- syslog-ng - lists.balabit.hu

Message length overflow, line is split, log_msg_size=2048
by Kalin KOZHUHAROV 13 Feb '07

13 Feb '07

Hi there, For some time I am running syslog-ng as a backend mostly for snare agents on windoze. I get the following in the log from time to time: Jan 28 00:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 28 12:01:33 svn01 syslog-ng[12377]: Message length overflow, line is split, log_msg_size=2048 Jan 28 12:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 29 00:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 29 12:00:01 svn01 syslog-ng[12377]: Message length overflow, line is split, log_msg_size=2048 Jan 29 12:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 30 00:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 30 12:00:00 svn01 syslog-ng[12377]: Message length overflow, line is split, log_msg_size=2048 Jan 30 12:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 31 00:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 31 12:00:01 svn01 syslog-ng[12377]: Message length overflow, line is split, log_msg_size=2048 Jan 31 12:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Feb 1 00:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Feb 1 12:01:40 svn01 syslog-ng[12377]: Message length overflow, line is split, log_msg_size=2048 Feb 1 12:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Feb 2 00:12:26 svn01 syslog-ng[12377]: STATS: dropped 0 Feb 2 12:02:20 svn01 syslog-ng[12377]: Message length overflow, line is split, log_msg_size=2048 Feb 2 12:12:26 svn01 syslog-ng[12377]: STATS: dropped 0 What does this "Message length overflow" ? How can I find/log who(=pid or IP) is sending long messages? Shall I increase log_msg_size? How? I am using syslog-ng-1.6.9 on Gentoo linux. The global part of the config: ### {{{ global options options { # hostname setup chain_hostnames(no); keep_hostname(no); use_dns(no); dns_cache(no); sync(0); stats(43200); create_dirs(yes); dir_owner(root); dir_group(logop); dir_perm(0750); owner(root); group(logop); perm(0640); }; ### global options }}} Some other bits-n-pieces: source s_network { udp(); }; destination d_ext_by_hosts_ALL { file("/var/log/syslog-ng/raw/remote/$YEAR-$MONTH-$DAY/$HOST/ALL" template("$ISODATE $HOST <$FACILITY.$LEVEL> $MSG\n") template_escape(no) ); }; log { source(s_network); destination(d_ext_by_hosts_ALL); }; Googling found only this unanswered mail from this ML: https://lists.balabit.hu/pipermail/syslog-ng/2005-December/008248.html Kalin. -- | A | | D | | J | | P |

3 4

syslog source-address from (cisco) routers
by Ramesh Uppuluri 12 Feb '07

12 Feb '07

I believe syslog-ng derives host ip address (Hostname if dns enabled) from source address from the ip header. However, since routers have multiple interfaces, is it typical to configure routers to send syslog messages from a configured src-address? I guess this is more of an operational question. thanks ramesh

1 0

Re: [syslog-ng] Log daemon for high volume of logs
by bryanh＠giraffe-data.com 12 Feb '07

12 Feb '07

>My troubles didn't go away >until I deployed syslog-ng everywhere and used TCP for all syslog >traffic (from UNIX hosts anyways). It's important to understand just how TCP addresses the problem. It's a problem of servers logging more than the network can handle; UDP addresses it by discarding log messages; TCP addresses it by slowing down the servers creating them. For many servers, logging is supposed to be transparent; it's not a central enough activity to have it pace the server's real work. Besides the pacing, there's also a difference in reliability. If the syslog server hangs, a UDP-based logger will stop logging and go on with life. A TPC-based one will hang with it. -- Bryan Henderson San Jose, California

2 1

HPUX, HP Ansi C compailer and syslog-ng 2.x.x
by Jüri Palis 12 Feb '07

12 Feb '07

Hi, Has anyone managed to compile syslog-ng 2.x with HP ansi c compiler? Now I receive following error : "cfg-lex.l" line 306: error 50: output table overflow, try using %o num 174/1000 nodes(%e), 274/2500 positions(%p), 40/500 (%n), 4475 transitions, 48/1000 packed char classes(%k), 241/2000 packed transitions(%a), 0/0 output slots(%o) *** Error exit code 1 J.

1 0

usertty endutent fix
by bryanh＠giraffe-data.com 12 Feb '07

12 Feb '07

Here's a fix for the usertty destination. Without it, you get one message to a user tty, then nothing, because the utmp database is positioned at the end, so future getutents return "no more entries." -- Bryan Henderson San Jose, California --- syslog-ng-2.0.2+20070202/src/afuser.c 2007-02-01 23:11:48.000000000 +0000 +++ syslog-ng/src/afuser.c 2007-02-12 00:28:32.000000000 +0000 @@ -87,6 +140,7 @@ } } } + endutent(); if ((path_flags & PF_FLOW_CTL_OFF) == 0) log_msg_ack(msg); log_msg_unref(msg);

2 1

log_msg_size() not used for syslog-ng internal messages
by Wolfram Schlich 12 Feb '07

12 Feb '07

Hi, it seems that syslog-ng does not use log_msg_size() for its own generated messages, because "Log statistics" messages are cut at exactly 1024 characters, even if 'log_msg_size(32768)' is set in syslog-ng.conf. The used syslog-ng version is 2.0.2. -- Regards, Wolfram Schlich <wschlich(a)gentoo.org> Gentoo Linux * http://dev.gentoo.org/~wschlich/

2 2

websphere
by Brian Loe 12 Feb '07

12 Feb '07

Anyone doing anything with websphere logs - especially websphere on AIX?

3 2

Log daemon for high volume of logs
by Federico Petronio 12 Feb '07

12 Feb '07

Dear list members, I have a syslog (traditional) server that receives logs from a variety of sources. Recently I added a new host to those that sends, but this one generate high volume of logs. After adding this new one I notice that many of the logs (form the new host and from the previous never arrives to the syslog files). I did a little research and came to the idea that syslog is not able to manage the large amount of logs. I would like to know if syslog-ng is better than syslog in that subject. I know syslog-ng is better in other subjects, but currently I am really urge to solve the high volume problem and that's why I interested mainly in knowing about high volume support. Thank you very much. Best regards, -- Federico Petronio petrus(a)activesec.biz

4 4

Re: [syslog-ng] user-bound UDP socket
by bryanh＠giraffe-data.com 11 Feb '07

11 Feb '07

>I am somewhat reluctant to include such a patch, so you need external >tools to actually set the fd up, For me, the ability to use an external tool to create the socket is a benefit, not a burden. I do it even where there is no privilege separation issue, because I don't think individual servers should all duplicate the same common functions; I want to rely on syslog-ng to handle syslog and socketexec to handle setting up sockets. >and it does not handle reloads. Yes, it's broken that way. And thanks for pointing it out, because it would have caused me grief. The fix looks simple enough, though: use dup() to provide syslog-ng something to close while the user's socket remains unmolested. >I would rather use some kind of dynamic capability management. (e.g. a >minimal set of syslog-ng would run as root, while the actual message >processing would happen in a restricted part. That would close the window of vulnerability substantially, but is still in a different league from a program that you don't give privileges to at all. And it adds to syslog-ng the complexity of understanding the privilege system on whatever system it's running on. Not all of them do the classic uid zero/nonzero thing. (I have some that use Linux capabilities, and the program that execs syslog-ng knows what to do with them). -- Bryan Henderson San Jose, California

1 0

I need help to understand a log in mysql db
by Fabian Pucciarelli 11 Feb '07

11 Feb '07

Can someone with a little bit more experience handling syslogs help me understanding this log: lux | syslog | notice | notice | 2d | 2007-02-11 | 13:14:10 | syslog-ng | syslog-ng[28472]: Log statistics; dropped='pipe(/tmp/mysql.pipe)=0', processed='center(queued)=133', processed='center(received)=33', processed='destination(d_mysql)=133', processed='source(net)=0', processed='source(src)=33' | 3577 | I'm getting many many of them and don't know why. TIA. -- Regards, Fabian Pucciarelli

1 0

RE: [syslog-ng] How to convert syslog-ng logs into xml format
by Padmanabhan, Rajeesh (GE Healthcare) 11 Feb '07

11 Feb '07

Hi Alex, Thanks a lot for your quick response. Infact my role here to act as 'Tech-monkey' :) I have a syslog-ng clients & server. Clients should be able to transfer logs in xml format to server. & server stores in a local location(xml file). Idea is to upload this to web & backup, which can read data in xml fomat. Could you please explain me to create a template that generate logs in xml format. Cheers! Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alexander Clouter Sent: Sunday, February 11, 2007 4:21 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] How to convert syslog-ng logs into xml format Hi, Padmanabhan, Rajeesh (GE Healthcare) <Rajeesh.Padmanabhan(a)ge.com> [20070211 15:40:27 +0530]: > > Hi All, > > I need to convert syslog-ng logs into xml format. Could you please > help me to do the same. If someone can send me a sample format, would > be great. > Oh dear...sounds like someone caught 'xml fever', it happens to all of us at some stage and we usually recover from the illness when its too late and the project is already using it... XML is something thats abused more often than its used properly. Its useful if you have two rather different systems that have no common data exchange mechanism between them and so XML is used as a 'common' format. Bear in mind that this means is at both ends you have to get programming tech-monkeys to write scripts to convert the data to XML and then back from XML into another format. In situations like this you do not care that it could take two weeks of solid CPU crunching to import the data, just as long as it gets there... Now as you have not given much detail about why you need the files in an XML format or what you plan on doing with the files the follow format is probably 'suitable': <?xml version="1.0" encoding="UTF-8"?> <syslog> <message>first syslog message</message> <message>second syslog message</message> ... </syslog> I'm finding it hard to think of a situation where XML and syslog data would be a good idea given that its rather easy to parse and store syslog data already. People want to archive and easily search (usually with nothing more than grep) their syslog logs and in an XML format searching your logs *will* slow down by at least a factor of 1000. A far more suitable format, if flat text files is not good enough, is a SQL database; probably the only real useful application of an SQL database[1]. I'm unsure how to help you recover from your XML fever, it was difficult for me to grow out of. I learn from my mistakes and unfortunately for me when you base a project around XML the mistakes (for me at least) do not have an effect till much later on. There is nothing on the Internet as suggested reading but I am happy to discuss this off list if you want to. I did some digging around to try to see if there was anything commercial doing this and found[2] something and was shocked at how they were doing it...its a bad schema and seems to be a solution to something that is not actually a problem. *Everything* that deals with logging data should support syslog built logfiles (you might need to use syslog-ng with its template() command to structure the logfile to be in a format that the import engine expects though), if it does not you should look for some other software. My gut feelings tell me this is an internal homebrew project though.. I hope the 'fever' breaks soon :) Cheers Alex [1] thats another rant of mine though :) [2] http://www.kiwisyslog.com/kb/idx/4/125/article/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

How to convert syslog-ng logs into xml format
by Padmanabhan, Rajeesh (GE Healthcare) 11 Feb '07

11 Feb '07

Hi All, I need to convert syslog-ng logs into xml format. Could you please help me to do the same. If someone can send me a sample format, would be great. Thanks in advance. -Rajeesh

2 1

Analysis of logs and alerting
by Muath Al Khalaf 11 Feb '07

11 Feb '07

Hi, I am implementing a syslog-ng centralized correlation server. The server receives the log entries from some servers, apps and devices. Is there any good product (commercial or open-source) with GUI or web interface to analyze these logs and give real time alerts with strong data mining tools? I need a tool which could be used by both help desk non-technical staff and technical engineers. It should give basic alerting on applications' or devices' failures first for help desk, and then engineers could dig deeper into these alerts to understand the problem. Kind regards

4 3

Problems using match() filter
by PATEL, Leena, GBM 09 Feb '07

09 Feb '07

Hi I'm having problem using the match() filter in my syslog-ng.conf file. I have a log file below which i'm trying to seperate the events to different log files based on the filed variables "[commonservices]" and "[fx]". eb 9 13:05:28 lonrs00341/lonrs00341 [commonservices] 2007-02-09 13:05:28,131 [Thread-19] DEBUG - StringCache Party Preference Total Cache refreshed in 250ms. Feb 9 13:05:28 lonrs00341/lonrs00341 [commonservices] 2007-02-09 13:05:28,771 [Thread-27] DEBUG - Sent heartbeat Feb 9 13:05:47 lonrs00341/lonrs00341 [fx] 2007-02-09 13:05:47,242 [QuoteStore cleanup] DEBUG - [2007-02-09 13:05:47.242] [lonrs00341] [DEBUG] [QuoteStore cleanup] [unknown] [] [] [] QuoteStore: Running cleanup thread Feb 9 13:05:47 lonrs00341/lonrs00341 [fx] 2007-02-09 13:05:47,812 [Thread-7] DEBUG - [2007-02-09 13:05:47.812] [lonrs00341] [DEBUG] [Thread-7] [unknown] [] [] [] QuoteStoreNotification from [lonrs00320] to add trade 376771,Source=RBSTrade,state=Start Feb 9 13:05:47 lonrs00341/lonrs00341 [fx] 2007-02-09 13:05:47,812 [Thread-7] DEBUG - [2007-02-09 13:05:47.812] [lonrs00341] [DEBUG] [Thread-7] [unknown] [] [] [] QuoteStore: Added Quote '10065.EUR.GBP.2/13/07 12:00 AM', tradeId=376771 my syslog-ng.conf looks like this filter f_common { match("[commonservices]"); }; filter f_fx { match("[fx]"); }; filter f_core { match("[core]"); }; log { source(remote); filter(f_common); destination(common); }; log { source(remote); filter(f_fx); destination(fx); }; log { source(remote); filter(f_core); destination(core); }; however the 3 seperate log files are created but events are still all mixed up in each log file instead of being filtered accordingly. Some help would be appreciated. Thanks Leena Regards Leena Patel | Royal Bank of Scotland Global Banking & Markets | E-Commerce | Desk: +44 (0) 207 085 0692 *********************************************************************************** The Royal Bank of Scotland plc. Registered in Scotland No 90312. Registered Office: 36 St Andrew Square, Edinburgh EH2 2YB. Authorised and regulated by the Financial Services Authority This e-mail message is confidential and for use by the addressee only. If the message is received by anyone other than the addressee, please return the message to the sender by replying to it and then delete the message from your computer. Internet e-mails are not necessarily secure. The Royal Bank of Scotland plc does not accept responsibility for changes made to this message after it was sent. Whilst all reasonable care has been taken to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that the onward transmission, opening or use of this message and any attachments will not adversely affect its systems or data. No responsibility is accepted by The Royal Bank of Scotland plc in this regard and the recipient should carry out such virus and other checks as it considers appropriate. Visit our websites at: www.rbs.com www.rbsgc.com www.rbsmarkets.com ***********************************************************************************

2 1

user-bound UDP socket
by bryanh＠giraffe-data.com 09 Feb '07

09 Feb '07

Here's a patch that adds an option to the UDP source to specify the file descriptor of an already bound UDP socket, in lieu of having syslog-ng create and bind the socket. This makes it possible to run syslog-ng without the privilege required to bind to reserved UDP port numbers (such as the standard syslog port number). I exec syslog-ng with no privileges at all, except write permission to the log files. Aside from the config file processing, all the patch does is skip the call to afsocket_open_socket() if the user supplied a file descriptor, and move the settings of the nonblock and close-on-exec options from afsocket_open_socket() to afsocket_setup_socket(). -- Bryan Henderson San Jose, California diff --rec --unif syslog-ng-2.0.2+20070202/src/afinet.c syslog-ng/src/afinet.c --- syslog-ng-2.0.2+20070202/src/afinet.c 2007-02-01 23:11:48.000000000 +0000 +++ syslog-ng/src/afinet.c 2007-02-02 17:26:26.000000000 +0000 @@ -233,6 +233,15 @@ afinet_resolve_name(self->bind_addr, ip); } +void +afinet_sd_set_fd(LogDriver *s, int fd) +{ + AFSocketSourceDriver *self = (AFSocketSourceDriver *) s; + + self->user_fd = fd; + self->user_bound_socket = TRUE; +} + static gboolean afinet_sd_setup_socket(AFSocketSourceDriver *s, gint fd) { diff --rec --unif syslog-ng-2.0.2+20070202/src/afinet.h syslog-ng/src/afinet.h --- syslog-ng-2.0.2+20070202/src/afinet.h 2007-02-01 23:11:40.000000000 +0000 +++ syslog-ng/src/afinet.h 2007-02-02 17:26:26.000000000 +0000 @@ -42,6 +42,7 @@ LogDriver *afinet_sd_new(gint af, gchar *host, gint port, guint flags); void afinet_sd_set_localport(LogDriver *self, gint port, gchar *service, gchar *proto); void afinet_sd_set_localip(LogDriver *self, gchar *ip); +void afinet_sd_set_fd(LogDriver *s, int fd); #define afinet_sd_set_auth(a,b) #define afinet_sd_set_mac(a,b) --- syslog-ng-2.0.2+20070202/src/afsocket.c 2007-02-01 23:11:47.000000000 +0000 +++ syslog-ng/src/afsocket.c 2007-02-09 03:00:27.000000000 +0000 @@ -157,6 +157,9 @@ gboolean afsocket_setup_socket(gint fd, SocketOptions *sock_options, AFSocketDirection dir) { + g_fd_set_nonblock(fd, TRUE); + g_fd_set_cloexec(sock, TRUE); + if (dir & AFSOCKET_DIR_RECV) { if (sock_options->rcvbuf) @@ -183,8 +186,6 @@ else sock = socket(bind_addr->sa.sa_family, SOCK_DGRAM, 0); - g_fd_set_nonblock(sock, TRUE); - g_fd_set_cloexec(sock, TRUE); if (sock != -1) { if (g_bind(sock, bind_addr) != G_IO_STATUS_NORMAL) @@ -390,9 +391,6 @@ return TRUE; } - g_fd_set_nonblock(new_fd, TRUE); - g_fd_set_cloexec(new_fd, TRUE); - msg_verbose("Syslog connection accepted", evt_tag_str("from", g_sockaddr_format(peer_addr, buf1, sizeof(buf1))), evt_tag_str("to", g_sockaddr_format(self->bind_addr, buf2, sizeof(buf2))), @@ -492,8 +490,13 @@ { if (!self->connections) { - if (!afsocket_open_socket(self->bind_addr, !!(self->flags & AFSOCKET_STREAM), &sock)) - return self->super.optional; + if (self->user_bound_socket) + sock = self->user_fd; + else { + if (!afsocket_open_socket(self->bind_addr, !!(self->flags & AFSOCKET_STREAM), &sock)) + return self->super.optional; + } + } self->fd = -1; @@ -633,6 +636,7 @@ self->max_connections = 10; self->listen_backlog = 255; self->flags = flags; + self->user_bound_socket = FALSE; log_reader_options_defaults(&self->reader_options); } diff --rec --unif syslog-ng-2.0.2+20070202/src/afsocket.h syslog-ng/src/afsocket.h --- syslog-ng-2.0.2+20070202/src/afsocket.h 2007-02-01 23:11:47.000000000 +0000 +++ syslog-ng/src/afsocket.h 2007-02-02 17:26:26.000000000 +0000 @@ -61,6 +61,8 @@ guint source_id; LogReaderOptions reader_options; + gboolean user_bound_socket; + int user_fd; GSockAddr *bind_addr; gint max_connections; gint num_connections; diff --rec --unif syslog-ng-2.0.2+20070202/src/cfg-grammar.y syslog-ng/src/cfg-grammar.y --- syslog-ng-2.0.2+20070202/src/cfg-grammar.y 2007-02-01 23:11:47.000000000 +0000 +++ syslog-ng/src/cfg-grammar.y 2007-02-02 17:26:26.000000000 +0000 @@ -94,7 +94,7 @@ /* socket related options */ %token KW_KEEP_ALIVE KW_MAX_CONNECTIONS -%token KW_LOCALIP KW_IP KW_LOCALPORT KW_PORT KW_DESTPORT +%token KW_LOCALIP KW_IP KW_LOCALPORT KW_PORT KW_DESTPORT KW_FD %token KW_IP_TTL KW_SO_BROADCAST KW_IP_TOS KW_SO_SNDBUF KW_SO_RCVBUF KW_SO_KEEPALIVE /* misc options */ @@ -371,6 +371,7 @@ : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_sd_set_localport(last_driver, 0, $3, "udp"); free($3); } | KW_PORT '(' string ')' { afinet_sd_set_localport(last_driver, 0, $3, "udp"); free($3); } + | KW_FD '(' NUMBER ')' { afinet_sd_set_fd(last_driver, $3); } ; source_afinet_option @@ -904,4 +905,4 @@ last_reader_options = NULL; last_writer_options = NULL; last_template = NULL; -} \ No newline at end of file +} diff --rec --unif syslog-ng-2.0.2+20070202/src/cfg-lex.l syslog-ng/src/cfg-lex.l --- syslog-ng-2.0.2+20070202/src/cfg-lex.l 2007-02-01 23:11:47.000000000 +0000 +++ syslog-ng/src/cfg-lex.l 2007-02-02 17:26:26.000000000 +0000 @@ -119,6 +119,7 @@ { "localport", KW_LOCALPORT }, { "port", KW_PORT }, { "destport", KW_DESTPORT }, + { "fd", KW_FD }, { "ip_ttl", KW_IP_TTL }, { "ip_tos", KW_IP_TOS }, { "so_broadcast", KW_SO_BROADCAST },

2 1

minor patch (maybe)
by Dhawal Doshy 07 Feb '07

07 Feb '07

Hello List, Am currently testing 2.0.2.. while building the RPM i noticed a broken dependency i.e. that of libevtlog-devel (which i though should be eventlog-devel). Here is a small patch, i would appreciate if the developers think this is not appropriate. [me@myhost rpms]# diff -u syslog-ng-2.0.2/syslog-ng.spec.bb syslog-ng.spec.bb --- syslog-ng-2.0.2/syslog-ng.spec.bb 2007-01-29 14:22:23.000000000 +0530 +++ syslog-ng.spec.bb 2007-02-03 18:23:30.000000000 +0530 @@ -12,7 +12,7 @@ Packager: Tamas Pal <folti(a)balabit.com> Vendor: Balabit IT Ltd. BuildRoot: %{_tmppath}/%{name}-root -BuildRequires: bison, flex, gcc-c++, pkgconfig, glib2-devel, libevtlog-devel +BuildRequires: bison, flex, gcc-c++, pkgconfig, glib2-devel, eventlog-devel Provides: syslog #BuildConflicts: #Exclusivearch: i386 - dhawal

2 2

problems compiling syslog-ng
by javier rojas 06 Feb '07

06 Feb '07

hello im trying to install syslog-ng, i installed the latest libol-0.3.9, but when i try to compile syslog-ng i get this error: ./configure --with-libol=/usr/local/bin/ checking libol version >= 0.3.16... no configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch on the config.log i get the same.... i saw that somebody got the same error, but he didnt post how to resolve it... https://lists.balabit.hu/pipermail/syslog-ng/2004-August/006332.html can somebody help me? -- Ciao, Javier linux counter #393724 GPG Key Fingerprint = 46B76CFEDB0161089D9ECB22FEFDE7EBA8C2007E

3 5

RE: [syslog-ng] Need Log Time in UTC/GMT Format.
by Padmanabhan, Rajeesh (GE Healthcare) 06 Feb '07

06 Feb '07

Hi Bazsi, As per my understanding, I need to add ts_format(unix) in syslog.ng.conf file(Solaris) while defining destination. Is that correct? Thanks a lot for your help. -Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, February 06, 2007 8:08 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Need Log Time in UTC/GMT Format. On Tue, 2007-02-06 at 19:19 +0530, Padmanabhan, Rajeesh (GE Healthcare) wrote: > Thanks a lot for ur response. > If I use the parameter as 'unix' log time will be exactly equal to > UTC/GMT right? Yes. (however I noticed that you also mention syslog-ng 1.6 which did not support this option, you need to change the destination template there). -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] Need Log Time in UTC/GMT Format.
by Padmanabhan, Rajeesh (GE Healthcare) 06 Feb '07

06 Feb '07

Thanks a lot for ur response. If I use the parameter as 'unix' log time will be exactly equal to UTC/GMT right? -Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, February 06, 2007 6:47 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Need Log Time in UTC/GMT Format. On Tue, 2007-02-06 at 17:12 +0530, Padmanabhan, Rajeesh (GE Healthcare) wrote: > Hi All, > > I need log format with time in UTC or GMT both in Solaris & Linux. How > do I set this in syslog-ng.conf file. Basically all the logs should > have time converted from local machine to GMT/UTC (Universal > Coordinated Time). > > Syslog-ng versions used are 2.0.1 for Linux & 1.6 for Solaris 8. > using the ts_format(unix) option. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Need Log Time in UTC/GMT Format.
by Padmanabhan, Rajeesh (GE Healthcare) 06 Feb '07

06 Feb '07

Hi All, I need log format with time in UTC or GMT both in Solaris & Linux. How do I set this in syslog-ng.conf file. Basically all the logs should have time converted from local machine to GMT/UTC (Universal Coordinated Time). Syslog-ng versions used are 2.0.1 for Linux & 1.6 for Solaris 8. Please help. Thanks in advance. -Rajeesh

2 1

spoof-source implemented
by Balazs Scheidler 05 Feb '07

05 Feb '07

hi, I have implemented spoof_source() support in my 2.0.x tree, as I described it in my blog article (at http://bazsi.blogspot.com) I'd appreciate some feedback, both an IPv4 and IPv6 environment would be interesting. I'd be grateful for positive feedback as well, so please tell me even if it works for you :) Thanks. -- Bazsi

1 0

command line option documentation
by bryanh＠giraffe-data.com 05 Feb '07

05 Feb '07

syslog-ng.8 says it is not up to date and to refer to the HTML documentation instead. But I don't find any HTML documentation of syslog-ng command options. The reference manual doc/syslog-ng.html.tar.gz is the only HTML documentation I see. syslog-ng.8 does appear to be out of date, at least with respect to --verbose, --debug, and --foreground. -- Bryan Henderson San Jose, California

2 1

Stats dropped
by Hari Sekhon 02 Feb '07

02 Feb '07

Hi, I've just been through a couple of threads on this, one from a couple of years back and one from last year. I am having the same issue with logs being dropped. Obviously to maintain the integrity of my audit trail I'd like to limit/stop this. Most of the stats are 0 (which are printed every 12hours). Here is the entire config which is exactly the same on all syslog clients: options { chain_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; destination net { tcp("x.x.x.x" port(xxx)); }; log { source(src); destination(messages); }; log { source(src); destination(net); }; Most of the time the dropped stats are 0 but sometimes they are 3000 or so and occasionally 20000-50000! Usually this happens on the mail server or the log server which are both heavily used machines. One of the destinations is obviously backing up, likely the tcp destination for the mail server. On the logserver I already have log_fifo_size(20000); to try to alleviate this. I would have thought this was reasonable. I don't think this increases memory consumption too much either, at least not by today's standards, the server has the nominal 1GB of Ram. Should I increase this on the server and add it to on the agents too? I think this would allow a large buffer to hopefully stop this altogether (unless of course the thing goes over the 20000 or whatever). Perhaps I should set log_fifo_size to 50000? Any recommendations or feedback on this? Thanks -- Hari Sekhon

3 4

concatenated sendmail messages
by Fran Loehmann 02 Feb '07

02 Feb '07

Hi, I am new to syslog-ng and have set up a system using eventlog-0.2.5 and syslog-ng-2.0.1 Local sendmail messages seem to have 2 entries together. I am not sure if something is awry with the config included below, but it seems to only happen with the sendmail entries from sendmail running on the log host. I am trying to write messages to both /var/log/maillog and /var/log/archive/2007-01-25. Messages logged from the sending server seem ok but sendmail running on they log server appear to be on the same line seperated by <22>. Messages in maillog and 2007-01-25 look the same. Thanks for your help, Fran Example: --------- Jan 25 13:20:12 secmgmt-cs01 sendmail[3050]: l0PIKCSY003050: from=<root(a)secmgmt-cs02.secmgmt.pvt>, size=619, class=0, nrcpts=1, msgi d=<200701251820.l0PIKCEu004718(a)secmgmt-cs02.secmgmt.pvt>, proto=ESMTP, daemon=MTA, relay=secmgmt-cs02.secmgmt.pvt [10.200.1.5]<22>Ja n 25 13:20:12 sendmail[3051]: l0PIKCSY003050: to=<lhmn(a)secmgmt-cs01.secmgmt.pvt>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30856, dsn=2.0.0, stat=Sent Config: ------- #********** # Options #********** options { use_dns(persist-only); dns_cache_hosts(/etc/hosts); chain_hostnames(no); keep_hostname(yes); log_fifo_size(4096); log_msg_size(8192); stats(3600); sync(0); time_reopen(10); bad_hostname("sccp|tmm"); }; #********* # Sources #********* ## local source s_local { unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); internal(); }; ## remote source s_remote { udp(); tcp(ip(0.0.0.0) port(514) max-connections(300)); }; #********* # Filters #********* ## Local filters filter f_messages { level(info..emerg); }; filter f_secure { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_emerg { level(emerg); }; filter f_spooler { level(crit..emerg) and facility(uucp, news); }; filter f_local7 { facility(local7); }; #filter f_debug { level(debug); }; ## SEC destination d_sec { program("/usr/local/bin/sec.pl -input=\"-\" -conf=/usr/local/etc/sec.conf"); }; ## Archive - timestamped archives destination d_archive { file("/var/log/archive/$R_YEAR-$R_MONTH-$R_DAY" owner("root") group("logs") dir_group("logs") perm(0640) dir_perm(0750) create_dirs(yes)); }; #***************** # Log statements #***************** # Send all logs to sec.pl log { source(s_local); source(s_remote); destination(d_sec); }; # Send all logs to archive log { source(s_local); source(s_remote); destination(d_archive); }; # Local logs - order DOES matter ! log { source(s_local); filter(f_emerg); destination(d_console); }; log { source(s_local); filter(f_secure); destination(d_secure); flags(final); }; log { source(s_local); filter(f_mail); destination(d_maillog); flags(final); }; log { source(s_local); filter(f_cron); destination(d_cron); flags(final); }; log { source(s_local); filter(f_spooler); destination(d_spooler); }; log { source(s_local); filter(f_local7); destination(d_bootlog); }; log { source(s_local); filter(f_messages); destination(d_messages); }; #log { source(s_local); filter(f_debug); destination(d_debug); };

3 10

Re: [syslog-ng] HAVE_GETUTENT not defined
by bryanh＠giraffe-data.com 01 Feb '07

01 Feb '07

>>> >>> BTW, I recommend not using a standard function name for a local function. >>> >>> E.g. in this case, the local version of getutent is called getutent. That >>> >>> misled me for a while, because I assumed syslog-ng was actually calling >>> >>> standard getutent. ... >>> > >>> >I don't want to add #ifdefs to the calling side of things. I know I >>> >could use macros, but then the calling side would not indicate that >>> >there's a private function implemented. >>> >>> I'm with you on that, but I was suggesting something different. There >>> is today an #ifdef in utils.c like this: >>> ... > >But how would the calling site look like? Today, it's: while ((ut = getutent())) In my scheme, it's: while ((ut = my_getutent())) (on a system that has standard getutent(), my_getutent() is implemented as a call to the system's getutent()). -- Bryan Henderson San Jose, California

2 1