- syslog-ng - lists.balabit.hu

Testing log paths
by Ryan Owen 19 Jun '06

19 Jun '06

I'm looking for a way to test a syslog-ng configuration to see if a given message (generated by the local machine) will be logged. This is for automated policy compliance measurement. For example, I need a program or script to be able to tell me if all authpriv messages with priority debug or higher are logged somewhere. With the old syslog stuff, the config file was easy enough to parse that a program could fairly easily determine this. Syslog-ng's extremely flexible configuration mechanism is somewhat more difficult, though. My current thinking is to take the lex/yacc grammar from the source and use it to write a program that could accept a message and return where it would be logged, if at all. This is still a pretty complex task, though, so I was hoping that perhaps there would be a simpler way. I'm not allowed to generate bogus log entries, or else I'd try spoofing a message of whatever facility/priority/etc that I needed to test for. Does anyone know of a better way to accomplish this? Thanks in advance for the help! -Ryan

3 3

Mac OS X 10.4 start config file
by Jacco Rens 19 Jun '06

19 Jun '06

Hi List members, I Just installed syslog-ng on a Mac OS X 10.4.6 machine trough darwinports, but I'm having trouble with the initial config. With the config I have now, syslog-ng uses 100% cpu time, for unknown reasons to me yet. syslog-ng 1.6.8 What I have now in the config, comes from here: http://sial.org/howto/ logging/syslog-ng/ options { dir_perm(0755); perm(0644); create_dirs(yes); use_fqdn(yes); log_fifo_size(4096); stats(3600); }; source local { unix-dgram("/var/run/syslog"); udp(ip(127.0.0.1) port(514)); internal(); }; source s_kernel { file("/dev/klog" log_prefix("kernel: ")); }; destination everything { file("/var/log/archive/$R_YEAR/$R_MONTH/$R_YEAR-$R_MONTH-$R_DAY" template("$ISODATE <$FACILITY.$PRIORITY> $HOST $MSG\n") template_escape(no) ); }; log { source(local); source(s_kernel); destination(everything); }; filter emerg { level(emerg); }; destination users { usertty("*"); }; log { source(local); filter(emerg); destination(users); }; What I basicly want, is the same as syslogd uses on an default Mac OS X install, and from there I'll try to set it more like I need. Thanks for your time.. - jacco

2 1

RE: [syslog-ng] logging statistics
by SOLIS, ALEX 19 Jun '06

19 Jun '06

This is probably a dumb and out of place question but I would really like to be sure. How do you pronounce Bazsi's name. Is it Ba-zee, Ba-see, or Baz-eye? Or am I completely off. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Sandor Geller Sent: Monday, June 19, 2006 10:40 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] logging statistics Wolfram Schlich wrote: >> This behaviour is going to be changed in the future, there was a >> discussion about the possible solutions already. The current proposal is >> to create a separate logfile which will be simply appended, so the >> statistic information (and maybe other internal messages) won't be >> handled as the other logs. > > Can you point me at the corresponding message(s)? > A URL from http://news.gmane.org/gmane.comp.syslog-ng would be nice :-) There aren't written messages. The conversion took place between Bazsi and myself and the decision is up to Bazsi as he is the syslog-ng developer. I'm sure that he will make his comments about this topic when he returns from vacation. -- Sandor Geller wildy(a)balabit.hu _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

RE: [syslog-ng] Losing TAG information
by SOLIS, ALEX 19 Jun '06

19 Jun '06

Thank you for your reply Evan. So, if you attempt what I did in bullet two in the previous post below do you get different results? If you do, then maybe I should consider upgrading my version of syslog-ng. Thanks again. Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel Sent: Monday, June 19, 2006 10:38 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Losing TAG information All I can really add is that we have a mix ov AIX 4.3.3 through 5.3 that are logging to a linux syslog-ng 1.6.8 machine and we are not experiencing the symptoms that you describe. I have a couple of applications where the tag ends up being "syslog" when it should be something else, but that is quite a bit different than removing it entirely. Evan. SOLIS, ALEX wrote: > I appreciate your sympathy but it does not help me with my TAG problem. > :) > > Anyone else have any idea how to stop syslog-ng from purging the TAG > information from an AIX syslogd message. I have successfully sniffed > syslog traffic between the AIX servers and my LOGHOST. The TAG (Process > Name info) is definitely intact on the wire. This confirms that > syslog-ng is simply parsing the log message and removing the TAG info. > > I did some more tests on the Linux LOGHOST using the logger utility and > I found that syslog-ng does not like spaces after the TAG information. > For example: > > 1) Logger -p syslog.info -t "TEST_TAG" "TEST_MESSAGE" > > Generates the log: > > Jun 19 08:42:38 loghost TEST_TAG: TEST_MESSAGE > > > 2) Logger -p syslog.info -t "TEST_TAG " "TEST_MESSAGE" > > Generates the log: > > Jun 19 08:44:08 loghost : TEST_MESSAGE > > Example two lost the TAG information because of the space after > TEST_TAG. I have considered the possibility that the messages being > sent from the AIX box do not conform to syslog formatting standards and > therefore syslog-ng discards the field. But I would like to know if > there is anything that can be done to stop this behavior. > > Thanks for all responses, even sympathetic ones. :) > > Alex > > > -----Original Message----- > From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Tuesday, June 13, 2006 9:09 PM > To: SOLIS, ALEX > Subject: Re: [syslog-ng] Losing TAG information > > On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said: > > (off-list reply) > >> I have about 20 or so AIX 4.3 servers that are sending syslog messages >> to a Linux desktop running syslog-ng 1.6.5. > > You have my condolences. IBM dropped support for even AIX 4.3.3 several > years ago - hopefully you're not having problems keeping the software > running and secure... > -----Original Message----- > From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > Sent: Tuesday, June 13, 2006 9:09 PM > To: SOLIS, ALEX > Subject: Re: [syslog-ng] Losing TAG information > > On Tue, 13 Jun 2006 10:07:33 CDT, "SOLIS, ALEX" said: > > (off-list reply) > >> I have about 20 or so AIX 4.3 servers that are sending syslog messages >> to a Linux desktop running syslog-ng 1.6.5. > > You have my condolences. IBM dropped support for even AIX 4.3.3 several > years ago - hopefully you're not having problems keeping the software > running and secure... > > This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > -- Evan Rempel erempel(a)uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

logging statistics
by Heinemann, Joerg (SBI Ruhr) 19 Jun '06

19 Jun '06

Hi, we are plannig to migrate our syslog infrastructure to syslog-ng. Is there a possibility to generate a daily logging statistics like our old kiwi syslogger? Kiwi Syslog Daemon Statistics --------------------------------------------------- 24 hour period ending on: Sun, 11 Jun 2006 00:00:03 Syslog Daemon started on: Sat, 13 May 2006 22:03:13 Syslog Daemon uptime: 28 days, 1 hour, 56 minutes --------------------------------------------------- + Messages received - Total: 129600953 + Messages received - Last 24 hours: 2556443 + Messages received - Since Midnight: 2418503 + Messages received - Last hour: 92320 + Messages received - This hour: 76835 + Messages per hour - Average: 103317 + Messages forwarded: 0 + Messages logged to disk: 4836834 + Errors - Logging to disk: 0 + Errors - Invalid priority tag: 0 + Errors - No priority tag: 0 + Errors - Oversize message: 11 Mit freundlichem Gruß / Best Regards Jörg Heinemann Services for Business IT Ruhr GmbH Communication & Network Services Operation WAN / LAN Bruchstraße 5, 45883 Gelsenkirchen, Germany Jörg Heinemann Tel.: +49 209 9456-7790 Fax: +49 209 9456-67790 joerg.heinemann(a)sbi-ruhr.de <mailto:joerg.heinemann@sbi-ruhr.de> http://www.sbi-ruhr.de <http://www.sbi-ruhr.de> Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet. This e-mail may contain confidential and/or privileged Information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

3 4

mark_freq() wrong?!
by Wolfram Schlich 18 Jun '06

18 Jun '06

I am using this in syslog-ng.conf: options { mark_freq(300); stats_freq(600); } Strangely, the MARK lines appear every 10 minutes (600s) instead of 300s. Any ideas on that? -- Wolfram Schlich

1 0

RE: Syslog-ng not logging anything from Solaris host
by Shah, Maunir 18 Jun '06

18 Jun '06

telnet uses tcp, whereas syslogd uses udp by default, so the traffic might still be blocked by a firewall. Regarding your response for telnet, we had tcp and udp protocol enabled for syslog-ng when we tested to make sure firewall is not blocking it. But, since default solaris syslog uses udp I took out tcp to test and no logging whatsoever. When I run a snoop on syslog-ng server I don't even see any kind of packets coming in when I run logger -p on the test host. Does anyone know if my syslog.conf file on the test box is right or wrong? Maybe that's what is causing it to not send anything. Thanks Maunir Shah ________________________________ From: Shah, Maunir Sent: Friday, June 16, 2006 11:37 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: Syslog-ng not logging anything from Solaris host I'm running syslog-ng 1.6.11 on Solaris 10 zone, and so far I'm able to see logs being created locally but I'm not seeing any kind of logging from other Solaris host. For my syslog-ng server I made sure that I'm using udp and for source its door. I've two test servers running Solaris 8 and 10 that I'm testing from and have changed syslog.conf to reflect the changes and point all my logs to go to syslog-ng. It's not the firewall that is blocking it as we are able to telnet to port 514 and whatever you type in the cmd prompt it records it on the syslog-ng server. I know I'm missing something in the config file but not sure what I'm doing wrong. My syslog-ng.conf file source s_dgram { sun-streams ("/dev/log" door("/etc/.syslog_door")); }; source s_internal { internal(); }; #source s_kernel # { pipe("/proc/kmsg" log_prefix("kernel: ")); }; #source s_tcp # { tcp(ip(10.1.100.84)port(514) keep-alive(yes) max_connections(100)); }; source s_udp { udp(); }; Solaris 8 box syslog.conf file #ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */ # # Copyright (c) 1991-1998 by Sun Microsystems, Inc. # All rights reserved. # # syslog configuration file. # # This file is processed by m4 so be careful to quote (`') names # that match m4 reserved words. Also, within ifdef's, arguments # containing commas must be quoted. # *.* @loghost Maunir Shah 630-285-5875 - desk 630-550-6266 - cell ******************************* IMPORTANT MESSAGE ****************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. ********************************************************************************

2 1

RE: Syslog-ng not logging anything from Solaris host
by Shah, Maunir 16 Jun '06

16 Jun '06

I guess I wasn't patient enough to try on one of our production boxes that does generate messages. I see the messages coming in now. But thanks for all the help. Maunir Shah ________________________________ From: Shah, Maunir Sent: Friday, June 16, 2006 2:47 PM To: Shah, Maunir; 'syslog-ng(a)lists.balabit.hu' Subject: RE: Syslog-ng not logging anything from Solaris host telnet uses tcp, whereas syslogd uses udp by default, so the traffic might still be blocked by a firewall. Regarding your response for telnet, we had tcp and udp protocol enabled for syslog-ng when we tested to make sure firewall is not blocking it. But, since default solaris syslog uses udp I took out tcp to test and no logging whatsoever. When I run a snoop on syslog-ng server I don't even see any kind of packets coming in when I run logger -p on the test host. Does anyone know if my syslog.conf file on the test box is right or wrong? Maybe that's what is causing it to not send anything. Thanks Maunir Shah ________________________________ From: Shah, Maunir Sent: Friday, June 16, 2006 11:37 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: Syslog-ng not logging anything from Solaris host I'm running syslog-ng 1.6.11 on Solaris 10 zone, and so far I'm able to see logs being created locally but I'm not seeing any kind of logging from other Solaris host. For my syslog-ng server I made sure that I'm using udp and for source its door. I've two test servers running Solaris 8 and 10 that I'm testing from and have changed syslog.conf to reflect the changes and point all my logs to go to syslog-ng. It's not the firewall that is blocking it as we are able to telnet to port 514 and whatever you type in the cmd prompt it records it on the syslog-ng server. I know I'm missing something in the config file but not sure what I'm doing wrong. My syslog-ng.conf file source s_dgram { sun-streams ("/dev/log" door("/etc/.syslog_door")); }; source s_internal { internal(); }; #source s_kernel # { pipe("/proc/kmsg" log_prefix("kernel: ")); }; #source s_tcp # { tcp(ip(10.1.100.84)port(514) keep-alive(yes) max_connections(100)); }; source s_udp { udp(); }; Solaris 8 box syslog.conf file #ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */ # # Copyright (c) 1991-1998 by Sun Microsystems, Inc. # All rights reserved. # # syslog configuration file. # # This file is processed by m4 so be careful to quote (`') names # that match m4 reserved words. Also, within ifdef's, arguments # containing commas must be quoted. # *.* @loghost Maunir Shah 630-285-5875 - desk 630-550-6266 - cell ******************************* IMPORTANT MESSAGE ****************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. ********************************************************************************

1 0

Syslog-ng not logging anything from Solaris host
by Shah, Maunir 16 Jun '06

16 Jun '06

I'm running syslog-ng 1.6.11 on Solaris 10 zone, and so far I'm able to see logs being created locally but I'm not seeing any kind of logging from other Solaris host. For my syslog-ng server I made sure that I'm using udp and for source its door. I've two test servers running Solaris 8 and 10 that I'm testing from and have changed syslog.conf to reflect the changes and point all my logs to go to syslog-ng. It's not the firewall that is blocking it as we are able to telnet to port 514 and whatever you type in the cmd prompt it records it on the syslog-ng server. I know I'm missing something in the config file but not sure what I'm doing wrong. My syslog-ng.conf file source s_dgram { sun-streams ("/dev/log" door("/etc/.syslog_door")); }; source s_internal { internal(); }; #source s_kernel # { pipe("/proc/kmsg" log_prefix("kernel: ")); }; #source s_tcp # { tcp(ip(10.1.100.84)port(514) keep-alive(yes) max_connections(100)); }; source s_udp { udp(); }; Solaris 8 box syslog.conf file #ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */ # # Copyright (c) 1991-1998 by Sun Microsystems, Inc. # All rights reserved. # # syslog configuration file. # # This file is processed by m4 so be careful to quote (`') names # that match m4 reserved words. Also, within ifdef's, arguments # containing commas must be quoted. # *.* @loghost Maunir Shah 630-285-5875 - desk 630-550-6266 - cell ******************************* IMPORTANT MESSAGE ****************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. ********************************************************************************

3 2

Re: syslog-ng Digest, Vol 14, Issue 11
by wayne yu 16 Jun '06

16 Jun '06

Hi Alex: How can I configure the logdog to send e-mail, through logdog.conf? Can you show me an example? I configured logdog.conf file, but when I started with logdog.pl -d , and went back to look at logdog.conf, it was back to its original form. Thanks Wayne --- syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, > visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body > 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it > is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. RE: Re: syslog-ng Digest, Vol 14, Issue 9 > (SOLIS, ALEX) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 15 Jun 2006 08:44:42 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: RE: [syslog-ng] Re: syslog-ng Digest, Vol > 14, Issue 9 > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C7E9(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > Wyane, > > Of course logdog.pl works with syslog-ng. > > The config file example sent in the tarball is > generously commented. If > you need more help, let me know where in the > installation you are at and > what you want logdog to do and Ill try to help. > > Alex > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On > Behalf Of wayne yu > Sent: Wednesday, June 14, 2006 2:30 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Re: syslog-ng Digest, Vol 14, > Issue 9 > > Hi Alex: > The logdog works for the syslogd, does also > working > with syslog-ng? How do I configure it? > > Thanks > > Wayne Yu > > --- syslog-ng-request(a)lists.balabit.hu wrote: > > > Send syslog-ng mailing list submissions to > > syslog-ng(a)lists.balabit.hu > > > > To subscribe or unsubscribe via the World Wide > Web, > > visit > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > or, via email, send a message with subject or body > > 'help' to > > syslog-ng-request(a)lists.balabit.hu > > > > You can reach the person managing the list at > > syslog-ng-owner(a)lists.balabit.hu > > > > When replying, please edit your Subject line so it > > is more specific > > than "Re: Contents of syslog-ng digest..." > > > > > > Today's Topics: > > > > 1. Losing TAG information (SOLIS, ALEX) > > 2. how to send alert throuth e-mail with > > syslog-ng (wayne yu) > > 3. RE: how to send alert throuth e-mail with > > syslog-ng (SOLIS, ALEX) > > 4. Re: how to send alert throuth e-mail with > > syslog-ng (sawall) > > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Tue, 13 Jun 2006 10:07:33 -0500 > > From: "SOLIS, ALEX" <asolis(a)oppd.com> > > Subject: [syslog-ng] Losing TAG information > > To: "Syslog-ng users' and developers' mailing > list" > > <syslog-ng(a)lists.balabit.hu> > > Message-ID: > > > > > <3E061654BA925846A7FAFE98BA3603B71714C401(a)SEPEX04.oppd.oppd-ds.com> > > Content-Type: text/plain; charset="us-ascii" > > > > > > I have about 20 or so AIX 4.3 servers that are > > sending syslog messages > > to a Linux desktop running syslog-ng 1.6.5. Every > > now and then I get a > > message that does not contain the TAG information > or > > process ID > > information. When I check the local > > /var/adm/messages file on the AIX > > server, the TAG information is intact. > > > > An example of an intact message on an AIX server > is: > > > > Jun 13 09:57:11 myhost dbc4 : 3 TRANSACT > > > 0 0 > > 33686 57:11.60 > > > > > > An example of the same message on my syslog server > > after syslog-ng gets > > a hold of it: > > > > Jun 13 09:57:11 myhost : 3 TRANSACT 0 > > > 0 33686 > > 57:11.60 > > > > > > As you can see I am losing the dbc4, why? Could > it > > be because of the > > spaces after the dbc4 string? According to RFC > > 3164, a space should > > simply terminate the TAG field and begin the > content > > portion of the > > message. Am I misunderstanding how this works? > > > > > > Thanks > > > > > > Alex > > > > > > This e-mail contains Omaha Public Power District's > > confidential and proprietary information and is > for > > use only by the intended recipient. Unless > > explicitly stated otherwise, this e-mail is not a > > contract offer, amendment, nor acceptance. If you > > are not the intended recipient you are notified > that > > disclosing, copying, distributing or taking any > > action in reliance on the contents of this > > information is strictly prohibited. > > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Tue, 13 Jun 2006 12:19:46 -0700 (PDT) > > From: wayne yu <zwyu7319(a)yahoo.com> > > Subject: [syslog-ng] how to send alert throuth > > e-mail with syslog-ng > > To: syslog-ng(a)lists.balabit.hu > > Message-ID: > > > <20060613191946.39833.qmail(a)web35910.mail.mud.yahoo.com> > > Content-Type: text/plain; charset=iso-8859-1 > > > > Hi everyone: > > > > I like to thank those who helped me on the > > syslog-ng > > earlier, and my syslog-ng is finally working, > > except I don't know how to send alerts from system > > to > > my yahoo mail. Can any one give me some hints. > === message truncated === __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

RE: [syslog-ng] Re: syslog-ng Digest, Vol 14, Issue 9
by SOLIS, ALEX 15 Jun '06

15 Jun '06

Wyane, Of course logdog.pl works with syslog-ng. The config file example sent in the tarball is generously commented. If you need more help, let me know where in the installation you are at and what you want logdog to do and Ill try to help. Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of wayne yu Sent: Wednesday, June 14, 2006 2:30 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Re: syslog-ng Digest, Vol 14, Issue 9 Hi Alex: The logdog works for the syslogd, does also working with syslog-ng? How do I configure it? Thanks Wayne Yu --- syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, > visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body > 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it > is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Losing TAG information (SOLIS, ALEX) > 2. how to send alert throuth e-mail with > syslog-ng (wayne yu) > 3. RE: how to send alert throuth e-mail with > syslog-ng (SOLIS, ALEX) > 4. Re: how to send alert throuth e-mail with > syslog-ng (sawall) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 13 Jun 2006 10:07:33 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: [syslog-ng] Losing TAG information > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C401(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > > I have about 20 or so AIX 4.3 servers that are > sending syslog messages > to a Linux desktop running syslog-ng 1.6.5. Every > now and then I get a > message that does not contain the TAG information or > process ID > information. When I check the local > /var/adm/messages file on the AIX > server, the TAG information is intact. > > An example of an intact message on an AIX server is: > > Jun 13 09:57:11 myhost dbc4 : 3 TRANSACT > 0 0 > 33686 57:11.60 > > > An example of the same message on my syslog server > after syslog-ng gets > a hold of it: > > Jun 13 09:57:11 myhost : 3 TRANSACT 0 > 0 33686 > 57:11.60 > > > As you can see I am losing the dbc4, why? Could it > be because of the > spaces after the dbc4 string? According to RFC > 3164, a space should > simply terminate the TAG field and begin the content > portion of the > message. Am I misunderstanding how this works? > > > Thanks > > > Alex > > > This e-mail contains Omaha Public Power District's > confidential and proprietary information and is for > use only by the intended recipient. Unless > explicitly stated otherwise, this e-mail is not a > contract offer, amendment, nor acceptance. If you > are not the intended recipient you are notified that > disclosing, copying, distributing or taking any > action in reliance on the contents of this > information is strictly prohibited. > > > > ------------------------------ > > Message: 2 > Date: Tue, 13 Jun 2006 12:19:46 -0700 (PDT) > From: wayne yu <zwyu7319(a)yahoo.com> > Subject: [syslog-ng] how to send alert throuth > e-mail with syslog-ng > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <20060613191946.39833.qmail(a)web35910.mail.mud.yahoo.com> > Content-Type: text/plain; charset=iso-8859-1 > > Hi everyone: > > I like to thank those who helped me on the > syslog-ng > earlier, and my syslog-ng is finally working, > except I don't know how to send alerts from system > to > my yahoo mail. Can any one give me some hints. > > Thanks for the help. > > Wayne Yu > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > > > ------------------------------ > > Message: 3 > Date: Tue, 13 Jun 2006 14:53:28 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: RE: [syslog-ng] how to send alert throuth > e-mail with > syslog-ng > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C508(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > I use a perl script called logdog to alert on > specific syslog events. > You can find the script here: > http://caspian.dotconf.net/menu/Software/LogDog/ > > Works good for me, check it out. > > Alex > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On > Behalf Of wayne yu > Sent: Tuesday, June 13, 2006 2:20 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] how to send alert throuth > e-mail with syslog-ng > > Hi everyone: > > I like to thank those who helped me on the > syslog-ng > earlier, and my syslog-ng is finally working, > except I don't know how to send alerts from system > to > my yahoo mail. Can any one give me some hints. > > Thanks for the help. > > Wayne Yu > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > This e-mail contains Omaha Public Power District's > confidential and proprietary information and is for > use only by the intended recipient. Unless > explicitly stated otherwise, this e-mail is not a > contract offer, amendment, nor acceptance. If you > are not the intended recipient you are notified that > disclosing, copying, distributing or taking any > action in reliance on the contents of this > information is strictly prohibited. > > > > ------------------------------ > > === message truncated === __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Re: syslog-ng Digest, Vol 14, Issue 9
by wayne yu 14 Jun '06

14 Jun '06

Hi: I got Jun 13 22:30:58 bestball3 syslog-ng[17783]: STATS: dropped 0 in my in my log , I don't know what is mean. ALso, How could I set up a central log file, insteas i have to open 20 directory(name after node name) . Thanks for reply. Wayne Yu syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, > visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body > 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it > is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Losing TAG information (SOLIS, ALEX) > 2. how to send alert throuth e-mail with > syslog-ng (wayne yu) > 3. RE: how to send alert throuth e-mail with > syslog-ng (SOLIS, ALEX) > 4. Re: how to send alert throuth e-mail with > syslog-ng (sawall) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 13 Jun 2006 10:07:33 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: [syslog-ng] Losing TAG information > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C401(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > > I have about 20 or so AIX 4.3 servers that are > sending syslog messages > to a Linux desktop running syslog-ng 1.6.5. Every > now and then I get a > message that does not contain the TAG information or > process ID > information. When I check the local > /var/adm/messages file on the AIX > server, the TAG information is intact. > > An example of an intact message on an AIX server is: > > Jun 13 09:57:11 myhost dbc4 : 3 TRANSACT > 0 0 > 33686 57:11.60 > > > An example of the same message on my syslog server > after syslog-ng gets > a hold of it: > > Jun 13 09:57:11 myhost : 3 TRANSACT 0 > 0 33686 > 57:11.60 > > > As you can see I am losing the dbc4, why? Could it > be because of the > spaces after the dbc4 string? According to RFC > 3164, a space should > simply terminate the TAG field and begin the content > portion of the > message. Am I misunderstanding how this works? > > > Thanks > > > Alex > > > This e-mail contains Omaha Public Power District's > confidential and proprietary information and is for > use only by the intended recipient. Unless > explicitly stated otherwise, this e-mail is not a > contract offer, amendment, nor acceptance. If you > are not the intended recipient you are notified that > disclosing, copying, distributing or taking any > action in reliance on the contents of this > information is strictly prohibited. > > > > ------------------------------ > > Message: 2 > Date: Tue, 13 Jun 2006 12:19:46 -0700 (PDT) > From: wayne yu <zwyu7319(a)yahoo.com> > Subject: [syslog-ng] how to send alert throuth > e-mail with syslog-ng > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <20060613191946.39833.qmail(a)web35910.mail.mud.yahoo.com> > Content-Type: text/plain; charset=iso-8859-1 > > Hi everyone: > > I like to thank those who helped me on the > syslog-ng > earlier, and my syslog-ng is finally working, > except I don't know how to send alerts from system > to > my yahoo mail. Can any one give me some hints. > > Thanks for the help. > > Wayne Yu > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > > > ------------------------------ > > Message: 3 > Date: Tue, 13 Jun 2006 14:53:28 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: RE: [syslog-ng] how to send alert throuth > e-mail with > syslog-ng > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C508(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > I use a perl script called logdog to alert on > specific syslog events. > You can find the script here: > http://caspian.dotconf.net/menu/Software/LogDog/ > > Works good for me, check it out. > > Alex > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On > Behalf Of wayne yu > Sent: Tuesday, June 13, 2006 2:20 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] how to send alert throuth > e-mail with syslog-ng > > Hi everyone: > > I like to thank those who helped me on the > syslog-ng > earlier, and my syslog-ng is finally working, > except I don't know how to send alerts from system > to > my yahoo mail. Can any one give me some hints. > > Thanks for the help. > > Wayne Yu > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > This e-mail contains Omaha Public Power District's > confidential and proprietary information and is for > use only by the intended recipient. Unless > explicitly stated otherwise, this e-mail is not a > contract offer, amendment, nor acceptance. If you > are not the intended recipient you are notified that > disclosing, copying, distributing or taking any > action in reliance on the contents of this > information is strictly prohibited. > > > > ------------------------------ > > === message truncated === __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: syslog-ng Digest, Vol 14, Issue 9
by wayne yu 14 Jun '06

14 Jun '06

Hi Alex: The logdog works for the syslogd, does also working with syslog-ng? How do I configure it? Thanks Wayne Yu --- syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, > visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body > 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it > is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Losing TAG information (SOLIS, ALEX) > 2. how to send alert throuth e-mail with > syslog-ng (wayne yu) > 3. RE: how to send alert throuth e-mail with > syslog-ng (SOLIS, ALEX) > 4. Re: how to send alert throuth e-mail with > syslog-ng (sawall) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 13 Jun 2006 10:07:33 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: [syslog-ng] Losing TAG information > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C401(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > > I have about 20 or so AIX 4.3 servers that are > sending syslog messages > to a Linux desktop running syslog-ng 1.6.5. Every > now and then I get a > message that does not contain the TAG information or > process ID > information. When I check the local > /var/adm/messages file on the AIX > server, the TAG information is intact. > > An example of an intact message on an AIX server is: > > Jun 13 09:57:11 myhost dbc4 : 3 TRANSACT > 0 0 > 33686 57:11.60 > > > An example of the same message on my syslog server > after syslog-ng gets > a hold of it: > > Jun 13 09:57:11 myhost : 3 TRANSACT 0 > 0 33686 > 57:11.60 > > > As you can see I am losing the dbc4, why? Could it > be because of the > spaces after the dbc4 string? According to RFC > 3164, a space should > simply terminate the TAG field and begin the content > portion of the > message. Am I misunderstanding how this works? > > > Thanks > > > Alex > > > This e-mail contains Omaha Public Power District's > confidential and proprietary information and is for > use only by the intended recipient. Unless > explicitly stated otherwise, this e-mail is not a > contract offer, amendment, nor acceptance. If you > are not the intended recipient you are notified that > disclosing, copying, distributing or taking any > action in reliance on the contents of this > information is strictly prohibited. > > > > ------------------------------ > > Message: 2 > Date: Tue, 13 Jun 2006 12:19:46 -0700 (PDT) > From: wayne yu <zwyu7319(a)yahoo.com> > Subject: [syslog-ng] how to send alert throuth > e-mail with syslog-ng > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <20060613191946.39833.qmail(a)web35910.mail.mud.yahoo.com> > Content-Type: text/plain; charset=iso-8859-1 > > Hi everyone: > > I like to thank those who helped me on the > syslog-ng > earlier, and my syslog-ng is finally working, > except I don't know how to send alerts from system > to > my yahoo mail. Can any one give me some hints. > > Thanks for the help. > > Wayne Yu > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > > > ------------------------------ > > Message: 3 > Date: Tue, 13 Jun 2006 14:53:28 -0500 > From: "SOLIS, ALEX" <asolis(a)oppd.com> > Subject: RE: [syslog-ng] how to send alert throuth > e-mail with > syslog-ng > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > > <3E061654BA925846A7FAFE98BA3603B71714C508(a)SEPEX04.oppd.oppd-ds.com> > Content-Type: text/plain; charset="us-ascii" > > I use a perl script called logdog to alert on > specific syslog events. > You can find the script here: > http://caspian.dotconf.net/menu/Software/LogDog/ > > Works good for me, check it out. > > Alex > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On > Behalf Of wayne yu > Sent: Tuesday, June 13, 2006 2:20 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] how to send alert throuth > e-mail with syslog-ng > > Hi everyone: > > I like to thank those who helped me on the > syslog-ng > earlier, and my syslog-ng is finally working, > except I don't know how to send alerts from system > to > my yahoo mail. Can any one give me some hints. > > Thanks for the help. > > Wayne Yu > > __________________________________________________ > Do You Yahoo!? > Tired of spam? Yahoo! Mail has the best spam > protection around > http://mail.yahoo.com > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > This e-mail contains Omaha Public Power District's > confidential and proprietary information and is for > use only by the intended recipient. Unless > explicitly stated otherwise, this e-mail is not a > contract offer, amendment, nor acceptance. If you > are not the intended recipient you are notified that > disclosing, copying, distributing or taking any > action in reliance on the contents of this > information is strictly prohibited. > > > > ------------------------------ > > === message truncated === __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

RE: [syslog-ng] how to send alert throuth e-mail with syslog-ng
by SOLIS, ALEX 13 Jun '06

13 Jun '06

I use a perl script called logdog to alert on specific syslog events. You can find the script here: http://caspian.dotconf.net/menu/Software/LogDog/ Works good for me, check it out. Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of wayne yu Sent: Tuesday, June 13, 2006 2:20 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] how to send alert throuth e-mail with syslog-ng Hi everyone: I like to thank those who helped me on the syslog-ng earlier, and my syslog-ng is finally working, except I don't know how to send alerts from system to my yahoo mail. Can any one give me some hints. Thanks for the help. Wayne Yu __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

how to send alert throuth e-mail with syslog-ng
by wayne yu 13 Jun '06

13 Jun '06

Hi everyone: I like to thank those who helped me on the syslog-ng earlier, and my syslog-ng is finally working, except I don't know how to send alerts from system to my yahoo mail. Can any one give me some hints. Thanks for the help. Wayne Yu __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Losing TAG information
by SOLIS, ALEX 13 Jun '06

13 Jun '06

I have about 20 or so AIX 4.3 servers that are sending syslog messages to a Linux desktop running syslog-ng 1.6.5. Every now and then I get a message that does not contain the TAG information or process ID information. When I check the local /var/adm/messages file on the AIX server, the TAG information is intact. An example of an intact message on an AIX server is: Jun 13 09:57:11 myhost dbc4 : 3 TRANSACT 0 0 33686 57:11.60 An example of the same message on my syslog server after syslog-ng gets a hold of it: Jun 13 09:57:11 myhost : 3 TRANSACT 0 0 33686 57:11.60 As you can see I am losing the dbc4, why? Could it be because of the spaces after the dbc4 string? According to RFC 3164, a space should simply terminate the TAG field and begin the content portion of the message. Am I misunderstanding how this works? Thanks Alex This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

max-connections or max_connections
by Mike Jonkmans 12 Jun '06

12 Jun '06

I have noticed that 'max_connections' gets accepted by syslog-ng. But it is not working as intended. It should have a minus instead of an underscore. As it is easily overlooked, i think this is something the code should either accept or complain about. Regards, Mike Jonkmans News-Service Europe (http://www.news-service.com)

2 2

syslog-ng 1.9.11 vs RHE
by David Royer 12 Jun '06

12 Jun '06

Hi, I recently compiled syslog-ng 1.9.11, properly linked and compiled eventlog-0.2.4 and the process seems stable / properly working. Although I have seen a very weird behaviour, maybe I'm just missing something obvious (well hopefully in fact). The configuration line: filter f_filter2 { level(debug,info,notice,warning,err,crit,alert,emerg); }; works very fine, f_filter2 is used here to filter the /var/log/messages. All levels are being properly logged in the file. The configuration line: filter f_filter2 { level(debug..emerg); }; just doesn't work. I hope it's only a syntax issue, hopefully some of you encountered the problem already. Using logger I was able to test which level was logged using that config line and only these levels properly log: debug, emerg. Nothing in between. Is the (..) syntax still supported in syslog-ng 1.9+ ? Thanks in advance, -David

2 1

messages > log_msg_size result in weird behaviour
by Seb Boving 09 Jun '06

09 Jun '06

Hi, I've been troubleshooting a weird behaviour of syslog-ng (tried 1.6.4, 1.6.8 and 1.6.11) when the message is larger than the log_msg_size() (before i had actually noticed that fact). Basically, the problem can be reduced to: ---------- config: options { log_msg_size(50); }; source src { unix-stream("/dev/log"); internal(); }; destination d1 { file("/tmp/d1"); }; destination d2 { file("/tmp/d2"); }; filter f1 { facility(user) and level(warn..emerg); }; filter f2 { facility(user) and level(info..emerg); }; log { source(src); filter(f1); destination(d1); }; log { source(src); filter(f2); destination(d2); }; ----- # log a message > log_msg_size to syslog echo '1234567890123456789012345678901234567890123456789012345678901234567890' | logger -p user.err ------ /tmp/d1 logs: Jun 8 16:46:16 src@seb1 logger: 1234567890123456789012 ----- while /tmp/d2 logs: Jun 8 16:46:16 src@seb1 logger: 1234567890123456789012 Jun 8 16:46:16 src@seb1 345678901234567890123456789012345678901234567890 change f1's "warn" to info or lower and it starts showing the full message as well. change f2's "info" to warn or higher and it stops showing the full message as well. The original problem involves messages with newline, in which case the f1 filter only seems shows the first line, but that is probably irrelevant. I assume that despite the message being larger than the max allowed size, this shouldn't happen, or did i miss anything? thanks. -seb.

1 0

RE: Syslog-ng-1.9.11 for Solaris 10
by Shah, Maunir 07 Jun '06

07 Jun '06

Sorry had to repost it again, as I wasn't registered. Thanks Maunir Shah 630-285-5875 - desk 630-550-6266 - cell ________________________________ From: Shah, Maunir Sent: Wednesday, June 07, 2006 12:05 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Syslog-ng-1.9.11 for Solaris 10 We have a created a zone in Solaris 10 but I'm installing this software on the parent server or the global zone and I was able to compile libol-0.3.18 just fine. But I'm running into issues while I do a "make" for Syslog-ng-1.9.11 and attach is the error output, which I can't seem to find any solutions on the web. Any help would be appreciated.... ke-nms06:root:#make make all-recursive Making all in src if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT misc.o -MD -MP -MF ".deps/misc.Tpo" \ -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ else rm -f ".deps/misc.Tpo"; exit 1; \ fi if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT utils.o -MD -MP -MF ".deps/utils.Tpo" \ -c -o utils.o `test -f 'utils.c' || echo './'`utils.c; \ then mv -f ".deps/utils.Tpo" ".deps/utils.Po"; \ else rm -f ".deps/utils.Tpo"; exit 1; \ fi --------more successful output-------------- if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT afunix.o -MD -MP -MF ".deps/afunix.Tpo" \ -c -o afunix.o `test -f 'afunix.c' || echo './'`afunix.c; \ then mv -f ".deps/afunix.Tpo" ".deps/afunix.Po"; \ else rm -f ".deps/afunix.Tpo"; exit 1; \ fi if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT afinet.o -MD -MP -MF ".deps/afinet.Tpo" \ -c -o afinet.o `test -f 'afinet.c' || echo './'`afinet.c; \ then mv -f ".deps/afinet.Tpo" ".deps/afinet.Po"; \ else rm -f ".deps/afinet.Tpo"; exit 1; \ fi afinet.c: In function `afinet_resolve_name': afinet.c:81: warning: implicit declaration of function `memset' afinet.c: In function `afinet_setup_socket': afinet.c:156: error: `SOL_IP' undeclared (first use in this function) afinet.c:156: error: (Each undeclared identifier is reported only once afinet.c:156: error: for each function it appears in.) afinet.c:181: error: request for member `_S6_un' in something not a structure or union afinet.c:188: error: `SOL_IPV6' undeclared (first use in this function) *** Error code 1 make: Fatal error: Command failed for target `afinet.o' Current working directory /usr/dist/syslog-ng-1.9.11/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/dist/syslog-ng-1.9.11 *** Error code 1 make: Fatal error: Command failed for target `all' ke-nms06:root:# Maunir Shah 630-285-5875 - desk 630-550-6266 - cell ******************************* IMPORTANT MESSAGE ****************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. ********************************************************************************

2 1

RE: [syslog-ng] Solaris 8 Hangs
by Neill Flynn 07 Jun '06

07 Jun '06

offending server: source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; Syslog-ng server: source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_tcp { tcp(port(5140) max-connections(200)); }; source s_udp { udp(); }; -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 07 June 2006 10:19 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Solaris 8 Hangs On Wed, 2006-06-07 at 08:47 +0100, Neill Flynn wrote: > I have been running syslog-ng 1.6.6 in a Solaris/RH environment > (almost 70 syslog-ng clients). All works fine but for two Solaris 8 > machines which do not allow me to su from my own account, if I "su -", > the process hangs indefinitely. I can open a second connection and > kill part of the su process and gain access. When I switch off > syslog-ng and start syslog, all work fine. Also, both the local files > and the remote syslog-ng server log the su as it happens. can you paste your source statement (more specifically, do you have sun_door() configured?) -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

2 1

RE: [syslog-ng] memory leak?
by Cai Wang(CD) 07 Jun '06

07 Jun '06

How can I limit it if modify the src code manually? Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Cai Wang(CD) Sent: 2006年6月7日 17:35 To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] memory leak? Thanks I used 1.6.10 now, and the memory usage grows from 5800K bytes to 9800K bytes, and I have last the traffic for 2 hours. Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 2006年6月7日 17:32 To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] memory leak? On Wed, 2006-06-07 at 17:20 +0800, Cai Wang(CD) wrote: > But, I have tested the version 1.6.5, it can be reproduced. But does it grow without limit? 8.5MB does not really ring the alarm for a busy syslog-ng process. And as I said 1.6.7 included the last leak fix and 1.6.5 is certainly before that. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] memory leak?
by Cai Wang(CD) 07 Jun '06

07 Jun '06

Thanks I used 1.6.10 now, and the memory usage grows from 5800K bytes to 9800K bytes, and I have last the traffic for 2 hours. Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 2006年6月7日 17:32 To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] memory leak? On Wed, 2006-06-07 at 17:20 +0800, Cai Wang(CD) wrote: > But, I have tested the version 1.6.5, it can be reproduced. But does it grow without limit? 8.5MB does not really ring the alarm for a busy syslog-ng process. And as I said 1.6.7 included the last leak fix and 1.6.5 is certainly before that. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] memory leak?
by Cai Wang(CD) 07 Jun '06

07 Jun '06

But, I have tested the version 1.6.5, it can be reproduced. Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 2006年6月7日 17:19 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] memory leak? On Wed, 2006-06-07 at 15:41 +0800, Cai Wang(CD) wrote: > Hi > > I have installed the Syslog-NG 1.6.10 in Red Hat 9.0 > environment, but when I test it as the following situation: > > > > Message sender à RH9 (Syslog-NG) à Message receiver > > > > They worked in Giga bits networks, but when I send message to > receiver in 800M bps rate, the memory usage of Syslog-NG last to > increase > > When Syslog-NG started, it used 5800k bytes of memory, and it > used 8500k bytes after 1 hour. > > Could u give me some advice? It might be used for internal memory based buffers (controlled by log_fifo_size) I currently don't know about any memory leaks after 1.6.7 (which was related to spoof-source support) -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Solaris 8 Hangs
by Neill Flynn 07 Jun '06

07 Jun '06

I have been running syslog-ng 1.6.6 in a Solaris/RH environment (almost 70 syslog-ng clients). All works fine but for two Solaris 8 machines which do not allow me to su from my own account, if I "su -", the process hangs indefinitely. I can open a second connection and kill part of the su process and gain access. When I switch off syslog-ng and start syslog, all work fine. Also, both the local files and the remote syslog-ng server log the su as it happens. Anyone any ideas? Thanks, Neill ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

2 1