- syslog-ng - lists.balabit.hu

organizig multiple events from one server
by Gustavo Soares 18 Jul '07

18 Jul '07

Hi!! I hope anyone can help me... I would like know how can I organize multiple events coming from differents application servers instances installed on just one physical server. Each instance is binding a different ip address. I´ve set up syslog to create a dir with the host name, but the events arrive with the same ip and not the ip address, which the app is binding and because of that sometimes I can´t distinguish which message belongs to a specific instance. Maybe I could use differents facilitys to try to organize things better, but then people would have to know which facility corresponds to which application. The events are sent using log4j (syslog appender). I hope, I´ve made myself clear... Cheers, Gustavo

2 2

syslog-ng-2.0.4 compilation error
by Ganesh Kundapur 18 Jul '07

18 Jul '07

gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/home/kundapur/GLIB-2.12.9/lib -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamic libsyslog-ng.a(misc.o)(.text+0x3a9): In function `resolve_hostname': /home/kundapur/suma/syslog-ng-2.0.4/src/misc.c:191: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format': /home/kundapur/suma/syslog-ng-2.0.4/src/logmsg.c:110: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x2b6): In function `log_msg_ref': /home/kundapur/suma/syslog-ng-2.0.4/src/logmsg.c:498: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x342): In function `log_msg_unref': /home/kundapur/suma/syslog-ng-2.0.4/src/logmsg.c:512: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xe36): In function `log_msg_ack_block_end': /home/kundapur/suma/syslog-ng-2.0.4/src/logmsg.c:648: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref': /home/kundapur/suma/syslog-ng-2.0.4/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref': /home/kundapur/suma/syslog-ng-2.0.4/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free': /home/kundapur/suma/syslog-ng-2.0.4/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new': /home/kundapur/suma/syslog-ng-2.0.4/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x2de): In function `log_template_ref': /home/kundapur/suma/syslog-ng-2.0.4/src/templates.c:180: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x346):/home/kundapur/suma/syslog-ng-2.0.4/src/templates.c:191: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/home/kundapur/suma/syslog-ng-2.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/kundapur/suma/syslog-ng-2.0.4' make: *** [all] Error 2 I installed glib-2.12.9. -- $ cat glib.c # include <glib.h> int main ( void ) { printf ( "glib version = %d.%d.%d\n", glib_major_version, glib_minor_version, glib_micro_version ); return 0; } $ cc glib.c `pkg-config --cflags --libs glib-2.0` $ a.out glib version = 2.12.9 -- Still I'm getting these messages. Any idea about this? Thanks, Ganesh

6 7

(no subject)
by patrick simon 18 Jul '07

18 Jul '07

> stopped by renaming? Sounds problematic, stop it explicitly, and make > sure it > won't get restarted. Renaming/ removing symlinks under /etc/rc*.d on > Debian is > strongly discouraged. use update-rc.d for this task, first remove the > existing > links, and then recreate them as K... ones. Otherwise the next package > upgrade > might reenable the daemon. > I recreate them as K... ones now, and syslog-ng give me the same Error Message. I tried to stop them with rcconf, it say they will be not started, but syslog-ng can't start > You might also want to try removing the default syslog package. On > Ubuntu this is done with: > sudo apt-get remove sysklogd > I removed it just after installing syslog-ng, so i don't know what is the problem. Why syslog-ng don't start? I think maybe I configured something wrong, but i can't they what... thank you for your answers Patrick

4 5

RE: [syslog-ng] syslog-ng not start
by patrick simon 17 Jul '07

17 Jul '07

Sorry for sending a mail two times but I've forgotten the Mail-Subject. I hope thats ok? > > stopped by renaming? Sounds problematic, stop it explicitly, and make > > sure it > won't get restarted. Renaming/ removing symlinks under /etc/rc*.d on > Debian is > strongly discouraged. use update-rc.d for this task, first remove the > existing > links, and then recreate them as K... ones. Otherwise the next package > upgrade > might reenable the daemon. > I recreate them as K... ones now, and syslog-ng give me the same Error Message. I tried to stop them with rcconf, it say they will be not started, but syslog-ng can't start > > > You might also want to try removing the default syslog package. On > Ubuntu this is done with: > sudo apt-get remove sysklogd > I removed it just after installing syslog-ng, so i don't know what is the problem. > Why syslog-ng don't start? > I think maybe I configured something wrong, but i can't they what... > thank you for your answers > Patrick

1 0

problem with filter behavior in 2.0.4
by aero1967＠fastmail.fm 17 Jul '07

17 Jul '07

I'm seeing some results with filtering that I don't expect / understand. I have the following statements in syslog-ng.conf (I am just giving the relevant configuration lines): source src { unix-stream("/dev/log"); internal(); file("/proc/kmsg"); }; filter kern { facility(kern); }; filter kern_critical { filter(kern) and priority(emerg .. err); }; filter critical { filter(kern_critical) or match("crit*") or priority(emerg .. crit); }; template verbose_msg_fmt { template("$FULLDATE $FACILITY.$PRIORITY $MSG\n"); template_escape(no); }; destination root_tty { usertty("root"); }; destination critical_logfile { file("/var/log/critical.log" template(verbose_msg_fmt)); }; log { source(src); filter(critical); destination(root_tty); destination(critical_logfile); }; There are no other configuration lines which reference the critical_logfile destination , and no destination has a "final" flag. Now, when I check /var/log/critical.log, I get messages from the facility.priority combination of daemon.warning that do not contain any string starting with "crit". I also get messages from daemon.err, which also shouldn't match the filter. For example: 2007 Jul 12 10:51:07 daemon.warning <message, not containing the string crit anywhere> 2007 Jul 11 20:33:57 daemon.err <message, not containing the string crit anywhere> IIRC, I was using these same lines in a syslog-ng 1.6.x installation without these kinds of results. Also, a question: does it matter if the priority range is given in ascending or descending order (syslog's numerical code-wise)? Thanks for any insight. -- aero1967(a)fastmail.fm -- http://www.fastmail.fm - IMAP accessible web-mail

7 10

syslog-ng not start
by patrick simon 17 Jul '07

17 Jul '07

Hello list, I got a problem with starting syslog-ng on my Debian Etch Vserver. When I try to start it, it give me the following Error-Message: lutz@31:~$ sudo /etc/init.d/syslog-ng start Password: Starting system logging: syslog-ngError opening file for reading; filename='/proc/kmsg', error='Operation not permitted (1)' Error initializing source driver; source='s_all' start failed. I checked the file-permissions from /proc/kmsg: lutz@31:~$ ls -al /proc | grep kmsg -r-------- 1 root root 0 May 8 18:08 kmsg I installed syslog-ng with apt-get install syslog-ng, but I couldn't start it correctly, yet. I posted my config here: http://nopaste.com/p/aVl1HOXXj It is the Standard syslog-ng config the old syslog daemon i stopped by renaming in /etc/rc2.d - /etc/rc5.d I ask Google now for 2 Days, but I can't locate the Problem I hope you can help me ? sorry, my English is not the best thanks, Patrick

3 2

year field in the log messages
by Ganesh Kundapur 17 Jul '07

17 Jul '07

Hi, Please let me know how to get the year field also in the syslog messages. Regards, Ganesh

1 0

syslog-ng cross compile error
by Bujor, Sorin 16 Jul '07

16 Jul '07

Hi, I am trying to cross compile syslog-ng for a box running MontaVista on an ARM CPU . When I type ./configure -host=arm I get an error. (please see below) checking for EVTLOG... yes checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib Any advice, Thanks

1 0

Log a directory
by Nicolas de Marqué - Fromentin 16 Jul '07

16 Jul '07

Hello, I must log files in a directory The rules are : - this files are created with a name that i must to redirect to syslog-ng. - i must redirect a file just after his creation Do you know a solution that can that can resolve this problem. With searchs i have a idea with xtails but if a standard exist with this problem i prfer use it. Thanks for your answers. Nicolas de Marqué

2 3

compilation errors -- Syslog-ng-2.0.4
by Raj Gurung 12 Jul '07

12 Jul '07

i am trying to compile syslog-ng-2.0.4 in RHEL4 box. When i did ./configure, it provides me the following error: .............. checking for GLIB... Package glib-2.0 was not found in the pkg-config search path. Perhaps you should add the directory containing `glib-2.0.pc' to the PKG_CONFIG_PATH environment variable No package 'glib-2.0' found no configure: error: Cannot find GLib library version >= 2.2: is pkg-config in path? ............. I have glib-1.2.10-11.1 version on my RHEL4 box. Is that the problem with the glib version or has anyone got this problem before ? I could not figure out what might be the problem...suggestions/experiences are welcome.. Thank You, gorkhe

3 6

tcp centralized setup
by Blurry 12 Jul '07

12 Jul '07

I had my sys admin install syslog-ng for me, because I can't have root access. I wish to set up a syslog-ng listener to collect syslog (TCP) messages from cisco routers. I need the existing solaris 9 syslog daemon (UDP 514) to remain running. I used a basic conf file options { long_hostnames(on);sync(0);stats(43200);dns_cache(yes); use_fqdn(no);keep_hostname(yes);use_dns(yes); }; source tcpgateway { unix-stream("/dev/log"); internal(); tcp(ip(0.0.0.0) port(514) max_connections(1000)); }; destination tcplocalhost { file("/var/tmp/syslog-ng.all"); }; log { source(tcpgateway); destination(tcplocalhost); }; I tried to start the syslog-ng daemon and got this error 'io.c: bind_unix_socket(): /dev/log not a socket' the ls -l of /dev/log shows /devices/pseudo/log@0:log Is this because I am not running syslog-ng as root ? What am I doing wrong ? Thanks

2 1

RE: [syslog-ng] compilation errors -- Syslog-ng-2.0.4
by mohan.kumar3＠wipro.com 12 Jul '07

12 Jul '07

The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Unsuccessful not match filter
by Louis Bohm 09 Jul '07

09 Jul '07

So what am I doing wrong here with this filter??? Because it is not working for me. filter f_discard { ( not match("Connection from UDP: ")) or ( not match("Did not receive identification string from 192.168.0.46")) or ( not match("Received SNMP packet(s) from UDP: [192.168.0.46]")); }; Thanks, Louis ~~ ------------------------------------- Louis Bohm Network Administrator Adnexus Therapeutics 781.209.2324 -------------------------------------

2 1

[patch] Add filters to strip unwanted data from incoming syslog messages.
by William Pitcock 09 Jul '07

09 Jul '07

Hello, A project that I am involved with has requirements for the ability to strip personally identifiable data from their syslogs. The attached patch allows us to accomplish this functionality. I believe it would be useful if it is included in upstream syslog-ng. Please consider it for inclusion in the next release. Thanks in advance, - William

2 2

Reg: A database connection problem was encountered.
by mohan.kumar3＠wipro.com 08 Jul '07

08 Jul '07

Hi, I am new to phpsyslog-ng, after finishing a installation i am getting the following error while accessing phpsyslog-ng via browser A database connection problem was encountered. Please check config/config.php to make sure everything is correct and make sure the MySQL server is up and running. Note: the logs are stored in mysql successfully. Regards G.Mohankumar The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Re: [syslog-ng] Assistance compiling 1.6.12
by tim.brown＠juno.com 06 Jul '07

06 Jul '07

hmmm. noted. appreciate the clarification, despite the defensive attitude. apologies if the previous post was misinterpreted as a complaint or attack. -- Carson Gaspar <carson(a)taltos.org> wrote: tim.brown(a)juno.com wrote: > according to error message the requirement is for glib 2.2 or later. > you're references point to 2.1. No. They point to 2.12. 12 > 2. It would really be great if you'd actualy _try_ the solutions you're given before complaining that I'm wrong. > -- Carson Gaspar <carson(a)taltos.org> wrote: > tim.brown(a)juno.com wrote: >> agreed, unfortunately the latest I've been able to locate for Solaris 9 >> on sparc is 2.1.3. >> >> I would greatly appreciate any pointers to where I might locate a >> version later that 2.2. > > OK, as you seem to be unable to use Google yourself, I did it for you. > > http://ftp.gnome.org/pub/GNOME/sources/glib/2.12/ > > specifically > > http://ftp.gnome.org/pub/GNOME/sources/glib/2.12/glib-2.12.12.tar.gz > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _____________________________________________________________ Click to make millions by owning your own franchise http://track.juno.com/s/lc?u=http://tagline.untd.us/fc/Ioyw6iifWGNMxas7CvyQ…

1 0

SYSLOG RELAY CONF FILE
by Ronald Jones 05 Jul '07

05 Jul '07

Hi, I would like to use SYSLOG-NG to relay syslog messages received to multiple destinations. Through TCPDUMP I can tell I receive the messages but they aren't not being sent to the destionations. Any help will be greatly aprreciated of course... #sample syslog-ng.conf for a remote client source src { udp (ip(0.0.0.0) port (514)); tcp (ip(0.0.0.0) port (514)); }; destination loghos { udp ("172.22.134.58" port(514)); # udp ("172.22.134.55" port(514)); }; log { source (src); destination (loghos); }; ________________________________________________________ DTCC DISCLAIMER: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify us immediately and delete the email and any attachments from your system. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

3 3

what influence occurs ?
by hi ro 05 Jul '07

05 Jul '07

Hi, I want to know what influence occurs when syslogd service and syslog-ng service start in one node. Could anyone tell me? Thanks hiro _________________________________________________________________ Hotmailの新着を自動で教えてくれるWindows Live メッセンジャー http://messenger.live.jp/

3 3

Re: [syslog-ng] Assistance compiling 1.6.12
by tim.brown＠juno.com 04 Jul '07

04 Jul '07

according to error message the requirement is for glib 2.2 or later. you're references point to 2.1. -- Carson Gaspar <carson(a)taltos.org> wrote: tim.brown(a)juno.com wrote: > agreed, unfortunately the latest I've been able to locate for Solaris 9 > on sparc is 2.1.3. > > I would greatly appreciate any pointers to where I might locate a > version later that 2.2. OK, as you seem to be unable to use Google yourself, I did it for you. http://ftp.gnome.org/pub/GNOME/sources/glib/2.12/ specifically http://ftp.gnome.org/pub/GNOME/sources/glib/2.12/glib-2.12.12.tar.gz -- Carson _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _____________________________________________________________ Begin a career in graphic design. Click here for free information. http://track.juno.com/s/lc?u=http://tagline.untd.us/fc/Ioyw6iieZ6BIL6sIKK9s…

2 1

Timestamp inconsistency
by Tim Boyer 04 Jul '07

04 Jul '07

I'm running 2.0.0, and the docs say that The sender can specify the timezone of the messages. If the incoming message includes a timezone it is associated with the message. Otherwise, the local timezone is assumed. I'm not specifying any timezone, but I'm seeing a bunch of messages stamped UTC mixed in with EDT, which makes the log a bit... weird: Jun 24 21:38:01 tolstoy.denmantire.com sshd[7949]: Connection closed by 192.168 Jun 24 17:40:01 tolstoy.denmantire.com crond[7987]: (root) CMD (/usr/lib/sa/sa1 Jun 24 21:43:01 tolstoy.denmantire.com sshd[7994]: Connection closed by 192.168 Jun 24 17:44:34 tolstoy.denmantire.com syslog-ng[11618]: Log statistics; droppe Jun 24 21:48:02 tolstoy.denmantire.com sshd[8036]: Connection closed by 192.168 Jun 24 17:50:01 tolstoy.denmantire.com crond[8082]: (root) CMD (/usr/lib/sa/sa1 Jun 24 21:53:03 tolstoy.denmantire.com sshd[8107]: Connection closed by 192.168 So just to test, I did this: TZ="UTC+23:56" logger "Look I'm logging from yesterday" and sure enough, it logged it as yesterday. So I tried to explicitly set the time zones: options { send_time_zone(-04:00); recv_time_zone(-04:00); destination dtolstoy_all { file("/var/log/tolstoy.log" owner(root) group(hobbit) perm(0640) time_zone(-04:00)); Restarted syslog-ng, and: Jun 24 17:09:00 tolstoy.denmantire.com syslog-ng: syslog-ng startup succeeded Jun 23 21:13:09 tolstoy.denmantire.com tim: Look I'm logging from yesterday I don't understand why it's not logging as local time without me having to do anything. And I _really_ don't understand why the explicit instructions don't work. Pounters in the the right direction appreciated... -- Tim Boyer Director Information Systems and Engineering Projects Denman Tire Corporation tim(a)denmantire.com

6 9

Re: [syslog-ng] Assistance compiling 1.6.12
by tim.brown＠juno.com 04 Jul '07

04 Jul '07

agreed, unfortunately the latest I've been able to locate for Solaris 9 on sparc is 2.1.3. I would greatly appreciate any pointers to where I might locate a version later that 2.2. -- Carson Gaspar <carson(a)taltos.org> wrote: tim.brown(a)juno.com wrote: > That would be ideal if I could locate a version of glib >= 2.2 for > Solaris 9 on sparc, based on the following: > > checking for GLIB... Requested 'glib-2.0 >= 2.2' but version of GLib is > 2.0.7 > no > configure: error: Cannot find GLib library version >= 2.2: is > pkg-config in path? Download, compile, install. It's not that hard ;-) -- Carson _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _____________________________________________________________ Click for free info on online degrees and make $150K/ year http://track.juno.com/s/lc?u=http://tagline.untd.us/fc/Ioyw6iigA5BTZcRbYLnF…

2 1

One destination stopped logging?
by Hari Sekhon 03 Jul '07

03 Jul '07

Hi, I've got syslog-ng on my mail server and today I noticed while trying to debug something else that there was nothing in the maillog. I thought this was very odd as there should be lots of stuff, so I checked syslog-ng was running. It was but I decided to restart it and then the maillog started to fill up again. Now it's been several days since it's written anything to the mail log, but it has continued writing to the /var/log/messages destination during that time. Here is my config: options { chain_hostnames(off); sync(0); stats(43200); log_fifo_size(30000); }; source src { unix-stream("/dev/log" max-connections(1000)); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; destination d_net { tcp("ip_to_logserver" port(logserver_port) ); }; destination maillog { file("/var/log/maillog"); }; destination mailerr { file("/var/log/mail.err"); }; filter f_mail { facility(mail); }; filter f_mailerr { facility(mail) and level(err); }; filter f_notmailjunk { not (program("postfix/*") and not level(err)); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_mailerr); destination(mailerr); }; log { source(src); filter(f_notmailjunk); destination(messages); destination(d_net); }; Possible idea: My logserver was flooded as I was doing something else on it and it's likely that logs didn't get through (I know, I know - I wanted a separate machine for this of course but my boss holds the money...). Is it possible that the logger filled up locally backlogged messages for the logserver and this caused logs to be lost for the other destination maillog as syslog-ng was full or something? Does this sound like it or not at all? I am using syslog-ng 1.6.11 by the way. Thanks Hari -- Hari Sekhon

3 5

Constant disconnects
by Tim Boyer 03 Jul '07

03 Jul '07

I'm running 2.0.0, and have eight remote servers logging to a central server. Seven of those servers are running fine; the eighth keeps getting log messages like this: Jun 26 10:41:33 kyushu.denmantire.com syslog-ng[6829]: syslog-ng starting up; version='2.0.0' Jun 26 10:41:33 kyushu.denmantire.com syslog-ng: syslog-ng startup succeeded Jun 26 10:41:33 kyushu.denmantire.com syslog-ng[6829]: EOF occurred while idle;fd='5' Jun 26 10:41:33 kyushu.denmantire.com syslog-ng[6829]: Connection broken; time_reopen='60' My first assumption was a firewall problem, but tcpdump says that data's getting there: 10:42:49.013423 IP kyushu-vpn-cli.denmantire.com.37759 > buran.denmantire.com.5142: S 1168830611:1168830611(0) win 5840 <mss 1460,sackOK,timestamp 316509070 0,nop,wscale 2> 10:42:49.014768 IP buran.denmantire.com.5142 > kyushu-vpn-cli.denmantire.com.37759: S 845996771:845996771(0) ack 1168830612 win 5792 <mss 1460,sackOK,timestamp 39334539 316509070,nop,wscale 7> Any ideas what could be causing the connection to drop - but only on this server? Thanks much, -- Tim Boyer Director IT and Engineering Projects Denman Tire Corporation (330) 675-4249

5 11

Log messages looping back infinitely
by Christopher Cowart 02 Jul '07

02 Jul '07

Hello, I've had a recent problem where my dhcpd logs appear to be arriving and rearriving until /var fills up. My log traffic looks like this (all over udp/syslog and IPSec): ------------+ all logs +----------+ dhcpd logs +------------+ dhcp servers|---------->|log server|------------>|other server|----| ------------+ +----------+ +------------+ | ^ | | all logs except dhcpd | -------------------------------------| This configuration has been in effect and working as expected for about 11 months now. Approximately 2 weeks ago, I was reviewing my morning cronspam and discovered that /var had filled up on my log server. The dhcpd log was the obvious culprit, expanded to fill my entire log partition. I'm attaching sample entries so you can take a look if you are so inclined; I apologize for sanitizing out the data in the messages, but they're both protected data and not important to the discussion at hand. There should be *no* dhcpd log messages originating on the log server. When logging is working properly, the host field in the entries properly reflect their dhcp servers of origin. When logging becomes fubar'd, I see a lot of messages with localhost in that field, all with increasing amounts of whitespace in them. syslog-ng spins the CPU to 100% and proceeds to fill up /var with these "feedback" entries. This has happened 3 times in the past 2 weeks. It always begins at midnight. I checked my crons -- I have an hourly execution of logrotate. It is configured to rotate most of my logs (dhcpd included) once a day, which happens at midnight. It politely runs `pkill -HUP syslog-ng' after truncating the log files; this works successfully for all the other logfiles on the log server and has been working fine for dhcpd for the previous 11 months as well. The other likely candidate for trouble is the "other server" from the diagram above that logs back to the log server. I'm relatively certain that this (alone) is not the cause of the problem. I was painstakingly careful to not generate any feedback loops in its configuration. The incoming udp messages have a dedicated source, which is written to a dedicated destination. I'm having trouble piecing two and two together here. I don't think either of these things are causing the problem, but they're the only obvious culprits. Neither of them, if misconfigured, would explain why the duplicates all appear to come from the localhost. Why would the udp source on the logserver be receiving the messages it sends, but only recently and only immediately after midnight? I haven't had the chance to do a tcpdump yet to see the actual network traffic; twice now I've gotten there after /var was already full and tonight when I did finally catch it in the act, I was too concerned about stopping it to troubleshoot it. Stopping and starting syslog-ng returns my logging into a normal state of affairs. $ uname -a | FreeBSD pitfall.rescomp.berkeley.edu 6.1-RELEASE-p3 FreeBSD | 6.1-RELEASE-p3 #0: Mon Aug 21 15:42:31 PDT 2006 | root@new-pitfall.rescomp.berkeley.edu:/usr/obj/usr/src/sys/RCBSD_1 | i386 $ syslog-ng -V | syslog-ng 2.0.0 First time-stamp in fubar'd logfile: Jun 29 00:00:07 First localhost entry: Jun 29 00:02:19 (Line #256) Last time-stamp in fubar'd logfile: Jun 29 00:08:46 Number of "good" entries: 1266 Number of localhost entries: 1123083 Total number of entries: 1124349 If anyone has tips for continuing my troubleshooting process, please let me know. I'd be tempted to upgrade to 2.0.2 (it's in ports), but given the changelogs didn't mention anything about random feedback loops, I didn't figure it would help much. Thanks in advance for your time, -- Chris Cowart Lead Systems Administrator Network Infrastructure, RSSP-IT UC Berkeley

2 1

Static compilation
by Nicolas de Marqué - Fromentin 02 Jul '07

02 Jul '07

Hello, I have problems with compilation of syslog-ng on a solaris 5.8 : After Syslog-ng Configuration : ./configure --prefix=/tmp/local --disable-spoof-source --enable-static-linking => i have this error : checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib => but i have the correct file : ls -la /tmp/local/lib/libglib-2.0.a -rw-r--r-- 1 outils dinb 2096104 Jun 28 15:51 /tmp/local/lib/libglib-2.0.a Have you an idea about this problem? Nicolas

3 2