- syslog-ng - lists.balabit.hu

suggestions for a web frontend to syslog data
by Doug Ahern 08 Apr '06

08 Apr '06

I've got syslog-ng logging in a traditional fashion to files on a filesystem. Some of my user community is clamoring for a web fronted with search features. Does anyone have any suggestions for any packages that might be able to provide this sort of functionality? In preparation for this, I've got the pieces together to send messages to a MySQL database, so that is no problem. Doug Ahern University System of Georgia

4 3

RE: [syslog-ng] suggestions for a web frontend to syslog data
by Heigl Florian - Munich-MR - external 07 Apr '06

07 Apr '06

> We're using Splunk (http://www.splunk.com) as a visual > front-end to our > syslog data. Wow, compared to php-syslog this seems like ferrari and fiat. Are You still happy with it? I played around in their demo site and am really amazed by it. Florian

4 4

RE: [syslog-ng] filters do not work from syslogd pipe as a source
by Lumir Unzeitig (DHL CZ) 07 Apr '06

07 Apr '06

[root@czchovwint011 root]# cat /dev/log-syslog-ng & [1] 12411 [root@czchovwint011 root]# logger -p mail.info "xxxxxxxxxxxxxxx" Apr 7 16:29:24 czchovwint011 root: xxxxxxxxxxxxxxx I tried the proposal action and it's partially clear. It is going out in the same format as it is in the syslog file file - without facility and priority. So I have to create pipe for all the lines in syslog.conf and not to use filters. Thanks a lot Jochen. Regards Lumir Unzeitig ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jochen Kirn Sent: Friday, April 07, 2006 3:09 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] filters do not work from syslogd pipe as a source 2006/4/7, Lumir Unzeitig (DHL CZ) <lumir.unzeitig(a)dhl.com>: .. It's looking like the facility, priority information has been lost after syslogd evaluation or by going through the pipe. (All events go only to /dev/null destination) Have you tried to log the messages read from the pipe without the filter to a file and post an example of the log entries to this mailling list ? I've a similar problem on AIX (5.3 ML3) where the system syslog daemon writes its messages to a named pipe and syslog ng should read from it. But for some odd reason AIX syslog adds the FACILITY and LEVEL to the log message which causes that the LEVEL field "shifts" to the right. Therefore Syslog-NG isn't able to parse this correctly, because it interpreted the FACILITY entry as program name ... I don't know what causes this, because I can't reproduce this problem on AIX 5.2 or below. regards Jochen

1 0

filters do not work from syslogd pipe as a source
by Lumir Unzeitig (DHL CZ) 07 Apr '06

07 Apr '06

Hi all, I installed syslog-ng for central logging in a company. The remote logging works perfectly. The syslog-ng machine should log its own logs to central repository and to typical /var/log by syslogd as well. I changed the original syslogd port to different one (510/udp) and created a pipe device which will be used for transport between syslogd and syslog-ng. /etc/syslog.conf ----------------------- *.info;mail.none;authpriv.none;cron.none /var/log/messages *.* |/dev/log-syslog-ng ----------------------- Generally the pipe is working the events are logged in by syslogd and syslog-ng as well. BUT if I apply any standard filter for the pipe source the statement is false in spite of should being true. Part of /etc/syslog-ng/syslog-ng.conf ----------------------------------------------------- options { ....... }source s_local { pipe("/dev/log-syslog-ng"); file("/proc/kmsg"); }; destination d_mesg_XXXX { file("/local/messages"); }; destination d_null { file("/dev/null"); }; filter f_mail_XXXX { level(debug); }; log { source(s_local); filter(f_mail_XXXX); destination(d_mesg_XXXX); }; log { source(s_local); destination(d_null); flags(final); }; ---------------------------------------------------- It's looking like the facility, priority information has been lost after syslogd evaluation or by going through the pipe. (All events go only to /dev/null destination) Any help is appreciated. Thanks Lumir Unzeitig

2 1

$HOST macro doing weird stuff
by Paul Krizak 06 Apr '06

06 Apr '06

I'm using the $HOST macro in a template, the relevant configuration bits being: template t_human_readable { template("$R_FULLDATE $HOST $FACILITY.$PRIORITY $MESSAGE\n"); template-escape(no); }; source s_external_syslog { udp(port(514)); }; destination d_big_messages { file ( "/var/log/logs/messages.log" template(t_human_readable) owner(root) group(root) perm(0644) ); }; log { source(s_external_syslog); destination(d_big_messages); }; The weird thing is that occasionally the $HOST field shows up as the IP address, but without dots, i.e. 163181224153. I haven't really discovered a pattern to it yet, but I'm wondering if maybe it's a bug in the DNS caching code. I'm using pretty large values: dns_cache(yes); dns_cache_size(10000); dns_cache_expire(3600); dns_cache_expire_failed(30); Any ideas? -- Paul Krizak 5900 E. Ben White Blvd. MS 625 Advanced Micro Devices Austin, TX 78741 Linux/Unix Systems Engineering Phone: (512) 602-8775 Microprocessor Solutions Sector Cell: (512) 791-0686

3 4

Re: [syslog-ng] I/O error since upgrade to v1.9.9-1
by ma.LAN.ge 06 Apr '06

06 Apr '06

> On Wed, 2006-04-05 at 20:00 +0200, ma.LAN.ge wrote: > > > > Yesterday I updated my Debian Etch (kernel 2.6.16-1) with syslog-ng > > > > v1.9.9-1. > > > > > > > > I had to modify syslog-ng.conf, cause syslog-ng did not start after > > > > upgrading (syntax error line xxx). > > > > > > I already reported similar issues in our bugzilla about (currently) > > > unimplemented features in the 1.9 branch which were working in the 1.6 > > > branch. Hopefully Bazsi will implement the missing features or convert > > > these errors into warnings and FIXME-s in the near future :)) > > > > > > > OK, I merged my old .conf with the new .conf and cleaned some old > .log > > > files > > > > in /var/log/. > > > > > > > > syslog-ng script started now w/o any syntax errors, but in > > > /var/log/messages > > > > folowing occurs massively and rapidly: > > > > > > > > syslog-ng: I/O error occurred while writing, error='Operation not > > > permitted > > > > (1)', fd='5' | fd='17' > > > > > > If your configuration isn't confidental, please post your > configuration > > OK, attached. (now compressed ;) > > > with the list of the /proc/[syslog-ng_pid]/fd directory. > > Hm, unbeliebvable, but true: I only restarted syslog-ng and it seems to > > work. No more errors like mentioned above occurred anymore (until now > =). > > It must have been some kind of permission problem on one/more of the > destination files. "Operation not permitted" was returned in response > for write(). OK, I've got this problem again. (see attachments, 1 for private mail) I attached the syslog and a pic from the /proc/<pid>/fd/ directory with sockets etc. The syslog seems to point me to a possible reason: while initializing my firewall with iptables rules, these I/O errors occur. After that, the errors disappear in syslog. But a good syslog should always be started before most services, cause it should log system messages ;) So it should also work while initializing my firewall rules 8) So, how can we cath this problem to find a solution? > > > > > But a question besides: How can I hide the syslog-ng 'log statistics' > list > > from being displayed in syslog? It nerves a little bit ;) > > use stats_freq(-1) in your global options. Thx for this =) -- Thx in advance "Feel free" - 10 GB Mailbox, 100 FreeSMS/Monat ... Jetzt GMX TopMail testen: http://www.gmx.net/de/go/topmail

2 1

Re: [syslog-ng] I/O error since upgrade to v1.9.9-1 [again w/o attachments]
by ma.LAN.ge 06 Apr '06

06 Apr '06

> > Yesterday I updated my Debian Etch (kernel 2.6.16-1) with syslog-ng > > v1.9.9-1. > > > > I had to modify syslog-ng.conf, cause syslog-ng did not start after > > upgrading (syntax error line xxx). > > I already reported similar issues in our bugzilla about (currently) > unimplemented features in the 1.9 branch which were working in the 1.6 > branch. Hopefully Bazsi will implement the missing features or convert > these errors into warnings and FIXME-s in the near future :)) > > > OK, I merged my old .conf with the new .conf and cleaned some old .log > files > > in /var/log/. > > > > syslog-ng script started now w/o any syntax errors, but in > /var/log/messages > > folowing occurs massively and rapidly: > > > > syslog-ng: I/O error occurred while writing, error='Operation not > permitted > > (1)', fd='5' | fd='17' > > If your configuration isn't confidental, please post your configuration OK, attached. (now compressed ;) > with the list of the /proc/[syslog-ng_pid]/fd directory. Hm, unbeliebvable, but true: I only restarted syslog-ng and it seems to work. No more errors like mentioned above occurred anymore (until now =). But a question besides: How can I hide the syslog-ng 'log statistics' list from being displayed in syslog? It nerves a little bit ;) > > Unfortunately there are issues with the current 1.9.9 version. Syslog-ng > 1.9.x entered into debian unstable and testing, so it's getting > used/tested more widely than before. If your machine is in production > use, I recommend to downgrade to the latest 1.6.x package, and hold it > until the remaining issues will be fixed. -- Thx in advance. E-Mails und Internet immer und �berall! 1&1 PocketWeb, perfekt mit GMX: http://www.gmx.net/de/go/pocketweb

2 2

I/O error since upgrade to v1.9.9-1 [again w/o attachments]
by ma.LAN.ge 06 Apr '06

06 Apr '06

Hi everybody out there =) Yesterday I updated my Debian Etch (kernel 2.6.16-1) with syslog-ng v1.9.9-1. I had to modify syslog-ng.conf, cause syslog-ng did not start after upgrading (syntax error line xxx). OK, I merged my old .conf with the new .conf and cleaned some old .log files in /var/log/. syslog-ng script started now w/o any syntax errors, but in /var/log/messages folowing occurs massively and rapidly: syslog-ng: I/O error occurred while writing, error='Operation not permitted (1)', fd='5' | fd='17' Please help me =) [I've sent this message again w/o attachments, cause maybe my first mail was too big for this list.] -- Thx in advance =) Analog-/ISDN-Nutzer sparen mit GMX SmartSurfer bis zu 70%! Kostenlos downloaden: http://www.gmx.net/de/go/smartsurfer

3 3

IPv6 support
by Michael Clark 05 Apr '06

05 Apr '06

We've got a client looking into moving to IPv6 and their asking if syslog-ng support IPv6. My initial response is sure if the OS supports IPv6 (Solaris in this case, which it does). However, there are some address centric parameters in the configuration file that might be affected by IPv6. I checked the FAQ but didn't find anything on the search. Does anyone know if IPv6 support works with syslog-ng? BTW, this is a large network which will have lots of legacy IPv4 networks that it will have to connect to as well so this isn't going to happen within the next year. It's more of a planning question so they can start mapping out the change. ______________________ Michael W. Clark Adaptive Architecture, Inc. (www.adapt2.com) mclark(a)adapt2.com

2 2

syslog-ng dying after reload
by Rune V. Sjøen 05 Apr '06

05 Apr '06

When logrotate does this: /var/log/messages { rotate 4 weekly missingok notifempty postrotate /etc/init.d/syslog-ng reload >/dev/null <--- this endscript } syslog-ng dies without any trace in the logs. '/etc/init.d/syslog-ng restart' works fine. I've included an strace[1] of '/etc/init.d/syslog-ng reload' and the syslog-ng config file[2]. This is version 1.9.9-1 Any help in this matter would be appreciated. [1] Strace execve("/etc/init.d/syslog-ng", ["/etc/init.d/syslog-ng", "reload"], [/* 15 vars */]) = 0 uname({sys="Linux", node="rainbow.homelinux.org", ...}) = 0 brk(0) = 0x80f5000 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=27071, ...}) = 0 old_mmap(NULL, 27071, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7fc2000 close(3) = 0 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/libncurses.so.5", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p\343\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0644, st_size=268396, ...}) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc1000 old_mmap(NULL, 273580, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f7e000 old_mmap(0xb7fb8000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x39000) = 0xb7fb8000 close(3) = 0 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/tls/libdl.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\20\f\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0644, st_size=9592, ...}) = 0 old_mmap(NULL, 12404, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f7a000 old_mmap(0xb7f7c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0xb7f7c000 close(3) = 0 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/tls/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\320O\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1266800, ...}) = 0 old_mmap(NULL, 1272764, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e43000 old_mmap(0xb7f70000, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x12d000) = 0xb7f70000 old_mmap(0xb7f78000, 7100, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f78000 close(3) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e42000 mprotect(0xb7f70000, 20480, PROT_READ) = 0 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7e426c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 munmap(0xb7fc2000, 27071) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 open("/dev/tty", O_RDWR|O_NONBLOCK|O_LARGEFILE) = 3 close(3) = 0 open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=288544, ...}) = 0 mmap2(NULL, 288544, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7dfb000 close(3) = 0 brk(0) = 0x80f5000 brk(0x80f6000) = 0x80f6000 brk(0x80f7000) = 0x80f7000 brk(0x80f8000) = 0x80f8000 getuid32() = 0 getgid32() = 0 geteuid32() = 0 getegid32() = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 time(NULL) = 1143980943 brk(0x80f9000) = 0x80f9000 open("/etc/mtab", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=242, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc8000 read(3, "/dev/hda1 / ext3 rw,acl,errors=r"..., 4096) = 242 close(3) = 0 munmap(0xb7fc8000, 4096) = 0 open("/proc/meminfo", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc8000 read(3, "MemTotal: 515576 kB\nMemFre"..., 1024) = 598 close(3) = 0 munmap(0xb7fc8000, 4096) = 0 brk(0x80fa000) = 0x80fa000 rt_sigaction(SIGCHLD, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGCHLD, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGQUIT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGQUIT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigaction(SIGQUIT, {SIG_IGN}, {SIG_DFL}, 8) = 0 uname({sys="Linux", node="rainbow.homelinux.org", ...}) = 0 brk(0x80fb000) = 0x80fb000 stat64("/root", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat64(".", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 getpid() = 6890 getppid() = 6889 getpgrp() = 6889 rt_sigaction(SIGCHLD, {0x807b7c0, [], 0}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 open("/etc/init.d/syslog-ng", O_RDONLY|O_LARGEFILE) = 3 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfcdd8f8) = -1 ENOTTY (Inappropriate ioctl for device) _llseek(3, 0, [0], SEEK_CUR) = 0 read(3, "#! /bin/sh\n#\n# skeleton\texample "..., 80) = 80 _llseek(3, 0, [0], SEEK_SET) = 0 getrlimit(RLIMIT_NOFILE, {rlim_cur=1024, rlim_max=1024}) = 0 dup2(3, 255) = 255 close(3) = 0 fcntl64(255, F_SETFD, FD_CLOEXEC) = 0 fcntl64(255, F_GETFL) = 0x8000 (flags O_RDONLY|O_LARGEFILE) fstat64(255, {st_mode=S_IFREG|0755, st_size=2199, ...}) = 0 _llseek(255, 0, [0], SEEK_CUR) = 0 brk(0x80fc000) = 0x80fc000 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 read(255, "#! /bin/sh\n#\n# skeleton\texample "..., 2199) = 2199 brk(0x80fd000) = 0x80fd000 open("/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/lib/gconv/gconv-modules", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=45568, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc8000 read(3, "# GNU libc iconv configuration.\n"..., 4096) = 4096 brk(0x80fe000) = 0x80fe000 read(3, "lias\tJS//\t\t\tJUS_I.B1.002//\nalias"..., 4096) = 4096 brk(0x80ff000) = 0x80ff000 brk(0x8100000) = 0x8100000 brk(0x8101000) = 0x8101000 read(3, "ule\tINTERNAL\t\tISO-8859-3//\t\tISO8"..., 4096) = 4096 brk(0x8102000) = 0x8102000 brk(0x8103000) = 0x8103000 brk(0x8104000) = 0x8104000 read(3, "lias\tISO-IR-199//\t\tISO-8859-14//"..., 4096) = 4096 brk(0x8105000) = 0x8105000 brk(0x8106000) = 0x8106000 brk(0x8107000) = 0x8107000 read(3, "\t\tto\t\t\tmodule\t\tcost\nalias\tCSEBCD"..., 4096) = 4096 brk(0x8108000) = 0x8108000 brk(0x8109000) = 0x8109000 read(3, "ule\t\tcost\nalias\tCP284//\t\t\tIBM284"..., 4096) = 4096 brk(0x810a000) = 0x810a000 brk(0x810b000) = 0x810b000 brk(0x810c000) = 0x810c000 read(3, "lias\tCP864//\t\t\tIBM864//\nalias\t86"..., 4096) = 4096 brk(0x810d000) = 0x810d000 brk(0x810e000) = 0x810e000 brk(0x810f000) = 0x810f000 read(3, "module\tIBM937//\t\tINTERNAL\t\tIBM93"..., 4096) = 4096 brk(0x8110000) = 0x8110000 brk(0x8111000) = 0x8111000 brk(0x8112000) = 0x8112000 read(3, "\tEUC-JP//\nalias\tUJIS//\t\t\tEUC-JP/"..., 4096) = 4096 brk(0x8113000) = 0x8113000 brk(0x8114000) = 0x8114000 brk(0x8115000) = 0x8115000 read(3, "module\t\tcost\nalias\tISO-IR-143//\t"..., 4096) = 4096 brk(0x8116000) = 0x8116000 brk(0x8117000) = 0x8117000 brk(0x8118000) = 0x8118000 read(3, "-BOX//\nmodule\tISO_10367-BOX//\t\tI"..., 4096) = 4096 brk(0x8119000) = 0x8119000 brk(0x811a000) = 0x811a000 read(3, "module\tINTERNAL\t\tEUC-JISX0213//\t"..., 4096) = 512 read(3, "", 4096) = 0 close(3) = 0 munmap(0xb7fc8000, 4096) = 0 brk(0x811b000) = 0x811b000 open("/usr/lib/gconv/ISO8859-1.so", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200\4\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0644, st_size=5340, ...}) = 0 brk(0x811c000) = 0x811c000 old_mmap(NULL, 8228, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7fc6000 old_mmap(0xb7fc7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0xb7fc7000 close(3) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 stat64("/sbin/syslog-ng", {st_mode=S_IFREG|0755, st_size=243436, ...}) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 stat64("/etc/default/syslog-ng", {st_mode=S_IFREG|0644, st_size=320, ...}) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 stat64("/etc/default/syslog-ng", {st_mode=S_IFREG|0644, st_size=320, ...}) = 0 open("/etc/default/syslog-ng", O_RDONLY|O_LARGEFILE) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=320, ...}) = 0 brk(0x811d000) = 0x811d000 read(3, "# If variables is not set here, "..., 320) = 320 close(3) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 brk(0x811e000) = 0x811e000 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 brk(0x811f000) = 0x811f000 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 brk(0x8120000) = 0x8120000 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 brk(0x8121000) = 0x8121000 rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0 _llseek(255, -9, [2190], SEEK_CUR) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7e42708) = 6891 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGCHLD (Child exited) @ 0 (0) --- waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], WNOHANG) = 6891 waitpid(-1, 0xbfcdc4ec, WNOHANG) = -1 ECHILD (No child processes) sigreturn() = ? (mask now []) rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigaction(SIGINT, {0x807a090, [], 0}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {0x807a090, [], 0}, 8) = 0 stat64(".", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat64("/sbin/start-stop-daemon", {st_mode=S_IFREG|0755, st_size=18488, ...}) = 0 stat64("/sbin/start-stop-daemon", {st_mode=S_IFREG|0755, st_size=18488, ...}) = 0 brk(0x8122000) = 0x8122000 rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7e42708) = 6892 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGCHLD (Child exited) @ 0 (0) --- waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], WNOHANG) = 6892 waitpid(-1, 0xbfcdbdac, WNOHANG) = -1 ECHILD (No child processes) sigreturn() = ? (mask now []) rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigaction(SIGINT, {0x807a090, [], 0}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {0x807a090, [], 0}, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 read(255, "\nexit 0\n\n", 2199) = 9 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 exit_group(0) = ? [2] syslog-ng.conf ###### # Standard syslog levels # emerg alert crit err warning notice info debug # Standard syslog facilities # auth, authpriv, cron, daemon, ftp, kernel, lpr, mail, news, syslog, user, uucp ###### # Options options { chain_hostnames(0); time_reopen(10); time_reap(360); #sync(0); log_fifo_size(2048); create_dirs(yes); owner(root); group(adm); perm(0640); dir_owner(root); dir_group(root); dir_perm(0755); use_dns(no); #log_msg_size(2048); stats_freq(86400); }; ###### # Sources source all { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); # udp(); }; source krnl {file("/proc/kmsg" log_prefix("kernel: "));}; source int { internal(); }; source main { unix-stream("/dev/log"); }; source net { udp(); }; ###### # Destinations destination df_auth { file("/var/log/auth.log"); }; destination df_syslog { file("/var/log/syslog"); }; destination df_cron { file("/var/log/cron.log"); }; destination df_daemon { file("/var/log/daemon.log"); }; destination df_kern { file("/var/log/kern.log"); }; destination df_lpr { file("/var/log/lpr.log"); }; destination df_mail { file("/var/log/mail.log"); }; destination df_mail_err { file("/var/log/mail.err"); }; destination df_user { file("/var/log/user.log"); }; destination df_uucp { file("/var/log/uucp.log"); }; destination df_messages { file("/var/log/messages"); }; destination df_debug { file("/var/log/debug.log"); }; destination df_network { file("/var/log/network.log"); }; destination dp_xconsole { pipe("/dev/xconsole"); }; # X console destination du_all { usertty("*"); }; # Users logged in destination df_report { file("/var/log/report.log"); }; ###### # Filters filter f_auth { facility(auth,authpriv); }; filter f_syslog { not facility(auth,authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warning { level(warn); }; filter f_error { level(err); }; filter f_critical { level(crit); }; filter f_over_info_up { level(info..emerg); }; filter f_over_notice { level(notice..emerg); }; filter f_over_warning { level(warn..emerg); }; filter f_over_error { level(err..emerg); }; filter f_over_critical { level(crit..emerg); }; filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; filter f_xconsole { facility(daemon,mail) or level(debug,info,notice,warn) or (facility(news) and level(crit,err,notice)); }; ###### # Logs # order matters if you use "flags(final);" log { source(net); destination(df_network); flags(final); }; log { source(all); filter(f_auth); destination(df_auth); flags(final); }; log { source(all); filter(f_mail); filter(f_error); destination(df_mail_err); }; log { source(all); filter(f_mail); destination(df_mail); flags(final); }; log { source(all); filter(f_cron); destination(df_cron); flags(final); }; log { source(all); filter(f_daemon); destination(df_daemon); }; log { source(all); filter(f_kern); destination(df_kern); }; log { source(all); filter(f_debug); destination(df_debug); }; log { source(all); filter(f_over_error); destination(df_report); }; log { source(all); filter(f_emergency); destination(du_all); }; log { source(all); destination(df_messages); }; log { source(all); filter(f_xconsole); destination(dp_xconsole); }; -- -=<X>=- Rune V. Sjøen You always pass failure on the way to success http://www.opensourcesolutions.no

2 6

2GB log file size restrictions 1.9 tree
by William Bell 01 Apr '06

01 Apr '06

Is there a way to configure this restriction, nothin is mentioned about it in the doc's. Up until recently I deployed 1.6 tree across all my devices and i never ran into this problem. I just recently upgraded to the 1.9 tree and now syslog-ng just crashes when a 2gb file is reached. If anyone has ANY ideas there are greatly accepted. William Bell CWIE Security

2 1

syslog-ng 1.6.10 released
by Balazs Scheidler 31 Mar '06

31 Mar '06

Hi, As some of you might have read it on my blog (http://bazsi.blogspot.com) I have released syslog-ng 1.6.10, the next stable version in the 1.6.x series, with the following changes: News for the 1.6.10 release Mon, 27 Mar 2006 16:43:08 +0200 * Updated documentation, documentation is now generated from XML instead of SGML. * Scalability improvements for many parallel syslog connections tunable using the time_sleep() global option. -- Bazsi

1 0

syslog-ng & mysql set up for network devices only
by Patrick Topping 31 Mar '06

31 Mar '06

I have a MySQL question that I hope does not sound to 'newbie-ish'..:-) I have just set up a new server for logging all the network devices. Syslog-ng is working fine and now I am ready to move onto setting up the MySQL side. I was wondering if any had created a MySQL database specifically for network devices and if it was significantly different than what is on the following URL: http://vermeer.org/display_doc.php?doc_id=1 CREATE TABLE logs ( host varchar(32) default NULL, facility varchar(10) default NULL, priority varchar(10) default NULL, level varchar(10) default NULL, tag varchar(10) default NULL, date date default NULL, time time default NULL, program varchar(15) default NULL, msg text, seq int(10) unsigned NOT NULL auto_increment, PRIMARY KEY (seq), KEY host (host), KEY seq (seq), KEY program (program), KEY time (time), KEY date (date), KEY priority (priority), KEY facility (facility) ) TYPE=MyISAM; The question that I have relates to following tables in the DB: priority : where would this come into play for network devices? level: not sure what this is tag: where would this come into play for network devices? program: where would this come into play for network devices? If there is anyone who could help me with this network specific DB I would appreciate it. Thanks in advance. -Patrick

1 0

RE: [syslog-ng] Creating a named pipe (FIFO)
by Timothy A. Holmes 29 Mar '06

29 Mar '06

Good morning Peter: thank you for your reply Does the name of the named pipe need to be the same as the destination line mkfifo splunk; destination splunk { pipe("/var/syslog-ng/syslog_fifo"); }; This is what I currently have in the config file now, and I am still getting an error. Thank you TIM My entire syslog-ng.conf is posted at http://www.pastebin.com/616048 Thank you Timothy A. Holmes IT Manager / Network Admin / Web Master / Computer Teacher Medina Christian Academy A Higher Standard... Jeremiah 33:3 Jeremiah 29:11 Esther 4:14 > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng- > bounces(a)lists.balabit.hu] On Behalf Of HÖLTZL Péter > Sent: Wednesday, March 22, 2006 9:07 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] Creating a named pipe (FIFO) > > On Wed, 2006-03-22 at 08:50 -0500, Timothy A. Holmes wrote: > > I did some investigation and asked a few questions on IRC, and someone > > told me that I needed to use the mkpipe command, however I have been > > unable to locate (using google) the proper syntax for the mkpipe > > command. > > you can create pipes by 'mknod PIPENAME p' command on any linux box. > 'mkfifo PIPENAME' makes the same pipe as well. > > Péter > > > -- > BalaBit IT Bizt. Kft | Tel: +36 1 371-0540 | GnuPG Fingerprint: > holtzl.peter(a)balabit.hu | Mobil: +36 20 366-9667 | 796B C9D3 E492 B006 > C8B2 > http://www.balabit.hu/ | Fax: +36 1 208-0875 | 4D1F 5320 28E3 9A1B > 3FC6

3 2

blog available
by Balazs Scheidler 28 Mar '06

28 Mar '06

Hi, After giving some thought to the idea I decided to start my blog where I'm planning to publish syslog-ng related things as well. If you are interested you can find it at: http://bazsi.blogspot.com/ blogger.com has RSS feeds, so you can use that as well. -- Bazsi

1 0

RE: [syslog-ng] multicast support
by Heigl Florian - Munich-MR - external 28 Mar '06

28 Mar '06

Hi, > Let me know what you think, I wrote this patch to make > clustering logging > servers dead easy and straight forward....I hope its useful > to someone else > too. This will come in handy some day, and even if I can't use it 'right now', thank You lots for taking the time to implement that. florian

1 0

RE: [syslog-ng] prune identical messages
by Richard Legault 28 Mar '06

28 Mar '06

I would prefer the message suppressed if possible as it gives more information, sorry for not being specific. So is it possible to have the suppressed message. As I have not seen any such option? Richard -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Valdis.Kletnieks(a)vt.edu Sent: March 27, 2006 4:42 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] prune identical messages On Mon, 27 Mar 2006 15:26:41 EST, Richard Legault said: > But the message repeating does not give you any new information so it is a wa ste of diskspace to store it. > Because It is just as helpfull to say > foo1: ssh connection from 129.257.10.4 > foo1: 2,348 duplicate messages suppressed *exactly*. But what you asked for was (your words now): "those occurring between would simply be dropped." Producing a "duplicate messages suppressed" is *not* "simply dropping". Also, notice that if you have an interleaved series of 2 or more message streams that are identical to themselves but not each other, you can get this: foo1: message 1 foo1: message 2 foo1: message 3 foo1: message 2 foo1: message 3 foo1: message 1 foo1: message 3 and so on - this requires keeping a copy of the last N messages rather than just the last single one to do it correctly. Proper choice of N to prevent being DoS'ed by an out-of-memory when flooded by a mass of non-identical messages is left as an exercise for the student....

3 4

multicast support
by Alexander Clouter 28 Mar '06

28 Mar '06

Hi, I dug around for ages and could not find any hint of multicast support in syslog-ng so I decided to throw a patch together. Its a Works For Me(tm) job and took a little longer than I was expecting but hopefully others will find it useful. It applies to a 1.9.9 tree and should just work. I have not tested the IPv6 support but I cannot see a reason why it would not work, unless I have borked up my struct's :) Let me know what you think, I wrote this patch to make clustering logging servers dead easy and straight forward....I hope its useful to someone else too. The only improvement I can think of is adding a multicast 'drop membership' occurance, however I could not see a nice simple place to do this; it should be before the socket closes. Cheers Alex

1 0

prune identical messages
by Richard Legault 27 Mar '06

27 Mar '06

How can I prevent a log from being written that is identical to the log message that immediately preceded it. I would like to throttle those messages so that they can only be printed once every 10 minutes, those occurring between would simply be dropped. Richard Legault Senior Engineer 519-880-2400 ext 2722 www.sandvine.com

3 2

RE: [syslog-ng] prune identical messages
by Richard Legault 27 Mar '06

27 Mar '06

But the message repeating does not give you any new information so it is a waste of diskspace to store it. Because It is just as helpfull to say foo1: ssh connection from 129.257.10.4 foo1: 2,348 duplicate messages suppressed then to say foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 ... foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 I only want to throttle the part that writes the message to the disk. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Valdis.Kletnieks(a)vt.edu Sent: March 27, 2006 2:59 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] prune identical messages On Mon, 27 Mar 2006 14:25:51 EST, Richard Legault said: > How can I prevent a log from being written that is identical to the log message > that immediately preceded it. I would like to throttle those messages so that > they can only be printed once every 10 minutes, those occurring between would > simply be dropped. You *don't* want to simply drop them. For instance, there's a *big* difference between: foo1: ssh connection from 129.257.10.4 and foo1: ssh connection from 129.257.10.4 foo1: 2,348 duplicate messages suppressed Similarly, how would your response differ for: frobozz13: Correctable ECC error detected on board 4, SIMM 7. and frobozz13: Correctable ECC error detected on board 4, SIMM 7. frobozz13: 1,438,598 duplicate messages suppressed

2 1

RE: [syslog-ng] prune identical messages
by SOLIS, ALEX 27 Mar '06

27 Mar '06

I don't get a "duplicate messages suppressed" log when I have multiple entries. Is there an option I need to turn on or is there a certain threshold for this feature to engage? I could really use this type of suppression for some logs that I actively alert on. Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Richard Legault Sent: Monday, March 27, 2006 2:27 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] prune identical messages But the message repeating does not give you any new information so it is a waste of diskspace to store it. Because It is just as helpfull to say foo1: ssh connection from 129.257.10.4 foo1: 2,348 duplicate messages suppressed then to say foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 ... foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 I only want to throttle the part that writes the message to the disk. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Valdis.Kletnieks(a)vt.edu Sent: March 27, 2006 2:59 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] prune identical messages On Mon, 27 Mar 2006 14:25:51 EST, Richard Legault said: > How can I prevent a log from being written that is identical to the log message > that immediately preceded it. I would like to throttle those messages so that > they can only be printed once every 10 minutes, those occurring between would > simply be dropped. You *don't* want to simply drop them. For instance, there's a *big* difference between: foo1: ssh connection from 129.257.10.4 and foo1: ssh connection from 129.257.10.4 foo1: 2,348 duplicate messages suppressed Similarly, how would your response differ for: frobozz13: Correctable ECC error detected on board 4, SIMM 7. and frobozz13: Correctable ECC error detected on board 4, SIMM 7. frobozz13: 1,438,598 duplicate messages suppressed _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Profiling syslog-ng
by John Morrissey 27 Mar '06

27 Mar '06

I'm trying to profile syslog-ng on a set of servers that generate high levels of logging traffic (a few GB/day). Currently, syslog-ng is consuming anywhere from 40-80% of a CPU on a dual Pentium IV Xeon machine. gprof(1) generates a profile, except for time consumed - it says "no time accumulated" even after running a profile-enabled syslog-ng for several minutes. For example: Flat profile: Each sample counts as 0.01 seconds. no time accumulated % cumulative self self total time seconds seconds calls Ts/call Ts/call name 0.00 0.00 0.00 667 0.00 0.00 xalloc 0.00 0.00 0.00 593 0.00 0.00 prepare 0.00 0.00 0.00 434 0.00 0.00 gc_mark 0.00 0.00 0.00 372 0.00 0.00 ol_string_free 0.00 0.00 0.00 313 0.00 0.00 do_prepare_write I've found similar complaints in the binutils list archives: http://sourceware.org/ml/binutils/2005-07/msg00364.html http://sourceware.org/ml/binutils/2002-01/msg00121.html http://sourceware.org/ml/binutils/2001-10/msg00315.html Personally, we're using glibc 2.3.2.ds1-22 and building the Debian syslog-ng 1.6.9-1 package using gcc 3.3.5-3 or 3.4.3-13. I've also tried oprofile, but it only(?) seems to report call counts, not time consumed. For example: samples % symbol name 102829 67.7349 io_iter 16560 10.9083 prepare 2975 1.9597 parse_log_msg 2518 1.6586 expand_macro I've read io_iter() and it doesn't seem to contain any smoking guns that would account for 68% of total syslog-ng CPU usage. Any suggestions on how to profile syslog-ng? I can post my configuration if it'd be helpful, but we've twisted many knobs (gc idle/busy thresholds, buffering via different sync() levels, disabling remote syslogging via UDP, etc.) without a major change in CPU consumption. john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

5 23

Re: [syslog-ng] AIX compilation of syslog-ng 1.6.* (problems with ld)
by Jochen Kirn 27 Mar '06

27 Mar '06

I use gcc to build full static syslog binaries on AIX 5.1/5.3 gcc version 3.3.2 from AIX Toolbox site (http://www-03.ibm.com/servers/aix/products/aixos/linux/download.html ) 1) configure & compile libol 0.3.17 ./configure --disable-shared 2) configure & compile syslog ng 1.6.9 ./configure --prefix=/opt/syslog-ng --with-libol=/home/build/work/libol- 0.3.17 LIBS=-ldl --enable-full-static afaik you'll fail to build full static version on AIX unless you tweak the 'configure' script of syslog ng, since it can not identify the ld version on AIX @Balazs: I think the the syslog-ng's configure script requires additional tweaking for supporting AIX's version of the ld command. The configure script tries to identify the ld option by issuing 'ld -V' which doesn't work on AIX 5.1. The output of AIX 5.3 isn't recognized. AIX 5.1 (ML8): root@aix51host:/root : uname -a AIX aix51host 1 5 00594BAA4C00 root@aix51host:/root : ld -V ld: 0706-011 The -V flag needs a parameter. ld: 0706-030 No processing done. Specify at least one input or import file or use at least one -b ex<n> option. AIX 5.3 (ML3): root@aix53host:/root : uname -a AIX aix53host 3 5 00C6D95B4C00 root@aix53host:/root : ld -V ld: LD 1.64 (08/19/2003) It would make sense to me to have an additional configure parameter '--with-ldflags' because AIX's ld requires '-dn' parameter for performing a static build what do you think ? thx, Jochen

2 3

RE: [syslog-ng] Creating a named pipe (FIFO)
by William Bell 24 Mar '06

24 Mar '06

As a feature request / bonus to this conversation, has any investigation been done into adding create fifo ability to the pipe source driver. Im sure that everyone could benefit from pipes that are created and torn down by syslog-ng so that unless syslog-ng is holding the pipe open and holding ownership of the pipe the pipe does not exist. This would be an extra added bonus on the security front. Its an ok fix to have the pipe created by the startup script and even torn down by that same script, however if for some reason syslog-ng crashes or an administrator thinks it's a good idea to just kill off the process that pipe hangs around and is a potential security risk. Its just an idea. Maybe someone can run with it. William Bell II CWIE Security -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel Sent: Wednesday, March 22, 2006 10:21 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Creating a named pipe (FIFO) We do the opposite. We wanted to use the message matching rules of syslog-ng to essentially rewrite the facility.level (priority) of messages and then log them again. To accomplish this, we have a "normal" syslog-ng running that listens on the localhost:514 port that then logs to the local files, and to a central syslog-ng server. We then start a second instance of syslog-ng within the startup script for the applications, such as apache. - check for and create the named pipe(s) - start syslong-ng specific to this application - start the application that logs to the named pipe(s) This instance of syslog-ng parses the messages and relogs via syslog to localhost with a new set of priorities. This allows local syslog files to contain the appriopriate facitliy.level of messages as well as our central syslog-ng server. It also allows for a very complicated set of match rules for a given application without making an overly complicated syslong-ng configuration file. Basically you end up with one configuration file per application. This is just our syslog architecture, so your milage may vary. Evan. On Wed, 22 Mar 2006, Cary, Kim wrote: > Date: Wed, 22 Mar 2006 09:11:26 -0800 > From: "Cary, Kim" <Kim.Cary(a)pepperdine.edu> > Reply-To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Creating a named pipe (FIFO) > > We create our pipes by placing the appropriate commands in the > syslog-ng startup file (/etc/init.d/syslog-ng). > > [Actually, we test to see if the pipe already exists; if not, we > create it. We do this creation in /var/run and here the pipe needs to > be recreated after every boot. We don't want to recreate it when we > restart the process (syslog-ng) that is feeding it, since recreating > it requires us to bounce the process that is reading from it (fisq.pl)]. > > Kim Cary > Infrastructure Security Administrator > M-F 7-4 ~ 310 506 6655 > > > -- Evan Rempel erempel(a)uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Forward to eIQ?
by Kevin 23 Mar '06

23 Mar '06

Is anybody using syslog-ng to forward events to EIQ's "Syslog Service"? I'm using Secure Computing's new "Security Reporter" (aka "G2SR"), a relabeled EIQ product, to process logs from multiple Sidewinder G2 firewalls. When forwarding events from syslog-ng to EIQ, their proprietary Windows syslog daemon takes the source IP address of the syslog-ng box and puts it into the resulting logfiles as the source of the event. I'm wondering if there's a template() I can use to insert the original hostname/IP such that EIQ will respect the forwarded hostname, or if I must use source IP spoofing when forwarding to EIQ? Thanks, Kevin

1 0