hppa-11.11.depot.gz from HP porting center on a HP 9000/800/rp3440 "HP-UX xyz B.11.11 U 9000/800 189374938 unlimited-user license". After starting /usr/local/bin/syslog-ng -v -s, I got the following error : Segmentation fault (core dumped). Anybody an idea what is wrong on the installtion? kind regards Uwe MArtin Festo AG & Co. KG Uwe Martin Abteilung IN-O Network-Operation Obere Kaiserstraße 303 D - 66386 St. Ingbert Tel: ++49 (0) 6894-591-6323 Fax: ++49 (0) 6894-591-6326 http://www.festo.com Der Inhalt dieses E-Mails ist ausschliesslich fuer den bezeichneten Adressaten bestimmt. Jede Form der Kenntnisnahme, Veroeffentlichung, Vervielfaeltigung oder Weitergabe des Inhalts dieses E-Mails durch unberechtigte Dritte ist unzulaessig. Wir bitten Sie, sich mit dem Absender des E-Mails in Verbindung zu setzen, falls Sie nicht der Adressat dieses E-Mails sind und das Material von Ihrem Computer zu loeschen. This e-mail and any attachments are confidential and intended solely for the addressee. The perusal, publication, copying or dissemination of the contents of this e-mail by unauthorised third parties is prohibited. If you are not the intended recipient of this e-mail, please delete it and immediately notify the sender. Rechtsform: Kommanditgesellschaft Sitz: Esslingen a.N. Registergericht Stuttgart HRA 211583 Umsatzsteuerident-Nummer: DE 145339206 Persoenlich haftende Gesellschafterin:Festo Aktiengesellschaft Sitz: Stuttgart Registergericht Stuttgart HRB 18535 Vorstand: Dr. Ekkehard Gericke, Lothar Kempf, Dipl.-Ing. Rudi Menrad Dr. Thomas Rubbe Dr. Eberhard Veit (Sprecher) Dr. Ulrich Walker Aufsichtsratsvorsitzender: Dr. Wilfried Stoll

2 1

Re: [syslog-ng] Assistance compiling 1.6.12
by tim.brown＠juno.com 28 Sep '07

28 Sep '07

That would be ideal if I could locate a version of glib >= 2.2 for Solaris 9 on sparc, based on the following: checking for GLIB... Requested 'glib-2.0 >= 2.2' but version of GLib is 2.0.7 no configure: error: Cannot find GLib library version >= 2.2: is pkg-config in path? Thanks -- Carson Gaspar <carson(a)taltos.org> wrote: Carson Gaspar wrote: > Andrej Ricnik-Bay wrote: >> On 6/26/07, tim.brown(a)juno.com <tim.brown(a)juno.com> wrote: > >>> I've scanned the net for references to "-lxnet" on Solaris and could >>> only determine that is a library routine particular to Linux. I could >>> not find how to provide this on a Solaris platform. >> >> No, it's not. It's part of SUNWcslx and I've never seen it on any >> Linux machine :} > > Why is syslog-ng trying to link in the XTI library? Something is wrong, > here... Ah, libol's autoconf code adds in libxnet even though it isn't needed. I'm not sure what the code is _trying_ to do, but it's doing it wrong. On the plus side, I don't see references to xnet in the 2.0.4 syslog-ng, nor in the 0.2.5 eventlog. So my advice is to skip the old code and use the shiny new stuff. -- Carson _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _____________________________________________________________ Save on Tax Preparation Services. Click here. http://track.juno.com/s/lc?u=http://tagline.untd.us/fc/Ioyw6iigAEckp8Ap1pqX…

3 2

ICMP port unreachable sent to one of logging hosts
by Karel Hendrych 27 Sep '07

27 Sep '07

Hi, I'm experiencing strange issue with syslog-ng 2.0.5 build on a CentOS4 machine. One of a logging hosts receives after syslog message a ICMP port unreachable message sent from machine running syslog-ng. Other hosts logging is working fine. The only difference between logging hosts and this single not logging host is a little bit faster logging rate. Aprox. 10 log records/s. Debug option did not show something interesting why the syslog's are not being accepted. There is no firewall/filtering on the log server. Here is my simple config: options { use_fqdn(no); use_dns(persist_only); dns_cache_hosts(/etc/hosts); keep_hostname(yes); long_hostnames(off); sync(1); log_fifo_size(1024); perm(0640); }; source src { udp(ip("0.0.0.0") port(514) so_rcvbuf(4194304) ); tcp(ip("0.0.0.0") port(514)); }; source self { internal(); }; destination central {file("/var/log/central/$HOST_FROM.log"); }; destination self {file("/var/log/central/syslog-ng.log"); }; log { source(src); destination(central); }; log { source(self); destination(self); }; netstat -su output: 20578970 packets to unknown port received. 464 packet receive errors 190828 packets sent Does anyone have some idea how to deal with it? -- Karel

1 0

why dose the usage of mem by syslog-ng keep growing?
by liuruihong 27 Sep '07

27 Sep '07

the configure file as follows: options { use_dns(no); create_dirs(yes);ts_format(iso); }; #options { log_fifo_size(3000); }; source src { udp(ip(0.0.0.0) port(514) ); }; filter f_kern { facility(kern); }; filter f_authpriv { facility(auth,authpriv); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_boot { facility(local7); }; filter f_spooler { facility(uucp, news) and level(crit..emerg); }; filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); }; destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); }; destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); }; destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); }; destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); }; destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); }; destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); }; destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_authpriv); destination(authpriv); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_boot); destination(boot); }; log { source(src); filter(f_spooler); destination(spooler); }; log { source(src); filter(f_messages); destination(messages); }; syslog-ng receive logs from about 1000 clients ,and the usage of mem by syslog-ng keeps growing,here are a days record of the usage of mem(got by command 'ps aux'): cup %mem 0.1 29.9 0.1 30.1 0.1 30.3 0.1 30.5 0.1 30.7 0.1 30.9 0.1 31.1 0.1 31.2 0.1 31.4 0.1 31.6 0.1 31.9 0.1 32.1 0.1 32.3 0.1 32.4 0.1 32.6 0.1 32.8 0.1 33.0 0.1 33.2 0.1 33.4 0.1 33.5 0.1 33.8 0.1 33.9 0.1 34.1 0.1 34.3 0.1 34.5 0.1 34.6 0.1 34.9 0.1 35.0 0.1 35.2

5 13

Re: [syslog-ng] Compiling on HP/UX 11.11
by C Wells 27 Sep '07

27 Sep '07

> > So I modified configure to copy out a conftest.l since > > it cleans it up. Then I tried running > > flex -d -o pleasework conftest.l and get the same > > result, can not find output. What should I try next ? > > I think it must have something to do with the "fatal error" that flex is > reporting: > > "flex: fatal internal error, exec failed" > > Where did you get the flex binary from? I obtained flex from this link http://hpux.connect.org.uk/hppd/hpux/Gnu/flex-2.5.33/ I will try and remove it and reinstall. Are there any other workarounds if I can't make flex work ? Thanks ____________________________________________________________________________________ Tonight's top picks. What will you watch tonight? Preview the hottest shows on Yahoo! TV. http://tv.yahoo.com/

2 1

(no subject)
by hi ro 27 Sep '07

27 Sep '07

Hi, I have a client node and a server node which has two Network Interface Card(NIC A, NIC B). Syslog message sender is installed in the client node. Syslog-ng(version2.0.5) and eventlog(version0.2.5) are installed in the server node. I can't understand following situation. [situation] 1. Change status NIC A and B UP by ifup command 2. Start syslog-ng service 3. Change status NIC A DOWN by ifdown command 4. Syslog-ng service can receive message to NIC A. ※ situation (Syslog-ng service can also receive message to NIC B.) 5. Change status NIC B DOWN by ifdown command 6. Syslog-ng service can't receive message to NIC A and B. Under the situation(4), I expected that syslog-ng service can't receive message to NIC A and can receive message to NIC B. The OS of the server node is Red Hat Enterprice Linux Version4 update4 x86. Thanks hiro _________________________________________________________________ MSNミュージックとEMI Artistsが共同開催するオーディション SCHOOL OF SCHOOL http://music.jp.msn.com/

2 1

Re: [syslog-ng] Compiling on HP/UX 11.11
by C Wells 26 Sep '07

26 Sep '07

On 9/14/07, Balazs Scheidler <bazsi(a)balabit.hu> wrote: > On Thu, 2007-09-13 at 11:16 -0700, C Wells wrote: > > > What's the error message of configure that you get > > if you have flex installed and not renamed? > > > > 'checking lex output file root... configure: error: > > cannot find output from flex; giving up' > > I guess I can try a newer flex maybe, not sure > > The config.log file might have more details. The error basically says > that the output for flex was not found. > > Are you sure it is using flex and not the system installed lex? Again, > the config.log file has more details. > > The flex/lex commands generate their output as a fixed named file > (usually lex.yy.c) and the makefiles cannot find this file. > > Try running the flex command line by hand and check whether the file > gets generated. > > -- > Bazsi configure:3535: found /usr/local/bin/flex configure:3546: result: flex configure:3583: flex conftest.l flex: fatal internal error, exec failed flex: error writing output file lex.yy.c configure:3586: $? = 1 configure:3588: checking lex output file root configure:3599: error: cannot find output from flex; giving up So I modified configure to copy out a conftest.l since it cleans it up. Then I tried running flex -d -o pleasework conftest.l and get the same result, can not find output. What should I try next ? Thanks ____________________________________________________________________________________ Building a website is a piece of cake. Yahoo! Small Business gives you all the tools to get online. http://smallbusiness.yahoo.com/webhosting

2 1

Supported Platform
by hi ro 26 Sep '07

26 Sep '07

Hi, Is Redhat Enterprise Linux Version4 EM64T (Update5) supported ?Tell me anyone, please. Thanks hiro _________________________________________________________________ メッセンジャーの疑問を解決！リニューアルしたメッセンジャーページ http://messenger.live.jp/

1 0

Is there a max value limit about the A which is in the command "ulimit -n A"
by liuruihong 26 Sep '07

26 Sep '07

Is there a max value limit about the A which is in the command "ulimit -n A",and how can I know the max value? Thanks!

1 0

who knows the mechanism of syslog-ng writing log fies?
by liuruihong 25 Sep '07

25 Sep '07

If syslog-ng writes logs to many files,How does syslog-ng write the log files? do all the logfiles keep opening and being writted in when logs come from remote? or a certern log file will be closed if there are no log comes during a certain time?

2 2

Filtering using SO_PEERCRED
by Simon Arlott 24 Sep '07

24 Sep '07

I've attached a patch that uses SO_PEERCRED to find the PID/UID/GID of the application using syslog. I wanted to be able to prevent users faking messages but at the same time not lose some of sshd's messages that are sent from a non-privileged process. The next step would be to send users' other messages to /home/$FROM_USER/syslog which would be owned by them - but owner(....) is only evaluated at startup... Sample config: filter f_sshd { uid(0) and program("sshd"); }; filter f_sshdu { not uid(0) and program("sshd") and pid(); }; #pid() checks PID in message is correct destination sshd { file("/var/log/sshd.$YEAR$MONTH" template("$DAY $HOUR:$MIN:$SEC $MSG\n") template-escape(no)); }; log { source(local); filter(f_sshd); destination(sshd); }; destination usshd { file("/var/log/sshd.$YEAR$MONTH" template("$DAY $HOUR:$MIN:$SEC $PROGRAM[$PID]: ($FROM_USER) $MSGONLY\n") template-escape(no)); }; log { source(local); filter(f_sshdu); destination(usshd); }; * Allows log messages from sshd as root and from sshd as a user to be distinguished * Further processing of the log can be assured of the authenticity of the message * No need to restrict access to /dev/log and lose otherwise useful logging Sample log: sshd[30955]: Connection from 0.0.0.0 port 0 sshd[30955]: Failed none for nobody from 0.0.0.0 port 0 ssh2 sshd[30955]: (nobody) Found matching DSA key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 sshd[30955]: (nobody) Found matching DSA key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 sshd[30955]: Accepted publickey for nobody from 0.0.0.0 port 0 ssh2 sshd[30957]: (nobody) Connection closed by 0.0.0.0 sshd[30957]: (nobody) Closing connection to 0.0.0.0 -- Simon Arlott

2 1

Log Server Check
by Hari Sekhon 22 Sep '07

22 Sep '07

Hi, A while ago I was looking for the best way to periodically check my Syslog-NG log server with a MySQL back end, and finding no great method, I wrote my own. It's been in production where I work for a few months now, so I recently decided to have a rewrite and then release it so that others can benefit. It is actually a Nagios plugin, but it can also be run from the command line or from cron or just as a one off to find out if your new Syslog-NG/MySQL log server is full working as expected. I have just released it on Nagios Exchange (GPL of course). It can be found here: http://www.nagiosexchange.org/Check_Plugins.21.0.html?&tx_netnagext_pi1[p_v… or just search nagiosexchange.org for "logserver", it's the only hit. As mentioned, you don't need Nagios to run this (Nagios is Excellent though, so if you aren't yet running it, I recommend that you try it out - I couldn't live without it now) It is flexible enough to test a log server via either TCP or UDP on any port, and to query a MySQL database either on the same host or another host for the log to make sure it has come through the whole logserver and been stored correctly. It should be flexible enough for use with any syslog implementation using a MySQL storage back end. I wrote this originally for the typical Syslog-NG / MySQL log server combination since the joining bit between Syslog-NG and MySQL can break and it is not easily testable without sending a log and checking if it actually comes through to the back end storage. It has actually happened to me a few times that the log server stack stopped working for one reason or another... I may consider adding support for file based or Oracle back end log servers if there is demand. For support, feedback, bug reports or feature requests, you can contact me at this address, hpsekhon(AT)googlemail.com. Regards, -h -- Hari Sekhon

1 0

ArcSight (Again)
by Ivey, Chris 21 Sep '07

21 Sep '07

OK folks, this has come up (again). Seems that the ArcSight parser is not intelligent enough to handle messages coming from syslog-ng after being forwarded along. So I need some advice on how to handle this issue. First, some background... I added our ArcSight server as a syslog-ng target some time ago. The folks who use the ArcSight stuff emailed me and said that the parser for ArcSight could not handle parsing the messages coming from syslog-ng, because of the prepending of the server time to the syslog-ng message. Here is an excerpt from one of the emails from their support folks: In looking through all the information, I see that there are lot of parsing issues, all due to what look like malformed syslog messages. For example: Apr 25 22:54:24 x.x.x.x router/router 99228: Apr 25 22:54:23.474 UTC: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet1/0/1 (not full duplex), with switch FastEthernet0/1 (full duplex). This is a raw event from the export. Notice that the second timestamp forward is the actual message, which is CDP, so from a cisco switch or some layer 2 device. The actual event from the cisco device should look like as follows, which is what our parser is designed to work with: Apr 25 22:54:23.474 UTC: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet1/0/1 (not full duplex), with switch FastEthernet0/1 (full duplex). Another excerpt... I looked over the information you had uploaded already, and is actually a common issue. When syslog events are forwarded from one syslog server to another syslog server, or pipe, or file, the forwarding syslog server prepends timestamp and other information, which makes the message unusable. We require syslog message to adhere to the standard RFC syslog format for the connector to read them, and when forwarding syslog messages that is not the case and we are unable to support that configuration. So, the question is what to do about it. I apparently need to send this information on to the ArcSight server without the prepended data (the "Apr 25 22:54:24 x.x.x.x router/router 99228:" portion of the message from the first email excerpt), but I need to keep it in place for EVERY other target I am sending to. Can anyone tell me what are my options here, please? Thanks a LOT in advance!!! (Bazsi, please feel free to chime in on this one! LOL) Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

3 3

there are many udp packet receive errors
by liuruihong 21 Sep '07

21 Sep '07

Eenvironment : > under linux > 1 central log-collecting server.syslog-ng 2 client: syslog sending logs to central log-collecting server. The syslog-ng server configuration: > options { use_dns(no); create_dirs(yes);ts_format(iso); }; > source src { udp(ip(0.0.0.0) port(514)); }; > > filter f_kern { facility(kern); }; > filter f_authpriv { facility(auth,authpriv); }; > filter f_mail { facility(mail); }; > filter f_cron { facility(cron); }; > filter f_boot { facility(local7); }; > filter f_spooler { facility(uucp, news) and level(crit..emerg); }; > filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); }; > destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); }; > destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); }; > destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); }; > destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); }; > destination boot{ file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); }; > destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); }; destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); }; > log { source(src); filter(f_kern); destination(kern); };> > log { source(src); filter(f_authpriv); destination(authpriv); };> > log { source(src); filter(f_mail); destination(mail); };> > log { source(src); filter(f_cron); destination(cron); };> > log { source(src); filter(f_boot); destination(boot); };> > log { source(src); filter(f_spooler); destination(spooler); }; > log { source(src); filter(f_messages); destination(messages); };> QUESTION: I used the syslog-ng to collect logs from about 1000 clients,while there are many udp packets receive erros: # netstat -su # Udp: 41200545 packets received 0 packets to unknown port received. 410733273 packet receive errors 21311935 packets sent I think it means many log sending by the client are not received by syslog-ng successfully, How can I resolve this problems?

3 4

whether udp source driver can set the max_connections() option?
by liuruihong 20 Sep '07

20 Sep '07

My syslog-ng 2.0.5 This is a source define in my configuration: source src { udp(ip(0.0.0.0) port(514) max_connections(100)); }; when running syslog-ng ,there is a error : syntax error

3 2

puzzled about the system resources used by syslog-ng
by liuruihong 20 Sep '07

20 Sep '07

Eenvironment : under linux 1 central log-collecting server.syslog-ng 2 client: syslog sending logs to central log-collecting server. And I have two central log-collecting servers which is logging for different clients,I call them A and B. configuration 1 The A ` configuration as follows: options { use_dns(no); create_dirs(yes);ts_format(iso); }; source src { udp(ip(0.0.0.0) port(514)); }; filter f_kern { facility(kern); }; filter f_authpriv { facility(auth,authpriv); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_boot { facility(local7); }; filter f_spooler { facility(uucp, news) and level(crit..emerg); }; filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); }; destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); }; destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); }; destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); }; destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); }; destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); }; destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); }; destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_authpriv); destination(authpriv); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_boot); destination(boot); }; log { source(src); filter(f_spooler); destination(spooler); }; log { source(src); filter(f_messages); destination(messages); }; 2 The B` configuration as follows: source src { unix-stream("/dev/log");internal();udp(ip(0.0.0.0) port(514)); }; destination dsearch { file("/home/work/syslog-ng/log/$HOST"); }; log { source(src); destination(dsearch); }; QUESTIONS: A server log files: ps aux /home/syslog-ng/2007/ 10.11.100.3 / messages %MEM VSZ RSS 965 directories 3860 6.8 567772 562524 B server log files: ps aux /home/work/syslog-ng/log/10.12.55.6 % MEM VSZ RSS 4482 0.0 2232 1276 I think the MEM VSZ and RSS usage is related to the logfile numbers, A server has fewer logfiles than B server, while A server has higher usages of MEM VSZ and RSS than B server, I don`t know why ?

2 2

Timezones, daylight saving times and a lot of confusion
by Thomas Gelf 20 Sep '07

20 Sep '07

Hi list, timezones and daylight saving time are causing me a serious headache, and I hope that someone can give me a hint :-) Let's start: * I have several servers sending syslog (clients) and also several syslog servers (receivers) * Most (all) of them are running syslog-ng :o) * Local timezone is Europe/Rome (CEST), that's GMT +01:00 and +02:00 while summertime * All systems have their system clock set to UTC and correct local settings (Europe/Rome) * syslog is written to local files on each server (just to be sure to miss nothing in case of network outages etc) + local files on syslog reciever (rotation & archive) + mysql db on syslog reciever (for short history & web app) * syslog reciever is currently getting about 60 syslog entries per second, once in full production that will be something like 200 per second Even if all of my servers are (at least right now) residing in the same timezone I would like to do things the right way. Therefore in my believes timestamp should be saved as a UTC value - correct localized presentation should be up to my web application. Documentation is telling me that: > 2.6. Daylight saving changes > The syslog-ng application receives the timezone and daylight saving > information from the operating system it is installed on. If the > operating system handles daylight saving correctly, so does > syslog-ng. This is great news :-) But what exactly does it mean to me? As told before all my systems are running with UTC system clock and CEST local timezone. Should I set recv_time_zone("+01:00")? Doesn't make sense to me, as I need CEST: +01:00 and +02:00!? Should I set send_time_zone('00:00') on each syslog client? Can I trust S_UNIXTIME and / or R_UNIXTIME (instead of R_HOUR & Co)? Lot's of questions, I know :o) Thanks for your attention! Cheers, Thomas Gelf -- Thomas Gelf <thomas(a)gelf.net>

2 1

compiling Spoof address problem
by James B Horwath 20 Sep '07

20 Sep '07

I am trying to compile 2.0.5 syslog-ng without success. I am interested in compiling the code with spoof-source support, however I am running into compiler errors reference Bazsi's directory structure. Even when I try to compile without any options I receive the message below. I am running RedHat AS4. ./configure --enable-debug --enable-dynamic-linking --enable-tcp-wrapper --enable-spoof-source if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:590: error: syntax error before ')' token /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:623: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/devel/jim/syslog-ng-2.0.5/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/devel/jim/syslog-ng-2.0.5' make: *** [all] Error 2 ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

2 1

the filter doesn`t work for the remote log
by liuruihong 19 Sep '07

19 Sep '07

I use the syslog-ng to receive remote log, The syslog-ng is running under linux ,the remote client is sending log by syslog, and the syslog-ng configure fie is as follows: options { use_dns(yes); create_dirs(yes); }; source src { udp(ip(0.0.0.0) port(514)); }; filter f_cron { facility(cron); }; filter f_messages { not facility(cron); }; destination messages { file("/home/liuruihong/syslog-ng/log/$HOST/$YEAR/messages-$MONTH"); }; destination cron { file("/home/liuruihong/syslog-ng/log/$HOST/$YEAR/cron-$MONTH"); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_messages); destination(messages); }; but the log files "messages-$MONTH" still include the crond information, I don't know why?

2 2

Messages not going to logs
by David H. Lynch Jr. 18 Sep '07

18 Sep '07

I am running syslog-ng under OpenBSD 4.1. I am using it as a debugging tool for driver/application development. I have used it similarly for Linux driver application development without problem. Normal system logging is working correctly But syslog messages sent from inside applications are only going to the console. I have tried different permutations of openlog openlog("pico", LOG_PERROR, LOG_LOCAL0); syslog("(%s, %d)", path, readonly); results in a message on the console but grep -rl pico /var/log returns nothing. Any ideass how to debug/trace/chase this down would be greatly appreciated.

2 1