- syslog-ng - lists.balabit.hu

RE: [syslog-ng] HUP does not work
by Lumir Unzeitig (DHL CZ) 21 Apr '06

21 Apr '06

Good idea. Thanks for your tip! -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Kevin Sent: Thursday, April 20, 2006 5:08 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] HUP does not work On 4/20/06, Lumir Unzeitig (DHL CZ) <lumir.unzeitig(a)dhl.com> wrote: > The problem is: A central syslog server logs huge number of maillog > messages from a server. HUP signal is sent to the syslog-ng in > postrotate instructions when logrotate runs. All log files are rotated > properly except maillog. The old maillog messages are in the proper > file, but no new file is created and thus nothing is logged for the > facility . When I stop/start syslog-ng daemon it's working good. Personally, instead of using 'logrotate' I configure syslog-ng to name the 'destination' file as the hour of day and day of week, and let it automatically create new files on the hour. For example: file("/var/log/mail/$WEEKDAY/$HOUR" remove_if_older(172800) ); If you only need today's log messages on hand, you could do: file("/var/log/mail/$HOUR" remove_if_older(7200) ); Kevin _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] HUP does not work
by Lumir Unzeitig (DHL CZ) 20 Apr '06

20 Apr '06

The problem is: A central syslog server logs huge number of maillog messages from a server. HUP signal is sent to the syslog-ng in postrotate instructions when logrotate runs. All log files are rotated properly except maillog. The old maillog messages are in the proper file, but no new file is created and thus nothing is logged for the facility . When I stop/start syslog-ng daemon it's working good. Yes, you are right. No start time of syslog-ng process gets changed when HUP is sent. Sorry my bad idea. Thanks for your help Lumir Unzeitig -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Sandor Geller Sent: Wednesday, April 19, 2006 3:31 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] HUP does not work Lumir Unzeitig (DHL CZ) wrote: > Hi, > > I use syslog-ng-1.6.9-1. When the server should be killed by HUP signal > (logrotate ) nothing happens (no time change in process table) The HUP signal doesn't kill syslog-ng, it's effect is to reopen the destinations. > I attached list of HUP action and strace of the action. You straced the kill command, not syslog-ng, so the output isn't useful. > The daemon uses pipes() and udp() as the sources. > > Do you have any idea? What problem do you want to solve? -- Sandor Geller wildy(a)balabit.hu _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

Changing sysconf dir ?!
by Jochen Kirn 19 Apr '06

19 Apr '06

Hi, Does it make sense to rework the "--sysconfdir" option of configure, so that I can define the actual directory where syslog-ng.conf is being placed ? $ ./configure --sysconfdir=/usr/local/syslog-ng/etc $ make && make install -> /usr/local/syslog-ng/etc/syslog-ng/syslog-ng.conf where it should look like /usr/local/syslog-ng/etc/syslog-ng.conf (without the unneccessary/additional 'syslog-ng' directory in /usr/local/syslog-ng/etc) any ideas ? regards Jochen

2 1

zero-loss from source{pipe()}
by Jon Stearley 19 Apr '06

19 Apr '06

manual snippet: "syslog-ng always reads its incoming log channels to prevent the running daemons from blocking." log_fifo_size() is offered as mitigation strategy. is there a way to force syslog-ng not to do this - option i've missed (or undocumented), preprocessor DEFINE, etc? why: i want to re-bin some historical logs into a $YEAR/$MONTH/$DAY/ $HOUR/$HOST file layout. syslog-ng is configured with a source pipe and destination as above, and fed via a fifo: find /historical/log/dir -type f -exec cat {} /tmp/myfifo \; but the resulting output dir is only 1/3 the size of the input dir. syslog-ng internal() messages include: syslog-ng[425]: Cannot open file /scratch/ptest/2005/05/13/13/sn5 for writing (No such file or directory) syslog-ng[425]: STATS: dropped 0 "dropped 0" seems inaccurate. this continues to happen even when log_fifo_size() is set higher than the maximum actual number of lines in an output file (which i happen to know for this test case). i could throttle feeding the pipe, but then it's trial-and-error to find the zero-loss rate. is there a better way? i'm running syslog-ng 1.6.0 on an old debian box, but since 1.6.x and 1.9.x manuals both contain the statement above i doubted an upgrade would behave differently in this respect? so i thought i'd ask. many thanks! -- +--------------------------------------------------------------+ | Jon Stearley (505) 845-7571 (FAX 844-9297) | | Sandia National Laboratories Scalable Systems Integration | +--------------------------------------------------------------+

2 3

HUP does not work
by Lumir Unzeitig (DHL CZ) 19 Apr '06

19 Apr '06

Hi, I use syslog-ng-1.6.9-1. When the server should be killed by HUP signal (logrotate ) nothing happens (no time change in process table) I attached list of HUP action and strace of the action. The daemon uses pipes() and udp() as the sources. Do you have any idea? Thanks for your help. Regards Lumir Unzeitig [root@server root]# ps -ef|grep syslog-n[g] 26 4893 1 0 15:06 ? 00:00:00 /sbin/syslog-ng -p /var/run/syslog-ng.pid -u syslog-ng -g syslog-ng -C /service/log [root@server root]# kill -HUP 4893 [root@server root]# ps -ef|grep syslog-n[g] 26 4893 1 0 15:06 ? 00:00:00 /sbin/syslog-ng -p /var/run/syslog-ng.pid -u syslog-ng -g syslog-ng -C /service/log [root@server root]# strace kill -HUP 4893 execve("/bin/kill", ["kill", "-HUP", "4893"], [/* 29 vars */]) = 0 uname({sys="Linux", node="server", ...}) = 0 brk(0) = 0x8345000 open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=77678, ...}) = 0 old_mmap(NULL, 77678, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb75e3000 close(3) = 0 open("/lib/tls/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200X\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1572440, ...}) = 0 old_mmap(NULL, 1279916, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x51c000 old_mmap(0x64f000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x132000) = 0x64f000 old_mmap(0x652000, 10156, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x652000 close(3) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb75e2000 set_thread_area({entry_number:-1 -> 6, base_addr:0xb75e2500, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 munmap(0xb75e3000, 77678) = 0 brk(0) = 0x8345000 brk(0x8366000) = 0x8366000 brk(0) = 0x8366000 open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=32148976, ...}) = 0 mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb73e2000 close(3) = 0 kill(4893, SIGHUP) = 0 exit_group(0) = ?

2 1

RE: [syslog-ng] DOMAIN Name Variable
by Breitman, Jason 18 Apr '06

18 Apr '06

Is there any update to this discussion? Will someone work on this? Thanks. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Valdis.Kletnieks(a)vt.edu Sent: Tuesday, March 14, 2006 9:24 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] DOMAIN Name Variable On Tue, 14 Mar 2006 09:04:13 GMT, David Anderson said: > Rob, > > Monday, March 13, 2006, 11:47:52 PM, you wrote: > > > that would be the TLD, yes: but i got the impression jason means > > 'domain' more like xyz.com foo.edu how.de > > > so therefore 'starting with the string before the last dot.' > > That doesn't work, as many domains outside of the US have a 3-part > domain, as in xyz.co.uk. And even within the US, the number of levels in the domain are quite flexible. For instance, most of our hosts are of the form 'hostname.dept.vt.edu' - but in a few cases, we have only 3 levels (mostly central servers), and in others we have 5 levels - the CS department has a few hosts of the form 'hostname.project.cs.vt.edu' for some large long-term groups. The only sane definition is "everything between the *first* period and the *final* period" (yes, there's a (usually implicit) trailing period in there, and some DNS resolvers would consider that 'foo.cc.' was a domain under the 'cc' top-level domain, and 'foo.cc' was 'foo.cc.vt.edu'. And forgetting the trailing dot is a favorite way to hose up an entry in a BIND zone file. ;) echo ${FQDN} | cut -d. -f2- is what you want. THE INFORMATION CONTAINED IN THIS MESSAGE AND ANY ATTACHMENT MAY BE PRIVILEGED, CONFIDENTIAL, PROPRIETARY OR OTHERWISE PROTECTED FROM DISCLOSURE. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, copying or use of this message and any attachment is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and permanently delete it from your computer and destroy any printout thereof.

1 0

RE: [syslog-ng] Changing sysconf dir ?!
by Heigl Florian - Munich-MR - external 18 Apr '06

18 Apr '06

hi, > Does it make sense to rework the "--sysconfdir" option of > configure, so that I can define the actual directory where > syslog-ng.conf is being placed ? > > $ ./configure --sysconfdir=/usr/local/syslog-ng/etc > $ make && make install > > -> /usr/local/syslog-ng/etc/syslog-ng/syslog-ng.conf > > where it should look like > > /usr/local/syslog-ng/etc/syslog-ng.conf > (without the unneccessary/additional 'syslog-ng' directory in > /usr/local/syslog-ng/etc) I stumbled over that issue and ended up using the config file path command line option instead, which is not a very beautiful way of site localization :) florian

1 0

log_fifo_size and locked tables
by Rob Munsch 17 Apr '06

17 Apr '06

'allo all, I've 1.6.9 in a centralized environment logging to MySQL. I'm currently working up a rotate system whereby: - the db is locked - mysqldump, gzip, scp off the box - rows with a timestamp older than 7 days are deleted - unlock - carry on. and was wondering a couple things. Firstly, 1) is this a horribly bad idea that should be replaced with a completely different plan? failing that, 2) How long does the default log_fifo_size of 2048 (lines, yes?) hold up, volume-wise? That is, while the tables are locked, i am assuming that this is where messages start piling up until they're unlocked. At the moment, i'm not dealing with high volume, but once everything seems in place i'm going to be adding many more hosts. is there any kind of rule of thumb for this value vis-a-vis the logs generated? At what sort of daily volume should i look towards upping it? Thanks! -- Rob Munsch Solutions For Progress IT

5 7

a question about facilities in syslog-ng
by Mohsen A. Momeni 17 Apr '06

17 Apr '06

Hi, Is it possible to change the facility of messages in destination part when sending messages to TCP or UDP destination? I have seen some applications providing the option to change the facility for remote logging. They get the host and facility. Is it possible in syslog-ng or linux default syslog? Is there any other logger that support this feature? Regards, Mohsen

1 0

Problems compiling syslog-ng on RH9 with spoof source
by Veum, Gary 14 Apr '06

14 Apr '06

Hi, I'm having some difficulty building syslog-ng on RH9 with spoof source. I've looked through the archives and haven't seen this particular issue. I've tried it using 1.6.5, 1.6.7, 1.6.10. They all have the same problem. I've loaded libol-0.3.16 and libnet-1.1.2.1-2.0. It will build fine w/o spoof source enabled. The start of the compiling problem appears as below. Any suggestions? thanks. -gv if gcc -DHAVE_CONFIG_H -I. -I/usr/src/redhat/SOURCES/syslog-ng-1.6.10/src -I. -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -g -O2 -Wall -I/usr/src/redhat/SOURCES/libol-0.3.16/src -D_GNU_SOURCE -MT afinet.o -MD -MP -MF ".deps/afinet.Tpo" \ -c -o afinet.o `test -f 'afinet.c' || echo '/usr/src/redhat/SOURCES/syslog-ng-1.6.10/src/'`afinet.c; \ then mv -f ".deps/afinet.Tpo" ".deps/afinet.Po"; \ else rm -f ".deps/afinet.Tpo"; exit 1; \ fi In file included from afinet.c:47: afinet.c.x:34: parse error before "libnet_t" afinet.c.x:34: warning: no semicolon at end of struct or union afinet.c.x:41: parse error before '}' token afinet.c.x: In function `do_afinet_dest_mark': afinet.c.x:50: dereferencing pointer to incomplete type afinet.c.x:51: dereferencing pointer to incomplete type afinet.c.x:52: dereferencing pointer to incomplete type afinet.c.x:53: dereferencing pointer to incomplete type afinet.c.x: In function `do_afinet_dest_free': afinet.c.x:59: dereferencing pointer to incomplete type

2 1

Synchronize logs after network outrage
by news gonzo news gonzo 14 Apr '06

14 Apr '06

hello, I'll have a question :) I would like to know if main server for syslog-ng is unreachable, when the connection redone, Are the 2 syslog will be synchronized ? and is there a specific message which describe the 2 events (deconnection and re-connection) ? Thx a lot --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici.

1 0

Antw: [syslog-ng] zero-loss from source{pipe()} (Abwesenheitsnotiz)
by Stephan Hendl 13 Apr '06

13 Apr '06

Sehr geehrte Damen und Herren, ich bin vom 12.-21.04.2006 nicht im Hause. In dringenden Fällen wenden Sie sich bitte an Herrn Göring (Tel. -545). Viele Grüße Stephan Hendl

3 2

Antw: [syslog-ng] Problems compiling syslog-ng on RH9 with spoof source (Abwesenheitsnotiz)
by Stephan Hendl 12 Apr '06

12 Apr '06

Sehr geehrte Damen und Herren, ich bin vom 12.-21.04.2006 nicht im Hause. In dringenden Fällen wenden Sie sich bitte an Herrn Göring (Tel. -545). Viele Grüße Stephan Hendl

1 0

Antw: Re: [syslog-ng] zero-loss from source{pipe()} (Abwesenheitsnotiz)
by Stephan Hendl 12 Apr '06

12 Apr '06

Sehr geehrte Damen und Herren, ich bin vom 12.-21.04.2006 nicht im Hause. In dringenden Fällen wenden Sie sich bitte an Herrn Göring (Tel. -545). Viele Grüße Stephan Hendl

1 0

Antw: Re: [syslog-ng] log_fifo_size and locked tables (Abwesenheitsnotiz)
by Stephan Hendl 12 Apr '06

12 Apr '06

Sehr geehrte Damen und Herren, ich bin vom 12.-21.04.2006 nicht im Hause. In dringenden Fällen wenden Sie sich bitte an Herrn Göring (Tel. -545). Viele Grüße Stephan Hendl

1 0

Antw: RE: Antw: [syslog-ng] zero-loss fromsource{pipe()} (Abwesenheitsnotiz) (Abwesenheitsnotiz)
by Stephan Hendl 12 Apr '06

12 Apr '06

Sehr geehrte Damen und Herren, ich bin vom 12.-21.04.2006 nicht im Hause. In dringenden Fällen wenden Sie sich bitte an Herrn Göring (Tel. -545). Viele Grüße Stephan Hendl

1 0

RE: Antw: [syslog-ng] zero-loss fromsource{pipe()} (Abwesenheitsnotiz)
by Heigl Florian - Munich-MR - external 12 Apr '06

12 Apr '06

I only found a phone number for their human ressources department, and I'm not that nasty to get in reach of mr. goering via that route. :) > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Rob Munsch > Sent: Wednesday, April 12, 2006 6:06 PM > To: Stephan.Hendl(a)lds.brandenburg.de; Syslog-ng users' and > developers' mailing list > Subject: Re: Antw: [syslog-ng] zero-loss fromsource{pipe()} > (Abwesenheitsnotiz) > > Okay, we get it, Herr Hendl isn't in. Can we do something not to get > these bounces until, by the looks of it, the 21st?? XD > > Stephan Hendl wrote: > > >Sehr geehrte Damen und Herren, > > > >ich bin vom 12.-21.04.2006 nicht im Hause. In dringenden > Fällen wenden Sie sich bitte an Herrn Göring (Tel. -545). > > > >Viele Grüße > >Stephan Hendl > >_______________________________________________ > >syslog-ng maillist - syslog-ng(a)lists.balabit.hu > >https://lists.balabit.hu/mailman/listinfo/syslog-ng > >Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > > > > > > > -- > Rob Munsch > Solutions For Progress IT > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

Antw: Re: Antw: [syslog-ng] zero-loss fromsource{pipe()} (Abwesenheitsnotiz) (Abwesenheitsnotiz)
by Stephan Hendl 12 Apr '06

12 Apr '06

Sehr geehrte Damen und Herren, ich bin vom 12.-21.04.2006 nicht im Hause. In dringenden Fällen wenden Sie sich bitte an Herrn Göring (Tel. -545). Viele Grüße Stephan Hendl

1 0

Antw: RE: [syslog-ng] Apache 2 + logger + syslog-ng (Abwesenheitsnotiz)
by Stephan Hendl 12 Apr '06

12 Apr '06

Sehr geehrte Damen und Herren, ich bin vom 12.-21.04.2006 nicht im Hause. In dringenden Fällen wenden Sie sich bitte an Herrn Göring (Tel. -545). Viele Grüße Stephan Hendl

1 0

RE: [syslog-ng] Apache 2 + logger + syslog-ng
by Doyon, Jean-Francois 12 Apr '06

12 Apr '06

Wow, thanks a bunch, that was very helpful! For the list archives: "logger" truncates messages to 400 bytes! The C source is very simple though, so I just modified some numbers to allow for messages of up to 2048 bytes, to match syslog-ng's default. Works like a charm now. Thanks again, J.F. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: April 12, 2006 4:44 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Apache 2 + logger + syslog-ng On Tue, 2006-04-11 at 09:50 -0400, Doyon, Jean-Francois wrote: > Sorry, > > Here's the system information: > > syslog-ng 1.6.9 built from source (on both ends) CentOS/RHEL 4.3 (on > both ends) Apache 2.2 built from source as well /usr/bin/logger from > package util-linux-2.12a-16.EL4.12 I've just tried to send a 5000 byte message to syslog-ng and it correctly wrote MSGONLY to the file. Tried the same using logger and it did not work: write(3, "<5>Apr 12 10:42:22 <someone>: xx"..., 431) = 431 readlink("/proc/self/fd/0", "pipe:[69597]", 511) = 12 ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfffe878) = -1 EINVAL (Invalid argument) time([1144831342]) = 1144831342 write(3, "<5>Apr 12 10:42:22 <someone>: xx"..., 431) = 431 readlink("/proc/self/fd/0", "pipe:[69597]", 511) = 12 ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfffe878) = -1 EINVAL (Invalid argument) time([1144831342]) = 1144831342 write(3, "<5>Apr 12 10:42:22 <someone>: xx"..., 431) = 431 readlink("/proc/self/fd/0", "pipe:[69597]", 511) = 12 ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfffe878) = -1 EINVAL (Invalid argument) time([1144831342]) = 1144831342 write(3, "<5>Apr 12 10:42:22 <someone>: xx"..., 431) = 431 read(0, "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"..., 4096) = 905 readlink("/proc/self/fd/0", "pipe:[69597]", 511) = 12 ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfffe878) = -1 EINVAL (Invalid argument) time([1144831342]) = 1144831342 write(3, "<5>Apr 12 10:42:22 <someone>: xx"..., 431) = 431 strace shows that logger writes 431 bytes to syslog-ng, so the problem is in logger. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Antw: RE: [syslog-ng] Apache 2 + logger + syslog-ng (Abwesenheitsnotiz)
by Stephan Hendl 12 Apr '06

12 Apr '06

Sehr geehrte Damen und Herren, ich bin vom 12.-21.04.2006 nicht im Hause. In dringenden Fällen wenden Sie sich bitte an Herrn Göring (Tel. -545). Viele Grüße Stephan Hendl

1 0

RE: [syslog-ng] Apache 2 + logger + syslog-ng
by Doyon, Jean-Francois 12 Apr '06

12 Apr '06

Sorry, Here's the system information: syslog-ng 1.6.9 built from source (on both ends) CentOS/RHEL 4.3 (on both ends) Apache 2.2 built from source as well /usr/bin/logger from package util-linux-2.12a-16.EL4.12 Thanks, J.F. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: April 11, 2006 8:03 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Apache 2 + logger + syslog-ng On Mon, 2006-04-10 at 14:04 -0400, Doyon, Jean-Francois wrote: > Hello, > > I've implemented centralized logging for my web servers using > syslog-ng and Apache's log pipe functionality. > you forgot to mention syslog-ng version, which is an important piece of information when reporting a problem. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Antw: Re: [syslog-ng] log_fifo_size and locked tables (Abwesenheitsnotiz)
by Stephan Hendl 12 Apr '06

12 Apr '06

Sehr geehrte Damen und Herren, ich bin vom 12.-21.04.2006 nicht im Hause. In dringenden Fällen wenden Sie sich bitte an Herrn Göring (Tel. -545). Viele Grüße Stephan Hendl

1 0

Regarding flush_timeout option !
by Arumugam, Rama 11 Apr '06

11 Apr '06

Hi, We're trying to use syslog-ng to log messages in an application. I'm trying to use sync option to buffer some messages and then flushing but I would like to use a combination of flushing based on the number of messages and time. I found out there's an option flush_timeout which does timely flushing irrespective of the number of messages specified with sync option but that option doesn't seem to work with my version of syslog-ng 1.6.9. Does anybody have any idea which version of syslog-ng support this option or is there any other equivalent option ? Thanks, Rama Confidentiality Notice This e-mail (including any attachments) is intended only for the recipients named above. It may contain confidential or privileged information and should not be read, copied or otherwise used by any other person. If you are not a named recipient, please notify the sender of that fact and delete the e-mail from your system.

2 1

Apache 2 + logger + syslog-ng
by Doyon, Jean-Francois 11 Apr '06

11 Apr '06

Hello, I've implemented centralized logging for my web servers using syslog-ng and Apache's log pipe functionality. All seemed to work quite well until I noticed that on the log server, where the entries get writen to file, all log lines get truncated at exactly 400 characters! I haven't messed with the log_msg_size() setting, which should be at default 2048. I still tried to increase, just to see, and it didn't change anything. I'm using the $MSGONLY template, so that the log file looks exactly like a regular Apache log file. On the log server side I have: ------ options { use_dns(no); dns_cache(no); stats(3600); }; source syslog_int { internal(); }; source apache_tcp { tcp(port(1999) keep-alive(yes) tcp-keep-alive(yes) max-connections(2)); }; destination apache_file { file("/home/atlas/var/log/access_log" template("$MSGONLY\n") template_escape(no) ); }; destination syslog_file { file("/home/atlas/var/log/syslog-ng.log"); }; log { source(syslog_int); destination(syslog_file); }; log { source(apache_tcp); destination(apache_file); }; ------ And on the log "clients" (the apache machines): ------ options { use_dns(no); dns_cache(no); stats(3600); }; source syslog_int { internal(); }; source apache_stream { unix-stream("/home/atlas/var/log/access_log.socket" keep-alive(yes)); }; destination syslog_file { file("/home/atlas/var/log/syslog-ng.log"); }; destination apache_tcp { tcp(192.168.100.91 port(1999) tcp-keep-alive(yes)); }; log { source(syslog_int); destination(syslog_file); }; log { source(apache_stream); destination(apache_tcp); }; ------ Along with: CustomLog "|/usr/bin/logger -u /home/atlas/var/log/access_log.socket" combined Anybody have any clue as to what's happening here??? I'm out of ideas ... Thanks! Jean-François Doyon Internet Service Development and Systems Support / Spécialiste de dèveloppements internet et soutien technique Canada Centre for Remote Sensing/Centre Canadien de télédétection Natural Resources Canada/Ressources Naturelles Canada http://atlas.gc.ca Tel./Tél.: (613) 992-4902 Fax: (613) 947-2410

2 1