- syslog-ng - lists.balabit.hu

Cygwin bind_unix_socket(): bind failed /dev/log
by Alessio Massaro 24 Aug '06

24 Aug '06

Hi, On cygwin syslog-ng fails to start with the following in /var/log/syslog-ng.log io.c: bind_unix_socket(): bind failed /dev/log (Bad file descriptor) Error initializing configuration, exiting. Any help is greatly appreciated. Thanks I have a virgin intallation created by syslog-ng-config which creates the following /etc/syslog-ng.conf options { keep_hostname(yes); chain_hostnames(no); owner("system"); group("root"); perm(0664); sync(0); }; source applications { unix-dgram("/dev/log"); internal(); }; source kernel { file("/dev/kmsg", log_prefix("kernel: ")); }; destination messages { file("/var/log/messages"); }; log { source(applications); destination(messages); }; log { source(kernel); destination(messages); };

1 0

netmask
by Werner Thal 24 Aug '06

24 Aug '06

Hallo, I try to use the "netmask" filter option to generate seperate logfiles for different subnets. I tried this filter krzn_all { netmask("10.254.0.0/255.255.0.0"); }; this filter krzn_all { netmask(10.254.0.0/255.255.0.0); }; this filter krzn_all { netmask("10.254.0.0/16"); }; and this filter krzn_all { netmask(10.254.0.0/16); }; No errors have been reported starting syslog-ng but also no messages have been logged. I use syslog-ng 2.0rc1-2 on a debian Etch. Kind Regards W. Thal

2 2

PIX VPN logging
by Brian Loe 23 Aug '06

23 Aug '06

Anyone here have a complete list of VPN related syslog messages they'd like to share? I'm essentially wanting to monitor for site-to-site tunnels going down so that I can alert on them, but having a hell of a time finding exactly what I want to look for on the Cisco site. Part of the problem is that I won't have an example of such an event until it happens - and I've only just now implemented a syslog server capable of maintaining the logs.. At any rate, if anyone here is monitoring for this as well and you're willing to share...let me know!

2 4

RE: [syslog-ng] Performance tuning questions
by King, John (Greg) (LMIT-HOU) 23 Aug '06

23 Aug '06

Yeah the only other services than syslog are sshd and iptables, nothing else was installed, the only worry I have with moving from udp to tcp for such a large number of messages would be denial of service. I recall some years ago some mmorpg tried using tcp instead of udp for client data and it brought their system(s) to a halt. Since I am looking at (on avg) 26000 messages per minute I am worried about what this will do not only to the syslog server performance but to the agents as well (and thus the servers the agents reside on). I am still trying to get time to work on the lab syslog-ng system to convert redhat es 4 syslog configs into syslog-ng so the standard logging format for the system is not lost. Then create a rule for tcp based syslog and slowly ramp up traffic and see what happens in the lab to get an idea on what to expect. -Greg -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Kevin Sent: Wednesday, August 23, 2006 10:41 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Performance tuning questions Both TCP and UDP have risks and limitations. If message loss/spoofing are important to you, TCP is the way to go. (One key exception being logs from PIX firewalls :) Is the log server handling other services as well? Kevin _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Config template for redhat es 4
by King, John (Greg) (LMIT-HOU) 22 Aug '06

22 Aug '06

Has anyone created a redhat es/as/ws 4 config file? I saw the Debian example and I was going to start working on converting it, but to save some time I was curious if anyone else has done this and would share their template. Thanks Greg

1 0

RE: [syslog-ng] Newbie Question
by William Bell 21 Aug '06

21 Aug '06

You should probably create multiple sources. Like: source remote { udp(ip("0.0.0.0") port(514)); }; Then send the remote files to a nice archive directive destination ala: destination remotelogs { file("/var/REMOTE/$HOST.log" owner(root) group(root) perm(0755) dir_perm(0755) create_dirs(yes)); }; Finish it up with its own log directive like: log { source(remote); destination(remotelogs); }; Adding any filters you want to the log directive above. I hope this helps. William L. Bell II CWIE Security Dept. _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Donald Rush Sent: Monday, August 21, 2006 10:18 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Newbie Question All, I am working on creating a logging host for some network hardware. Being new to lunix and syslog-ng I am a little confused to how to keep the remote syslog messages from showing up in the system log files. I had to rem out the messages and and localmessages do to they are filling to fast. Any advice would be greatly appreciated. Don R. rushd-linux:/home/rushd # cat /etc/syslog-ng/syslog-ng.conf # # /etc/syslog-ng/syslog-ng.conf # # Automatically generated by SuSEconfig on Thu Aug 17 16:58:59 PDT 2006. # # PLEASE DO NOT EDIT THIS FILE! # # you can modify /etc/syslog-ng/syslog-ng.conf.in instead # # # # File format description can be found in syslog-ng.conf(5) # and /usr/share/doc/packages/syslog-ng/syslog-ng.txt. # # # Global options. # options { long_hostnames(off); sync(0); perm(0640); stats(3600); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; # source src { # # include internal syslog-ng messages # note: the internal() soure is required! # internal(); # # the following line will be replaced by the # socket list generated by SuSEconfig using # variables from /etc/sysconfig/syslog: # unix-dgram("/dev/log"); # # uncomment to process log messages from network: # udp(ip("0.0.0.0") port(514)); }; # # Filter definitions # filter f_iptables { facility(kern) and match("IN=") and match("OUT="); }; filter f_console { level(warn) and facility(kern) and not filter(f_iptables) or level(err) and not facility(authpriv); }; filter f_newsnotice { level(notice) and facility(news); }; filter f_newscrit { level(crit) and facility(news); }; filter f_newserr { level(err) and facility(news); }; filter f_news { facility(news); }; filter f_mailinfo { level(info) and facility(mail); }; filter f_mailwarn { level(warn) and facility(mail); }; filter f_mailerr { level(err, crit) and facility(mail); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_acpid { match('^\[acpid\]:'); }; filter f_netmgm { match('^NetworkManager:'); }; filter f_messages { not facility(news, mail) and not filter(f_iptables); }; filter f_warn { level(warn, err, crit) and not filter(f_iptables); }; filter f_alert { level(alert); }; # # Most warning and errors on tty10 and on the xconsole pipe: # destination console { file("/dev/tty10" group(tty) perm(0620)); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole" group(tty) perm(0400)); }; log { source(src); filter(f_console); destination(xconsole); }; # Enable this, if you want that root is informed immediately, # e.g. of logins: # #destination root { usertty("root"); }; #log { source(src); filter(f_alert); destination(root); }; # # News-messages in separate files: # destination newscrit { file("/var/log/news/news.crit" owner(news) group(news)); }; log { source(src); filter(f_newscrit); destination(newscrit); }; destination newserr { file("/var/log/news/news.err" owner(news) group(news)); }; log { source(src); filter(f_newserr); destination(newserr); }; destination newsnotice { file("/var/log/news/news.notice" owner(news) group(news)); }; log { source(src); filter(f_newsnotice); destination(newsnotice); }; # # and optionally also all in one file: # (don't forget to provide logrotation config) # #destination news { file("/var/log/news.all"); }; #log { source(src); filter(f_news); destination(news); }; # # Mail-messages in separate files: # destination mailinfo { file("/var/log/mail.info"); }; log { source(src); filter(f_mailinfo); destination(mailinfo); }; destination mailwarn { file("/var/log/mail.warn"); }; log { source(src); filter(f_mailwarn); destination(mailwarn); }; destination mailerr { file("/var/log/mail.err" fsync(yes)); }; log { source(src); filter(f_mailerr); destination(mailerr); }; # # and also all in one file: # destination mail { file("/var/log/mail"); }; log { source(src); filter(f_mail); destination(mail); }; # # acpid messages in one file: # destination acpid { file("/var/log/acpid"); }; log { source(src); filter(f_acpid); destination(acpid); flags(final); }; # # NetworkManager messages in one file: # destination netmgm { file("/var/log/NetworkManager"); }; log { source(src); filter(f_netmgm); destination(netmgm); flags(final); }; # # Cron-messages in one file: # (don't forget to provide logrotation config) # #destination cron { file("/var/log/cron"); }; #log { source(src); filter(f_cron); destination(cron); }; # # Some boot scripts use/require local[1-7]: # ##destination localmessages { file("/var/log/localmessages"); }; ##log { source(src); filter(f_local); destination(localmessages); }; # # All messages except iptables and the facilities news and mail: # ##destination messages { file("/var/log/messages"); }; ##log { source(src); filter(f_messages); destination(messages); }; # # Firewall (iptables) messages in one file: # destination firewall { file("/var/log/firewall"); }; log { source(src); filter(f_iptables); destination(firewall); }; # # Warnings (except iptables) in one file: # destination warn { file("/var/log/warn" fsync(yes)); }; log { source(src); filter(f_warn); destination(warn); }; # # Enable this, if you want to keep all messages in one file: # (don't forget to provide logrotation config) # #destination allmessages { file("/var/log/allmessages"); }; #log { source(src); destination(allmessages); }; destination logip { file("/data/logs/HOSTS/$HOST_FROM/$FACILITY/$YEAR$MONTH/$FACILITY$YEAR$M ONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; log { source(src); destination(logip); }; rushd-linux:/home/rushd #

2 1

Newbie Question
by Donald Rush 21 Aug '06

21 Aug '06

All, I am working on creating a logging host for some network hardware. Being new to lunix and syslog-ng I am a little confused to how to keep the remote syslog messages from showing up in the system log files. I had to rem out the messages and and localmessages do to they are filling to fast. Any advice would be greatly appreciated. Don R. rushd-linux:/home/rushd # cat /etc/syslog-ng/syslog-ng.conf # # /etc/syslog-ng/syslog-ng.conf # # Automatically generated by SuSEconfig on Thu Aug 17 16:58:59 PDT 2006. # # PLEASE DO NOT EDIT THIS FILE! # # you can modify /etc/syslog-ng/syslog-ng.conf.in instead # # # # File format description can be found in syslog-ng.conf(5) # and /usr/share/doc/packages/syslog-ng/syslog-ng.txt. # # # Global options. # options { long_hostnames(off); sync(0); perm(0640); stats(3600); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; # source src { # # include internal syslog-ng messages # note: the internal() soure is required! # internal(); # # the following line will be replaced by the # socket list generated by SuSEconfig using # variables from /etc/sysconfig/syslog: # unix-dgram("/dev/log"); # # uncomment to process log messages from network: # udp(ip("0.0.0.0") port(514)); }; # # Filter definitions # filter f_iptables { facility(kern) and match("IN=") and match("OUT="); }; filter f_console { level(warn) and facility(kern) and not filter(f_iptables) or level(err) and not facility(authpriv); }; filter f_newsnotice { level(notice) and facility(news); }; filter f_newscrit { level(crit) and facility(news); }; filter f_newserr { level(err) and facility(news); }; filter f_news { facility(news); }; filter f_mailinfo { level(info) and facility(mail); }; filter f_mailwarn { level(warn) and facility(mail); }; filter f_mailerr { level(err, crit) and facility(mail); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_acpid { match('^\[acpid\]:'); }; filter f_netmgm { match('^NetworkManager:'); }; filter f_messages { not facility(news, mail) and not filter(f_iptables); }; filter f_warn { level(warn, err, crit) and not filter(f_iptables); }; filter f_alert { level(alert); }; # # Most warning and errors on tty10 and on the xconsole pipe: # destination console { file("/dev/tty10" group(tty) perm(0620)); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole" group(tty) perm(0400)); }; log { source(src); filter(f_console); destination(xconsole); }; # Enable this, if you want that root is informed immediately, # e.g. of logins: # #destination root { usertty("root"); }; #log { source(src); filter(f_alert); destination(root); }; # # News-messages in separate files: # destination newscrit { file("/var/log/news/news.crit" owner(news) group(news)); }; log { source(src); filter(f_newscrit); destination(newscrit); }; destination newserr { file("/var/log/news/news.err" owner(news) group(news)); }; log { source(src); filter(f_newserr); destination(newserr); }; destination newsnotice { file("/var/log/news/news.notice" owner(news) group(news)); }; log { source(src); filter(f_newsnotice); destination(newsnotice); }; # # and optionally also all in one file: # (don't forget to provide logrotation config) # #destination news { file("/var/log/news.all"); }; #log { source(src); filter(f_news); destination(news); }; # # Mail-messages in separate files: # destination mailinfo { file("/var/log/mail.info"); }; log { source(src); filter(f_mailinfo); destination(mailinfo); }; destination mailwarn { file("/var/log/mail.warn"); }; log { source(src); filter(f_mailwarn); destination(mailwarn); }; destination mailerr { file("/var/log/mail.err" fsync(yes)); }; log { source(src); filter(f_mailerr); destination(mailerr); }; # # and also all in one file: # destination mail { file("/var/log/mail"); }; log { source(src); filter(f_mail); destination(mail); }; # # acpid messages in one file: # destination acpid { file("/var/log/acpid"); }; log { source(src); filter(f_acpid); destination(acpid); flags(final); }; # # NetworkManager messages in one file: # destination netmgm { file("/var/log/NetworkManager"); }; log { source(src); filter(f_netmgm); destination(netmgm); flags(final); }; # # Cron-messages in one file: # (don't forget to provide logrotation config) # #destination cron { file("/var/log/cron"); }; #log { source(src); filter(f_cron); destination(cron); }; # # Some boot scripts use/require local[1-7]: # ##destination localmessages { file("/var/log/localmessages"); }; ##log { source(src); filter(f_local); destination(localmessages); }; # # All messages except iptables and the facilities news and mail: # ##destination messages { file("/var/log/messages"); }; ##log { source(src); filter(f_messages); destination(messages); }; # # Firewall (iptables) messages in one file: # destination firewall { file("/var/log/firewall"); }; log { source(src); filter(f_iptables); destination(firewall); }; # # Warnings (except iptables) in one file: # destination warn { file("/var/log/warn" fsync(yes)); }; log { source(src); filter(f_warn); destination(warn); }; # # Enable this, if you want to keep all messages in one file: # (don't forget to provide logrotation config) # #destination allmessages { file("/var/log/allmessages"); }; #log { source(src); destination(allmessages); }; destination logip { file("/data/logs/HOSTS/$HOST_FROM/$FACILITY/$YEAR$MONTH/$FACILITY$YEAR$M ONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; log { source(src); destination(logip); }; rushd-linux:/home/rushd #

1 0

Problem with hostnames (keep_hostname(no);)
by Dukes Clayton 17 Aug '06

17 Aug '06

Hiya folks, Here's the situation: All devices log to syslog-ng Syslog-ng then forwards logs to individual NMS systems, like Ciscoworks, etc. We're setting up a demo of Loglogic and are forwarding from the NG server to Loglogic. I'm getting the messages on the Loglogic side, but the originating hostnames are coming in as the NG server, not the actual device names (so it only sees one source) I've tried setting keep_hostname(no); but this doesn't seem to correct the problem. Any suggestions? TIA! Clayton

1 0

How many log files does syslog0ng support
by Walt Rich 17 Aug '06

17 Aug '06

We are running version 1.6.11 on Solaris 10, and have Syslog-ng configured to log to 7 different files. It logs just fine to 6 of them but will not for some reason log to the 7th destination which we created this week. Please advise. Thanks!

2 1

syslog-ng on AIX
by Brian Loe 15 Aug '06

15 Aug '06

I've installed syslog-ng on the AIX box and I thought I had pretty much replaced AIX's syslogd with it. However, it appears as though I'm missing a lot. Cron is logging to mail, for instance, and with the original syslogd it also logged to it. Syslog-ng is running and logging network messages, its own messages and that's it. So, the question, what more do I need to look at?

2 3

re:kernel message logging
by Bruce M. Penrod 14 Aug '06

14 Aug '06

Balazs Scheidler wrote: >On Fri, 2006-08-11 at 16:11 -0700, Bruce Penrod wrote: >> As a workaround, I tried using klogd with syslog-ng. I did turn off the >> syslog-ng source for /proc/kmsg. Now I don't see kernel messages on my >> console, but I don't get any kernel message logging either. Again, >> should this work? I don't see that there should be any special source >> definition in syslog-ng.conf for this to work. > In addition to Sandor's response, I'd like to add that this combination > should work, however klogd uses its own syslog() implementation instead > of using the one in libc, and it does not support > unix-stream() /dev/log, only unix-dgram(). That's probably the reason > why it does not work.Thanks to both Sandor and Balazs for the answers to my kernel logging questions. I did not know about /proc/sys/kernel/printk, or that dmesg had the capability to set it, just like klogd. Learn something new all the time. I was using the unix-stream source for /dev/log. Might be good to explain the need to use the datagram source for klogd in the reference docs, although I don't see why anyone would want to use it now. I only tried it because of the console logging issue, which Sandor's suggestion has solved nicely. Thanks for the quick responses. Bruce

1 0

kernel message logging
by Bruce Penrod 14 Aug '06

14 Aug '06

I've been using syslogd/klogd for years on linux systems and it seems to work as described in its docs, no issues. Unfortunately, it isn't being maintained and I now need ipv6 capability. Hence, syslog-ng. I like the straightforward configuration file structure, and with its emerging ipv6 capability, it seems like the future of open source syslogging, but I'm running into a little trouble making a seamless transition from syslogd/klogd. Apart from the problem I described in my previous post concerning the hostname being dropped from messages forwarded over udp6 to a loghost, I'm also running into a little difficulty with kernel message handling. It seems that the internal syslog-ng kernel message logging lacks a feature present in klogd that allows inhibiting kernel messages from appearing on the console, unless they are above a command line settable priority level. With syslog-ng, I seem to be getting all of the kernel messages coming out on /dev/console. I'm in an embedded environment using the mtd flash kernel drivers, which generate a lot of info level messages while erasing and writing to raw flash devices. klogd allows me to inhibit these quite nicely. Am I correct that syslog-ng lacks this capability, or just that I don't know how to configure it? As a workaround, I tried using klogd with syslog-ng. I did turn off the syslog-ng source for /proc/kmsg. Now I don't see kernel messages on my console, but I don't get any kernel message logging either. Again, should this work? I don't see that there should be any special source definition in syslog-ng.conf for this to work. Thanks, Bruce.

3 2

Re: [syslog-ng] How can i log messages from slapd in one file and, not /var/log/messages
by Gustavo Mendes de Carvalho 12 Aug '06

12 Aug '06

Fernando, I have this filters and destinatiosn in my configuration file: #============== source s_all { unix-stream("/dev/log"); internal(); }; destination d_ldap { file("/var/log/ldap.log"); }; filter f_syslog { not facility(auth, authpriv) and not match(slapd); }; filter f_ldap { match("slapd"); }; log { source(s_all); filter(f_syslog); destination(d_syslog); }; log { source(s_all); filter(f_ldap); destination(d_ldap); }; #=============== Tha's all that you need to send all ldap messages to one single file. Gustavo > Date: Fri, 11 Aug 2006 12:15:03 -0300 > From: "Fernando Loureiro" <loureiro.fernando(a)gmail.com> > Subject: [syslog-ng] How can i log messages from slapd in one file and > not /var/log/messages > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <a000e3310608110815i15f6a5b5rdc513481f3bae7ee(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi All, > > I want to know how can i have all my log messages inside a file called > slapd.log. > > Actually it´s logging most messages in /var/log/messages and some in > /var/log/slapd/slapd.log. > > I created the following filter for this daemon: > filter f_openldap { > program(slapd); }; > > And, by the way, i don´t know whenever to use which of those filter > functions. Can somebody explain me? > > > Att, > -- Fernando >

1 0

How can i log messages from slapd in one file and not /var/log/messages
by Fernando Loureiro 11 Aug '06

11 Aug '06

Hi All, I want to know how can i have all my log messages inside a file called slapd.log. Actually it´s logging most messages in /var/log/messages and some in /var/log/slapd/slapd.log. I created the following filter for this daemon: filter f_openldap { program(slapd); }; And, by the way, i don´t know whenever to use which of those filter functions. Can somebody explain me? Att, -- Fernando

1 0

(no subject)
by krishna y 09 Aug '06

09 Aug '06

Please remove my id from this list. Thanks, Krishna Y

1 0

Re: syslog-ng Digest, Vol 16, Issue 5
by Fernando Loureiro 09 Aug '06

09 Aug '06

Here is my syslog-ng.conf On 8/7/06, syslog-ng-request(a)lists.balabit.hu <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: syslog-ng doesn't log messages (Sandor Geller) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 07 Aug 2006 10:36:41 +0200 > From: Sandor Geller <wildy(a)balabit.hu> > Subject: Re: [syslog-ng] syslog-ng doesn't log messages > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <44D6FB99.5070804(a)balabit.hu> > Content-Type: text/plain; charset=ISO-8859-2 > > Fernando Loureiro wrote: > > I think everything is ok with my conf but it isn't working with some > > applications such as openldap, apcupsd. > > > > Can somebody help me? Here is a part of my conf. > > > > > > []s > > -- Fernando > > > > > > ------------------------------ > > > > options { > > chain_hostnames(off); > > sync(0); > > use_dns(no); > > create_dirs(yes); > > }; > > > > source kernsrc { file("/proc/kmsg"); internal(); }; > > > > destination openldap { file("/var/log/openldap.log"); }; > > destination apcupsd { file("/var/log/apcupsd.log"); }; > > > > filter f_openldap { program(slapd); }; > > filter f_apcupsd { program(apcupsd); }; > > > > log { source(kernsrc); filter(f_openldap); > > destination(openldap); }; > > log { source(kernsrc); filter(f_apcupsd); > > destination(apcupsd); }; > > This is a very incomplete configuration. You missed /dev/log, userspace > processes don't log through /proc/mksg. > > -- > Sandor Geller > wildy(a)balabit.hu > > > ------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > End of syslog-ng Digest, Vol 16, Issue 5 > **************************************** >

2 1

RE: Re: syslog-ng 2.0rc1 memory usage (Balazs Scheidler)
by Martin, David M 09 Aug '06

09 Aug '06

applied the patch and resident size increased only marginally over a 10 minute period. much better. ran through valgrind another 10 minutes, here's the report. ==25356== Memcheck, a memory error detector for x86-linux. ==25356== Copyright (C) 2002-2004, and GNU GPL'd, by Julian Seward et al. ==25356== Using valgrind-2.2.0, a program supervision framework for x86-linux. ==25356== Copyright (C) 2000-2004, and GNU GPL'd, by Julian Seward et al. ==25356== ==25356== My PID = 25356, parent PID = 1284. Prog and args are: ==25356== ./syslog-ng ==25356== -dv ==25356== ==25356== Valgrind library directory: /usr/lib/valgrind ==25356== Command line ==25356== ./syslog-ng ==25356== -dv ==25356== Startup, with flags: ==25356== --tool=memcheck ==25356== -v ==25356== --leak-check=yes ==25356== --show-reachable=yes ==25356== --log-file=/tmp/debug.txt ==25356== Contents of /proc/version: ==25356== Linux version 2.6.9-34.ELsmp (bhcompile(a)hs20-bc1-7.build.redhat.com) (gcc version 3.4.5 20051201 (Red Hat 3.4.5-2)) #1 SMP Fri Feb 24 16:54:53 EST 2006 ==25356== Reading syms from /opt/sfw/syslogng/2.0rc1/sbin/syslog-ng (0x8048000) ==25356== Reading syms from /lib/ld-2.3.4.so (0x1B8E4000) ==25356== object doesn't have any debug info ==25356== Reading syms from /usr/lib/valgrind/stage2 (0xB0000000) ==25356== Reading syms from /lib/ld-2.3.4.so (0xB1000000) ==25356== object doesn't have any debug info ==25356== Reading syms from /usr/lib/valgrind/vgskin_memcheck.so (0xB7C3E000) ==25356== Reading syms from /lib/tls/libc-2.3.4.so (0xB7E67000) ==25356== object doesn't have any debug info ==25356== Reading syms from /lib/libdl-2.3.4.so (0xB7F92000) ==25356== object doesn't have any debug info ==25356== Reading suppressions file: /usr/lib/valgrind/default.supp ==25356== REDIRECT soname:libc.so.6(__GI___errno_location) to soname:libpthread.so.0(__errno_location) ==25356== REDIRECT soname:libc.so.6(__errno_location) to soname:libpthread.so.0(__errno_location) ==25356== REDIRECT soname:libc.so.6(__GI___h_errno_location) to soname:libpthread.so.0(__h_errno_location) ==25356== REDIRECT soname:libc.so.6(__h_errno_location) to soname:libpthread.so.0(__h_errno_location) ==25356== REDIRECT soname:libc.so.6(__GI___res_state) to soname:libpthread.so.0(__res_state) ==25356== REDIRECT soname:libc.so.6(__res_state) to soname:libpthread.so.0(__res_state) ==25356== REDIRECT soname:libc.so.6(stpcpy) to *vgpreload_memcheck.so*(stpcpy) ==25356== REDIRECT soname:libc.so.6(strnlen) to *vgpreload_memcheck.so*(strnlen) ==25356== REDIRECT soname:ld-linux.so.2(stpcpy) to *vgpreload_memcheck.so*(stpcpy) ==25356== REDIRECT soname:ld-linux.so.2(strchr) to *vgpreload_memcheck.so*(strchr) ==25356== ==25356== Reading syms from /usr/lib/valgrind/vg_inject.so (0x1B8FC000) ==25356== Reading syms from /usr/lib/valgrind/vgpreload_memcheck.so (0x1B901000) ==25356== TRANSLATE: 0x1B8F5F70 redirected to 0x1B904100 ==25356== Reading syms from /lib/libnsl-2.3.4.so (0xC09000) ==25356== object doesn't have any debug info ==25356== Reading syms from /lib/tls/librt-2.3.4.so (0xDD5000) ==25356== object doesn't have any debug info ==25356== Reading syms from /usr/lib/libglib-2.0.so.0.400.7 (0x101000) ==25356== object doesn't have a symbol table ==25356== object doesn't have any debug info ==25356== Reading syms from /opt/sfw/eventlog/0.2.5/lib/libevtlog.so.0.0.0 (0x1B910000) ==25356== Reading syms from /lib/tls/libc-2.3.4.so (0xA60000) ==25356== object doesn't have any debug info ==25356== Reading syms from /usr/lib/valgrind/libpthread.so (0x1B917000) ==25356== Reading syms from /lib/libdl-2.3.4.so (0xB8C000) ==25356== object doesn't have any debug info ==25356== TRANSLATE: 0xAC4030 redirected to 0x1B9048F8 ==25356== TRANSLATE: 0x1B8E47A0 redirected to 0x52BFF040 ==25356== TRANSLATE: 0xAC1F60 redirected to 0x1B904E24 ==25356== TRANSLATE: 0xAC3D50 redirected to 0x1B905274 ==25356== TRANSLATE: 0xA752D0 redirected to 0x1B91EB87 ==25356== TRANSLATE: 0xACA370 redirected to 0x1B9046F4 ==25356== Reading syms from /lib/libnss_files-2.3.4.so (0x1BA51000) ==25356== object doesn't have any debug info ==25356== TRANSLATE: 0xAC4670 redirected to 0x1B905326 ==25356== discard syms at 0x1BA51000-0x1BA5C000 in /lib/libnss_files-2.3.4.so due to munmap() ==25356== ==25356== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 22 from 2) --25356-- --25356-- supp: 2 _dl_relocate_object/dl_open_worker --25356-- supp: 20 dl_relocate_object/dl_main ==25356== malloc/free: in use at exit: 47118 bytes in 370 blocks. ==25356== malloc/free: 535 allocs, 165 frees, 58735 bytes allocated. ==25356== ==25356== searching for pointers to 370 not-freed blocks. ==25360== TRANSLATE: 0xAC9000 redirected to 0x1B9042D0 ==25360== Reading syms from /lib/libnss_dns-2.3.4.so (0x1BA49000) ==25360== object doesn't have any debug info ==25360== Reading syms from /lib/libresolv-2.3.4.so (0xC21000) ==25360== object doesn't have any debug info ==25356== checked 2396740 bytes. ==25356== ==25356== 8 bytes in 2 blocks are still reachable in loss record 1 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAF72C8: register_state (in /lib/tls/libc-2.3.4.so) ==25356== by 0xAF765A: create_cd_newstate (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB004C5: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== ==25356== ==25356== 8 bytes in 2 blocks are still reachable in loss record 2 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAF7439: create_cd_newstate (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB004C5: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== ==25356== ==25356== 12 bytes in 1 blocks are still reachable in loss record 3 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0x1B9123A7: evt_ctx_tag_hook_add (evtctx.c:126) ==25356== by 0x1B91248B: evt_ctx_init (evtctx.c:151) ==25356== by 0x804C228: msg_init (messages.c:124) ==25356== ==25356== ==25356== 16 bytes in 1 blocks are still reachable in loss record 4 of 19 ==25356== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25356== by 0xB8D364: _dlerror_run (in /lib/libdl-2.3.4.so) ==25356== by 0xB8CE3B: dlsym (in /lib/libdl-2.3.4.so) ==25356== by 0x1B91ECA6: __errno_location (vg_libpthread.c:2127) ==25356== ==25356== ==25356== 56 bytes in 14 blocks are still reachable in loss record 5 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAF9D1A: calc_eclosure_iter (in /lib/tls/libc-2.3.4.so) ==25356== by 0xAFF83F: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== ==25356== ==25356== 56 bytes in 2 blocks are still reachable in loss record 6 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAFF59E: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== ==25356== ==25356== 92 bytes in 1 blocks are still reachable in loss record 7 of 19 ==25356== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25356== by 0x1B912410: evt_ctx_init (evtctx.c:142) ==25356== by 0x804C228: msg_init (messages.c:124) ==25356== by 0x804BA3E: main (main.c:389) ==25356== ==25356== ==25356== 104 bytes in 2 blocks are still reachable in loss record 8 of 19 ==25356== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25356== by 0xAF73F8: create_cd_newstate (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB004C5: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== ==25356== ==25356== 112 bytes in 2 blocks are still reachable in loss record 9 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAFEF10: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== ==25356== ==25356== 168 bytes in 2 blocks are still reachable in loss record 10 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAFF5F7: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== ==25356== ==25356== 168 bytes in 2 blocks are still reachable in loss record 11 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAFF5E3: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== ==25356== ==25356== 168 bytes in 2 blocks are still reachable in loss record 12 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xAFF5CF: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== ==25356== ==25356== 288 bytes in 2 blocks are still reachable in loss record 14 of 19 ==25356== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25356== by 0xAFEF3A: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==25356== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== ==25356== ==25356== 512 bytes in 2 blocks are still reachable in loss record 15 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0xB0123F: regcomp (in /lib/tls/libc-2.3.4.so) ==25356== by 0x8051B40: filter_re_compile (filter.c:266) ==25356== by 0x8051DA5: filter_host_new (filter.c:345) ==25356== ==25356== ==25356== 3608 bytes in 120 blocks are still reachable in loss record 16 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0x1B905373: realloc (vg_replace_malloc.c:189) ==25356== by 0x12AC4B: g_realloc (in /usr/lib/libglib-2.0.so.0.400.7) ==25356== by 0x13C55B: (within /usr/lib/libglib-2.0.so.0.400.7) ==25356== ==25356== ==25356== 4784 bytes in 118 blocks are still reachable in loss record 17 of 19 ==25356== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25356== by 0x12ABDF: g_malloc0 (in /usr/lib/libglib-2.0.so.0.400.7) ==25356== by 0x804CA1A: cfg_new (cfg.c:231) ==25356== by 0x804BA53: main (main.c:392) ==25356== ==25356== ==25356== 16438 bytes in 3 blocks are still reachable in loss record 18 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0x804E8EA: yyalloc (cfg-lex.c:1958) ==25356== by 0x804E55B: yyensure_buffer_stack (cfg-lex.c:1693) ==25356== by 0x804DFD0: yyrestart (cfg-lex.c:1467) ==25356== ==25356== ==25356== 20320 bytes in 91 blocks are still reachable in loss record 19 of 19 ==25356== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25356== by 0x12AB72: g_malloc (in /usr/lib/libglib-2.0.so.0.400.7) ==25356== by 0x12B6D6: g_mem_chunk_new (in /usr/lib/libglib-2.0.so.0.400.7) ==25356== by 0x130DD7: g_queue_new (in /usr/lib/libglib-2.0.so.0.400.7) ==25356== ==25356== LEAK SUMMARY: ==25356== definitely lost: 0 bytes in 0 blocks. ==25356== possibly lost: 0 bytes in 0 blocks. ==25356== still reachable: 46918 bytes in 369 blocks. ==25356== suppressed: 200 bytes in 1 blocks. --25356-- TT/TC: 0 tc sectors discarded. --25356-- 6727 tt_fast misses. --25356-- translate: new 6283 (108562 -> 1439356; ratio 132:10) --25356-- discard 124 (1626 -> 21552; ratio 132:10). --25356-- chainings: 4327 chainings, 3 unchainings. --25356-- dispatch: 150000 jumps (bb entries); of them 33019 (22%) unchained. --25356-- 188/7945 major/minor sched events. --25356-- reg-alloc: 1248 t-req-spill, 266926+8325 orig+spill uis, --25356-- 32968 total-reg-rank --25356-- sanity: 99 cheap, 4 expensive checks. --25356-- ccalls: 27187 C calls, 55% saves+restores avoided (89446 bytes) --25356-- 36049 args, avg 0.87 setup instrs each (8718 bytes) --25356-- 0% clear the stack (81192 bytes) --25356-- 10763 retvals, 32% of reg-reg movs avoided (6762 bytes) ==25360== TRANSLATE: 0xB37F10 redirected to 0x1B91EE2A ==25360== TRANSLATE: 0xB3C050 redirected to 0x1B91ED13 ==25360== discard syms at 0x1BA51000-0x1BA5C000 in /lib/libnss_files-2.3.4.so due to munmap() ==25360== discard syms at 0x1BA49000-0x1BA4F000 in /lib/libnss_dns-2.3.4.so due to munmap() ==25360== discard syms at 0xC21000-0xC34000 in /lib/libresolv-2.3.4.so due to munmap() ==25360== ==25360== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 25 from 2) --25360-- --25360-- supp: 5 _dl_relocate_object/dl_open_worker --25360-- supp: 20 dl_relocate_object/dl_main ==25360== malloc/free: in use at exit: 38779 bytes in 173 blocks. ==25360== malloc/free: 12356936 allocs, 12356763 frees, 294589976 bytes allocated. ==25360== ==25360== searching for pointers to 173 not-freed blocks. ==25360== checked 2394928 bytes. ==25360== ==25360== 16 bytes in 1 blocks are still reachable in loss record 1 of 8 ==25360== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25360== by 0xB8D364: _dlerror_run (in /lib/libdl-2.3.4.so) ==25360== by 0xB8CE3B: dlsym (in /lib/libdl-2.3.4.so) ==25360== by 0x1B91ECA6: __errno_location (vg_libpthread.c:2127) ==25360== ==25360== ==25360== 108 bytes in 1 blocks are definitely lost in loss record 2 of 8 ==25360== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25360== by 0x12ABDF: g_malloc0 (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x80530FD: log_msg_new (logmsg.c:545) ==25360== by 0x804C0A7: msg_send_internal_message (messages.c:57) ==25360== ==25360== ==25360== 128 bytes in 1 blocks are still reachable in loss record 3 of 8 ==25360== at 0x1B9053EE: realloc (vg_replace_malloc.c:197) ==25360== by 0x12AC4B: g_realloc (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x13C55B: (within /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x13CACD: g_string_insert_len (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== ==25360== ==25360== 3272 bytes in 45 blocks are still reachable in loss record 5 of 8 ==25360== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==25360== by 0x12ABDF: g_malloc0 (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x80530FD: log_msg_new (logmsg.c:545) ==25360== by 0x804C0A7: msg_send_internal_message (messages.c:57) ==25360== ==25360== ==25360== 3984 bytes in 84 blocks are still reachable in loss record 6 of 8 ==25360== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25360== by 0x1B905373: realloc (vg_replace_malloc.c:189) ==25360== by 0x12AC4B: g_realloc (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x13C55B: (within /usr/lib/libglib-2.0.so.0.400.7) ==25360== ==25360== ==25360== 14633 bytes in 37 blocks are still reachable in loss record 7 of 8 ==25360== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25360== by 0x12AB72: g_malloc (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x12B6D6: g_mem_chunk_new (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== by 0x130DD7: g_queue_new (in /usr/lib/libglib-2.0.so.0.400.7) ==25360== ==25360== ==25360== 16438 bytes in 3 blocks are still reachable in loss record 8 of 8 ==25360== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==25360== by 0x804E8EA: yyalloc (cfg-lex.c:1958) ==25360== by 0x804E55B: yyensure_buffer_stack (cfg-lex.c:1693) ==25360== by 0x804DFD0: yyrestart (cfg-lex.c:1467) ==25360== ==25360== LEAK SUMMARY: ==25360== definitely lost: 108 bytes in 1 blocks. ==25360== possibly lost: 0 bytes in 0 blocks. ==25360== still reachable: 38471 bytes in 171 blocks. ==25360== suppressed: 200 bytes in 1 blocks. --25360-- TT/TC: 0 tc sectors discarded. --25360-- 3473105 tt_fast misses. --25360-- translate: new 10152 (171521 -> 2315890; ratio 135:10) --25360-- discard 687 (11209 -> 143352; ratio 127:10). --25360-- chainings: 7759 chainings, 3 unchainings. --25360-- dispatch: 200000 jumps (bb entries); of them 337925145 (168962%) unchained. --25360-- 1207539/32139357 major/minor sched events. --25360-- reg-alloc: 1915 t-req-spill, 428681+13190 orig+spill uis, --25360-- 52732 total-reg-rank --25360-- sanity: 641240 cheap, 25650 expensive checks. --25360-- ccalls: 44737 C calls, 56% saves+restores avoided (149268 bytes) --25360-- 58904 args, avg 0.88 setup instrs each (13864 bytes) --25360-- 0% clear the stack (133704 bytes) --25360-- 17609 retvals, 33% of reg-reg movs avoided (11332 bytes) ------------------------------ Message: 8 Date: Tue, 08 Aug 2006 22:02:03 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] Re: syslog-ng 2.0rc1 memory usage To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1155067324.11773.2.camel(a)bzorp.balabit> Content-Type: text/plain; charset="us-ascii" On Mon, 2006-08-07 at 19:11 -0500, Martin, David M wrote: > I ran valgrind with these options for 10 minutes: > > valgrind --tool=memcheck -v --leak-check=yes --show-reachable=yes > --log-file=/tmp/debug.txt ./syslog-ng -dv Attached my latest set of leak fixes, please check if it fixes your problem. I've also committed it, so it should be available in tomorrow's snapshot. Thanks again for helping me to debug this problem. -- Bazsi

2 1

Re: syslog-ng 2.0rc1 memory usage
by Martin, David M 08 Aug '06

08 Aug '06

I ran valgrind with these options for 10 minutes: valgrind --tool=memcheck -v --leak-check=yes --show-reachable=yes --log-file=/tmp/debug.txt ./syslog-ng -dv Here's the output: ==15455== Memcheck, a memory error detector for x86-linux. ==15455== Copyright (C) 2002-2004, and GNU GPL'd, by Julian Seward et al. ==15455== Using valgrind-2.2.0, a program supervision framework for x86-linux. ==15455== Copyright (C) 2000-2004, and GNU GPL'd, by Julian Seward et al. ==15455== ==15455== My PID = 15455, parent PID = 5730. Prog and args are: ==15455== ./syslog-ng ==15455== -dv ==15455== ==15455== Valgrind library directory: /usr/lib/valgrind ==15455== Command line ==15455== ./syslog-ng ==15455== -dv ==15455== Startup, with flags: ==15455== --tool=memcheck ==15455== -v ==15455== --leak-check=yes ==15455== --show-reachable=yes ==15455== --log-file=/tmp/debug.txt ==15455== Contents of /proc/version: ==15455== Linux version 2.6.9-34.ELsmp (bhcompile(a)hs20-bc1-7.build.redhat.com) (gcc version 3.4.5 20051201 (Red Hat 3.4.5-2)) #1 SMP Fri Feb 24 16:54:53 EST 2006 ==15455== Reading syms from /opt/sfw/syslogng/2.0rc1/sbin/syslog-ng (0x8048000) ==15455== Reading syms from /lib/ld-2.3.4.so (0x1B8E4000) ==15455== object doesn't have any debug info ==15455== Reading syms from /usr/lib/valgrind/stage2 (0xB0000000) ==15455== Reading syms from /lib/ld-2.3.4.so (0xB1000000) ==15455== object doesn't have any debug info ==15455== Reading syms from /usr/lib/valgrind/vgskin_memcheck.so (0xB7BEB000) ==15455== Reading syms from /lib/tls/libc-2.3.4.so (0xB7E14000) ==15455== object doesn't have any debug info ==15455== Reading syms from /lib/libdl-2.3.4.so (0xB7F3F000) ==15455== object doesn't have any debug info ==15455== Reading suppressions file: /usr/lib/valgrind/default.supp ==15455== REDIRECT soname:libc.so.6(__GI___errno_location) to soname:libpthread.so.0(__errno_location) ==15455== REDIRECT soname:libc.so.6(__errno_location) to soname:libpthread.so.0(__errno_location) ==15455== REDIRECT soname:libc.so.6(__GI___h_errno_location) to soname:libpthread.so.0(__h_errno_location) ==15455== REDIRECT soname:libc.so.6(__h_errno_location) to soname:libpthread.so.0(__h_errno_location) ==15455== REDIRECT soname:libc.so.6(__GI___res_state) to soname:libpthread.so.0(__res_state) ==15455== REDIRECT soname:libc.so.6(__res_state) to soname:libpthread.so.0(__res_state) ==15455== REDIRECT soname:libc.so.6(stpcpy) to *vgpreload_memcheck.so*(stpcpy) ==15455== REDIRECT soname:libc.so.6(strnlen) to *vgpreload_memcheck.so*(strnlen) ==15455== REDIRECT soname:ld-linux.so.2(stpcpy) to *vgpreload_memcheck.so*(stpcpy) ==15455== REDIRECT soname:ld-linux.so.2(strchr) to *vgpreload_memcheck.so*(strchr) ==15455== ==15455== Reading syms from /usr/lib/valgrind/vg_inject.so (0x1B8FC000) ==15455== Reading syms from /usr/lib/valgrind/vgpreload_memcheck.so (0x1B901000) ==15455== TRANSLATE: 0x1B8F5F70 redirected to 0x1B904100 ==15455== Reading syms from /lib/libnsl-2.3.4.so (0xC09000) ==15455== object doesn't have any debug info ==15455== Reading syms from /lib/tls/librt-2.3.4.so (0xDD5000) ==15455== object doesn't have any debug info ==15455== Reading syms from /usr/lib/libglib-2.0.so.0.400.7 (0x101000) ==15455== object doesn't have a symbol table ==15455== object doesn't have any debug info ==15455== Reading syms from /opt/sfw/eventlog/0.2.5/lib/libevtlog.so.0.0.0 (0x1B910000) ==15455== Reading syms from /lib/tls/libc-2.3.4.so (0xA60000) ==15455== object doesn't have any debug info ==15455== Reading syms from /usr/lib/valgrind/libpthread.so (0x1B917000) ==15455== Reading syms from /lib/libdl-2.3.4.so (0xB8C000) ==15455== object doesn't have any debug info ==15455== TRANSLATE: 0xAC4030 redirected to 0x1B9048F8 ==15455== TRANSLATE: 0x1B8E47A0 redirected to 0x52BFF040 ==15455== TRANSLATE: 0xAC1F60 redirected to 0x1B904E24 ==15455== TRANSLATE: 0xAC3D50 redirected to 0x1B905274 ==15455== TRANSLATE: 0xA752D0 redirected to 0x1B91EB87 ==15455== TRANSLATE: 0xACA370 redirected to 0x1B9046F4 ==15455== Reading syms from /lib/libnss_files-2.3.4.so (0x1BA51000) ==15455== object doesn't have any debug info ==15455== TRANSLATE: 0xAC4670 redirected to 0x1B905326 ==15455== discard syms at 0x1BA51000-0x1BA5C000 in /lib/libnss_files-2.3.4.so due to munmap() ==15455== ==15455== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 22 from 2) --15455-- --15455-- supp: 2 _dl_relocate_object/dl_open_worker --15455-- supp: 20 dl_relocate_object/dl_main ==15455== malloc/free: in use at exit: 47114 bytes in 370 blocks. ==15455== malloc/free: 535 allocs, 165 frees, 58731 bytes allocated. ==15455== ==15455== searching for pointers to 370 not-freed blocks. ==15459== TRANSLATE: 0xAC9000 redirected to 0x1B9042D0 ==15455== checked 2396536 bytes. ==15455== ==15455== 8 bytes in 2 blocks are still reachable in loss record 1 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0xAF72C8: register_state (in /lib/tls/libc-2.3.4.so) ==15455== by 0xAF765A: create_cd_newstate (in /lib/tls/libc-2.3.4.so) ==15455== by 0xB004C5: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==15455== ==15455== ==15455== 8 bytes in 2 blocks are still reachable in loss record 2 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0xAF7439: create_cd_newstate (in /lib/tls/libc-2.3.4.so) ==15455== by 0xB004C5: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==15455== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==15455== ==15455== ==15455== 12 bytes in 1 blocks are still reachable in loss record 3 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0x1B9123A7: evt_ctx_tag_hook_add (evtctx.c:126) ==15455== by 0x1B91248B: evt_ctx_init (evtctx.c:151) ==15455== by 0x804C21F: msg_init (messages.c:123) ==15455== ==15455== ==15455== 16 bytes in 1 blocks are still reachable in loss record 4 of 19 ==15455== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==15455== by 0xB8D364: _dlerror_run (in /lib/libdl-2.3.4.so) ==15455== by 0xB8CE3B: dlsym (in /lib/libdl-2.3.4.so) ==15455== by 0x1B91ECA6: __errno_location (vg_libpthread.c:2127) ==15455== ==15455== ==15455== 56 bytes in 14 blocks are still reachable in loss record 5 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0xAF9D1A: calc_eclosure_iter (in /lib/tls/libc-2.3.4.so) ==15455== by 0xAFF83F: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==15455== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==15455== ==15455== ==15455== 56 bytes in 2 blocks are still reachable in loss record 6 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0xAFF59E: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==15455== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==15455== by 0x8051B1C: filter_re_compile (filter.c:266) ==15455== ==15455== ==15455== 92 bytes in 1 blocks are still reachable in loss record 7 of 19 ==15455== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==15455== by 0x1B912410: evt_ctx_init (evtctx.c:142) ==15455== by 0x804C21F: msg_init (messages.c:123) ==15455== by 0x804BA3E: main (main.c:389) ==15455== ==15455== ==15455== 104 bytes in 2 blocks are still reachable in loss record 8 of 19 ==15455== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==15455== by 0xAF73F8: create_cd_newstate (in /lib/tls/libc-2.3.4.so) ==15455== by 0xB004C5: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==15455== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==15455== ==15455== ==15455== 112 bytes in 2 blocks are still reachable in loss record 9 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0xAFEF10: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==15455== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==15455== by 0x8051B1C: filter_re_compile (filter.c:266) ==15455== ==15455== ==15455== 168 bytes in 2 blocks are still reachable in loss record 10 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0xAFF5F7: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==15455== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==15455== by 0x8051B1C: filter_re_compile (filter.c:266) ==15455== ==15455== ==15455== 168 bytes in 2 blocks are still reachable in loss record 11 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0xAFF5E3: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==15455== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==15455== by 0x8051B1C: filter_re_compile (filter.c:266) ==15455== ==15455== ==15455== 168 bytes in 2 blocks are still reachable in loss record 12 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0xAFF5CF: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==15455== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==15455== by 0x8051B1C: filter_re_compile (filter.c:266) ==15455== ==15455== ==15455== 288 bytes in 2 blocks are still reachable in loss record 14 of 19 ==15455== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==15455== by 0xAFEF3A: re_compile_internal (in /lib/tls/libc-2.3.4.so) ==15455== by 0xB012AB: regcomp (in /lib/tls/libc-2.3.4.so) ==15455== by 0x8051B1C: filter_re_compile (filter.c:266) ==15455== ==15455== ==15455== 512 bytes in 2 blocks are still reachable in loss record 15 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0xB0123F: regcomp (in /lib/tls/libc-2.3.4.so) ==15455== by 0x8051B1C: filter_re_compile (filter.c:266) ==15455== by 0x8051D81: filter_host_new (filter.c:345) ==15455== ==15455== ==15455== 3608 bytes in 120 blocks are still reachable in loss record 16 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0x1B905373: realloc (vg_replace_malloc.c:189) ==15455== by 0x12AC4B: g_realloc (in /usr/lib/libglib-2.0.so.0.400.7) ==15455== by 0x13C55B: (within /usr/lib/libglib-2.0.so.0.400.7) ==15455== ==15455== ==15455== 4780 bytes in 118 blocks are still reachable in loss record 17 of 19 ==15455== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==15455== by 0x12ABDF: g_malloc0 (in /usr/lib/libglib-2.0.so.0.400.7) ==15455== by 0x804C9F6: cfg_new (cfg.c:231) ==15455== by 0x804BA53: main (main.c:392) ==15455== ==15455== ==15455== 16438 bytes in 3 blocks are still reachable in loss record 18 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0x804E8C6: yyalloc (cfg-lex.c:1958) ==15455== by 0x804E537: yyensure_buffer_stack (cfg-lex.c:1693) ==15455== by 0x804DFAC: yyrestart (cfg-lex.c:1467) ==15455== ==15455== ==15455== 20320 bytes in 91 blocks are still reachable in loss record 19 of 19 ==15455== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15455== by 0x12AB72: g_malloc (in /usr/lib/libglib-2.0.so.0.400.7) ==15455== by 0x12B6D6: g_mem_chunk_new (in /usr/lib/libglib-2.0.so.0.400.7) ==15455== by 0x130DD7: g_queue_new (in /usr/lib/libglib-2.0.so.0.400.7) ==15455== ==15455== LEAK SUMMARY: ==15455== definitely lost: 0 bytes in 0 blocks. ==15455== possibly lost: 0 bytes in 0 blocks. ==15455== still reachable: 46914 bytes in 369 blocks. ==15455== suppressed: 200 bytes in 1 blocks. --15455-- TT/TC: 0 tc sectors discarded. --15455-- 6718 tt_fast misses. --15455-- translate: new 6280 (108519 -> 1438685; ratio 132:10) --15455-- discard 124 (1626 -> 21552; ratio 132:10). --15455-- chainings: 4327 chainings, 3 unchainings. --15455-- dispatch: 150000 jumps (bb entries); of them 33013 (22%) unchained. --15455-- 186/7935 major/minor sched events. --15455-- reg-alloc: 1249 t-req-spill, 266791+8325 orig+spill uis, --15455-- 32960 total-reg-rank --15455-- sanity: 98 cheap, 4 expensive checks. --15455-- ccalls: 27165 C calls, 55% saves+restores avoided (89350 bytes) --15455-- 36017 args, avg 0.87 setup instrs each (8714 bytes) --15455-- 0% clear the stack (81126 bytes) --15455-- 10761 retvals, 32% of reg-reg movs avoided (6756 bytes) ==15459== Reading syms from /lib/libnss_dns-2.3.4.so (0x1BA49000) ==15459== object doesn't have any debug info ==15459== Reading syms from /lib/libresolv-2.3.4.so (0xC21000) ==15459== object doesn't have any debug info ==15459== TRANSLATE: 0xB37F10 redirected to 0x1B91EE2A ==15459== TRANSLATE: 0xB3C050 redirected to 0x1B91ED13 ==15459== discard syms at 0x1BA51000-0x1BA5C000 in /lib/libnss_files-2.3.4.so due to munmap() ==15459== discard syms at 0x1BA49000-0x1BA4F000 in /lib/libnss_dns-2.3.4.so due to munmap() ==15459== discard syms at 0xC21000-0xC34000 in /lib/libresolv-2.3.4.so due to munmap() ==15459== ==15459== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 25 from 2) --15459-- --15459-- supp: 5 _dl_relocate_object/dl_open_worker --15459-- supp: 20 dl_relocate_object/dl_main ==15459== malloc/free: in use at exit: 780924 bytes in 20868 blocks. ==15459== malloc/free: 5144214 allocs, 5123346 frees, 119383338 bytes allocated. ==15459== ==15459== searching for pointers to 20868 not-freed blocks. ==15459== checked 3118956 bytes. ==15459== ==15459== 16 bytes in 1 blocks are still reachable in loss record 1 of 9 ==15459== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==15459== by 0xB8D364: _dlerror_run (in /lib/libdl-2.3.4.so) ==15459== by 0xB8CE3B: dlsym (in /lib/libdl-2.3.4.so) ==15459== by 0x1B91ECA6: __errno_location (vg_libpthread.c:2127) ==15459== ==15459== ==15459== 224 bytes in 7 blocks are possibly lost in loss record 3 of 9 ==15459== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==15459== by 0x12ABDF: g_malloc0 (in /usr/lib/libglib-2.0.so.0.400.7) ==15459== by 0x805A5E7: g_sockaddr_inet_new2 (gsockaddr.c:378) ==15459== by 0x805A3E2: g_sockaddr_new (gsockaddr.c:188) ==15459== ==15459== ==15459== 13956 bytes in 201 blocks are still reachable in loss record 4 of 9 ==15459== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==15459== by 0x12ABDF: g_malloc0 (in /usr/lib/libglib-2.0.so.0.400.7) ==15459== by 0x8056BDB: affile_dd_new (affile.c:584) ==15459== by 0x804FCAF: yyparse (cfg-grammar.y:478) ==15459== ==15459== ==15459== 14848 bytes in 70 blocks are still reachable in loss record 5 of 9 ==15459== at 0x1B9053EE: realloc (vg_replace_malloc.c:197) ==15459== by 0x12AC4B: g_realloc (in /usr/lib/libglib-2.0.so.0.400.7) ==15459== by 0x13C55B: (within /usr/lib/libglib-2.0.so.0.400.7) ==15459== by 0x13CACD: g_string_insert_len (in /usr/lib/libglib-2.0.so.0.400.7) ==15459== ==15459== ==15459== 16438 bytes in 3 blocks are still reachable in loss record 6 of 9 ==15459== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15459== by 0x804E8C6: yyalloc (cfg-lex.c:1958) ==15459== by 0x804E537: yyensure_buffer_stack (cfg-lex.c:1693) ==15459== by 0x804DFAC: yyrestart (cfg-lex.c:1467) ==15459== ==15459== ==15459== 21876 bytes in 403 blocks are still reachable in loss record 7 of 9 ==15459== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15459== by 0x1B905373: realloc (vg_replace_malloc.c:189) ==15459== by 0x12AC4B: g_realloc (in /usr/lib/libglib-2.0.so.0.400.7) ==15459== by 0x13C55B: (within /usr/lib/libglib-2.0.so.0.400.7) ==15459== ==15459== ==15459== 71654 bytes in 138 blocks are still reachable in loss record 8 of 9 ==15459== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==15459== by 0x12AB72: g_malloc (in /usr/lib/libglib-2.0.so.0.400.7) ==15459== by 0x12B6D6: g_mem_chunk_new (in /usr/lib/libglib-2.0.so.0.400.7) ==15459== by 0x130DD7: g_queue_new (in /usr/lib/libglib-2.0.so.0.400.7) ==15459== ==15459== ==15459== 641712 bytes in 20044 blocks are definitely lost in loss record 9 of 9 ==15459== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==15459== by 0x12ABDF: g_malloc0 (in /usr/lib/libglib-2.0.so.0.400.7) ==15459== by 0x805A5E7: g_sockaddr_inet_new2 (gsockaddr.c:378) ==15459== by 0x805A3E2: g_sockaddr_new (gsockaddr.c:188) ==15459== ==15459== LEAK SUMMARY: ==15459== definitely lost: 641712 bytes in 20044 blocks. ==15459== possibly lost: 224 bytes in 7 blocks. ==15459== still reachable: 138788 bytes in 816 blocks. ==15459== suppressed: 200 bytes in 1 blocks. --15459-- TT/TC: 0 tc sectors discarded. --15459-- 837986 tt_fast misses. --15459-- translate: new 10227 (172436 -> 2329564; ratio 135:10) --15459-- discard 686 (11202 -> 143164; ratio 127:10). --15459-- chainings: 7861 chainings, 3 unchainings. --15459-- dispatch: 600000 jumps (bb entries); of them 140194964 (23365%) unchained. --15459-- 498074/12754935 major/minor sched events. --15459-- reg-alloc: 1928 t-req-spill, 431251+13266 orig+spill uis, --15459-- 53090 total-reg-rank --15459-- sanity: 265389 cheap, 10616 expensive checks. --15459-- ccalls: 44952 C calls, 56% saves+restores avoided (149946 bytes) --15459-- 59179 args, avg 0.88 setup instrs each (13872 bytes) --15459-- 0% clear the stack (134349 bytes) --15459-- 17732 retvals, 33% of reg-reg movs avoided (11472 bytes) This is w/ eventlog-0.2.5 and syslog-ng-2.0rc1+20060807. Let me know if you need additional info. I could not reproduce the leak so far locally, although I fixed some one-off allocation leaks but that should only affect reloads and not simply running the process. I suspect this is strict production environment, but I ask anyway, can you run something like valgrind on the syslog-ng process? Another idea is to use the built-in leak finder in syslog-ng, it is not as intrusive but might still help. If neither of these is possible, I could still use a core file dumped when syslog-ng is large in size. (I'd need debugging symbols on the syslog-ng executable as well) There must be some kind of usage pattern that I miss here, but without that I cannot fix the problem. -- Bazsi The information transmitted (including attachments) is covered by the Electronic Communications Privacy Act, 18 U.S.C. 2510-2521, is intended only for the person(s) or entity/entities to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient(s) is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

2 2

Case Insensitive Match?
by Hari Sekhon 08 Aug '06

08 Aug '06

Is there a way I can do a case insensitive match in syslog-ng? Every place I've seen from grep to python to perl has their own way of doing the case insensitive flag. So how do I set the case-insensitive match flag in syslog-ng? Hari

3 3

$MSG parsing question
by Hubert Lang 08 Aug '06

08 Aug '06

Hello, i have a few questions about the message parser, basically i want to parse/split up the MESSAGE field itself and write the splitted up message in a mysql database, i cant find any documents about how this can be done, do i need an external parser (perl or whatever) or can this be done within syslog-ng.conf? right now i just can write the whole message to the mysqldb syslog-ng.conf template("INSERT INTO logs (host, facility, priority, level, tag, date,time, program, msg) VALUES ( '$HOST', '$FACILITY','$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); so it gets written to the database in this way: INSERT INTO logs (host, facility, priority, level, tag, date,time, program, msg) VALUES ( '10.44.10.253', 'local4','notice', 'notice', 'a5', '2006-06-29', '14:39:46', 'NS25', 'NS25: NetScreen device_id=NS25 [Root]system-notification-00257(traffic): start_time=\"2006-06-29 14:38:38\" duration=0 policy_id=95 service=http proto=6 src zone=Untrust dst zone=Untrust action=Deny sent=0 rcvd=0 src=10.10.10.225 dst=208.174.52.61 src_port=2042 dst_port=80 session_id=0' ); now i want to split up the message part itself system-notification traffic, insert the start_time/duration/policy_id/service/proto/src-zone etc etc in a different table this perl script http://www.optekconsulting.com/tools/nstf.pl has every field i need, Any Help is really welcome Cheers Hubert -- Die e-Mail-Boxes von Brennercom sind Virus-gesichert und Spam-gefiltert. Le caselle e-Mail di Brennercom sono protette da sistemi antivirus e antispam. http://www.brennercom.it

5 5

Syslog-ng again
by Brian Loe 08 Aug '06

08 Aug '06

I robbed the HP-UX configuration file and have tried it on my AIX box. If the last line isn't commented out, it logs nothing. With it commented, netmessages acts as expect but either way no other files are created, nothing else is logged. Configuration file follows: /etc/syslog-ng/syslog-ng.conf options { sync (0); time_reopen (10); chain_hostnames (no); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-dgram("/dev/log"); internal(); }; source s_udp { udp(ip("0.0.0.0") port(514)); }; source s_udp_s { udp(ip("0.0.0.0") port(601)); }; source s_tcp { tcp(ip("0.0.0.0") port(601)); }; destination d_cons { file("/data/logs/console"); }; destination d_mesg { file("/data/logs/syslog.log"); }; destination d_mail { file("/data/logs/mail.log"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; destination netmessages { file("/data/logs/netmessages.log" perm(0660)); }; destination net_pipe { pipe("/data/pipes/net_pipe" perm(0660)); }; filter f_filter1 { facility(mail) and level(debug); }; filter f_filter2 { (facility(mail) and level(debug)) or level(info); }; filter f_filter3 { level(alert); }; filter f_filter4 { level(emerg); }; log { source(s_sys); filter(f_filter1); destination(d_mail); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_cons); destination(d_mlrt); }; log { source(s_sys); filter(f_filter4); destination(d_mlal); }; log { source(s_udp); source (s_udp_s); source (s_tcp); destination(netmessages); }; # log { source(s_udp); source (s_udp_s); source (s_tcp); destination(net_pipe); }; arg-mailgate1.argushealth.com made the following annotations---------------------------------------------------------------------PRIVILEGED AND CONFIDENTIAL This email transmission contains privileged and confidential information intended only for the use of the individual or entity named above. If the reader of the email is not the intended recipient or the employee or agent responsible for delivering it to the intended recipient, you are hereby notified that any use, dissemination or copying of this email transmission is strictly prohibited by the sender. If you have received this transmission in error, please delete the email and immediately notify the sender via the email return address or mailto:postmaster@argushealth.com. Thank you. ---------------------------------------------------------------------

2 4

Fwd: Syslog-ng.conf
by Brian Loe 07 Aug '06

07 Aug '06

I'm still having issues with either my config or privileges on the files that are supposed to be created or something. The cron output file isn't getting created - perhaps because it isn't receiving anything? The other files are created (not the pipe - I'm assuming it can't create a pipe) but the localmessages file only gets the "syslog-ng has started" and nothing else is written. In other words, it appears to start, create the file, write one line to the file and then stops - the daemon keeps running, just nothing is getting written to the files... AIX 5.3 - and if anyone has opinions on the best way to launch syslog-ng in AIX, I'll read it as well! # # Global options. # options { long_hostnames(off); use_dns(no); chain_hostnames(no); sync(0); perm(0640); stats(3600); }; # # 'src' is our main source definition. you can add # more sources driver definitions to it, or define # your own sources, i.e.: # #source my_src { .... }; # source s_local { internal(); unix-dgram("/dev/log"); }; source s_udp { udp(ip("0.0.0.0") port(514)); }; # # Filter definitions # filter f_cron { facility(cron); }; # filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7) and not filter(f_cron); }; # # filter f_messages { not facility(news, mail); }; # filter f_warn { level(warn, err, crit); }; # filter f_alert { level(alert); }; # # Cron-messages in one file: # destination cron { file("/data/logs/cron"); }; log { source(s_local); filter(f_cron); destination(cron); }; # # local[1-7]: # destination localmessages { file("/data/logs/localmessages"); }; log { source(s_local); destination(localmessages); }; # # Network messages: # destination netmessages { file("/data/logs/netmessages"); }; log { source(s_udp); destination(netmessages); }; # # Network message pipe: # destination net_pipe { pipe("/data/pipes/net_pipe"); }; log { source(s_udp); destination(net_pipe); };

1 0

syslog-ng doesn't log messages
by Fernando Loureiro 07 Aug '06

07 Aug '06

I think everything is ok with my conf but it isn't working with some applications such as openldap, apcupsd. Can somebody help me? Here is a part of my conf. []s -- Fernando ------------------------------ options { chain_hostnames(off); sync(0); use_dns(no); create_dirs(yes); }; source kernsrc { file("/proc/kmsg"); internal(); }; destination openldap { file("/var/log/openldap.log"); }; destination apcupsd { file("/var/log/apcupsd.log"); }; filter f_openldap { program(slapd); }; filter f_apcupsd { program(apcupsd); }; log { source(kernsrc); filter(f_openldap); destination(openldap); }; log { source(kernsrc); filter(f_apcupsd); destination(apcupsd); };

2 1

syslog-ng 2.0rc1 memory usage
by Martin, David M 04 Aug '06

04 Aug '06

Anyone running 2.0rc1 on Solaris 9 (sparc)? If so, what memory requirements are you seeing for the syslog-ng process? My install handles ~ 700 messages/sec (all UDP) and over the course of a day syslog-ng will gradually consume nearly all available free memory (I've seen it up to 1GB). (syslog-ng is bounced by logrotate daily, so the process repeats itself) I was able to substantially decrease the rate of consumption by adding the 'flush_lines" global (syslog-ng process now at 91MB and growing ... slowly). I installed 2.0rc1 on one server, kept another at 1.6.8 (roughly 500 messages/sec load). The syslog-ng process there is stable at 3 MB. Here's the config from the 2.0rc1 server: options { log_fifo_size(8192); flush_lines(4096); long_hostnames(off); use_dns(yes); use_fqdn(no); create_dirs(no); }; source network { udp(); }; filter f_messages { level(info..warn) and not facility(auth); }; destination messages { file("/var/log/messages"); }; log { source(network); filter(f_messages); destination(messages); }; syslog-ng 1.6.8 config identical except for options section: options { use_fqdn(no); keep_hostname(no); use_dns(yes); long_hostnames(off); sync(0); log_fifo_size(1000); }; The information transmitted (including attachments) is covered by the Electronic Communications Privacy Act, 18 U.S.C. 2510-2521, is intended only for the person(s) or entity/entities to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient(s) is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

2 2

Compilation problem with Syslog-ng-2.0rc1 in Solaris9
by Bruno Maimoni 04 Aug '06

04 Aug '06

Hello there, I'm having problems to compile the new syslog-ng version in a Solaris9 os. bash-2.05# uname -a SunOS <something> 5.9 Generic_117171-05 sun4u sparc SUNW,Ultra-5_10 gcc version: 3.3.2 I run ./configure without problems: export PKG_CONFIG_PATH=/opt/eventlog-0.2.5/lib/pkgconfig ./configure --prefix=/opt/syslog-ng-2.0rc1 --enable-dynamic-linking Then when i run make: [...] if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/opt/eventlog-0.2.5/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT fdread.o -MD -MP -MF ".deps/fdread.Tpo" \ -c -o fdread.o `test -f 'fdread.c' || echo './'`fdread.c; \ then mv -f ".deps/fdread.Tpo" ".deps/fdread.Po"; \ else rm -f ".deps/fdread.Tpo"; exit 1; \ fi if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/opt/eventlog-0.2.5/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT memtrace.o -MD -MP -MF ".deps/memtrace.Tpo" \ -c -o memtrace.o `test -f 'memtrace.c' || echo './'`memtrace.c; \ then mv -f ".deps/memtrace.Tpo" ".deps/memtrace.Po"; \ else rm -f ".deps/memtrace.Tpo"; exit 1; \ fi rm -f libsyslog-ng.a ar cru libsyslog-ng.a misc.o utils.o messages.o syslog-names.o cfg.o cfg-lex.o cfg-grammar.o macros.o filter.o logmsg.o logpipe.o logsource.o driver.o sgroup.o dgroup.o center.o templates.o logreader.o logwriter.o affile.o afstreams.o afuser.o afprog.o afsocket.o afunix.o afinet.o afinter.o children.o stats.o gsockaddr.o fdwrite.o fdread.o memtrace.o ranlib libsyslog-ng.a if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/opt/eventlog-0.2.5/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo './'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lpthread -lnsl -lrt -lsocket -ldoor -lfl -lglib-2.0 -L/opt/eventlog-0.2.5/lib -levtlog Undefined first referenced symbol in file G_UNLIKELY libsyslog-ng.a(filter.o) G_LIKELY libsyslog-ng.a(filter.o) ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/tmp/teste/syslog-ng-2.0rc1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/tmp/teste/syslog-ng-2.0rc1' make: *** [all] Error 2 bash-2.05# Does anyone knows what's missing? Tks in advance -- [ ],s Bruno Maimoni

1 0