- syslog-ng - lists.balabit.hu

Re: RE: Re: syslog-ng 2.0rc1 memory usage
by Martin, David M 10 Sep '06

10 Sep '06

here are the definitely lost record results. short duration (start valgrind, send hup, wait, send hup, kill) ==7989== 70 bytes in 1 blocks are definitely lost in loss record 15 of 43 ==7989== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==7989== by 0x12AB72: g_malloc (in /usr/lib/libglib-2.0.so.0.400.7) ==7989== by 0x1394F5: g_strdup (in /usr/lib/libglib-2.0.so.0.400.7) ==7989== by 0x80559B6: log_writer_options_init (logwriter.c:507) ==7989== 1080 bytes in 10 blocks are definitely lost in loss record 35 of 43 ==7989== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==7989== by 0x12ABDF: g_malloc0 (in /usr/lib/libglib-2.0.so.0.400.7) ==7989== by 0x80530FD: log_msg_new (logmsg.c:545) ==7989== by 0x805BE42: log_reader_handle_line (logreader.c:178) ==7989== LEAK SUMMARY: ==7989== definitely lost: 1150 bytes in 11 blocks. ==7989== possibly lost: 0 bytes in 0 blocks. ==7989== still reachable: 113453 bytes in 1157 blocks. ==7989== suppressed: 200 bytes in 1 blocks. ------------------------------ Message: 2 Date: Wed, 09 Aug 2006 10:00:02 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] RE: Re: syslog-ng 2.0rc1 memory usage (Balazs Scheidler) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1155110402.6312.14.camel(a)bzorp.balabit> Content-Type: text/plain On Tue, 2006-08-08 at 15:56 -0500, Martin, David M wrote: > applied the patch and resident size increased only marginally over a > 10 minute period. much better. > ran through valgrind another 10 minutes, here's the report. Only one definitely lost record was present, which should be fixed by the patch below. Some of the remaining leaks seem to be part of buffered messages not yet sent to destinations, but they were still reachable. Some reload tests would be appreciated (e.g. run syslog-ng and reload it a couple of times with your configuration and load), that might reveal some real leaks. --- orig/src/messages.c +++ mod/src/messages.c @@ -53,10 +53,12 @@ msg_send_internal_message(int prio, cons { LogMessage *m; - g_snprintf(buf, sizeof(buf), "<%d> syslog-ng[%d]: %s\n", prio, getpid(), msg); - m = log_msg_new(buf, strlen(buf), NULL, LP_INTERNAL | LP_LOCAL, NULL); if (G_LIKELY(internal_msg_queue)) - g_queue_push_tail(internal_msg_queue, m); + { + g_snprintf(buf, sizeof(buf), "<%d> syslog-ng[%d]: %s\n", prio, getpid(), msg); + m = log_msg_new(buf, strlen(buf), NULL, LP_INTERNAL | LP_LOCAL, NULL); + g_queue_push_tail(internal_msg_queue, m); + } } } -- Bazsi ------------------------------ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest, Vol 16, Issue 9 **************************************** The information transmitted (including attachments) is covered by the Electronic Communications Privacy Act, 18 U.S.C. 2510-2521, is intended only for the person(s) or entity/entities to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient(s) is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

2 1

syslog-ng-2.0rc1 doesn't log hostaddress using ipv6
by Bruce Penrod 10 Sep '06

10 Sep '06

I'm using the unpatched syslog-ng-2.0rc1. When logging messages sent from another machine over udp6, the hostname of the sending machine is not logged and the receiving host's name is logged instead, so that it looks like the message was generated locally. When using udp, it works fine. -- Bruce Penrod

2 1

Problems compiling Syslog-NG 2.0 rc1 (error 'va_start' used in function with fixed args)
by Jochen Kirn 08 Sep '06

08 Sep '06

Hi, Currently I stumble over a problem when trying to compile syslog-ng: OS: Solaris 5.10 Generic_118822-25 sun4u sparc (also tried on Solaris 5.9Generic_117171-12 sun4u sparc) Syslog-NG: 2.0 rc1 eventlog: eventlog-0.2.5 1) configure & make of enventlog works fine 2) configure of syslog-ng works fine 3) make of syslog-ng fails with following error: messages.c:105: error: `EVT_PRI_ERR' undeclared (first use in this function) messages.c:107: error: `EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c: In function `msg_init': messages.c:123: warning: implicit declaration of function `evt_ctx_init' messages.c:123: error: `EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c:123: warning: assignment makes pointer from integer without a cast messages.c: In function `msg_deinit': messages.c:134: warning: implicit declaration of function `evt_ctx_free' messages.c: In function `msg_event_create': messages.c:72: error: `va_start' used in function with fixed args *** Error code 1 make: Fatal error: Command failed for target `messages.o' Current working directory /opt/dcx/build/syslog-ng/wrk/syslog-ng-2.0rc1/src *** Error code 1 does anyone have a clue how to fix this va_start call to get a succesfully compile run ? thx Jochen

1 0

Re: Messages concatenated on one line in log file.
by G.W. Haywood 06 Sep '06

06 Sep '06

Hi there, On Tue, 5 Sep 2006 syslog-ng-request(a)lists.balabit.hu wrote: > On Fri, 2006-09-01 at 23:04 +0100, G.W. Haywood wrote: > > > > Using 2.0rc1 I find lines like this in /var/log/messages: > > > > Sep 1 22:18:32 mail3 by lists.balabit.hu (Postfix) with ESMTP id 83E8A4C117 > > Sep 1 22:18:32 mail3 for <ged(a)jubileegroup.co.uk>; Fri, 1 Sep 2006 23:18:17 +0200 (CEST)')<31>Sep 1 22:18:32 milter-regex[20073]: 212.92.18.33: cb_header('MIME-Version', '1.0') > > Sep 1 22:18:32 mail3 <syslog-ng.lists.balabit.hu>')<31>Sep 1 22:18:32 milter-regex[20073]: 212.92.18.33: cb_header('X-List-Administrivia', 'yes') > > [...] > > There are two problems. First, these lines shouldn't be written to > > this log at all. Second, some of the lines are being concatenated > > onto a single line instead of being written to two lines. [...] > > Can you check if this patch fixes the problem That's fixed it, thanks. -- 73, Ged.

1 0

couple install questions
by Nick Baronian 06 Sep '06

06 Sep '06

I have a RedHat Ent.4 box I want to put syslog-ng on. Should I remove syslogd (sysklogd) first? If so how do I get syslog-ng to handle the cron (vixie) and initscripts? How can I find out what configure options are available to me for syslog-ng? I figured I would just try compiling syslog-ng on the machine and see what happens with syslogd. I built glib-2.12.0 & eventlog-0.2.4 and then exported PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/usr/local/lib/pkgconfig I did a ./configure --enable-tcp-wrapper. But during make I get this error gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -Wl,-Bdynamic libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format': /root/syslog-ng-2.0rc1/src/logmsg.c:111: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x2c2): In function `log_msg_ref': /root/syslog-ng-2.0rc1/src/logmsg.c:489: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x35e): In function `log_msg_unref': /root/syslog-ng-2.0rc1/src/logmsg.c:503: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xd9a): In function `log_msg_ack_block_end': /root/syslog-ng-2.0rc1/src/logmsg.c:623: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref': /root/syslog-ng-2.0rc1/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref': /root/syslog-ng-2.0rc1/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free': /root/syslog-ng-2.0rc1/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new': /root/syslog-ng-2.0rc1/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x2a6): In function `log_template_ref': /root/syslog-ng-2.0rc1/src/templates.c:169: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x30e):/root/syslog-ng-2.0rc1/src/templates.c:180: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/root/syslog-ng-2.0rc1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-2.0rc1' make: *** [all] Error 2 Does anyone have any ideas on what is causing this? Thanks, Nick Baronian

4 3

Compilation problems under RH AS3
by news gonzo news gonzo 06 Sep '06

06 Sep '06

Hello, I have some problem to install syslog-ng 2rc1. The install/compilation of glib and eventlog worked fine. Besides, the ./configure of syslog is also OK. But after the make I have this error : gcc: cannot specify -o with -c or -S and multiple compilations So what can I do for fixing this ? Regards. p3.vert.ukl.yahoo.com uncompressed/chunked Mon Sep 4 14:33:45 GMT 2006 ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com

2 4

Messages concatenated on one line in log file.
by G.W. Haywood 04 Sep '06

04 Sep '06

Hi folks, Using 2.0rc1 I find lines like this in /var/log/messages: Sep 1 22:18:32 mail3 by lists.balabit.hu (Postfix) with ESMTP id 83E8A4C117 Sep 1 22:18:32 mail3 for <ged(a)jubileegroup.co.uk>; Fri, 1 Sep 2006 23:18:17 +0200 (CEST)')<31>Sep 1 22:18:32 milter-regex[20073]: 212.92.18.33: cb_header('MIME-Version', '1.0') Sep 1 22:18:32 mail3 <syslog-ng.lists.balabit.hu>')<31>Sep 1 22:18:32 milter-regex[20073]: 212.92.18.33: cb_header('X-List-Administrivia', 'yes') Sorry if the three lines above wrap for you. I haven't attempted to break them. They are imported using an editor, not copy-n-paste, so that non-printing characters are reproduced correctly in the mail. Each line above has a tab character after the string "mail3 ", which is the hostname followed by a single space. There are two problems. First, these lines shouldn't be written to this log at all. Second, some of the lines are being concatenated onto a single line instead of being written to two lines. Instead of three lines above, there should have been five lines. The <facility, priority> info is visible at the points where the lines are joined. The lines that you see here are produced by a sendmail milter called 'milter-regex' which is supposed to be logging with facility 'daemon' and according to the syslog-ng configuration messages from this milter should not appear in the 'messages' file at all. Most of them don't (milter-regex is producing a _lot_ of output), but mail message header continuation lines do. A log message following a header continuation line is concatenated to it, and the filter doesn't seem to notice it. The lines that incorrectly appear in 'messages' do not appear in the correct file, which is 'mail.milter-regex' in the config below. Any ideas? -- 73, Ged. =========================================================================== # Relevant extracts from configuration: =========================================================================== options {long_hostnames(off);sync(0);perm(0640);stats(3600);mark_freq(0);}; source src { internal(); unix-dgram("/dev/log"); }; ... # output from milter-regex is facility daemon filter f_mailmrx { facility(daemon); }; # facility daemon should not go to 'messages' filter f_messages { not facility(news, mail, daemon) and not ... }; # most facility daemon messages are correctly written to 'mail.milter-regex' destination mailmrx { file("/var/log/mail.milter-regex"); }; # but some make it to 'messages' destination messages { file("/var/log/messages"); }; ... log { source(src); filter(f_mailmrx); destination(mailmrx); }; log { source(src); filter(f_messages); destination(messages); }; ...

3 2

Re: Messages concatenated on one line in log file.
by G.W. Haywood 02 Sep '06

02 Sep '06

Hi there, On Sat, 2 Sep 2006 Evan Rempel wrote: > Is syslong-ng running on the host that produced these messages. Yes. Sorry, I should have said. > (don't ask why we do all three :-) OK. I understand. :) > As soon as I replace the standard syslog software on the source server > with syslog-ng (I am running 1.6 series) this problem goes away. My logs are all on the local machines, I don't do any remote logging (yet:). Thanks for the tip, though, it might help shed some light on the issue eventually. -- 73, Ged.

1 0

syslog.err
by Anshul Saxena 01 Sep '06

01 Sep '06

Hi, I am trying to send syslog-ng error messages over stunnel My client side's stunnel.conf file is : client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 #verify = 1 [5140] accept = 127.0.0.1:514 connect = 10.105.1.25:5140 My server side's stunnel.conf file is : chroot = /chroot/stunnel setuid = stunnel setgid = stunnel pid = /stunnel.pid debug = mail.notice client = no #cert = /etc/stunnel/stunnel.pem cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem #verify = 1 verify = 3 service = syslog-ng #Service-level configuration [syslog-ng] accept = 5140 connect = 127.0.0.1:514 But at runtime , I am getting the following error message at client : <syslog.err> syslog-ng[32460]: I/O error occurred while writing; fd='7', error='Broken pipe (32)' I don't understand what the number 32460 means here. If it is the port number running syslog-ng then why is it not 514 as marked in the accept parameter of the client ? Kindly let me know where to look for the bug Regards

1 0

Installation options
by Anshul Saxena 01 Sep '06

01 Sep '06

Hi, I want to install syslog-ng on my rhel4.0 box. I was going through the "Hardening Linux" book, Chapter 5 , "Understanding Logging and Log monitoring" . It is written there that in order to install syslog-ng, i have to first install the "libol" package . But I cannot find the package anywhere on this page: http://www.balabit.com/products/syslog_ng/upgrades.bbq which has been mentioned in the book. So I haven't started to install syslog-ng as yet. Please let me know the step by step procedure to install syslog-ng and ny dependencies with it. Regards

3 2

Using Syslog NG 2.0-rc1 instead of 1.6.11 for production
by Jochen Kirn 31 Aug '06

31 Aug '06

Hi, we plan to introduce Syslog NG in our environment. When will be version 2.0 final released ? Do you think version 2.0 rc 1 is already stable enough to start with ? thx Jochen

2 1

Pipe to MYSQL does not work
by Matthew Redel 30 Aug '06

30 Aug '06

Thanks for the response. Tailing the pipe while SYSLOG-NG is running shows nothing being input to the pipe. As I mentioned, however, SYSLOG-NG writes to file just fine. The databse is working, I can manually login to the db and do an INSERT just fine. The script does persist and specifies the correct the db, username and password. However, this script is a moot point if SYSLOG-NG doesn't even send to the pipe. Could my Libol version be an issue, or woul;d SYSLOG-NG not even run if Libol is not correct? Matt

2 1

using the program destination driver
by Matt Zagrabelny 28 Aug '06

28 Aug '06

greetings list, i will (breifly) describe what i would like to do, what i have tried in order to accomplish that, and what i think is going wrong. i would very much appreciate any help. at the university that i work at we have a cisco vpn box that is configured to send syslog messages to a debian box running syslog-ng version 2.0rc1-2 (version in 'testing'). the types of messages that are sent from the vpn box are like 'user logging in using ip <ip>' and 'user logging out'. as these messages are coming in, i would like to spawn a process, extract the useful bits of info from the syslog message and update a database with the connection window for the user, local and remote ip address. what i have tried: excerpts from /etc/syslog-ng/syslog-ng.conf source s_remote { udp(); }; destination dp_process_vpn { program("/usr/local/sbin/process_vpn_syslog"); }; filter f_vpn { netmask("131.212.4.2/255.255.255.255"); }; log { source(s_remote); filter(f_vpn); destination(dp_process_vpn); }; end of excerpt from /etc/syslog-ng/syslog-ng.conf # cat /usr/local/sbin/process_vpn_syslog #!/usr/bin/perl # eventually this program will parse the data in the syslog entry # and update a database, but for now, it is just appending the # info to a file in /tmp use strict; $| = 1; my $file = '/tmp/vpn_info'; open FILE, '>>'.$file; while (<>) { print FILE $_; } end of cat /usr/local/sbin/process_vpn_syslog i do the following commands to test and confirm that the program process_vpn_syslog is working ok and expected. $ tail -f /tmp/vpn_info $ tail -f /storage/syslog/hosts/131.212.4.2/2006/08/28/local4 i get instant data from the file destination driver syslogs going to /storage/syslog/hosts/131.212.4.2/2006/08/28/local4. i get *very* latent data in the file /tmp/vpn_info. possibilities of what i think is going wrong: 1) data is not being flushed from syslog-ng to the program. i have tried adding flush_lines(1) to the program directive above, to no avail. 2) the syslog-ng documentation says: that it starts the program once and restarts it if it exits. i think i am looking for a program that is executed once for every *line* entry from syslog-ng, however i am not sure where to go from here. thanks again for taking time to look at this. sincerely, -- Matt Zagrabelny - mzagrabe(a)d.umn.edu - (218) 726 8844 University of Minnesota Duluth Information Technology Systems & Services PGP key 1024D/84E22DA2 2005-11-07 Fingerprint: 78F9 18B3 EF58 56F5 FC85 C5CA 53E7 887F 84E2 2DA2 He is not a fool who gives up what he cannot keep to gain what he cannot lose. -Jim Elliot

1 0

Equivalent to Syslog's -a for extra socket listening?
by Hari Sekhon 25 Aug '06

25 Aug '06

I'm reading up on chrooting bind and need a log socket inside the chroot jail. Is there an equivalent to Syslogd's -a switch that creates a second socket to listen on? I suspect not, and that I will have to create it myself and then just add a source for the extra unix-stream definition to my conf. Thanks for any feedback you can give on this. Hari Sekhon

2 2

RE: syslog-ng Digest, Vol 16, Issue 27
by Andrew Meyer 25 Aug '06

25 Aug '06

Message: 2 Date: Fri, 25 Aug 2006 13:51:44 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] Cisco Pix 501 To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1156506704.11997.10.camel(a)bzorp.balabit> Content-Type: text/plain On Tue, 2006-08-22 at 12:39 -0500, Andrew Meyer wrote: > After upgrading from 1.6.x on debian unstable to the latest 2.0.0, L > have noticed that syslog-ng is no longer picking up logs from my pix. > What do I need to change from the old way of doing things to make it > log? I'm not sure, it should work. Can you check if the logs actually arrive at the loghost? -- Bazsi I checked the logs on Debian, they are not being forwardede to my server. Andrew Meyer 314-277-3307

1 0

FQDN's in syslog-ng
by Steven Hajducko 25 Aug '06

25 Aug '06

Hi everyone, We've currently got a syslog setup that centralizes our logs from many of our different teirs into one location, using each system's prebuilt syslog. It works at the moment, but we've got some issues. Our main one is that we name our hosts the same in different environments, mainly because these environments are for moving code and configs from 1 step to the next, so to make it easier on people so they don't have to change configurations each time the code moves, hosts share similar names. The problem is that when all the logs come back to the central syslog server, they can't be seperated by host because of the similiarities. So 'web5' in our QA is the same as 'web5' in production. Because of that, we were looking at syslog-ng and while I found a couple references to using FQDN, I've been unable to tell whether or not this is possible. Our machines DO have different FQDNs. For example, web5.qa.location.domain.com vs. web5.prod.location.domain.com. If we run our main central server on syslog-ng and replace all the syslog daemon's on each system with it, can we force the FQDN to be given rather then just the base hostname and have the central log server sort the logs into different directories based on the FQDN? Thanks! -- sh

4 7

SEC and slct
by Brian Loe 25 Aug '06

25 Aug '06

So... I'm look at these applications and trying to figure out how best to implement them - does anyone have thoughts? I guess I haven't read enough of the man page yet, but I'm still not even sure how the SEC config file works (what you put into it)! But, both apps look promising - and the SEC page mentions another tool I'm going to check out as well...

2 1

Truncated Messages when using templates
by Ivan Stegic 25 Aug '06

25 Aug '06

Hello everyone... We have chosen syslog-ng for our corporate application's central logging daemon and are very happy with it so far. Just one problem: truncated messages. We are running syslog-ng 1.6.11-1 on a Fedora 5 Intel Xeon box. We have an application specific template that we are logging information for into a MySQL 5.0.22 database. If we ever try to log a message that is more than 10674 characters in length, the message is truncated. We expect to only log this large sized message when the DEBUG level of our application is switched to EXTREMELY_HIGH. Now, although this probably won't happen often, it will be at that point that we would most need that information! If the message is logged to a file, the truncation does NOT occur. Does anyone have any insight into this? I would appreciate a push in the right direction for more information, or maybe even a patch of some sort? Please help! Ivan Stegic.

3 3

RE: Performance tuning questions
by Martin, David M 25 Aug '06

25 Aug '06

Greg, I had 'messages being dropped' issue recently on rhel4 and sol8 hosts. since you are using rhl.. 'netstat -ucs' was reporting 500-2000 packet receive errors per second. after making a few adjustments it has dropped to 0. my sysctl.conf is similar to yours, except for: net.core.rmem_default = 16777216 net.core.wmem_default = 16777216 * values mentioned worked for me, your mileage may vary. in my syslog-ng.conf file, I adjusted the source: (may be unnecessary since I use the default as set by sysctl (above), but for documentation sake) source abs_udp514 { udp(ip(0.0.0.0) port(514) so_rcvbuf(16777216)); }; set the log_fifo_size destination abd_sec { program( "/opt/sec/2.3.3/sec.pl -input=\"-\" -conf=/opt/sec/etc/sec.conf" template("$MONTH$DAY $UNIXTIME $HOST $MSG\n") log_fifo_size(8192) ); }; did something similar for my file destinations. and then add flow-control log { source(abs_udp514); filter(abf_postfix); destination(abd_sec); flags(flow-control); }; # netstat -ucs Udp: 1067529425 packets received 9835593 packets to unknown port received. 27851339 packet receive errors 772843529 packets sent Udp: 1067529464 packets received 9835593 packets to unknown port received. 27851339 packet receive errors 772843549 packets sent ------------------------------ Message: 3 Date: Tue, 22 Aug 2006 08:04:38 -0500 From: "King, John (Greg) (LMIT-HOU)" <Greg.King(a)lmit.com> Subject: [syslog-ng] Performance tuning questions To: <syslog-ng(a)lists.balabit.hu> Message-ID: <7E0DB88FB5A5C04AAB0A06E72D58B2B4026053AF(a)lmit-mb01-hou.SERVICE.lmit.com> Content-Type: text/plain; charset="us-ascii" I am currently using the stock syslog daemon from RedHat but it appears to not be able to keep up so I am looking at syslog-ng to improve things. The data below is to provide a baseline of what I am currently seeing and what I have attempted to do. Then if anyone would let me know if syslog-ng would be able to improve the performance and what measures I can take to achieve the improved performance that would be great. Logs have to be rotated each hour due to the amount of traffic. On average I am successfully logging 25,888 events per minute. That goes higher during the early morning login times. I have set the following sysctl params: net.core.rmem_max = 33554432 net.core.wmem_max = 33554432 net.core.rmem_default = 65536 net.core.wmem_default = 65536 net.ipv4.tcp_rmem = 4096 87380 33554432 net.ipv4.tcp_wmem = 4096 65536 33554432 net.ipv4.tcp_mem = 33554432 33554432 33554432 Netstat -su shows what might be data loss: Udp: 131725715 packets received 16642 packets to unknown port received. 4859684 packet receive errors 31571 packets sent The information transmitted (including attachments) is covered by the Electronic Communications Privacy Act, 18 U.S.C. 2510-2521, is intended only for the person(s) or entity/entities to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient(s) is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

2 1

Cisco Pix 501
by Andrew Meyer 25 Aug '06

25 Aug '06

After upgrading from 1.6.x on debian unstable to the latest 2.0.0, L have noticed that syslog-ng is no longer picking up logs from my pix. What do I need to change from the old way of doing things to make it log? Andrew Meyer 314-277-3307

2 1

Performance tuning questions
by King, John (Greg) (LMIT-HOU) 25 Aug '06

25 Aug '06

I am currently using the stock syslog daemon from RedHat but it appears to not be able to keep up so I am looking at syslog-ng to improve things. The data below is to provide a baseline of what I am currently seeing and what I have attempted to do. Then if anyone would let me know if syslog-ng would be able to improve the performance and what measures I can take to achieve the improved performance that would be great. Logs have to be rotated each hour due to the amount of traffic. On average I am successfully logging 25,888 events per minute. That goes higher during the early morning login times. I have set the following sysctl params: net.core.rmem_max = 33554432 net.core.wmem_max = 33554432 net.core.rmem_default = 65536 net.core.wmem_default = 65536 net.ipv4.tcp_rmem = 4096 87380 33554432 net.ipv4.tcp_wmem = 4096 65536 33554432 net.ipv4.tcp_mem = 33554432 33554432 33554432 I have also set the ring params on the intel1000 nic (using intels latest driver e1000-7.1.9, not the default kernel one) to 512MB. Pre-set maximums: RX: 4096 RX Mini: 0 RX Jumbo: 0 TX: 4096 Current hardware settings: RX: 512 RX Mini: 0 RX Jumbo: 0 TX: 512 Based on the nic statistics, the bottleneck is not at the nic: NIC statistics: rx_packets: 148314357 tx_packets: 24906469 rx_bytes: 3023662070 tx_bytes: 3216438764 rx_errors: 0 tx_errors: 0 tx_dropped: 0 multicast: 8531 collisions: 0 rx_length_errors: 0 rx_over_errors: 0 rx_crc_errors: 0 rx_frame_errors: 0 rx_no_buffer_count: 0 rx_missed_errors: 0 tx_aborted_errors: 0 tx_carrier_errors: 0 tx_fifo_errors: 0 tx_heartbeat_errors: 0 tx_window_errors: 0 tx_abort_late_coll: 0 tx_deferred_ok: 0 tx_single_coll_ok: 0 tx_multi_coll_ok: 0 tx_timeout_count: 0 rx_long_length_errors: 0 rx_short_length_errors: 0 rx_align_errors: 0 tx_tcp_seg_good: 10699059 tx_tcp_seg_failed: 0 rx_flow_control_xon: 0 rx_flow_control_xoff: 0 tx_flow_control_xon: 0 tx_flow_control_xoff: 0 rx_long_byte_count: 76038106102 rx_csum_offload_good: 148139283 rx_csum_offload_errors: 0 rx_header_split: 0 alloc_rx_buff_failed: 0 Sar -B output shows a lot of paging going on which is probably causing some loss 06:10:01 AM pgpgin/s pgpgout/s fault/s majflt/s 06:20:01 AM 0.00 160.46 3.02 0.00 06:30:01 AM 0.00 162.02 3.04 0.00 06:40:01 AM 0.00 164.49 4.14 0.00 06:50:01 AM 0.02 161.51 3.03 0.00 07:00:01 AM 0.00 174.21 3.04 0.00 07:10:01 AM 0.11 198.15 6.02 0.00 07:20:01 AM 0.01 193.53 3.03 0.00 07:30:01 AM 1278.66 1593.51 29.30 0.04 Average: 67.76 189.06 19.12 0.02 Strange though (or maybe I am misreading this) sar -W shows all zeroe's for pswpin/s and pswpout/s which says there is not swapping going on. Sar -N shows no errors either, but the udpsck value is locked at 5. I am thinking this is hardcoded somewhere or maybe compiled in syslog srpms as I cannot find a syslog setting. This is one reason for wanting to use syslog-ng as from what I read I can change the number of allocated sockets via the configuration file. Sar -P shows the CPU is avg 95% idle so I see no issue here. I have re-niced syslog to -10 to increase it's priority. Netstat -su shows what might be data loss: Udp: 131725715 packets received 16642 packets to unknown port received. 4859684 packet receive errors 31571 packets sent I have no way to tell if the udp errors are related to syslog data and with so much syslog data arriving setting up tcpdump to see what the errors relate to is going to be rather difficult. What I think is going on is the stock syslog daemon is simply unable to buffer enough to keep up with the syslog stream. Therefore I am wanting to look at using syslog-ng to see if the error rate drops. Also I was thinking of using TCP for this but at the data rate I am seeing I am thinking this would cause a potential denial of service on both the syslog transmitters and the syslog receiving server. Any thoughts, ideas? Thanks Greg

3 2

log rotation
by Brian Loe 25 Aug '06

25 Aug '06

I've been trying to get logrotate to work on AIX and it simply doesn't "do" anything (run it with debug and it tells me its reading the config file then exits, files remain the same - regardless of size or age). So, what else should I try? Eventually it looks like I'm going to be feeding pipes and files for use with SEC - but I need to archive each log for 30 days, then archive all of those files for a year, etc..

3 2

Pipe to MYSQL does not work
by Matthew Redel 25 Aug '06

25 Aug '06

Running 1.6.9 version of syslog-ng. libol version 3.9 OS is Redhat Fedora 4. mysql version is 4.1.12 . Below is my config: *options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); };* *source s_net { udp(ip(0.0.0.0) port(514)); };* *destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, f acility, priority, level, tag, date, time, program, msg) VALUES ('$HOST', '$FACI LITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$ PROGRAM', '$MSG');\n") template-escape(yes)); };* *log { source(s_net); destination(d_mysql); };* Here is the script used to pipe /tmp/mysql.pipe into databse: *#!/bin/bash* *if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u syslog --password=password syslog < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi* I have confirmed that I can redirect echo to the pipe, so I know the pipe is working. I've even chmod 777 the pipe. I have also confirmed that log messages are coming in over the network using tcpdump and when I use syslog-ng to log to file, it works just fine. Why doesn't syslog-ng output to the pipe, argh!? Any help would be greatly appreciated. Matt

2 1

RE: [syslog-ng] FQDN's in syslog-ng
by Stenglein, David 24 Aug '06

24 Aug '06

Russell and Steven, There are problems with trying to use macros, as you have found. There is a good bit of detail on this page (part of the FAQ, I believe) http://www.campin.net/syslog-ng/syslog.html. The problem I had was that I started to get strange directory names, like "cd .." and "::". All sorts of garbage. The reason? The Sun syslog service produces non-RFC compliant network packets. The packet is supposed to have the hostname twice, and then the ID field. Syslog-ng can deal with the second host not being there, but if it is missing the square brackets, there is no way for it to figure out where the message begins. So, you can use HOST_FROM and FULLHOST_FROM in your file output. Syslog-ng then logs everything very neatly, which is what the doc says. That's all well and good, but what about your remote hosts that have a forwarder in between? Sun syslog won't work for this anyway (doesn't handle the origin name correctly), so you use syslog-ng. Fine. But now you can't use _FROM macros, since that will be wrong too. What you will need to do is have the remote syslog-ng forwarders sending to the central loghost over a separate port (might as well be TCP). Last, you will need a separate parallel set of rules that use FULLHOST instead of FULLHOST_FROM in the output path when the source is a remote syslog-ng server (which will forward correctly formatted messages). Did I mention timestamps? ;-) -Dave -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Russell Fulton Sent: Thursday, August 24, 2006 4:18 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] FQDN's in syslog-ng There are a several of different options for dealing with host names and I have not managed to sort them all out yet. The single line explanations in the manual are not enough to work out the details. Be aware that the hostname can be set on either the central log server or on the system generating the logs. The default seems to be that the central server will keep the host name that is in the packet, if there is no hostname in the packet it will do a reverse lookup to determine it. We want to override this but have not spent a lot of time fiddling with the options to see what works. What you want to do is possible it just a matter of figuring out which options you need on the client and server. What is bothering us at the moment is that SUN monitoring crap called SRS manages to generate some syslog records with SRS in the hostname field. So on the central server these all turn up in the same file. I really must sort this out today, sigh... I'd be happy to hear from someone who has already sussed out how these options work! Russell Steven Hajducko wrote: > Hi everyone, > > We've currently got a syslog setup that centralizes our logs from many > of our different teirs into one location, using each system's prebuilt > syslog. It works at the moment, but we've got some issues. > > Our main one is that we name our hosts the same in different > environments, mainly because these environments are for moving code and > configs from 1 step to the next, so to make it easier on people so they > don't have to change configurations each time the code moves, hosts > share similar names. > > The problem is that when all the logs come back to the central syslog > server, they can't be seperated by host because of the similiarities. > So 'web5' in our QA is the same as 'web5' in production. > > Because of that, we were looking at syslog-ng and while I found a couple > references to using FQDN, I've been unable to tell whether or not this > is possible. > > Our machines DO have different FQDNs. For example, > web5.qa.location.domain.com vs. web5.prod.location.domain.com. If we > run our main central server on syslog-ng and replace all the syslog > daemon's on each system with it, can we force the FQDN to be given > rather then just the base hostname and have the central log server sort > the logs into different directories based on the FQDN? > > Thanks! > > -- > sh > > > ------------------------------------------------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Bug? Dual destinations on Solaris
by Richard Whelan 24 Aug '06

24 Aug '06

Hi All, I've come across what looks like a bug. Whether it's syslog-ng, stunnel or Solaris I can't tell. I'm also going to report this to Michal (Stunnel). The setup/problem is as follows: I'm effectively re-creating a syslog-ng client/server setup, except, the traffic is being encrypted using Stunnel, and it's talking to two servers simultaneously for redundancy. In order for this to happen, I have stunnel set to listen to two separate ports on the client, and syslog-ng set to send to the two separate ports. The configuration, parts of which are below, are working fine with 6 or so Linux clients, and also appears to work fine with Solaris 8, but not under Solaris 9. The config for the stunnel side is: stunnel-4.15 client = yes cert = /usr/local/ssl/certs/syslog-ng-client.pem CAfile = /usr/local/ssl/certs/syslog-ng-server.pem chroot = /var/run/stunnel pid = /run/stunnel.pid setuid = stunnel setgid = stunnel verify = 3 debug = 7 output = /var/log/stunnel.log [5140] accept = 127.0.0.1:5140 connect = x.x.x.x:5140 TIMEOUTclose = 0 [5141] accept = 127.0.0.1:5141 connect = y.y.y.y:5140 TIMEOUTclose = 0 As you can see it's set to listen to ports 5140 and 5141 on the localhost. If you start this first, the process runs fine, and shows up with a netstat -a: localhost.5140 *.* 0 0 32768 0 LISTEN localhost.5141 *.* 0 0 32768 0 LISTEN The config for the syslog-ng process is: syslog-ng-1.6.11 options { sync (0); keep_hostname (yes); use_fqdn (yes); chain_hostnames (no); use_dns (no); time_reopen (10); time_reap (120); log_fifo_size (2048); }; source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination ....... destination d_stunnel { tcp ("127.0.0.1" port(5140)); }; destination d_stunnel2 { tcp ("127.0.0.1" port(5141)); }; Here showing that two of the destinations are to tcp ports 5140 and 5141 on the localhost. It seems reasonable enough, and as I mentioned does work on Linux. However as soon as the syslog-ng process starts, the stunnel process is either killed or just dies. The netstat then shows: localhost.64142 localhost.5141 32768 0 32768 0 CLOSE_WAIT localhost.5141 localhost.64142 32768 0 32768 0 FIN_WAIT_2 localhost.64143 localhost.5140 32768 0 32768 0 CLOSE_WAIT localhost.5140 localhost.64143 32768 0 32768 0 FIN_WAIT_2 and after a while you are just left with the CLOSE_WAIT lines. I've tried this on two separate Solaris 9 systems, both the same result. One actually producing a core dump of the stunnel process. Has anyone seen anything like this, or can shed any light as to why this may not be working. Thanks, Richard -- Richard Whelan Senior Systems & NMS Administrator Pipex Communications Tel: +44 (0) 1865 381568 Mob: +44 (0) 7786 276020 Web: http://www.pipex.com This e-mail is subject to: http://www.pipex.net/disclaimer.html

1 1