- syslog-ng - lists.balabit.hu

Syslog-ng appears to hang for local requests to log
by Paul Robert Marino 10 Aug '07

10 Aug '07

I just joined the list after seeing in the archive the syslog-ng causing other proccesses to freeze I've seen the same issue in syslog-ng-2.0.2. I also usualy see some error about exciding the maximum number of open files for root. if i happen to be loged in to the box as root I've been able to fix it by restarting syslog-ng. if ive been loged in as my normal useri can usualy run a sudo lsof but when i count the number of open files its onwhere near the number set in /etc/secutiy/limits.conf. i also ocasionaly see this in the logs right before it happens kernel: warning: many lost ticks. kernel: Your time source seems to be instable or some driver is hogging interupts kernel: rip default_idle+0x20/0x23

3 5

Compatability with Windows?
by Burns Andrew 09 Aug '07

09 Aug '07

Hi, I'm trying out Syslog-NG, and it's been working well with Linux, but I've been asked to start monitoring the eventlog of Windows 2000 Servers and Windows 2003 Servers. Is there a plugin or can Syslog-NG read those eventlog entries natively if they are sent to the Syslog-NG server? Any suggestions or tips are appreciated. Thanks, Andrew

6 5

Routers don´t send syslog
by Roberto Dud 09 Aug '07

09 Aug '07

Mrs, I have a lot of Routers configured to send logs to syslog-ng, but isn´t work. Only 1 router send ok, others 10 not ok. My configuration on routers is the same: service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone logging <my ip> logging buffered 10000 debugging logging trap debugging I check with command : show logging And it´s ok, for me. Anyone have a problema with routers? Thanks, Dud.

3 3

Problem with local*
by Javier Terceiro 08 Aug '07

08 Aug '07

Hello list, I am forming a system syslog and have a problem with facility's local*, I have two destinations, the first: filter f_local7_info { facility(local7) and level(info); }; destination df_local7_info { file("/var/log/$R_YEAR-$R_MONTH-$R_DAY/$SOURCEIP/$PROGRAM.error.log" template("$FULLDATE <> $PROGRAM <> $MSGONLY\n") template_escape(no)); }; log { source(s_udp); filter(f_local7_info); destination(df_local7_info); }; and the second: filter f_local6 { facility(local6); }; destination df_local6 { file("/var/log/$R_YEAR-$R_MONTH-$R_DAY/$SOURCEIP/router.log" template("$FULLDATE <> $PROGRAM <> $MSGONLY\n") template_escape(no)); }; log { source(s_udp); filter(f_local6); destination(df_local6); }; The problem is in which some messages with facility local6 are written in disc with facility local7, reason why does not respect its file. An example is the following one: Server:/var/log/10.0.0.51 # ls 239.error.log 241.error.log 244.error.log router.log Server:/var/log/10.0.0.51 # more 239.error.log 2007 Aug 8 03:30:59 <> 239 -- local6 -- <> *Apr 2 05:15:21: %LINK-3-UPDOWN: Interface Serial1/1:19, changed state to down The facility local6 is present in the menssage, but the name of file is $PROGRAM.error.log The version of syslog-ng that i use is 1.6.8. Some idea of so that this happens? -- Power by Debian. A greeting, Javier.

1 0

syslog-ng.conf help - syslog-ng writing everything to 'messages' in addition to $HOST.log
by Kevin Reiter 07 Aug '07

07 Aug '07

All, I'm fairly new to syslog-ng (been using syslogd for many years) and I have a question with the config file syntax. What I'm trying to do is log all remote hosts to /var/log/$HOST.log while keeping the logging host's logs seperate. What I'm seeing is all messages are being written to /var/log/$HOST.log, including the logging system, as well as to /var/log/messages. In a single day, /var/log/messages grows to over 11GB (I'm logging less than 100 devices - Windows servers, routers, and switches.) I haven't quite figured out which part of the config file is causing this to happen, since I'm still going through my growing pains with it. Can someone point me in the right direction with this? This is running on FreeBSD 6.2-RELEASE, and syslog-ng was installed via ports: root@logmeister [~]# pkg_info | grep syslog-ng syslog-ng-2.0.2 A powerful syslogd replacement In /etc/rc.conf I have the following defined: # We want syslog-ng, not the default syslogd: syslog_ng_enable="YES" syslogd_enable="NO" Here's my syslog-ng.conf file (note that I have the swatch portion at the end commented out. I'll figure that out once I get the important issues ironed out.) ------- Begin syslog-ng.conf ------- # /usr/local/etc/syslog-ng.conf # Modified for logmeister (running FreeBSD 6.2-RELEASE SMP) # # options # options { long_hostnames(on); sync(0); use_dns(yes);}; # # sources # source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); udp(); internal(); file("/dev/klog"); }; # # destinations # destination messages { file("/var/log/messages"); }; destination security { file("/var/log/security"); }; destination authlog { file("/var/log/auth.log"); }; destination maillog { file("/var/log/maillog"); }; destination lpd-errs { file("/var/log/lpd-errs"); }; destination xferlog { file("/var/log/xferlog"); }; destination cron { file("/var/log/cron"); }; destination debuglog { file("/var/log/debug.log"); }; destination consolelog { file("/var/log/console.log"); }; destination all { file("/var/log/all.log"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination slip { file("/var/log/slip.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination console { file("/dev/console"); }; destination allusers { usertty("*"); }; #destination loghost { udp("loghost" port(514)); }; # Log all remote hosts to their own file: destination remote { file("/var/log/$HOST.log" owner(root) group(wheel) perm(0644) dir_perm(0700) create_dirs(yes)); }; # # log facility filters # filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_not_authpriv { not facility(authpriv); }; filter f_console { facility(console); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # # log level filters # filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; filter f_is_debug { level(debug); }; # # program filters # filter f_ppp { program("ppp"); }; filter f_slip { program("startslip"); }; # # *.err;kern.warning;auth.notice;mail.crit /dev/console # log { source(src); filter(f_err); destination(console); }; log { source(src); filter(f_kern); filter(f_warning); destination(console); }; log { source(src); filter(f_auth); filter(f_notice); destination(console); }; log { source(src); filter(f_mail); filter(f_crit); destination(console); }; # # *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages # log { source(src); filter(f_notice); filter(f_not_authpriv); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_mail); filter(f_crit); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # # security.* /var/log/security # log { source(src); filter(f_security); destination(security); }; # # auth.info;authpriv.info /var/log/auth.log log { source(src); filter(f_auth); filter(f_info); destination(authlog); }; log { source(src); filter(f_authpriv); filter(f_info); destination(authlog); }; # # mail.info /var/log/maillog # log { source(src); filter(f_mail); filter(f_info); destination(maillog); }; # # lpr.info /var/log/lpd-errs # log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); }; # # ftp.info /var/log/xferlog # log { source(src); filter(f_ftp); filter(f_info); destination(xferlog); }; # # cron.* /var/log/cron # log { source(src); filter(f_cron); destination(cron); }; # # *.=debug /var/log/debug.log # log { source(src); filter(f_is_debug); destination(debuglog); }; # # *.emerg * # log { source(src); filter(f_emerg); destination(allusers); }; # # uncomment this to log all writes to /dev/console to /var/log/console.log # console.info /var/log/console.log # #log { source(src); filter(f_console); filter(f_info); destination(consolelog); }; # # uncomment this to enable logging of all log messages to /var/log/all.log # touch /var/log/all.log and chmod it to mode 600 before it will work # *.* /var/log/all.log # #log { source(src); destination(all); }; # # uncomment this to enable logging to a remote loghost named loghost # *.* @loghost # #log { source(src); destination(loghost); }; # # uncomment these if you're running inn # news.crit /var/log/news/news.crit # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice # #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; # # !startslip # *.* /var/log/slip.log # log { source(src); filter(f_slip); destination(slip); }; # # !ppp # *.* /var/log/ppp.log # log { source(src); filter(f_ppp); destination(ppp); }; # Log remote hosts to {hostname}.log ####################### ### Local Machine ##### ####################### # *.err;kern.warning;auth.notice;mail.crit /dev/console log { source(src); filter(f_err); destination(console); }; log { source(src); filter(f_kern); filter(f_warning); destination(console); }; log { source(src); filter(f_auth); filter(f_notice); destination(console); }; log { source(src); filter(f_mail); filter(f_crit); destination(console); }; # *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages log { source(src); filter(f_notice); filter(f_not_authpriv); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_mail); filter(f_crit); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # security.* /var/log/security log { source(src); filter(f_security); destination(security); }; # auth.info;authpriv.info /var/log/auth.log log { source(src); filter(f_auth); filter(f_info); destination(authlog); }; log { source(src); filter(f_authpriv); filter(f_info); destination(authlog); }; # mail.info /var/log/maillog log { source(src); filter(f_mail); filter(f_info); destination(maillog); }; # cron.* /var/log/cron log { source(src); filter(f_cron); destination(cron); }; # *.=debug /var/log/debug.log log { source(src); filter(f_is_debug); destination(debuglog); }; # *.emerg * log { source(src); filter(f_emerg); destination(allusers); }; ####################### ### Remote Hosts ###### ####################### # *.err;kern.warning;auth.notice;mail.crit log { source(src); filter(f_err); destination(remote); }; log { source(src); filter(f_kern); filter(f_warning); destination(remote); }; log { source(src); filter(f_auth); filter(f_notice); destination(remote); }; log { source(src); filter(f_mail); filter(f_crit); destination(remote); }; # *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err log { source(src); filter(f_notice); filter(f_not_authpriv); destination(remote); }; log { source(src); filter(f_kern); filter(f_debug); destination(remote); }; log { source(src); filter(f_lpr); filter(f_info); destination(remote); }; log { source(src); filter(f_mail); filter(f_crit); destination(remote); }; log { source(src); filter(f_news); filter(f_err); destination(remote); }; # security.* log { source(src); filter(f_security); destination(remote); }; # auth.info;authpriv.info log { source(src); filter(f_auth); filter(f_info); destination(remote); }; log { source(src); filter(f_authpriv); filter(f_info); destination(remote); }; # mail.info log { source(src); filter(f_mail); filter(f_info); destination(remote); }; # cron.* log { source(src); filter(f_cron); destination(remote); }; # *.=debug log { source(src); filter(f_is_debug); destination(remote); }; # *.emerg log { source(src); filter(f_emerg); destination(remote); }; # local.* log { source(src); filter(f_local0); destination(remote); }; log { source(src); filter(f_local1); destination(remote); }; log { source(src); filter(f_local2); destination(remote); }; log { source(src); filter(f_local3); destination(remote); }; log { source(src); filter(f_local4); destination(remote); }; log { source(src); filter(f_local5); destination(remote); }; log { source(src); filter(f_local6); destination(remote); }; log { source(src); filter(f_local7); destination(remote); }; # send all logs to swatch for (near) real-time alerts #log { # source(src); # destination(swatch); #}; ------- End syslog-ng.conf ------- Many Thanks, Kevin Reiter Senior Security Engineer Financial Services, Inc. 21 Harristown Road Glen Rock, New Jersey 07452 (201)652-6000, ext. 588 PGP ID: 0xEE665233 This message may contain confidential or proprietary information and is intended solely for the individual(s) to whom it is addressed. If you are not a named addressee you should not disseminate, distribute or copy this e-mail or act upon the information contained herein. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.

2 3

Cannot open file for writing (Permission denied)
by Ian Marlier 06 Aug '07

06 Aug '07

This is driving me up a wall, and I'm hoping that someone can give me some help... I'm trying to set up a server that's going to take syslog messages coming in on local5, and put them in a log file. I've defined a source that listens on all interfaces, on UDP port 514. That seems to be working fine -- netstat shows that syslog is listening on that port, and messages do come in on it. I've got a filter set up as filter f_comblog { facility(local5); }; I've got a destination set up this way: destination d_comblog { file("/space/comblog/local5" perm(0644)); }; And the the log statement is defined this way: log { source(netsrc); filter(f_comblog); destination(d_comblog); }; No complaints from syslog-ng about the syntax or anything else. The trouble that I'm having is that syslog-ng refuses to open the destination file for writing, giving me the message "Cannot open file /space/comblog/local5 for writing (Permission denied)" I get this message even with permissions relaxed all the way to 0777, on the file itself, on the directory in which the file is located, and even on the directory above that. I can create another file in the directory with identical permissions, and open it, write to it, etc with vi, so there isn't a problem with the partition being ro or anything like that. `lsof` indicates that no other process has the log file open for reading, writing, or anything else. Syslog-ng is running as root. The one thing that occurs to me is that there might be some problem with my mount tree. The directory /space has a partition mounted to it, and then /space/comblog has a different partition mounted on it. Is that something that would cause a problem for syslog-ng? I tried doing an strace, which was uninformative -- it just shows an "-1 EPERM" exit when syslog-ng tries to open the file. I'm going crazy with this one...anyone? Thanks! - Ian

2 2

syslog-ng-2.0.5 on HP-UX 11.11
by Uwe Martin 06 Aug '07

06 Aug '07

Hello, I try to compile the new version 2.0.5 on HP-UX 11.11. configure is running without erorrs. (./configure --enable-dynamic-linking) make stops with the following error : if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -DLIBNET_BIG_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -g -MT afinet.o -MD -MP -MF ".deps/afinet.Tpo" \ -c -o afinet.o `test -f 'afinet.c' || echo './'`afinet.c; \ then mv -f ".deps/afinet.Tpo" ".deps/afinet.Po"; \ else rm -f ".deps/afinet.Tpo"; exit 1; \ fi afinet.c: In function 'afinet_setup_socket': afinet.c:163: error: storage size of 'mreq' isn't known afinet.c:163: warning: unused variable 'mreq' *** Error exit code 1 How can I solve this problem ? kind regards Uwe Martin Festo AG & Co. KG Uwe Martin Abteilung IN-O Network-Operation Obere Kaiserstraße 303 D - 66386 St. Ingbert Tel: ++49 (0) 6894-591-6323 Fax: ++49 (0) 6894-591-6326 http://www.festo.com Der Inhalt dieses E-Mails ist ausschliesslich fuer den bezeichneten Adressaten bestimmt. Jede Form der Kenntnisnahme, Veroeffentlichung, Vervielfaeltigung oder Weitergabe des Inhalts dieses E-Mails durch unberechtigte Dritte ist unzulaessig. Wir bitten Sie, sich mit dem Absender des E-Mails in Verbindung zu setzen, falls Sie nicht der Adressat dieses E-Mails sind und das Material von Ihrem Computer zu loeschen. This e-mail and any attachments are confidential and intended solely for the addressee. The perusal, publication, copying or dissemination of the contents of this e-mail by unauthorised third parties is prohibited. If you are not the intended recipient of this e-mail, please delete it and immediately notify the sender. Rechtsform: Kommanditgesellschaft Sitz: Esslingen a.N. Registergericht Stuttgart HRA 211583 Umsatzsteuerident-Nummer: DE 145339206 Persoenlich haftende Gesellschafterin:Festo Aktiengesellschaft Sitz: Stuttgart Registergericht Stuttgart HRB 18535 Vorstand: Dr. Ekkehard Gericke, Lothar Kempf, Dipl.-Ing. Rudi Menrad Dr. Thomas Rubbe Dr. Eberhard Veit (Sprecher) Dr. Ulrich Walker Aufsichtsratsvorsitzender: Dr. Wilfried Stoll

7 14

Frances Wand/Poughkeepsie/IBM is out of the office.
by Frances Wand 06 Aug '07

06 Aug '07

I will be out of the office starting 08/06/2007 and will not return until 08/13/2007. Please call my cell phone listed in blue page for urgent issues. Thank you!

1 0

Syslog_ng-2.0.2-Post install reboot problems
by Shamim 02 Aug '07

02 Aug '07

Hi All, Please sugget me the possible cause of the below error message. ********************************************************************************************************** The following error message is seen during a post install reboot. This appears to be related to the installation of the Syslog_ng-2.0.2 . These messages will appear during system startups and additional messages will be generated as a result of the setroubleshootd daemon not being present. Subsequent removal the Syslog_ng-2.0.2 corrects this issue. Starting setroubleshootd: [ OK ] Starting NFS statd: [ OK ] Traceback (most recent call last): File "/usr/sbin/setroubleshootd", line 59, in ? from setroubleshoot.config import cfg File "/usr/lib/python2.4/site-packages/setroubleshoot/__init__.py", line 24, in ? log_init(sys.argv[0]) File "/usr/lib/python2.4/site-packages/setroubleshoot/log.py", line 127, in log_init syslog = logging.handlers.SysLogHandler(address='/dev/log') File "/usr/lib64/python2.4/logging/handlers.py", line 602, in __init__ self._connect_unixsocket(address) File "/usr/lib64/python2.4/logging/handlers.py", line 617, in _connect_unixsocket self.socket.connect(address) File "<string>", line 1, in connect socket.error: (13, 'Permission denied') Starting RPC idmapd: [ OK ] Starting system message bus: [ OK ] Starting Bluetooth services: [ OK ] ***************************************************************************************************** Thanks --------------------------------- Yahoo! Mail is the world's favourite email. Don't settle for less, sign up for your freeaccount today.

2 1

Syslog-ng appears to hang for local requests to log
by Russell Fulton 01 Aug '07

01 Aug '07

Hi Folks We operate a central syslog server for several thousand system on a linux box running syslog-ng 2.0rc3. For some time we have noticed that the machine hosting the service slowly locks up and we then have to reset the power to restart it. Recently we significantly increased the load on the box and now this is happening about once a week. Here are the symptoms we observer: 1. service to systems sending logs to the host are not affected. Logs continue to get written to disk 2. Cron jobs hang 3. login attempts hang 4. as do sudo attempts. 5. ssh sessions that were established before things turned to custard are not affected 6. top, sar etc. don't show anything unusual 7. ps shows hung cron jobs but nothing else unusual We are guessing that syslog-ng is causing any local process that tries to log to hang. In particular login, sudo and cron all cause login activity. If the system is left it eventually runs out of swap and processes. What we will do is to establish an ssh session to root so next time things come unstuck we can restart syslog-ng to see if that gets things going again. Any idea what is wrong or what we can do to diagnose the problem. Russell

3 3

$EVENT_SOURCE and $USERNAME are blank
by Gustavo Soares 01 Aug '07

01 Aug '07

Hi all! When I try to capture the EVENT_SOURCE or USERNAME variables within the template clause, these fields are logged blank in the log file. here is an excerpt of my configuration file.. destination local6 { file("/opt/logserver/log4j/$HOST/$YEAR/$MONTH/received.$DAY$MONTH$YEAR.log" template("$DATE User:$USERNAME $EVENT_SOURCE $MESSAGE\n") template_escape(yes) owner(watcher) group(other) create_dirs(yes)); }; anybody knows why this occurs? Cheers, Gustavo

2 2

[Fwd: [issue365] FreeBSD ports/111462 - syslog-ng2 default configuration file path]
by Brian A. Seklecki 31 Jul '07

31 Jul '07

FYI some 3 months later this patch has been merged back into Ports. http://www.freebsd.org/cgi/query-pr.cgi?pr=111462 ~BAS -------- Forwarded Message -------- > Reply-To: Network Operations issues/ smcafee(a)collaborativefusion.com, > wmoran(a)collaborativefusion.com > Subject: [issue365] FreeBSD ports/111462 - syslog-ng2 default > configuration file path > Date: Mon, 30 Jul 2007 14:36:07 -0000 > > Brian Seklecki <bseklecki(a)collaborativefusion.com> added the comment: > > Patch committed -- Please start ... > > --- > > Date: Sat, 28 Jul 2007 22:28:29 GMT > From: pav(a)FreeBSD.org > To: bseklecki(a)collaborativefusion.com, pav(a)FreeBSD.org, linimon(a)FreeBSD.org > Subject: Re: ports/111462: syslog-ng2 default configuration file path > > Synopsis: syslog-ng2 default configuration file path > > State-Changed-From-To: open->closed > State-Changed-By: pav > State-Changed-When: Sat Jul 28 22:20:11 UTC 2007 > State-Changed-Why: > Committed the maintainer's patch. > > http://www.freebsd.org/cgi/query-pr.cgi?pr=111462 > ____________________________________________________________

1 0

Fail to write facility local0
by Javier Terceiro 31 Jul '07

31 Jul '07

Hello, I have this config file: filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; destination df_local1 { file("/mnt/log/$R_YEAR-$R_MONTH-$R_DAY/$SOURCEIP/local.log" template("$FULLDATE <> $PROGRAM <> $MSGONLY\n") template_escape(no)); }; log { source(s_tcp); source(s_internal); source(s_udp); source(s_unix); filter(f_local0); filter(f_local1); destination(df_local1); }; When an event arrives at the system by facility local0 or local1, this one is registered in the file never. Can be some bug of syslog-ng or failure in config? some idea of so that this one failure happens? Best regards and thanks in advance. -- A greeting, Javier.

4 3

syslog-ng log rotation
by Root Administrator 27 Jul '07

27 Jul '07

Hi All PLz GIVE ME A CLUE !!! [Platform] Solaris 9 for sparc syslog-ng 2.0.4 [Plan] Syslog-ng writes logs to local file. Log rotation function is required to be implemented as in its configuration rather than using other UNIX standard logrotation. Rotation is planned to be executed in one minute interval. And, we gather five of this one minute rotated file and archive them in one file. This is the brief plan. Could anyone please give me a clue to do this !!! I appreciate the detailed clue !!!

2 1

Solaris-9 Syslog-ng
by Rory Savage 27 Jul '07

27 Jul '07

I just installed syslog-ng on a Solaris 9 (SPARC) server. It will not log anything to the console nor to /var/adm/messages. Does anyone have any idea of what I am doing wrong? No existing syslog processes are running, I killed them and stopped them from start on reboot. I can not reboot this server now, it is something that has to remain up and running. The service is running: # ps -ef|grep syslog-ng root 29422 29002 0 17:33:14 pts/3 0:00 grep syslog-ng root 29364 1 0 17:27:44 ? 0:00 /usr/local/sbin/ syslog-ng -f /etc/syslog-ng/syslog-ng.conf -p /etc/syslog-ng/sy My /var/run/syslog_door file exists: # ls -la /var/run/syslog_door Drw-r--r-- 1 root other 0 Jul 25 16:49 /var/run/ syslog_door The contents of my syslog-ng.conf file: # syslog-ng configuration file. # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20070727 rsavage(a)nuvox.net options { sync (1); time_reopen (10); log_msg_size(8192); log_fifo_size(2048); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats(3600); mark_freq(1); }; source s_sys { internal(); sun-streams ("/dev/log" door("/var/run/ syslog_door")); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/messages"); }; destination d_mail { file("/var/log/syslog"); }; destination d_auth { file("/var/log/authlog"); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { level(err) or (level(notice) and facility (auth, kern)); }; filter f_filter2 { level(err) or (facility(kern) and level(notice)) or (facility(daemon) and level(notice)) or (facility(mail) and level(crit)); }; filter f_filter3 { level(alert) or (facility(kern) and level(err)) or (facility(daemon) and level(err)); }; filter f_filter4 { level(alert); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(kern) and level(notice); }; filter f_filter7 { facility(mail) and level(debug); }; filter f_filter8 { facility(user) and level(err); }; filter f_filter9 { facility(user) and level(alert); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_mlop); }; log { source(s_sys); filter(f_filter4); destination(d_mlrt); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_auth); }; log { source(s_sys); filter(f_filter7); destination(d_mail); }; log { source(s_sys); filter(f_filter8); destination(d_cons); destination(d_mesg); }; log { source(s_sys); filter(f_filter9); destination(d_mlop); destination(d_mlrt); }; -- Rory Savage, Systems Administrator Nuvox Communications, Server Operations A Data, Voice, and Solutions Provider Email: rsavage(a)nuvox.net

2 2

the lazy logging patch
by Alexander Clouter 27 Jul '07

27 Jul '07

Hi, Just curious if you were going to add something akin to the lazy logger patch I submitted some time back (of course written sensibly rather than in the hacky way I added): http://marc.info/?l=syslog-ng&m=116136122419201&w=2 Only asking as you said you would have a looking into adding $DESTIP (and probably $INTERFACE as you hinted at) later in the thread. I'm posting on the mailing list to hope to encourage someone else to say "hear hear I want that too", it's all about market pressure :) Cheers Alex

2 1

CentOS release 4.4 , Compile errors , syslog-ng 2.0.5
by Mr. James W. Laferriere 27 Jul '07

27 Jul '07

Hello All , Ok , What am I missing here ... , Tia , JimL /usr/lib/gcc/i386-redhat-linux/3.4.6/../../../libnet.a(libnet_resolve.o)(.text+0x457): In function `libnet_name2addr6': : warning: Using 'gethostbyname2' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(afinet.o)(.text+0x6e): In function `afinet_set_port': /home/archive/syslog-ng-2.0.5/src/afinet.c:58: warning: Using 'getservbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(afsocket.o)(.text+0x581): In function `afsocket_sd_process_connection': /home/archive/syslog-ng-2.0.5/src/afsocket.c:366: undefined reference to `request_init' libsyslog-ng.a(afsocket.o)(.text+0x58a):/home/archive/syslog-ng-2.0.5/src/afsocket.c:367: undefined reference to `sock_host' libsyslog-ng.a(afsocket.o)(.text+0x592):/home/archive/syslog-ng-2.0.5/src/afsocket.c:368: undefined reference to `hosts_access' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/home/archive/syslog-ng-2.0.5/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/archive/syslog-ng-2.0.5' make: *** [all] Error 2 # yum list installed glib* Installed Packages glib.i386 1:1.2.10-15 installed glib-devel.i386 1:1.2.10-15 installed glib2.i386 2.4.7-1 installed glib2-devel.i386 2.4.7-1 installed glibc.i686 2.3.4-2.25 installed glibc-common.i386 2.3.4-2.25 installed glibc-devel.i386 2.3.4-2.25 installed glibc-headers.i386 2.3.4-2.25 installed glibc-kernheaders.i386 2.4-9.1.98.EL installed glibc-profile.i386 2.3.4-2.25 installed glibc-utils.i386 2.3.4-2.25 installed # ver_linux Linux argus.sjc1.talkplus.com 2.6.9-42.0.3.ELsmp #1 SMP Fri Oct 6 06:21:39 CDT 2006 i686 i686 i386 GNU/Linux Gnu C 3.4.6 Gnu make 3.80 binutils 2.15.92.0.2 util-linux 2.12a mount 2.12a module-init-tools 3.1-pre5 e2fsprogs 1.35 reiserfsprogs line reiser4progs line pcmcia-cs 3.2.7 quota-tools 3.12. PPP 2.4.2 nfs-utils 1.0.6 Linux C Library 2.3.4 Dynamic linker (ldd) 2.3.4 Procps 3.2.3 Net-tools 1.60 Kbd 1.12 Sh-utils 5.2.1 Modules Loaded ipt_state ip_conntrack iptable_filter ip_tables md5 ipv6 i2c_dev i2c_core dm_mirror dm_multipath dm_mod button battery ac joydev uhci_hcd ehci_hcd e1000 ext3 jbd raid1 ata_piix libata sd_mod scsi_mod -- +-----------------------------------------------------------------+ | James W. Laferriere | System Techniques | Give me VMS | | Network Engineer | 663 Beaumont Blvd | Give me Linux | | babydr(a)baby-dragons.com | Pacifica, CA. 94044 | only on AXP | +-----------------------------------------------------------------+

1 0

syslog-ng 2.0.5 has been released
by devel＠balabit.hu 26 Jul '07

26 Jul '07

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.0.5 SUMMARY : new stable release DATE : Jul 26, 2007 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.0.5) has been released. For latest fixes in the 2.0.x branch you are recommended to upgrade to this version. CHANGES: 2.0.5 Sun, 22 Jul 2007 15:15:18 +0200 Bugfixes: * Fixed the configure script to automatically detect whether libnet is installed and disable spoof-source support if it is not. * Fixed the processing of the global log_fifo_size() option, in some cases the global option did not have any effect. * Fixed possible blocking on /proc/kmsg during boot, when a great number of kernel messages are generated. * Fixed a possible segfault during the syslog-ng exit procedure, that can be triggered by stopping a syslog-ng instance after it has been reloaded at least once. Other changes: * Increased the default value of max-connections to 256 for UNIX stream sources. * Added support for PIX timestamps that include year information. * Added support for fractions of a second information in BSD timestamps generated by certain Cisco devices. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.0 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.0 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.0 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.0 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.0 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.0/src/ _______________________________________________ syslog-ng-announce mailing list syslog-ng-announce(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng-announce

1 0

Download location change
by Balazs Scheidler 26 Jul '07

26 Jul '07

Dear syslog-ng users, The download location for syslog-ng sources is being changed due to internal web reorganization. In the future, syslog-ng sources will be available from: http://www.balabit.com/products/syslog-ng/sources/ instead of the old download location. The location of the upgrade summary page will not be changed, and will remain: http://www.balabit.com/products/syslog-ng/opensource/upgrades/ Sorry, for the possible inconvinience. -- Balazs Scheidler <bazsi(a)balabit.hu>

5 14

Syslog-ng performance (CPU)
by Rory 25 Jul '07

25 Jul '07

I'm using syslog-ng as a receiver to relay messages to local processes and other remote syslog listeners. I'm not currently using any local file destinations. The issue I'm having is that as soon as I start receiving more than a few hundred messages per second (udp) syslog-ng uses significant CPU resources, even on an intel core-duo. At 1000 messages per second with an average message size < 300 bytes syslog-ng consumes 9-12% CPU. With an event rate closer to 4000 messages per second the CPU use is 35-30%. This seems excessive given that I'm doing no filtering at all. In a test configuration, I am only receiving (no log{} clauses at all) and this behaviour is still demonstrated. It seems that all the CPU use is related to incoming packet processing. The test system is Linux 2.6.20 (Ubuntu) running on a Core2 dual 2.16GHz. Once I have completed some profiling I will share the findings but in the meantime: am I missing something that should be obvious? Some searching through the mailing list archives hasn't helped me much. My test configuration file: options { time_reopen(10); chain_hostnames(yes); keep_hostname(no); log_fifo_size(65535); gc_idle_threshold(100); gc_busy_threshold(65535); use_dns(no); }; source remote_sources { udp(ip(0.0.0.0) port(514)); }; destination event_collector { tcp("127.0.0.1" port(1028)); }; # log { # source(remote_sources); # destination(event_collector); # }; Thanks, Rory

4 5

RE: [syslog-ng] problems with Cisco WiFi controller syslog messages
by Poley, Jason 24 Jul '07

24 Jul '07

Bazsi, So I finally got around to the upgrade this morning (now on 2.0.4), only one month later... Is it possible you can help with these obviously non-standard Cisco syslog timestamps? JDP --------------------------------- Jason D Poley Network Tech GS ITS Network County of Santa Barbara 805.568.2680 jpoley(a)co.santa-barbara.ca.us -----Original Message----- From: Poley, Jason Sent: Thursday, June 14, 2007 7:57 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] problems with Cisco WiFi controller syslog messages Thanks so much for the reply. So, I will upgrade to the latest version and hope for a fix from you I suppose. A question along those lines then... What is the implication of upgrading from 1.6.9 to 2.0.x? Are there any problems or changes that will affect my current logs? I suppose I should mention that I dump these to a mysql database and report against them with php-syslog-ng. I sure don't want to blow up the whole system. JDP --------------------------------- Jason D Poley Network Tech GS ITS Network County of Santa Barbara 805.568.2680 jpoley(a)co.santa-barbara.ca.us > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng- > bounces(a)lists.balabit.hu] On Behalf Of Balazs Scheidler > Sent: Thursday, June 14, 2007 3:43 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] problems with Cisco WiFi controller syslog > messages > > On Wed, 2007-06-13 at 07:02 -0700, Poley, Jason wrote: > > We have upgraded our Cisco WiFi controller and now its syslog messages > > contain milliseconds which syslog-ng does not know how to handle. > > > > I am running version 1.6.9 of syslog-ng on RedHat version 3. > > > > TCP dump of first 96 bytes... > > 06:57:07.584716 IP (tos 0x0, ttl 59, id 0, offset 0, flags [DF], proto > 17, > > length: 248) 161.213.8.243.32768 > 161.213.4.226.syslog: UDP, length 220 > > 0x0000: 4500 00f8 0000 4000 3b11 ed75 a1d5 08f3 > E.....@.;..u.... > > 0x0010: a1d5 04e2 8000 0202 00e4 660c 3c31 3238 > ..........f.<128 > > 0x0020: 3e20 4a75 6e20 3133 2030 363a 3536 3a31 > >.Jun.13.06:56:1 > > 0x0030: 362e 3732 3820 6170 665f 726f 6775 655f > 6.728.apf_rogue_ > > 0x0040: 6465 7465 6374 2e63 3a35 3735 2041 5046 > detect.c:575.APF > > 0x0050: 2d31 -1 > > > > Is this behavior different in a later version of syslog-ng and should I > > upgrade? > > syslog-ng 2.0.x supports milliseconds in timestamps, however it uses > ISO8601 timestamps for that purpose. As I see the snipped quoted here > uses a BSD timestamps with milliseconds added. > > Gee.. At least they could have added year information too. > > So, upgrading to 2.0.x will not solve your problems, but there's a > chance that I can change this there. > > -- > Bazsi > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >

4 6

Hostname resolution of chained hosts
by Darwin, Samuel 23 Jul '07

23 Jul '07

Hi, I am trying to log messages from many servers of the network, each to their own file. The messages are coming in via a program called Lasso, which polls windows servers and sends the messages to syslog-ng via TCP. Lasso turns out to look like a "relay" in syslog-ng parlance. Each message comes from it's source, through the lasso server, and arrives at the syslog-ng server. I have the chain_hostnames(yes) set. Syslog-ng is able to resolve the hostname of the relay server, and shows the hostname instead of the IP address. Good. But the source servers are only being displayed by their IP address in the ${HOST} macro. I am using the ${HOST} macro to create the destination filename. It is not being resolved into a hostname. Does anyone out there use any type of relaying, and do you see that each hop in the relay chain is being resolved from IP Address -> Hostname ?? Thanks, Sam Darwin Thirteen WNET

1 0

(no subject)
by Ahmad Al-Dosari 20 Jul '07

20 Jul '07

Hi All, Can some one tell how to log from different hosts to a single file? I have several firewalls/routers/CSS and would like to have single file for firewalls logs and another for routers logs and the same for CSS. All of the devices logs are sent using udp port 514 I use syslog-ng 2.0.4 and currently all logs are sent to a single file. Thanks.

5 4

Syslog-ng 2.0.4 and libnet...
by Root Administrator 20 Jul '07

20 Jul '07

Hi ALL I need some advises regarding syslog-ng 2.0.4 compilation with such option as --enable-spoof-source. The reason I need this option is that I would like syslog-ng to behave as source address spoofing. LIBNET prepared is libnet-1.1.2.1. I configured it in this manner. bash-2.05# ./configure --enable-dynamic-linking --with-libnet=/usr/local/src/libnet --enable-spoof-source I compiled it in this manner. bash-2.05# make make all-recursive Making all in src source='cfg-grammar.c' object='cfg-grammar.o' libtool=no \ depfile='.deps/cfg-grammar.Po' tmpdepfile='.deps/cfg-grammar.TPo' \ depmode=gcc /bin/bash ../depcomp \ gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0-I/usr/local/lib/glib- 2.0/include -I/usr/local/include/eventlog -DLIBNET_BIG_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -g -c `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c In file included from /home/bazsi/zwa/git//syslog-ng/syslog- ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:30: libnet.h: No such file or directory *** Error code 1 make: Fatal error: Command failed for target `cfg-grammar.o' Current working directory /usr/local/src/syslog-ng-2.0.4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/local/src/syslog-ng-2.0.4 *** Error code 1 make: Fatal error: Command failed for target `all' bash-2.05# Is libnet right version to compile syslog-ng with option of --enable-spoof-source ? Is my preparation enough to successfully compile syslog-ng 2.0.4 ? Any other libraries or tools needed to do so ? Regards Jabberwock

2 1

syslog-ng 2.0.4 hang
by Geller, Sandor (IT) 18 Jul '07

18 Jul '07

Hi, I've encountered a strange problem. I'm using syslog-ng 2.0.4 with a fairly basic setup, and syslog-ng hangs when it is reading from /proc/kmsg, but only right after boot and only on one of my machines, which is a RHEL AS3 machine. It is reproducible, the host hangs on every boot as every process which tries to write to /dev/log gets blocked. Has anyone seen such behaviour? I've ran syslog-ng under strace, so I can send debug data in private. Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.

4 9