- syslog-ng - lists.balabit.hu

memory leak?
by Cai Wang(CD) 07 Jun '06

07 Jun '06

Hi I have installed the Syslog-NG 1.6.10 in Red Hat 9.0 environment, but when I test it as the following situation: Message sender --> RH9 (Syslog-NG) --> Message receiver They worked in Giga bits networks, but when I send message to receiver in 800M bps rate, the memory usage of Syslog-NG last to increase When Syslog-NG started, it used 5800k bytes of memory, and it used 8500k bytes after 1 hour. Could u give me some advice? Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com

2 1

RE: [syslog-ng] Starting syslog-ng as root
by Muath Al Khalaf 02 Jun '06

02 Jun '06

Thank you very much. I have disabled SELinux and every thing goes fine. Do you think it is better to run syslog-ng with or without SELinux especially that I may use MySQL and PHP-syslog-ng? Kind regards -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jose Pedro Oliveira Sent: Saturday, May 27, 2006 6:59 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Starting syslog-ng as root -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Muath Al Khalaf wrote: > Hi, > I am using Redhat Enterprise 4. I am using the official rpm image built > by Balabit for RHE 4 with their startup script. The executable did not > return anything (at least in front of me inside console). For strace I > do not know how to use it. You may be having problems with SELinux. In RHEL4, CentOS, and Fedora Core 3 you need to enable the use_syslogng SELinux boolean before starting the syslog-ng daemon [1]. To check the use_syslogng boolean status getsebool -a | grep syslogng To enable it (and saving its value) setsebool -P use_syslogng 1 jpo [1] - you need to have the a recent selinux-policy-targeted - -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFEeHc6l0metZG9hRsRAvqLAJ41iuwCrKNhFhyG2lWyv6Q2eScdzACgmoMD QzNXnXkc4tuHT0bbK5Fl5iw= =s/7p -----END PGP SIGNATURE-----

4 7

Solaris 10
by Walt Rich 01 Jun '06

01 Jun '06

Gents, I found some instructions on the net where Roberto Nibali had successfully installed syslog-ng on Solaris 10 (although I've not seen the email come from the mailing list) and have a couple of questions: What version of syslog-ng would be best to use? I've currently installed 1.6.11 and libol 0.3.18. Where do I find the file svc.method.syslog-ng? Step 4 of Roberto's instructions are to copy that file to /lib/svc/method/syslog-ng Where do I find the file svc.manifest.syslog-ng.xml as in Step 5 the instructions read to copy this to /var/svc/manifest/system/syslog-ng.xml. Any input regarding installing syslog-ng on solaris 1- would be most appreciated. Thanks!

1 0

1.9.11 compile failure on Solaris 2.6/7
by Albert Chin 01 Jun '06

01 Jun '06

Seems AF_INET6 is used unconditionally in src/cfg-grammar.y: source_afsocket : KW_UNIX_DGRAM '(' source_afunix_dgram_params ')' { $$ = $3; } | KW_UNIX_STREAM '(' source_afunix_stream_params ')' { $$ = $3; } | KW_UDP { last_addr_family = AF_INET; } '(' source_afinet_udp_params ') ' { $$ = $4; } | KW_TCP { last_addr_family = AF_INET; } '(' source_afinet_tcp_params ') ' { $$ = $4; } | KW_UDP6 { last_addr_family = AF_INET6; } '(' source_afinet_udp_params ')' { $$ = $4; } | KW_TCP6 { last_addr_family = AF_INET6; } '(' source_afinet_tcp_params ')' { $$ = $4; } ; A build on solaris 2.6/7 fails with: cc -DHAVE_CONFIG_H -I. -I. -I.. -DPATH_SYSCONFDIR=\"/etc/opt/TWWfsw/syslogng1911\" -DPATH_LOCALSTATEDIR=\"/var/opt/TWWfsw/syslogng1911\" -I/opt/TWWfsw/libglib26/include -I/opt/TWWfsw/libglib26/lib/include -I/opt/TWWfsw/gettext014/include -I/opt/TWWfsw/syslogng1911/include/eventlog -D_GNU_SOURCE -mr -Qn -xstrconst -xO2 -xtarget=ultra2 -xarch=v8plusa -c cfg-grammar.c "/home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y", line 303: undefined symbol: AF_INET6 "/home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y", line 304: undefined symbol: AF_INET6 "/home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y", line 539: undefined symbol: AF_INET6 "/home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y", line 540: undefined symbol: AF_INET6 cc: acomp failed for cfg-grammar.c -- albert chin (china(a)thewrittenword.com)

1 0

1.9.11 compile failure on IRIX 6.5, Tru64 UNIX 5.1
by Albert Chin 01 Jun '06

01 Jun '06

Seems like IRIX 6.5 and Tru64 UNIX 5.1 don't have IPV6_ADD_MEMBERSHIP. They do have IP_ADD_MEMBERSHIP though. Should we just: #ifndef IPV6_ADD_MEMBERSHIP #define IPV6_ADD_MEMBERSHIP IP_ADD_MEMBERSHIP #endif cc -DHAVE_CONFIG_H -I. -I. -I.. -DPATH_SYSCONFDIR=\"/etc/opt/TWWfsw/syslogng1911\" -DPATH_LOCALSTATEDIR=\"/var/opt/TWWfsw/syslogng1911\" -I/opt/TWWfsw/libglib26/include -I/opt/TWWfsw/libglib26/lib/include -I/opt/TWWfsw/gettext014/include -I/opt/TWWfsw/syslogng198/include/eventlog -D_GNU_SOURCE -Wl,-woff,84 -Wl,-woff,85 -woff 1009,1429 -use_readonly_const -G0 -rdata_shared -DEBUG:optimize_space=ON -O2 -OPT:Olimit=0 -c afinet.c cc-1020 cc: ERROR File = afinet.c, Line = 190 The identifier "IPV6_ADD_MEMBERSHIP" is undefined. setsockopt(fd, IPPROTO_IPV6, IPV6_ADD_MEMBERSHIP, &mreq6, sizeof(mreq6)); ^ 1 error detected in the compilation of "afinet.c". -- albert chin (china(a)thewrittenword.com)

2 2

syslog-ng[3933]: STATS: dropped 1074
by ashish tyagi 01 Jun '06

01 Jun '06

hi all I am using syslog-ng and php-syslog-ng with mysql to store logs on fedora core 4. i installed it using RPM for fedora 4. it is being used as a central loging server.in /var/log/messages a message appeares regularly "syslog-ng[3933]: STATS: dropped 1027".what does this message means, is it dropping messages comming from other servers.if i have done something wrong. i have attached syslog-ng configuration file. Thanks & Regards Ashish Tyagi

2 1

1.9.11 compile failure on HP-UX 11.23 and AIX 5.x
by Albert Chin 01 Jun '06

01 Jun '06

I'm getting the same compile failure on HP-UX and AIX using the vendor compiler: xlc -DHAVE_CONFIG_H -I. -I. -I.. -DPATH_SYSCONFDIR=\"/etc/opt/TWWfsw/syslogng1911\" -DPATH_LOCALSTATEDIR=\"/var/opt/TWWfsw/syslogng1911\" -I/opt/TWWfsw/libglib26/include -I/opt/TWWfsw/libglib26/lib/include -I/opt/TWWfsw/gettext014/include -I/opt/TWWfsw/syslogng1911/include/eventlog -D_GNU_SOURCE -O2 -ma -qro -qroconst -qmaxmem=-1 -qarch=com -c afinet.c "/usr/include/alloca.h", line 34.1: 1506-224 (I) Incorrect pragma ignored. "afinet.c", line 183.13: 1506-021 (S) Expecting struct or union. gmake[2]: *** [afinet.o] Error 1 gmake[2]: Leaving directory `/opt/build/syslog-ng-1.9.11/src' The problem is the following line: if (IN6_IS_ADDR_MULTICAST(g_sockaddr_inet6_get_address(addr)->s6_addr)) On AIX, from <netinet/in.h>: #define IN6_IS_ADDR_MULTICAST(p) IS_MULTIADDR6(*p) #define IS_MULTIADDR6(a) ((a).s6_addr8[0] == 0xff) #define s6_addr8 u6_addr.u6_addr8 #define s6_addr u6_addr.u6_addr8 So, IN6_IS_ADDR_MULTICAST(addr) is converted to IS_MULTIADDR6(*addr) and then: ((*addr).u6_addr.u6_addr8[0] == 0xff So, because addr == g_sockaddr_inet6_get_address(addr)->s6_addr, we get the following expansion: if (((*g_sockaddr_inet6_get_address(addr)->u6_addr.u6_addr8).u6_addr.u6_addr8[0] == 0xff)) The Redhat Linux definition is: #define IN6_IS_ADDR_MULTICAST(a) (((__const uint8_t *) (a))[0] == 0xff) The HP-UX 11.23 definition is: #define IN6_IS_ADDR_MULTICAST(i) ((((i)->s6_addr[0] ^ 0xff) \ | ((i)->s6_addr[1] & 0xe0)) == 0) ntp-4.2.0a also uses IN6_IS_ADDR_MULTICAST but does the following: if (IN6_IS_ADDR_MULTICAST(&((struct sockaddr_in6*)srcadr)->sin6_addr)) -- albert chin (china(a)thewrittenword.com)

2 2

RE: [syslog-ng] Compiling 1.9.11 on Solaris 9
by Heigl Florian - Munich-MR - external 29 May '06

29 May '06

> Not to mention that IPPROTO_IPV6 as a name suggests the IPv6 is a > subprotocol of IP itself, which is IPv4. This is certainly not true. You're just calling the 'Internet Protocol Version 4' 'IP'. This certainly can be confusing. SCNR, florian

1 0

RE: [syslog-ng] Starting syslog-ng as root
by Muath Al Khalaf 27 May '06

27 May '06

Hi, I am using Redhat Enterprise 4. I am using the official rpm image built by Balabit for RHE 4 with their startup script. The executable did not return anything (at least in front of me inside console). For strace I do not know how to use it. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Friday, May 26, 2006 10:35 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Starting syslog-ng as root On Fri, 2006-05-26 at 16:58 +0300, Muath Al Khalaf wrote: > Hi, > > > > I am trying to start syslog-ng as root but failed. The startup script > is using daemon. I have tried also by issuing /sbin/syslog-ng but got > nothing. I know it is better to run it with user privileges but this > is to be able to log kernel messages file("proc/kmsg"); hmm.. I don't see why it failed, but I would certainly need some more information to be able to help you. The return code of the executable, an strace dump or something. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Compiling 1.9.11 on Solaris 9
by Albert Chin 26 May '06

26 May '06

I tried building syslog-ng 1.9.11 on Solaris 9 with the Sun C compiler. It failed with the following: cc -DHAVE_CONFIG_H -I. -I. -I.. -DPATH_SYSCONFDIR=\"/etc/opt/TWWfsw/syslogng1911\" -DPATH_LOCALSTATEDIR=\"/var/opt/TWWfsw/syslogng1911\" -I/opt/TWWfsw/libglib26/include -I/opt/TWWfsw/libglib26/lib/include -I/opt/TWWfsw/gettext014/include -I/opt/TWWfsw/syslogng198/include/eventlog -D_GNU_SOURCE -mr -Qn -xstrconst -xO2 -xtarget=ultra2 -xarch=v8plusa -c afinet.c "afinet.c", line 81: warning: implicit function declaration: memset "afinet.c", line 156: undefined symbol: SOL_IP "afinet.c", line 162: undefined symbol: SOL_IP "afinet.c", line 169: undefined symbol: SOL_IP "afinet.c", line 172: undefined symbol: SOL_IP "afinet.c", line 181: warning: left operand of "->" must be pointer to struct/union "afinet.c", line 188: undefined symbol: SOL_IPV6 "afinet.c", line 194: undefined symbol: SOL_IPV6 "afinet.c", line 200: undefined symbol: SOL_IPV6 cc: acomp failed for afinet.c gmake[2]: *** [afinet.o] Error 2 gmake[2]: Leaving directory `/opt/build/syslog-ng-1.9.11/src' The prototype for memset() is in <string.h>. Solaris 9 doesn't have SOL_IP anywhere in /usr/include. From setsockopt(3SOCKET) on Solaris 9: When manipulating socket options, the level at which the option resides and the name of the option must be specified. To manipulate options at the "socket" level, level is speci- fied as SOL_SOCKET. To manipulate options at any other level, level is the protocol number of the protocol that controls the option. For example, to indicate that an option is to be interpreted by the TCP protocol, level is set to the TCP protocol number . See getprotobyname(3SOCKET). AIX 5.3 doesn't build for the same reason: "afinet.c", line 157.32: 1506-045 (S) Undeclared identifier SOL_IP. "afinet.c", line 182.13: 1506-021 (S) Expecting struct or union. "afinet.c", line 189.32: 1506-045 (S) Undeclared identifier SOL_IPV6. gmake[2]: *** [afinet.o] Error 1 gmake[2]: Leaving directory `/opt/build/syslog-ng-1.9.11/src' Ditto for HP-UX 11.23/PA and 11.23/IA. -- albert chin (china(a)thewrittenword.com)

2 3

Starting syslog-ng as root
by Muath Al Khalaf 26 May '06

26 May '06

Hi, I am trying to start syslog-ng as root but failed. The startup script is using daemon. I have tried also by issuing /sbin/syslog-ng but got nothing. I know it is better to run it with user privileges but this is to be able to log kernel messages file("proc/kmsg");

2 1

1.9.11 patch for src/stats.c
by Albert Chin 26 May '06

26 May '06

src/stats.c has the following: gchar *tag_names[SC_TYPE_MAX] = { [SC_TYPE_DROPPED] = "dropped", [SC_TYPE_PROCESSED] = "processed", }; "[SC_TYPE_DROPPED]" is a GCC thing. I guess GCC allows you to index items in an array. But, the vendor compilers from Sun, HP, IBM, etc. don't. -- albert chin (china(a)thewrittenword.com) -- snip snip Index: src/stats.c =================================================================== --- src/stats.c.orig 2006-02-11 04:57:29.000000000 -0600 +++ src/stats.c 2006-05-25 17:14:38.681857000 -0500 @@ -143,8 +143,8 @@ StatsCounterType type; gchar *tag_names[SC_TYPE_MAX] = { - [SC_TYPE_DROPPED] = "dropped", - [SC_TYPE_PROCESSED] = "processed", + "dropped", + "processed" }; e = msg_event_create(EVT_PRI_NOTICE, "Log statistics", NULL);

2 1

Facility / Priority
by Jeremy M. Guthrie 26 May '06

26 May '06

'lo I am the main author of a GPL packaged called Syslog Management Tool(SMT) - smt.dangermen.com. I am currently using Modular Syslog as the syslog package to import from syslog to PostgreSQL. I have found it has issues with about anymore than 70 messages per second. Modular Syslog also looks largely abandoned. Syslog-ng appears to be able to replace the functionality Modular Syslog via the use of pipes. The issue I have found with Syslog-NG is that it does convert the facility & priority/severity to full names when writing. Today I have Modular Syslog writing facility and severity as individual decimal values rather than the aggregate 0-255 decimal(see the table layout below). I was wondering if someone knew of a way to get Syslog-NG to write out the facility/priority values separately? .ie via the syslog-ng.conf filtering/manipulation kung fu? Or does this look like a modification that I will have to make in the .c code? TSyslog=# \d tsyslog Table "public.tsyslog" Column | Type | Modifiers ------------+------------------------+----------------------------------------------------------------- tsyslog_id | bigint | not null default nextval('public.tsyslog_tsyslog_id_seq'::text) facility | integer | severity | integer | date | date | time | time without time zone | host | character varying(128) | message | text | Indexes: "tsyslog_pkey" PRIMARY KEY, btree (tsyslog_id) "host_idx" btree (host) "tsyslhostid_idx" btree (tsyslog_id, host) "tsyslogdatetime_idx" btree (date, "time") -- -------------------------------------------------- Jeremy M. Guthrie jeremy.guthrie(a)berbee.com Senior Network Engineer Phone: 608-298-1061 Berbee Fax: 608-288-3007 5520 Research Park Drive NOC: 608-298-1102 Madison, WI 53711

3 12

RE: [syslog-ng] Syslog-ng dropped packets.
by Vaibhav Goel 26 May '06

26 May '06

We are using 1.6.5 (soon to upgrade to 1.6.11) in a production environment. Is 1.9.11 production ready? I recall a message from you saying that you are looking to release 2.0.0 within a month. I will install 1.9.11 on my QA server and start testing it once we deploy 1.6.11 to prod. I am actually not using /dev/xconsole... I have 2 production loghosts and one of them is more heavily used then the other. I am seeing dropped packets on that one during peak hours. That leads me to believe that syslog-ng. Is there a way to increase the incoming buffer in another way? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: May 25, 2006 3:51 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng dropped packets. On Wed, 2006-05-24 at 16:35 -0700, Vaibhav Goel wrote: > Recently, I started seeing dropped packets in syslog-ng. I increased > the log_fifo_size to 2000 (it was 1000) and it abated the problem > somewhat. But I am still seeing some dropped packets. Could I > increase the log_fifo_size? Are there any other tips? Unfortunately, > we are going to be adding more logging load to this loghost and I am > worried that this problem might increase. Any ideas? The most important part in addressing this problem is finding out which destination drops packets. syslog-ng 1.6.x only gave a global counter. You might have a slow destination (like /dev/xconsole) whereas your normal log flow works fine. If your primary log output is slow, you could switch to 1.9.11 which includes log message flow control. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

log line processed after flags(final)
by Kevin Lee Phair II 25 May '06

25 May '06

Are there any known situations where the use of flags(final) would still allow the processing of a matched line by log statements which come later in the config? In this case there are three log statements total which a particular line could possibly match; I want it to be processed by the first two statements but not the third. After adding flags(final) to the second log statement, all statements are still being matched.

2 3

Syslog-ng dropped packets.
by Vaibhav Goel 25 May '06

25 May '06

Recently, I started seeing dropped packets in syslog-ng. I increased the log_fifo_size to 2000 (it was 1000) and it abated the problem somewhat. But I am still seeing some dropped packets. Could I increase the log_fifo_size? Are there any other tips? Unfortunately, we are going to be adding more logging load to this loghost and I am worried that this problem might increase. Any ideas? Thanks!

2 1

syslog-ng 1.9.11 released
by Balazs Scheidler 23 May '06

23 May '06

Hi, Syslog-ng 1.9.11 has been released and uploaded to the usual places at http://www.balabit.com/products/syslog-ng/ with the following list of user-visible changes: 1.9.11 Tue, 23 May 2006 19:45:21 +0200 Some minor new features: * Added IPv6 support. * Added multicast support. Bugfixes: * Avoid changing owner/group/permission information for files that do not exist, to avoid clobbering the error value. * Added close-on-exec flag to avoid inheriting file descriptors for programs started by syslog-ng. * Fixed an off-by-one in flush_lines() calculation. * Fixed a possible memory leak. * Fixed a CPU spinning possibility when a non-existing filter is referenced on the log path the processes internal() messages. * Fixed hanging on reading /proc/kmsg on Linux. * Fixed sun-streams() fetching problem on Solaris. Other changes: * Documentation updates. I would like to release 2.0.0 real soon now, for this to happen I would need some positive feedback on this release. Anyone using the 1.9.x series and especially 1.9.11, please speak up. People on non-Linux platforms, now is the time to submit bugreports on portability issues. If nothing major shows up, I am going to release 2.0.0 in about a months time and obsolete 1.6.x once and for all. Thanks in advance, -- Bazsi

1 0

Syslog-ng + Freebsd
by Stefan Lind 23 May '06

23 May '06

I have a problem with syslog-ng It hangs every now and then, When it hangs I have to "kill -9" and then start again. I know this is a bad description do you know what I can do to find the problem? Mvh Stefan Lind 0520-500525 Leissner Data AB

2 1

filter set but still logged to mySQL
by Dennis Kavadas 23 May '06

23 May '06

Hi all I have a question, or rather a problem I've written a filter to trap entries from our BIND host that sends the output to /de/null (see below) I can send the match to any file or to /dev/null but syslog-ng is still seeing the entry from the host and is logging it to "destination d_mysql " I just need to filter out the match so it never reaches "destination d_mysql" Can anyone offer any advice ? my syslog-ng file below.... -------------------------------------- options { long_hostnames(off); sync(0); stats(43200); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_dns(yes); }; source shell { internal(); unix-stream("/dev/log"); udp(ip( my.syslog-ng.host.com)) }; destination err-update-dns { file("/dev/null"); }; filter err-update-dns { match("(59.167.232.229)"); }; log {source(shell); filter(err-update-dns); destination(err-update-dns); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(shell); destination(d_mysql); };

2 2

syslog-ng stalls system
by Mario Aeby 19 May '06

19 May '06

Hi Guys Wow, thanks for all your replies! So at least I'm not the only one having problems. - I'm running Debian testing with (self-compiled *boah*) Kernel 2.4.25 - I replaced syslog-ng with syslog until the issues are fixed - dpkg says I had the following syslog-ng installed: rc syslog-ng 1.9.9-1 Next generation logging daemon Really confusing, since Balazs is talking about 1.6.11 ... Do Debian maintainers follow a different numbering scheme? - My configuration is available as a download at http://mad4you.homeip.net/downloads/syslog-ng.conf . Note: It cannot be caused by this, since I soon replaced syslog-ng.conf with the one the original Debian package provided (to rule out exactly such a cause) Many thanks! Kind regards Mario -- Mario Aeby Stritenstrasse 47 CH-3176 Neuenegg Mobile 078 690 50 11 Fax 031 741 28 93 http://www.eMeidi.com/

2 1

Solaris 8 login hangs
by Neill Flynn 19 May '06

19 May '06

I have been running syslog-ng 1.6.6 in a Solaris/RH environment (almost 70 syslog-ng clients). All works fine but for two Solaris machines which do not allow me to su from my own account, if I "su -", the process hangs indefinitely. I can open a second connection and kill part of the su process and gain access. When I switch off syslog-ng and start syslog, all work fine. Also, both the local files and the remote syslog-ng server log the su as it happens. Anyone any ideas? ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

1 0

Re: [syslog-ng] syslog-ng stalls system
by Tony Davis 18 May '06

18 May '06

> Hi > > I've ran into serious problems yesterday with my Debian server and > finally was able to nail down the problem to syslog-ng and/or the > logging subsystem (or whatever it is called). I first noticed troubles > after I did a apt-get install, which hang while installing ssl-cert due > to a failure to create a group (connected to the symptoms mentioned > below). > > Symptoms: > - a growing number of unterminated /USR/SBIN/CRON processes (strace: > "connect(7, {sa_family=AF_FILE, path="/dev/log"}, 16") > - unable to 'su <user>' (Ctrl-C to return to shell) > - unable to establish a ssh connection (terminal hangs after entering > password, sshd <defunct> in processes) > - unable to login physically at the server itself ("You have new mail", > but no command line, Ctrl-C to return to the login screen) > - when logged in prior the failures, either 'shutdown' nor 'reboot' > have any effect (system must be shut down by /etc/init.d/reboot stop) > - no new entries in /var/log/cron.log or /var/log/syslog > > Temporary Cure: > - reboot and prevent syslog-ng from starting at boot > > Sidenotes: > - All other services work as expected > > I've got to know Linux in recent years, but it seems I'm not capable of > solving such a difficult issue by myself. Do you have any suggestions? > > Thank you very much! > Kind regards > Mario Hi Mario, I reported the exact same problem back on the 5th May but, so far, I haven't found a resolution. This was running syslog-ng version 1-6-10-1 on RedHat EL 3 using the RedHat conf file in the contribs directory bundled with the source. Tony ***************************************************** You can find us at www.voca.com ***************************************************** This communication is confidential and intended for the exclusive use of the addressee only. You should not disclose its contents to any other person. If you are not the intended recipient please notify the sender named above immediately. Registered in England, No 1023742, Registered Office: Voca Limited Drake House, Three Rivers Court, Homestead Road, Rickmansworth, Hertfordshire, WD3 1FX This message has been checked for all email viruses by MessageLabs.

3 2

log messages with LF
by PREVOSTO, Laurent 18 May '06

18 May '06

Hi, i'm afraid this is some kind of FAQ but is there a way to have syslog-ng correctly prints logs messages that contain LF ('\n') ? It looks like they are wiped out in log_msg_parse() (logmsg.c) but is there a reason for such a behaviour ? Regards Laurent

2 1

syslog-ng stalls system
by Mario Aeby 18 May '06

18 May '06

Hi I've ran into serious problems yesterday with my Debian server and finally was able to nail down the problem to syslog-ng and/or the logging subsystem (or whatever it is called). I first noticed troubles after I did a apt-get install, which hang while installing ssl-cert due to a failure to create a group (connected to the symptoms mentioned below). Symptoms: - a growing number of unterminated /USR/SBIN/CRON processes (strace: "connect(7, {sa_family=AF_FILE, path="/dev/log"}, 16") - unable to 'su <user>' (Ctrl-C to return to shell) - unable to establish a ssh connection (terminal hangs after entering password, sshd <defunct> in processes) - unable to login physically at the server itself ("You have new mail", but no command line, Ctrl-C to return to the login screen) - when logged in prior the failures, either 'shutdown' nor 'reboot' have any effect (system must be shut down by /etc/init.d/reboot stop) - no new entries in /var/log/cron.log or /var/log/syslog Temporary Cure: - reboot and prevent syslog-ng from starting at boot Sidenotes: - All other services work as expected I've got to know Linux in recent years, but it seems I'm not capable of solving such a difficult issue by myself. Do you have any suggestions? Thank you very much! Kind regards Mario -- Mario Aeby Stritenstrasse 47 CH-3176 Neuenegg Mobile 078 690 50 11 Fax 031 741 28 93 http://www.eMeidi.com/

3 2

syslog-ng GUI
by Arya, Manish Kumar 18 May '06

18 May '06

Hi Guys, I am storing logs on a central server having 3T SAN, using follwing template destination indexlog { file("/logs/log01/indexlog/$YEAR/$MONTH/$DAY/$HOST" template("$HOUR:$MIN:$SEC,$PROGRAM,$FACILITY,$PRIORITY,$MSGONLY\n") template-escape(yes) owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; my logging is done perfectly :) like /logs/log01/indexlog/2006/05/11/hostnames I want to have a GUI to view logs with following facilities -search logs on basis on date/time, text patterns in messages,hostnames. -should provide facility to have filters associated with user authentication/authorization. -should be able to to parallel search to improve search response time. Regards, -Manish __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

8 13