- syslog-ng - lists.balabit.hu

Re: HP-UX pipe read errors
by Andy G. 01 May '06

01 May '06

On 04/25/06 09:08, Andrew Gill wrote: > Hello, > > I'm new to syslog-ng and am trying to configure it to run on HP-UX 10.20 > and 11.11. It seems to have problems reading from the /dev/log pipe. > Each time a message is received on the pipe, syslog-ng hits an I/O error > and closes the filehandle, and no more messages are received. However, > the first message is always processed correctly. > > Here is my syslog-ng.conf: > source src { > pipe("/dev/log" pad_size(2048)); > internal(); > }; > > destination d_file { > file("/var/adm/syslog-ng/messages" > owner(root) > group(systaff) > perm(0640) > ); > }; > > destination d_net { > tcp(testy port(1514)); > }; > > log { > source(src); > destination(d_file); > destination(d_net); > }; > > When I run syslog-ng in the foreground with debug and verbose options, > this is what I see: > > io.c: Preparing fd 3 for reading > io.c: connecting using fd 6 > connecting fd 6 to inetaddr testy, port 1514 > syslog-ng version 1.6.10 starting > io.c: Preparing fd 6 for writing > io.c: Preparing fd 7 for writing > io.c: do_read: read() failed (errno 11), Resource temporarily > unavailable > fd = 3, buffer = 00098b0, length = 2048 > Marking fd 3 for closing. > Closing fd 3. > > The do_read line is when the message is received. syslog-ng continues > to run, and internal messages (e.g. STATS) continue to show up on the > local host and the remote loghost. > > Any thoughts would be greatly appreciated. > > -Andy > > I think I figured this out...in libol's src/io.c an assumption is made that EAGAIN == EWOULDBLOCK, but this is not the case for HP-UX. > egrep "EAGAIN|EWOULD" /usr/include/sys/errno.h #define EAGAIN 11 /* No more processes */ #define EWOULDBLOCK 246 /* Operation would block */ I applied the following change to src/io.c and recompiled libol, and it works correctly now. -Andy -- io.c.orig Mon Mar 13 10:01:31 2006 +++ io.c Mon Mar 13 10:01:31 2006 @@ -361,6 +361,7 @@ case EINTR: continue; /* FIXME: Is it really worth looping here, * instead of in the select loop? */ + case EAGAIN: case EWOULDBLOCK: /* aka EAGAIN */ return 0; case EPIPE: @@ -415,6 +416,7 @@ continue; /* FIXME: Is it really worth looping here, * instead of in the select loop? */ case EWOULDBLOCK: /* aka EAGAIN */ + case EAGAIN: return 0; case EPIPE: werror("io.c: recvfrom() returned EPIPE! Treating it as EOF.\n");

2 1

Compiling & Using syslog-ng 1.9.10 on Solaris 10
by Philippe JOYEZ 01 May '06

01 May '06

Hello all, I've finally succedeed in compiling syslog-ng on my new Solaris 10 box using the following tasks: Modifications src/Makefile (Add -lrt) 75c75 < LIBS = -lpthread -lnsl -lsocket -ldoor -ll -L/usr/local/lib -lglib-2.0 -lintl -L/usr/local/lib -levtlog --- > LIBS = -lpthread -lrt -lnsl -lsocket -ldoor -ll -L/usr/local/lib -lglib-2.0 -lintl -L/usr/local/lib -levtlog Modification src/filter.c (Adding macros): /* Define G_LIKELY() and G_UNLIKELY() so that they are available when * using GLib 1.2 as well. These allow optimization by static branch * prediction with GCC. */ #ifndef G_LIKELY #define G_LIKELY(x) (__builtin_expect(x, 1)) #define G_UNLIKELY(x) (__builtin_expect(x, 0)) #endif /* !G_LIKELY */ But when I start syslog-ng, I have the following error message: Apr 26 09:50:55 sewerrat syslog-ng[752]: syslog-ng starting up; version='1.9.10' Apr 26 09:50:55 sewerrat syslog-ng[752]: Insufficient buffer space for retrieving STREAMS log message; res='ffffffff' Any idea? Best regards, Philippe JOYEZ -- Disclaimer ------------------------------------ Ce message ainsi que les eventuelles pieces jointes constituent une correspondance privee et confidentielle a l'attention exclusive du destinataire designe ci-dessus. Si vous n'etes pas le destinataire du present message ou une personne susceptible de pouvoir le lui delivrer, il vous est signifie que toute divulgation, distribution ou copie de cette transmission est strictement interdite. Si vous avez recu ce message par erreur, nous vous remercions d'en informer l'expediteur par telephone ou de lui retourner le present message, puis d'effacer immediatement ce message de votre systeme. *** This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender by phone or by replying this message, and then delete this message from your system.

2 1

RE: [PATCH] Re: [syslog-ng] time_sleep()
by Vaibhav Goel 30 Apr '06

30 Apr '06

That did the trick. I was going through the code and I suspected that was the problem in cfg-grammar.y but I am no code monkey so I let it be ;-) Thanks again for your help. Now I hope that this parameter will help bring down the CPU load on one of my loghosts (it has a whole bunch of parallel connections). Thanks, -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Roberto Nibali Sent: April 26, 2006 2:19 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [PATCH] Re: [syslog-ng] time_sleep() ADDENDUM: > The grammar was missing an entry, the attached patch should fix it. > Please try and report back if this solves the problem for you. And my patch was missing the documentation update, which I've obtained by fraud from the marvellous syslog-ng-2 tree. > ------------------------------------------------------------------------ > > --- syslog-ng-1.6.10/src/cfg-grammar.y 2006-03-14 00:34:13.000000000 +0100 > +++ syslog-ng-1.6.10-ratz/src/cfg-grammar.y 2006-04-26 22:58:20.000000000 +0200 > @@ -631,6 +631,7 @@ > | KW_USE_DNS '(' yesno ')' { configuration->use_dns = $3; } > | KW_TIME_REOPEN '(' NUMBER ')' { configuration->time_reopen = $3; } > | KW_TIME_REAP '(' NUMBER ')' { configuration->time_reap = $3; } > + | KW_TIME_SLEEP '(' NUMBER ')' { configuration->time_sleep = $3; } > | KW_LOG_FIFO_SIZE '(' NUMBER ')' { configuration->log_fifo_size = $3; } > | KW_GC_BUSY_THRESHOLD '(' NUMBER ')' { configuration->gc_busy_threshold = $3; } > | KW_GC_IDLE_THRESHOLD '(' NUMBER ')' { configuration->gc_idle_threshold = $3; } And attached is the better version for Bazsi to apply if he's inclined to do so. This is about the third time I've chased down a parser-based bug, so I wonder if using (f)lex/yacc for this really pays off ;)? Considering my state of mind, I reckon I could be really off the track with this patch as well ... Cheers, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc

2 1

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 30 Apr '06

30 Apr '06

I can't post the whole thing since its too big but I am posting the relevant portion of it: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); owner(mdirect); group(mdirect); keep_hostname (yes); log_msg_size(20480); }; The rest of the file is just a bunch of source, destination, filter and log entries for various stuff Also: [root@clxd01md syslog-ng]# strings /sbin/syslog-ng | grep time_sleep time_sleep So looks like there could be some time_sleep code in the binary at least... -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of John Morrissey Sent: April 25, 2006 1:48 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() On Tue, Apr 25, 2006 at 01:00:17PM -0700, Vaibhav Goel wrote: > I did exactly that... > > [root@clxd01md syslog-ng]# /etc/init.d/syslog-ng restart > Shutting down system logger: [ OK ] > Starting system logger: syntax error at 20 > Parse error reading configuration file, exiting. (line 20) > [FAILED] > [root@clxd01md syslog-ng]# cat /etc/syslog-ng/syslog-ng.conf | grep time > time_reopen (10); > time_sleep(30); > > [root@clxd01md syslog-ng]# /sbin/syslog-ng -V > syslog-ng 1.6.10 > > > Am I doing something wrong? Strange. I backported the time_sleep change to the Debian package I'm running (1.6.9) so I can't speak for the pristine 1.6.10 source, but it's been working fine for us. I glanced at the 1.6.10 tarball and see some time_sleep code there. Could you post your entire syslog-ng.conf? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

RE: [syslog-ng] HUP does not work
by Lumir Unzeitig (DHL CZ) 30 Apr '06

30 Apr '06

Piece of command output strace -s 256 -o /tmp/output-file -p 4893 --------------------------------------------- poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18, events=0}, {fd=15, events=POLLOUT, revents=POLLOUT}, {fd=14, events=0}, {fd=13, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=12, events=POLLIN}, {fd=11, events=POLLIN}, {fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 2 recv(15, 0xbfffaf7b, 1, MSG_PEEK|MSG_DONTWAIT) = -1 ENOTSOCK (Socket operation on non-socket) write(15, "Apr 20 16:56:38 czchols020 sendmail[13901]: k3KEuWpW013859: to=<mrk(a)erwerwerwwer.com>, delay=00:00:04, xdelay=00:00:03, mailer=esmtp, pri=88225, relay=mrucontsv00001.mru-co.mu.asdasda.cz. [152.141.145.16], dsn=2.0.0, stat=Sent (mrucontsv00001.mru-co.mu.uuuu"..., 293) = 293 recv(4, 0xbfffaf7b, 1, MSG_PEEK|MSG_DONTWAIT) = -1 ENOTSOCK (Socket operation on non-socket) write(4, "Apr 20 16:56:38 czchols020 sendmail[13901]: k3KEuWpW013859: to=< mrk(a)erwerwerwwer.com >, delay=00:00:04, xdelay=00:00:03, mailer=esmtp, pri=88225, relay=mrucontsv00001.mru-co.mu.asdasda.cz. [152.141.145.16], dsn=2.0.0, stat=Sent (mrucontsv00001.mru-co.mu.uuuu"..., 293) = 293 time(NULL) = 1145544998 poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18, events=0}, {fd=15, events=0}, {fd=14, events=0}, {fd=13, events=0}, {fd=4, events=0}, {fd=12, events=POLLIN, revents=POLLIN}, {fd=11, events=POLLIN}, {fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 1 recvfrom(12, "<22>sendmail[13954]: k3KEub8A013945: to=<werwerw(a)asdasdasd.cz>, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=43032, relay=smtp-out-vip.asdasda.cz [85.72.196.13], dsn=2.0.0, stat=Sent (OK - Data received)\n", 2048, 0, {sa_family=AF_INET, sin_port=htons(514), sin_addr=inet_addr("2.252.103.89")}, [16]) = 215 time(NULL) = 1145544998 time(NULL) = 1145544998 time(NULL) = 1145544998 time(NULL) = 1145544998 time(NULL) = 1145544998 poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18, events=0}, {fd=15, events=POLLOUT, revents=POLLOUT}, {fd=14, events=0}, {fd=13, events=0}, {fd=4, events=POLLOUT, revents=POLLOUT}, {fd=12, events=POLLIN}, {fd=11, events=POLLIN}, {fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 2 recv(15, 0xbfffaf7b, 1, MSG_PEEK|MSG_DONTWAIT) = -1 ENOTSOCK (Socket operation on non-socket) write(15, "Apr 20 16:56:38 czchols020 sendmail[13954]: k3KEub8A013945: to=<rrr(a)rrrr.co.uk>, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=43032, relay=smtp-out-vip.asdasda.cz [85.72.196.13], dsn=2.0.0, stat=Sent (OK - Data received)\n", 238) = 238 recv(4, 0xbfffaf7b, 1, MSG_PEEK|MSG_DONTWAIT) = -1 ENOTSOCK (Socket operation on non-socket) write(4, "Apr 20 16:56:38 czchols020 sendmail[13954]: k3KEub8A013945: to=<sarah.queen(a)city-link.co.uk>, delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=43032, relay=smtp-out-vip.asdasda.cz [85.72.196.13], dsn=2.0.0, stat=Sent (OK - Data received)\n", 238) = 238 time(NULL) = 1145544998 poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18, events=0}, {fd=15, events=0}, {fd=14, events=0}, {fd=13, events=0}, {fd=4, events=0}, {fd=12, events=POLLIN}, {fd=11, events=POLLIN}, {fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = -1 EINTR (Interrupted system call) --- SIGHUP (Hangup) @ 0 (0) --- rt_sigaction(SIGHUP, {0x804a7b0, [HUP], SA_RESTORER|SA_RESTART, 0xaa20d8}, {0x804a7b0, [HUP], SA_RESTORER|SA_RESTART, 0xaa20d8}, 8) = 0 sigreturn() = ? (mask now []) open("/etc/resolv.conf", O_RDONLY) = 19 fstat64(19, {st_mode=S_IFREG|0644, st_size=52, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb75e3000 read(19, "search prg-dc.asdasda.cz asdasda.cz\n\nnameserver 127.0.0.1\n", 1024) = 52 read(19, "", 1024) = 0 close(19) = 0 munmap(0xb75e3000, 4096) = 0 write(2, "SIGHUP received, restarting syslog-ng\n", 38) = 38 time(NULL) = 1145544998 time(NULL) = 1145544998 poll([{fd=29, events=0}, {fd=17, events=0}, {fd=16, events=0}, {fd=18, events=0}, {fd=15, events=0}, {fd=14, events=0}, {fd=13, events=0}, {fd=4, events=0}, {fd=12, events=POLLIN, revents=POLLIN}, {fd=11, events=POLLIN}, {fd=10, events=POLLIN}, {fd=9, events=POLLIN}, {fd=8, events=POLLIN}, {fd=7, events=POLLIN}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 1 recvfrom(12, "<22>sendmail[13950]: k3KEucD1013950: from=<gematracing(a)asdasda.cz>, size=747, class=0, nrcpts=1, msgid=<5228949.1145544998753.JavaMail.weblogic(a)czhs0119.prg-dc.asdasda.c z>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]\n", 2048, 0, {sa_family=AF_INET, sin_port=htons(514), sin_addr=inet_addr("2.252.103.89")}, [16]) = 232 time(NULL) = 1145544998 time(NULL) = 1145544998 time(NULL) = 1145544998 time(NULL) = 1145544998 --------------------------------- >And an idea, isn't it postfix that stops logging? No, it is remotely logged sendmail 8.12.11. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, April 20, 2006 3:55 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] HUP does not work On Thu, 2006-04-20 at 13:47 +0200, Lumir Unzeitig (UUUU CZ) wrote: > The problem is: A central syslog server logs huge number of maillog > messages from a server. HUP signal is sent to the syslog-ng in > postrotate instructions when logrotate runs. All log files are rotated > properly except maillog. The old maillog messages are in the proper > file, but no new file is created and thus nothing is logged for the > facility . When I stop/start syslog-ng daemon it's working good. > We would need some more information about syslog-ng when in this bad state. Please attach to the syslog-ng process with strace right before sending a HUP signal and wait till some mail log is generated. Use the following strace command: strace -s 256 -o /tmp/output-file -p <syslog-ng pid> And an idea, isn't it postfix that stops logging? -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

DJBDNS&SYslog-ng
by Hamilton Vera 28 Apr '06

28 Apr '06

How to make djbdns and syslog-ng to work together? Thanks

1 0

service syslog-ng does not support chkconfig
by wayne yu 27 Apr '06

27 Apr '06

Hi: I'm new to syslog-ng, and I really need help for the error message [root@localhost init.d]# chkconfig --add syslog-ng service syslog-ng does not support chkconfig thanks in advance for any help --------------------------------- Love cheap thrills? Enjoy PC-to-Phone calls to 30+ countries for just 2¢/min with Yahoo! Messenger with Voice.

2 1

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 26 Apr '06

26 Apr '06

Here you go: 1 # syslog-ng configuration file.$ 2 #$ 3 # This should behave pretty much like the original syslog on RedHat Linux 9.$ 4 # But it could be configured a lot smarter.$ 5 #$ 6 # See syslog-ng(8) and syslog-ng.conf(5) for more information.$ 7 $ 8 options {$ 9 sync (0);$ 10 time_reopen (10);$ 11 log_fifo_size (1000);$ 12 long_hostnames (on);$ 13 use_dns (yes);$ 14 use_fqdn (no);$ 15 create_dirs (no);$ 16 owner(mdirect);$ 17 group(mdirect);$ 18 keep_hostname (yes);$ 19 log_msg_size(20480);$ 20 time_sleep(30);$ 21 };$ 22 $ 23 $ 24 #source s_sys {$ 25 # pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal();$ -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Roberto Nibali Sent: April 26, 2006 10:41 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() Vaibhav Goel wrote: > Still can't figure this one out. So far, I have compiled and installed > 1.6.9 and 1.6.10 and keep getting the same error. > > Anyone?!?!? One thing that sometimes bites people is a stupid control character inside a config file. Could you post the output of following command, please? cat -An mpt-status.c | head -25 Reducing the config file to a bare reproducable set of entries would help us as well. Regards, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 2

Any non-commercial Windows tcp clients?
by Davis, Jacob 26 Apr '06

26 Apr '06

I've been doing some digging around and have found references to several windows syslog clients (snare, ntsyslog, kiwi, etc..) but nothing I have found is both capable of using TCP ports instead of the standard UDP, and also non-commercial. The reason I ask is that I am intent on using SSL or SSH to tunnel connections to the log host and I don't think that UDP is an option in that case. Does such a solution exist? Thanks, -Jake

1 0

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 26 Apr '06

26 Apr '06

I cannot locate the mpt-status.c file in the 1.6.10 source tree. Syslog-ng gives a syntax error in a config file which has just this: options { time_sleep(30); }; (it works fine if you replace sleep with reap though) -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Roberto Nibali Sent: April 26, 2006 10:41 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() Vaibhav Goel wrote: > Still can't figure this one out. So far, I have compiled and installed > 1.6.9 and 1.6.10 and keep getting the same error. > > Anyone?!?!? One thing that sometimes bites people is a stupid control character inside a config file. Could you post the output of following command, please? cat -An mpt-status.c | head -25 Reducing the config file to a bare reproducable set of entries would help us as well. Regards, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 26 Apr '06

26 Apr '06

Still can't figure this one out. So far, I have compiled and installed 1.6.9 and 1.6.10 and keep getting the same error. Anyone?!?!? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of John Morrissey Sent: April 25, 2006 2:13 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() On Tue, Apr 25, 2006 at 01:52:30PM -0700, Vaibhav Goel wrote: > The rest of the file is just a bunch of source, destination, filter and > log entries for various stuff > > Also: > [root@clxd01md syslog-ng]# strings /sbin/syslog-ng | grep time_sleep > time_sleep > > So looks like there could be some time_sleep code in the binary at > least... True. You posted the output of syslog-ng -V before (1.6.10), and I definitely see the code in the final 1.6.10 tarball. strings(1) shows time_sleep text on my working syslog-ng binaries, and I can't find any reason it wouldn't be compiled in. Sorry, I'm not sure what to say. Baszi? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

FQDN based on destination
by Chris Whipple 25 Apr '06

25 Apr '06

Is there a way to change the use_fqdn() option based on the destination so that one receives the short host name an the other receives the FQ name? I'm using version 1.6.10. example: options { use_fqdn (yes) ... }; destination d_logfile { file("somelogfile") ; }; destination d_rmtserver { tcp("rmtserver.domain.com" port(514)); use_fqdn(no); }; Thank you, Chris Whipple Sr. Security Analyst Unix Security Group The Hertz Corporation 5601 NW Expressway Oklahoma City, OK 73132, USA cwhipple(a)hertz.com --------------- This message (including attachments) may contain information that is privileged, confidential or protected from disclosure. If you are not the intended recipient, you are hereby notified that dissemination, disclosure, copying, distribution or use of this message or any information contained in it is strictly prohibited. If you have received this message in error, please immediately notify the sender by reply e-mail and delete this message from your computer. Although we have taken steps to ensure that this e-mail and attachments are free from any virus, we advise that in keeping with good computing practice the recipient should ensure they are actually virus free. ---------------

3 4

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 25 Apr '06

25 Apr '06

BTW I just removed the time_sleep(30); from the file below to restart syslog-ng. But as soon as I put it in there, I get the syntax error... syntax error at 20 Parse error reading configuration file, exiting. (line 20) options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); owner(mdirect); group(mdirect); keep_hostname (yes); log_msg_size(20480); time_sleep(30); }; -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Vaibhav Goel Sent: April 25, 2006 1:53 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] time_sleep() I can't post the whole thing since its too big but I am posting the relevant portion of it: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); owner(mdirect); group(mdirect); keep_hostname (yes); log_msg_size(20480); }; The rest of the file is just a bunch of source, destination, filter and log entries for various stuff Also: [root@clxd01md syslog-ng]# strings /sbin/syslog-ng | grep time_sleep time_sleep So looks like there could be some time_sleep code in the binary at least... -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of John Morrissey Sent: April 25, 2006 1:48 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() On Tue, Apr 25, 2006 at 01:00:17PM -0700, Vaibhav Goel wrote: > I did exactly that... > > [root@clxd01md syslog-ng]# /etc/init.d/syslog-ng restart > Shutting down system logger: [ OK ] > Starting system logger: syntax error at 20 > Parse error reading configuration file, exiting. (line 20) > [FAILED] > [root@clxd01md syslog-ng]# cat /etc/syslog-ng/syslog-ng.conf | grep time > time_reopen (10); > time_sleep(30); > > [root@clxd01md syslog-ng]# /sbin/syslog-ng -V > syslog-ng 1.6.10 > > > Am I doing something wrong? Strange. I backported the time_sleep change to the Debian package I'm running (1.6.9) so I can't speak for the pristine 1.6.10 source, but it's been working fine for us. I glanced at the 1.6.10 tarball and see some time_sleep code there. Could you post your entire syslog-ng.conf? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] time_sleep()
by Vaibhav Goel 25 Apr '06

25 Apr '06

Hi John... I did exactly that... [root@clxd01md syslog-ng]# /etc/init.d/syslog-ng restart Shutting down system logger: [ OK ] Starting system logger: syntax error at 20 Parse error reading configuration file, exiting. (line 20) [FAILED] [root@clxd01md syslog-ng]# cat /etc/syslog-ng/syslog-ng.conf | grep time time_reopen (10); time_sleep(30); [root@clxd01md syslog-ng]# /sbin/syslog-ng -V syslog-ng 1.6.10 Am I doing something wrong? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of John Morrissey Sent: April 25, 2006 12:38 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] time_sleep() On Tue, Apr 25, 2006 at 11:44:29AM -0700, Vaibhav Goel wrote: > I just installed syslog-ng 1.6.10 and cannot figure out how to use the > time_sleep() option in the conf file. Any ideas? We are having some > nasty cpu spikes because of lots of parallel connections to syslog-ng > and hoping this will solve the issue. It's just an option, i.e.: options { time_sleep(30); } john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

time_sleep()
by Vaibhav Goel 25 Apr '06

25 Apr '06

Hi all I just installed syslog-ng 1.6.10 and cannot figure out how to use the time_sleep() option in the conf file. Any ideas? We are having some nasty cpu spikes because of lots of parallel connections to syslog-ng and hoping this will solve the issue. Thanks!

2 1

RE: [syslog-ng] Syslog file to Mysql
by Dukes Clayton 25 Apr '06

25 Apr '06

Yep, that would certainly work for ya :-) -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Mario Gzuk Sent: Tuesday, April 25, 2006 12:20 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog file to Mysql Hi, one line should do the work for you: zcat mygnuziplogfile.gz | awk '{print "INSERT INTO tablename VALUES("$1 $2 $3","$4","$5");"}' > sqlcommands.sql You have to rewrite the awk stuff because I dont know how your table layout locks like and I also dont know how your logfile locks like. Sorry for the english.... it is a work in progress! Am Dienstag, den 25.04.2006, 11:48 -0500 schrieb Nick: > Michael, > > Thanks for the reply, > > I did not describe my situation very well, but your solution will help > with other needs. I have multiple boxes where I can not directly > syslog to the central server. What I do is, scp the files back to the > central log server. From here I would like to uncompress them and > then import the files into the database. > > Hope that is a bit clearer. > > Nick > > On 4/25/06, Michael Redinger <Michael.Redinger(a)uibk.ac.at> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > Hi, > > > > regarding adding information to the local log, you could add this to > > the log destination definition, eg.: > > > > destination d_local { > > file("/var/log/mylogfile.log" template("$DATE $HOST > > [$FACILITY.$PRIORITY] $MSG\n")); }; > > > > The result looks something like this: > > > > Apr 25 16:59:09 myhost [local1.info] syslog message follows > > > > Greetings, > > Michael > > > > Nick Carstensen wrote: > > > Hello All, > > > > > > Have a question I hope someone can help with. > > > > > > Currently I have Syslog-ng running logging to a mysql db along > > > with keeping files. This is working well. I have a situation > > > where I can not log to the box directly. I need to "pull" the > > > logs to the central log server and import them into the db. As > > > syslogd and syslog-ng do not log all the needed fields by default > > > like facility:level and year, when they are writing them local I need a way to add that to the file. > > > > > > The second problems is how to import them to the db. Is there any > > > tool that will do this for me automatically? > > > > > > Thanks for the assistance. > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at > > > http://www.campin.net/syslog-ng/faq.html > > > > > > > > > > > > - -- > > Michael Redinger > > Zentraler Informatikdienst (Central IT Services) Universitaet > > Innsbruck > > Technikerstrasse 13 Tel.: ++43 512 507 2335 > > 6020 Innsbruck Fax.: ++43 512 507 2944 > > Austria Mail: Michael.Redinger(a)uibk.ac.at > > BB98 D2FE 0F2C 2658 3780 3CB1 0FD7 A9D9 65C2 C11D > > http://homepage.uibk.ac.at/~c102mr/mred-pubkey.asc > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG v1.4.2.2 (GNU/Linux) > > Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org > > > > iD8DBQFETjoyD9ep2WXCwR0RAoo+AKCKxQrcmNfDhCj5MPa+XzcSZbKKegCgpzti > > +BssjXgkZbz0OATuDUajyoY= > > =FrIc > > -----END PGP SIGNATURE----- > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > > http://www.campin.net/syslog-ng/faq.html > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] Syslog file to Mysql
by Dukes Clayton 25 Apr '06

25 Apr '06

Just use perl... Take a look at my php-syslog-ng package, there's a script in scripts/dbgen.pl that you could probably start with. My package is available at http://phlog.gdd.net -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nick Sent: Tuesday, April 25, 2006 9:39 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog file to Mysql I am currently using the php-syslog-ng but am in need to find a way to take a local file and "inject" it into the local database. If php-syslog-ng can do this I have missed it and would be appreciative if you could point that out to me. THanks for the help On 4/25/06, Dukes Clayton <Clayton.Dukes(a)hcahealthcare.com> wrote: > Take a look at php-syslog-ng > > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nick > Carstensen > Sent: Monday, April 24, 2006 9:52 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Syslog file to Mysql > > Hello All, > > Have a question I hope someone can help with. > > Currently I have Syslog-ng running logging to a mysql db along with > keeping files. This is working well. I have a situation where I can > not log to the box directly. I need to "pull" the logs to the central > log server and import them into the db. As syslogd and syslog-ng do > not log all the needed fields by default like facility:level and year, > when they are writing them local I need a way to add that to the file. > > The second problems is how to import them to the db. Is there any > tool that will do this for me automatically? > > Thanks for the assistance. > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Syslog file to Mysql
by Nick Carstensen 25 Apr '06

25 Apr '06

Hello All, Have a question I hope someone can help with. Currently I have Syslog-ng running logging to a mysql db along with keeping files. This is working well. I have a situation where I can not log to the box directly. I need to "pull" the logs to the central log server and import them into the db. As syslogd and syslog-ng do not log all the needed fields by default like facility:level and year, when they are writing them local I need a way to add that to the file. The second problems is how to import them to the db. Is there any tool that will do this for me automatically? Thanks for the assistance.

5 4

HP-UX pipe read errors
by Andy G. 25 Apr '06

25 Apr '06

Hello, I'm new to syslog-ng and am trying to configure it to run on HP-UX 10.20 and 11.11. It seems to have problems reading from the /dev/log pipe. Each time a message is received on the pipe, syslog-ng hits an I/O error and closes the filehandle, and no more messages are received. However, the first message is always processed correctly. Here is my syslog-ng.conf: source src { pipe("/dev/log" pad_size(2048)); internal(); }; destination d_file { file("/var/adm/syslog-ng/messages" owner(root) group(systaff) perm(0640) ); }; destination d_net { tcp(testy port(1514)); }; log { source(src); destination(d_file); destination(d_net); }; When I run syslog-ng in the foreground with debug and verbose options, this is what I see: io.c: Preparing fd 3 for reading io.c: connecting using fd 6 connecting fd 6 to inetaddr testy, port 1514 syslog-ng version 1.6.10 starting io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing io.c: do_read: read() failed (errno 11), Resource temporarily unavailable fd = 3, buffer = 00098b0, length = 2048 Marking fd 3 for closing. Closing fd 3. The do_read line is when the message is received. syslog-ng continues to run, and internal messages (e.g. STATS) continue to show up on the local host and the remote loghost. Any thoughts would be greatly appreciated. -Andy

1 0

RE: [syslog-ng] Syslog file to Mysql
by Dukes Clayton 25 Apr '06

25 Apr '06

Take a look at php-syslog-ng -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nick Carstensen Sent: Monday, April 24, 2006 9:52 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Syslog file to Mysql Hello All, Have a question I hope someone can help with. Currently I have Syslog-ng running logging to a mysql db along with keeping files. This is working well. I have a situation where I can not log to the box directly. I need to "pull" the logs to the central log server and import them into the db. As syslogd and syslog-ng do not log all the needed fields by default like facility:level and year, when they are writing them local I need a way to add that to the file. The second problems is how to import them to the db. Is there any tool that will do this for me automatically? Thanks for the assistance. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] Configuring syslog-ng to broadcast
by Kevin 24 Apr '06

24 Apr '06

On 4/23/06, Jim Schuyler <sky(a)red7.com> wrote: > Did we ever establish that syslog-ng cannot do a broadcast? > Sounds like it can not. It should be trivial to enable, a one-line change to the source, when creating a UDP transmit socket you also call setsockopt with SO_BROADCAST. Maybe a few more lines if the approach taken is to create a new option for udp destinations such as 'so_broadcast(yes)', just like a file destination can have 'create_dirs(yes)' set. There's no harm done in setting SO_BROADCAST and then sending packets to a unicast address -- the option won't change anything for regular packets, it just gives the program permission to send to local broadcast addresses. Kevin

1 0

Configuring syslog-ng to broadcast
by Jim Schuyler 24 Apr '06

24 Apr '06

Although I have tried to convince my client that this isn¹t exactly the best idea, they want to configure syslog-ng to send logs by broadcast rather than to a specific address on their subnet. Previously the configuration line we used for a specific remote syslog was: destination grouplog { udp(192.168.1.14 port(514)); }; Can syslog-ng actually do udp broadcast, and if so, what would be the appropriate config line to cause this to happen? (I have tried using 192.168.1.255 and 255.255.255.255 and neither seems to do it, although I might not be properly configured on the other end to receive broadcasts...the other end is Mac OSX and it does receive messages just fine if I configure 192.168.1.14, as above.) [Jim Sky]

3 6

filtering local facilities
by Bruce Pennypacker 21 Apr '06

21 Apr '06

Hi all, I'm just starting to work with syslog-ng. We're setting up a loghost that will be collecting logs from a number of applicatoin servers, and I want to split them up based on whether they're application logs or system logs. The application is logging to local syslogs using the facility local5, but I'm having trouble filtering on that in syslog-ng. I couldn't find any documentation that indicates this can't be done so I'm wondering what I might be doing wrong. Here's the relevant part of my syslog-ng.conf file: source s_udp { udp( ip(0.0.0.0) port(514) ); }; destination d_application { file("/var/log/application.log"); }; destination d_syslog { file("/var/log/syslog"); }; filter f_my_servers { host(h-001) or host(h-002) or host(h-003); }; filter f_test1 { facility(local5) and filter(f_my_servers); }; filter f_test2 { filter(f_my_servers); }; log { source(s_udp); filter(f_test1); destination(d_application); flags(final); }; log { source(s_udp); filter(f_test2); destination(d_syslog); flags(final); }; With the above configuration anything that comes in from one of the hosts as local5.* should get written to /var/log/application.log and everything else from those hosts should get written to /var/log/syslog, right? But if I log into one of these hosts and perform a test: [root@h-001 ~]# logger -t local5.info test The test message always ends up getting logged in /var/log/syslog. Does syslog-ng allow remote filtering based on the local5 facility, or am I doing something wrong here? -Bruce

1 1

RE: [syslog-ng] how to start the syslog-ng
by Heigl Florian - Munich-MR - external 21 Apr '06

21 Apr '06

> I'm new to syslog-ng. I need help on configuring the > syslog-ng. I already installed syslog-ng pkg to my > solaris 8 computer, but I can't find syslog-ng.conf > file or demeaon. > Thanks in advance for any comments. You will have to create a configuration by hand, there is no default to start from as far as I remember. You will find a nice setup documentation at sun's bigadmin site, look at the following url: http://www.sun.com/bigadmin/features/articles/syslog_ng.html syslog-ng has a debug/verbose startup mode which You should use until You have a basic environment up and running. Florian

1 0

how to start the syslog-ng
by wayne yu 21 Apr '06

21 Apr '06

Hi: I'm new to syslog-ng. I need help on configuring the syslog-ng. I already installed syslog-ng pkg to my solaris 8 computer, but I can't find syslog-ng.conf file or demeaon. Thanks in advance for any comments. Wayne __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0