- syslog-ng - lists.balabit.hu

autoconf confusion attempting to install v1.6.6
by Joe 29 Mar '05

29 Mar '05

on FreeBSD 4.11 Stable #1 I'm obtaining the following error which seems pretty obvious: aclocal.m4:39: error: Autoconf version 2.54 or higher is required aclocal.m4:39: the top level autoheader: autom4te failed with exit status: 1 However, output from suggests I'm using the latest autoconf (I also installed the latest) The one hack I did do was to delete the system installed autoconf and symlink autoconf to the autoconf259 executable #`which autoconf` -V autoconf (GNU Autoconf) 2.59 Written by David J. MacKenzie and Akim Demaille. Not sure where to go with this. -- Joe -- Joe S. ------------ praxis makes perfect. - anon

2 1

Syslog-ng on Sol10 Compile problems...
by Smith, James 29 Mar '05

29 Mar '05

ok, I admit, I'm not great at compiling. Has anyone had any issues with getting syslog-ng to compile on Solaris10? I'm getting the following, but am not sure how to go about solving the issue. I'm compiling on an E3500 with gcc3.4.2, libol-0.3.15, and syslog-ng-1.6.6 gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet -Wl,-Bstatic -ll -Wl,-Bdynamic ld: fatal: library -ll: not found ld: fatal: File processing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /tmp/syslog-ng-1.6.6/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='. tests'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /tmp/syslog-ng-1.6.6/src *** Error code 1 make: Fatal error: Command failed for target `all' Current working directory /tmp/syslog-ng-1.6.6/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src doc contrib'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive'

2 1

OpenBSD on SPARC64 - Syslog-ng hostname issues
by list.mail＠comcast.net 29 Mar '05

29 Mar '05

I was wondering if someone knows if the Syslog-ng issue with reading remote host hostname/IP addresses on SPARC64 has been resolved? https://lists.balabit.hu/pipermail/syslog-ng/2004-July/006320.html https://lists.balabit.hu/pipermail/syslog-ng/2004-August/006395.html Or Am I missing something in my config? - I tried every option with the hostname as suggested in http://www.campin.net/syslog-ng/faq.html#hostname Config is simple until I figure out this remote hostname/IP issue. - Please check comments in config.. And the Sample log file below... Any help would be great appricated. Thanks, Eric #---------------------------------------------------------------------- # General options #---------------------------------------------------------------------- options { chain_hostnames(no); create_dirs (no); dir_perm(0755); keep_hostname(yes); log_fifo_size(1024); long_hostnames(off); perm(0644); sync(1); time_reopen (10); use_dns(yes); use_fqdn(no); }; #---------------------------------------------------------------------- # Log sources #---------------------------------------------------------------------- source network { udp(); internal(); }; # source local { unix-stream("/dev/log"); internal(); }; #---------------------------------------------------------------------- # Log Destinations #---------------------------------------------------------------------- destination net { file("/var/syslog-ng/hosts/imd.log" ); }; #---------------------------------------------------------------------- # host-based filters - This is the only way I can get logs - filter for localhost # I can not get logs filtering for remote host - IP or hostname. #---------------------------------------------------------------------- filter net { host("obsd"); }; #---------------------------------------------------------------------- # put it all together #---------------------------------------------------------------------- log { source(network); filter(net); destination(net); }; Sample Log Message -from tail of log file - Mar 24 08:46:47 obsd Mar 24 2005 08:46:47 hcpix Localhost ----------^ Remotehost -------------------------------------------^

2 1

syslog-ng dies randomly on solaris
by Ian Veach 29 Mar '05

29 Mar '05

Greetings - We're just chomping at the bit to switch to syslog-ng from the standard syslog. Although it sounds like plenty of solaris people are having success, our testing is not going well. Our configs are all great, but syslog-ng just simply stops running at random times (sometimes an hour, the last one 35 days) on my test machine (low volume except for occasional load testing). Can anyone give me (a neophyte in this arena) any ideas on how to fix this? Ideally, I would like to solve the problem (or figure out what it is), but am open to things like a cron to verify syslog-ng is running...Could try to debug, but not great with truss, and for some reason syslog-ng cores don't show much useful info (to me, a noob). Syslog-ng 1.6.5 and libol version required at the time standard compile for solaris (details available) Solaris 9, recently patched thanks very much! ivo

3 4

snapshots now working
by Balazs Scheidler 29 Mar '05

29 Mar '05

hi, As of today I've disabled snapshot generation because of some internal changes of our web service. It will be restored soon. (you can remind me if it does not work in about a week) -- Bazsi

3 3

Log line lost during TCP connection?
by Jay Guerette 27 Mar '05

27 Mar '05

I have a postfix server logging via syslog-ng. The log data is written to a local file and also sent via TCP to a central syslog-ng loghost. On the source server (syslog-ng 1.6.6 on Linux) I see: 05:32:21 internal/smtpd[15534]: 9AE172D29A5: client=x.x.net[10.x.x.x] 05:32:21 internal/qmgr[9993]: 9AE172D29A5: from=<x(a)x.com>, size=1557811, nrcpt=1 (queue active) On the central loghost (syslog-ng 1.6.5 on Linux) I see: 05:32:21 syslog-ng[28919]: AF_INET client connected from 10.x.x.x, port 33645 and 05:32:21 internal/qmgr[9993]: 9AE172D29A5: from=<x(a)x.com>, size=1557811, nrcpt=1 (queue active) The 1st line from the source server is missing on the central loghost. Is this a bug?

2 3

destination Program - missing syslog sutdown message
by Brian Kee 19 Mar '05

19 Mar '05

I have a relatively simple perl program that is called from syslog-ng using destination <name> { program("/path/to/program"); }; syntax in syslog-ng.conf. I have noticed an interesting thing regarding the syslog-ng stop/start messages. When starting the syslog-ng daemon (via init script), I get an appropriate log messages sent to my program: Mar 19 01:54:52 loki2 syslog-ng[21700]: syslog-ng version 1.6.5 starting However, when stopping the daemon, I get no stop messages sent to the program, though I do see them sent to other configured destinations. (example stop message: Mar 19 01:48:41 loki2 syslog-ng[21187]: syslog-ng version 1.6.5 going down) Any ideas, or experience with a similar behavior? Any way to force the stop message to be sent to my program? IOW is this behavior configurable? Thank You, Brian A. Kee __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

1 0

problem in logging apache-log
by niraj 18 Mar '05

18 Mar '05

Hi I want to log access log of apache with the help of syslog-ng.But it is not working.I have added the code below. TIA Niraj source apachesrc{ file("/var/log/httpd/access_log"); }; destination destfile{ file("apache-ng.log"); }; log { source(apachesrc); destination(destfile); };

2 1

logging problem
by niraj 18 Mar '05

18 Mar '05

Hi I want to log access log of apache with the help of syslog-ng.But it is not working.I have added the code below. TIA Niraj source apachesrc{ file("/var/log/httpd/access_log"); }; destination destfile{ file("apache-ng.log"); }; log { source(apachesrc); destination(destfile); };

2 1

sudden hourly restarts
by sscalsk 16 Mar '05

16 Mar '05

I have been running syslog-ng v1.6.5 for about 6 months with no problems. Its the main syslog process and logs the days traffic to a single messages file, it does a little filtered for selected hosts and forwards them on (w/spoofing) to another device. Just this week, for some unknown reason I've yet to find, syslog-ng reinitializes a new configuration on the hour (just as if it received a HUP) and overwrites the previous hours file. Now I rotate the logs at midnight via cron, there i move the file and kill HUP the syslog-ng process which works fine. remove_if_older is not set in my config so its taking the default. Anyone else ever have unexplained hourly restarts on the syslog-ng process? -= stan ________________________________________________________________ Sent via the WebMail system at mail.ameritel.net --- [This E-mail scanned for viruses by mail.ameritel.net]

2 1

too much time() ?
by Dave Johnson 12 Mar '05

12 Mar '05

We did some maintaince on our sol9 central syslog-ng server recently running syslog-ng v1.6.4, and noticed something... truss -p on the syslog-ng process shows an abundant number of time() calls. The ratio of time() to read()/write()s were a factor of 20-40x. * This is even with use_time_recv(no); in the global options. I'm trying to understand if this is something that could be cut down some or if its a standard solaris process overhead... ?

2 2

RE: [syslog-ng]RE: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3
by Marquis Thibodeau 11 Mar '05

11 Mar '05

OK, I will try to make it working.. Thanks for the confirmation Marquis -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Earls, Michael Sent: 11 mars 2005 06:43 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]RE: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3 Syslog-ng version 1.5 and up have support for mysql templates. Thanks, Michael PGP Info: KeyID 0x0DFD993C Fingerprint F903 0325 5105 2CDB 4BF4 C88B 72F7 BA7A 28CC 598A -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] Sent: Thursday, March 03, 2005 7:33 AM To: syslog-ng(a)lists.balabit.hu; syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3 Hi, Thanks for your quick answer... I didn't find the version I need.. the 1.5.x because I want to store the log in MySQL and it says that only 1.5.x is working with template (MySQL) Any other idea?? Thanks Marquis _____ De: syslog-ng-admin(a)lists.balabit.hu de la part de Viper sec Date: mer. 2005-03-02 13:01 À: syslog-ng(a)lists.balabit.hu Objet : Re: [syslog-ng]Installation problem on Fedora C3 Hi I installed on FC3, it was ok. I used rpm from rpm.pbone.net. Regards, Viper$ec On Wed, 2 Mar 2005 12:53:03 -0500, Marquis Thibodeau <mthibodeau(a)avance.info> wrote: > Hi, > > I tried to install syslog-ng on my Fedora Core3 server and I get a bunch of > error in the compilation... > > Is someone can help me out... > > What thing do I need to provide here to get better help...??? > > Thanks > > Marquis _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail transmission contains information that is confidential and may be privileged. It is intended only for the addressee(s) named above. If you receive this e-mail in error, please do not read, copy or disseminate it in any manner. If you are not the intended recipient, any disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please erase it from your computer system. Your assistance in correcting this error is appreciated.

1 0

RE: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3
by Earls, Michael 11 Mar '05

11 Mar '05

Syslog-ng version 1.5 and up have support for mysql templates. Thanks, Michael PGP Info: KeyID 0x0DFD993C Fingerprint F903 0325 5105 2CDB 4BF4 C88B 72F7 BA7A 28CC 598A -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] Sent: Thursday, March 03, 2005 7:33 AM To: syslog-ng(a)lists.balabit.hu; syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3 Hi, Thanks for your quick answer... I didn't find the version I need.. the 1.5.x because I want to store the log in MySQL and it says that only 1.5.x is working with template (MySQL) Any other idea?? Thanks Marquis _____ De: syslog-ng-admin(a)lists.balabit.hu de la part de Viper sec Date: mer. 2005-03-02 13:01 À: syslog-ng(a)lists.balabit.hu Objet : Re: [syslog-ng]Installation problem on Fedora C3 Hi I installed on FC3, it was ok. I used rpm from rpm.pbone.net. Regards, Viper$ec On Wed, 2 Mar 2005 12:53:03 -0500, Marquis Thibodeau <mthibodeau(a)avance.info> wrote: > Hi, > > I tried to install syslog-ng on my Fedora Core3 server and I get a bunch of > error in the compilation... > > Is someone can help me out... > > What thing do I need to provide here to get better help...??? > > Thanks > > Marquis _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail transmission contains information that is confidential and may be privileged. It is intended only for the addressee(s) named above. If you receive this e-mail in error, please do not read, copy or disseminate it in any manner. If you are not the intended recipient, any disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please erase it from your computer system. Your assistance in correcting this error is appreciated.

1 0

Apache Access Log Load and Syslog-ng Stability
by Jason Stafford 11 Mar '05

11 Mar '05

Howdy, I'm trying to setup a load balanced system with several web servers and one central log server. Currently I have syslog-ng running and pipe the output form apache to logger. This is all running locally on one box. However, syslog-ng just randomly hangs and apache stop processing requests. I can restart apache and it still does not respond, but i can just restart syslog-ng and then it all starts working again. Is syslog-ng designed to handle this kinda of load, around 3 million entries a day? I have been googling for hours and can only find some comments about log_fifo_size and reap_time in the options section? here is my current config, if that helps any options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination d_http_access { file("/var/log/HTTP/$YEAR-$MONTH-$DAY/$YEAR-$MONTH-$DAY.accesslog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(\ yes)); }; destination d_http_search { file("/var/log/HTTP/$YEAR-$MONTH-$DAY/$YEAR-$MONTH-$DAY.searchlog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(\ yes)); }; destination d_http_error { file("/var/log/HTTP/$YEAR-$MONTH-$DAY/$YEAR-$MONTH-$DAY.errorlog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(ye\ s)); }; filter f_http_access { match("APACHE_ACCESS_LOG") and not match("test.html"); }; filter f_http_search { match("APACHE_ACCESS_LOG") and match("/content/search"); }; filter f_http_error { match("APACHE_ERR_LOG"); }; log { source(s_sys); filter(f_http_access); destination(d_http_access); }; #Log httpd search access logs log { source(s_sys); filter(f_http_search); destination(d_http_search); }; #Log httpd error logs log { source(s_sys); filter(f_http_error); destination(d_http_error); }; ###################################################3 httpd.conf log line CustomLog "|/usr/bin/logger -p local0.info -t APACHE_ACCESS_LOG" tracking

2 2

Michael J. Bock/NetServ/DST/US is out of the office.
by MJBock＠dstsystems.com 11 Mar '05

11 Mar '05

I will be out of the office starting 03/10/2005 and will not return until 03/16/2005. I will respond to your message when I return. ----------------------------------------- This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.

1 0

Syslog-ng fails during build
by Phillip Cockrell 10 Mar '05

10 Mar '05

Hi, I have googled and I still cant find an answer to this, wondering if anyone here knows. I am trying to build a syslog-ng RPM on Red Hat AS3, however, I get the following error: gcc -O2 -g -march=i386 -mcpu=i686 -Wall -I/usr/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv -lwrap /usr/lib/libol.a -lnsl cfg-lex.o(.text+0x42f): In function `yylex': /usr/src/redhat/BUILD/syslog-ng-1.6.5/src/cfg-lex.c:1123: undefined reference to `yywrap' cfg-lex.o(.text+0xbdf): In function `input': /usr/src/redhat/BUILD/syslog-ng-1.6.5/src/cfg-lex.c:1450: undefined reference to `yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-1.6.5/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-1.6.5/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-1.6.5/src' make: *** [all-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.65939 (%build) I built libol and libol-devel RPMs and they are both installed: libol-0.3.15-1 libol-devel-0.3.15-1 Any ideas? -- Phillip Cockrell [pcockrel(a)rackspace.com] RTS System Administrator Rackspace Managed Hosting Office: (210) 447-4161 Cell: (210) 618-6229 Pager: page.pcockrel(a)rackspace.com

2 2

logging to two files simultaneously
by Mike Pepe 10 Mar '05

10 Mar '05

I'm trying to log to two files at the same time. What's the best way to do it? I put two destinations in a log block, but it doesn't log to both places. Is there a trick to doing this? curious... -Mike

3 2

Re: [syslog-ng]logs are not generated and managed by syslog-ng but it is started properly
by jack alex 10 Mar '05

10 Mar '05

Thanks for listening! Below message is very long! Please specially read 2nd last line of below message becz it is depicting some UNKNOW message, which can help us to resolv the issue. # syslog-ng -d -v io.c: Preparing fd 3 for reading binding fd 4, inetaddr: 0.0.0.0, port: 514 io.c: Preparing fd 4 for reading binding fd 5, unixaddr: /dev/log io.c: listening on fd 5 syslog-ng version 1.6.0rc2 starting Garbage collecting while idle... gc_mark: Marking object of class 'syslog_backend' (0) gc_mark: Marking object of class 'syslog_config' (1) gc_mark: Marking object of class 'resource_list' (2) gc_mark: Marking object of class 'io_fd' (3) gc_mark: Marking object of class 'log_reader' (4) gc_mark: Marking object of class 'affile_source' (5) gc_mark: Marking object of class 'log_source_group' (6) gc_mark: Marking object of class 'log_source_group' (7) gc_mark: Marking object of class 'log_source_group' (8) gc_mark: Marking object of class 'afunix_source' (9) gc_mark: Marking object of class 'listen_fd' (10) gc_mark: Marking object of class 'afsocket_accept_callback' (11) gc_mark: Marking object of class 'io_fd' (11) gc_mark: Marking object of class 'log_reader' (12) gc_mark: Marking object of class 'afsocket_source_connection' (13) gc_mark: Marking object of class 'afinet_source' (14) gc_mark: Marking object of class 'inet_address_info' (15) gc_mark: Marking object of class 'object_queue' (15) gc_mark: Marking object of class 'afsocket_source_close_callback' (12) gc_mark: Marking object of class 'unix_address_info' (10) gc_mark: Marking object of class 'object_queue' (10) gc_mark: Marking object of class 'log_source_driver' (10) gc_mark: Marking object of class 'log_center' (9) gc_mark: Marking object of class 'log_connection' (10) gc_mark: Marking object of class 'log_endpoint_info' (11) gc_mark: Marking object of class 'log_endpoint_info' (12) gc_mark: Marking object of class 'log_endpoint_info' (11) gc_mark: Marking object of class 'log_filter' (12) gc_mark: Marking object of class 'filter_expr_pri' (13) gc_mark: Marking object of class 'log_filter' (13) gc_mark: Marking object of class 'filter_expr_op' (14) gc_mark: Marking object of class 'filter_expr_pri' (15) gc_mark: Marking object of class 'filter_expr_op' (15) gc_mark: Marking object of class 'filter_expr_pri' (16) gc_mark: Marking object of class 'filter_expr_pri' (16) gc_mark: Marking object of class 'log_filter' (14) gc_mark: Marking object of class 'filter_expr_op' (15) gc_mark: Marking object of class 'filter_expr_pri' (16) gc_mark: Marking object of class 'filter_expr_pri' (16) gc_mark: Marking object of class 'log_filter' (15) gc_mark: Marking object of class 'filter_expr_pri' (16) gc_mark: Marking object of class 'log_filter' (16) gc_mark: Marking object of class 'filter_expr_pri' (17) gc_mark: Marking object of class 'log_filter' (17) gc_mark: Marking object of class 'filter_expr_pri' (18) gc_mark: Marking object of class 'log_filter' (18) gc_mark: Marking object of class 'filter_expr_pri' (19) gc_mark: Marking object of class 'log_filter' (19) gc_mark: Marking object of class 'filter_expr_pri' (20) gc_mark: Marking object of class 'log_filter' (20) gc_mark: Marking object of class 'filter_expr_pri' (21) gc_mark: Marking object of class 'log_filter' (21) gc_mark: Marking object of class 'filter_expr_pri' (22) gc_mark: Marking object of class 'log_filter' (22) gc_mark: Marking object of class 'filter_expr_pri' (23) gc_mark: Marking object of class 'log_filter' (23) gc_mark: Marking object of class 'filter_expr_pri' (24) gc_mark: Marking object of class 'log_filter' (24) gc_mark: Marking object of class 'filter_expr_pri' (25) gc_mark: Marking object of class 'log_filter' (25) gc_mark: Marking object of class 'filter_expr_pri' (26) gc_mark: Marking object of class 'log_filter' (26) gc_mark: Marking object of class 'filter_expr_pri' (27) gc_mark: Marking object of class 'log_endpoint_info' (11) gc_mark: Marking object of class 'log_dest_group' (12) gc_mark: Marking object of class 'affile_dest' (13) gc_mark: Marking object of class 'log_connection' (11) gc_mark: Marking object of class 'log_endpoint_info' (12) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_endpoint_info' (12) gc_mark: Marking object of class 'log_endpoint_info' (12) gc_mark: Marking object of class 'log_dest_group' (13) gc_mark: Marking object of class 'log_dest_group' (14) gc_mark: Marking object of class 'affile_dest' (15) gc_mark: Marking object of class 'affile_dest' (14) gc_mark: Marking object of class 'log_connection' (12) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_dest_group' (14) gc_mark: Marking object of class 'affile_dest' (15) gc_mark: Marking object of class 'log_connection' (13) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_dest_group' (15) gc_mark: Marking object of class 'affile_dest' (16) gc_mark: Marking object of class 'log_connection' (14) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_dest_group' (16) gc_mark: Marking object of class 'log_dest_group' (17) gc_mark: Marking object of class 'log_dest_group' (18) gc_mark: Marking object of class 'log_dest_group' (19) gc_mark: Marking object of class 'affile_dest' (20) gc_mark: Marking object of class 'affile_dest' (19) gc_mark: Marking object of class 'affile_dest' (18) gc_mark: Marking object of class 'affile_dest' (17) gc_mark: Marking object of class 'log_connection' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_connection' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_dest_group' (18) gc_mark: Marking object of class 'log_dest_group' (19) gc_mark: Marking object of class 'log_dest_group' (20) gc_mark: Marking object of class 'log_dest_group' (21) gc_mark: Marking object of class 'log_dest_group' (22) gc_mark: Marking object of class 'log_dest_group' (23) gc_mark: Marking object of class 'log_dest_group' (24) gc_mark: Marking object of class 'log_dest_group' (25) gc_mark: Marking object of class 'affile_dest' (26) gc_mark: Marking object of class 'affile_dest' (25) gc_mark: Marking object of class 'affile_dest' (24) gc_mark: Marking object of class 'affile_dest' (23) gc_mark: Marking object of class 'affile_dest' (22) gc_mark: Marking object of class 'affile_dest' (21) gc_mark: Marking object of class 'affile_dest' (20) gc_mark: Marking object of class 'affile_dest' (19) gc_mark: Marking object of class 'log_connection' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_connection' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_connection' (19) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'log_endpoint_info' (21) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'log_connection' (20) gc_mark: Marking object of class 'log_endpoint_info' (21) gc_mark: Marking object of class 'log_connection' (21) gc_mark: Marking object of class 'log_endpoint_info' (22) gc_mark: Marking object of class 'log_endpoint_info' (23) gc_mark: Marking object of class 'log_endpoint_info' (22) gc_mark: Marking object of class 'log_endpoint_info' (22) gc_mark: Marking object of class 'log_connection' (22) gc_mark: Marking object of class 'log_endpoint_info' (23) gc_mark: Marking object of class 'log_endpoint_info' (24) gc_mark: Marking object of class 'log_endpoint_info' (23) gc_mark: Marking object of class 'log_endpoint_info' (23) gc_mark: Marking object of class 'log_connection' (23) gc_mark: Marking object of class 'log_endpoint_info' (24) gc_mark: Marking object of class 'log_endpoint_info' (25) gc_mark: Marking object of class 'log_endpoint_info' (24) gc_mark: Marking object of class 'log_endpoint_info' (24) gc_mark: Marking object of class 'log_connection' (24) gc_mark: Marking object of class 'log_endpoint_info' (25) gc_mark: Marking object of class 'log_endpoint_info' (26) gc_mark: Marking object of class 'log_endpoint_info' (25) gc_mark: Marking object of class 'log_endpoint_info' (25) gc_mark: Marking object of class 'UNKNOWN' (1) Objects alive: 169, garbage collected: 0 Any help appreciated, -jack --- Nate Campi <nate(a)campin.net> wrote: > On Wed, Mar 09, 2005 at 01:43:55AM -0800, jack alex > wrote: > > > > I am trying to configure syslog-ng package for > > managing logs, but there is some where something > wrong > > in my configuration such that it is not > generatinglogs > > > > below file is quite long > > <SNIP> > > > Any guess , why it is not managing log, no new > logs > > have been added to log directory, as > > /var/log/messages doens't contains any new message > > after i configured syslog-ng but if i will restart > my > > syslog(the default that comes with redhat) it will > > start adding new logs to /var/log/messages. . > ...... > > Your config file is syntactically correct (syslog-ng > -s), and I don't > see anything wrong at a glance. I suppose I'd make > sure it's running (as > root since /var/log has strict file perms by > default). Maybe there's > some problem making it exit, so keep it in the > foreground in debugging > when you start it and see what you get: > > # syslog-ng -d -v > > -- > Nate > > ". . . a classic - something that everybody wants to > have read and > nobody wants to read." - speech (1900) - Samuel > Clemens > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

1 0

logs are not generated and managed by syslog-ng but it is started properly
by jack alex 09 Mar '05

09 Mar '05

Dear All, I am trying to configure syslog-ng package for managing logs, but there is some where something wrong in my configuration such that it is not generatinglogs below file is quite long #vi /usr/local/etc/syslog-ng/syslog-ng.conf code: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_fqdn (yes); create_dirs (no); chain_hostnames(no); keep_hostname (yes); perm(0644); dir_perm(0755); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source s_udp { udp(); }; source kernel_file { file("/proc/kmsg"); }; destination d_cons { file("/dev/console"); }; destination d_spol { file("/var/log/spooler.log"); }; destination d_mesg { file("/var/log/messages.log"); }; destination d_auth { file("/var/log/secure.log"); }; destination d_uucp { file("/var/log/uucp.log"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_mlal { usertty("*"); }; destination d_kern { file("/var/log/kernel.log"); }; destination numetrace { file("/var/log/numetrace.log"); }; destination nume { file("/var/log/nume.log"); }; destination postgres { file("/var/log/postgres.log"); }; destination php { file("/var/log/local2.log"); }; destination boot { file("/var/log/boot.log"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination ftp { file("/var/log/ftp.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination mail { file("/var/log/maillog"); }; destination news { file("/var/log/news.log"); }; destination syslog { file("/var/log/syslog.log"); }; destination user { file("/var/log/user.log"); }; destination local3 { file("/var/log/local3.log"); }; destination local4 { file("/var/log/local4.log"); }; destination local5 { file("/var/log/local5.log"); }; destination local6 { file("/var/log/local6.log"); }; destination emerg { file("/var/log/emerg.log"); }; destination crit { file("/var/log/crit.log"); }; destination alert { file("/var/log/alert.log"); }; destination err { file("/var/log/err.log"); }; destination warning { file("/var/log/warning.log"); }; filter cons { facility(kern); }; filter spooler { facility(uucp) or (facility(news) and level(crit)); }; filter mesg { level(info, notice, warning, err, crit, alert, emerg) and facility(kern, uucp, news, local3, local4, local5, local6, daemon, ftp, lpr); }; filter auth { facility(authpriv); }; filter emerg { level(emerg); }; filter uucp { facility(uucp); }; filter cron { facility(cron); }; filter kern_debug { facility(kern); }; filter postgres { facility(local0); }; filter nume_trace { facility(local1); }; filter nume { facility(local1) and level(info, notice, warning, err, crit, alert, emerg); }; filter php { facility(local2); }; filter local3 { facility(local3); }; filter local4 { facility(local4); }; filter local5 { facility(local5); }; filter local6 { facility(local6); }; filter boot { facility(local7); }; filter daemon { facility(daemon); }; filter ftp { facility(ftp); }; filter lpr { facility(lpr); }; filter mail { facility(mail); }; filter news { facility(news); }; filter syslog { facility(syslog); }; filter user { facility(user); }; filter warning { level(warning); }; filter crit { level(crit, alert, emerg); }; filter alert { level(alert, emerg); }; filter err { level(err, crit, alert, emerg); }; log { source(s_sys); source(s_udp); filter(cons); destination(d_cons); }; log { source(s_sys); source(s_udp); filter(mesg); destination(d_mesg); }; log { source(s_sys); source(s_udp); filter(auth); destination(d_auth); }; log { source(s_sys); source(s_udp); filter(emerg); destination(d_mlal); }; log { source(s_sys); source(s_udp); filter(uucp); destination(d_uucp); }; log { source(s_sys); source(s_udp); filter(boot); destination(boot); }; log { source(s_sys); source(s_udp); filter(php); destination(php); }; log { source(s_sys); source(s_udp); filter(postgres); destination(postgres); }; log { source(s_sys); source(s_udp); filter(nume_trace); destination(numetrace); }; log { source(s_sys); source(s_udp); filter(nume); destination(nume); }; log { source(s_sys); source(s_udp); source(kernel_file); filter(kern_debug); destination(d_kern); }; log { source(s_sys); source(s_udp); filter(cron); destination(cron); }; log { source(s_sys); source(s_udp); filter(daemon); destination(daemon); }; log { source(s_sys); source(s_udp); filter(ftp); destination(ftp); }; log { source(s_sys); source(s_udp); filter(lpr); destination(lpr); }; log { source(s_sys); source(s_udp); filter(mail); destination(mail); }; log { source(s_sys); source(s_udp); filter(news); destination(news); }; log { source(s_sys); source(s_udp); filter(syslog); destination(syslog); }; log { source(s_sys); source(s_udp); filter(user); destination(user); }; log { source(s_sys); source(s_udp); filter(local3); destination(local3); }; log { source(s_sys); source(s_udp); filter(local4); destination(local4); }; log { source(s_sys); source(s_udp); filter(local5); destination(local5); }; log { source(s_sys); source(s_udp); filter(local6); destination(local6); }; log { source(s_sys); source(s_udp); filter(spooler); destination(d_spol); }; log { source(s_sys); source(s_udp); filter(emerg); destination(emerg); }; log { source(s_sys); source(s_udp); filter(crit); destination(crit); }; log { source(s_sys); source(s_udp); filter(alert); destination(alert); }; log { source(s_sys); source(s_udp); filter(err); destination(err); }; log { source(s_sys); source(s_udp); filter(warning); destination(warning); }; filter ext_filter { level(warning) or level(err) or level(alert) or level(crit) or level(emerg) or facility(authpriv); }; log { source(s_sys); source(s_udp); source(kernel_file); filter(ext_filter); }; Any guess , why it is not managing log, no new logs have been added to log directory, as /var/log/messages doens't contains any new message after i configured syslog-ng but if i will restart my syslog(the default that comes with redhat) it will start adding new logs to /var/log/messages. . ...... -jack __________________________________ Celebrate Yahoo!'s 10th Birthday! Yahoo! Netrospective: 100 Moments of the Web http://birthday.yahoo.com/netrospective/

2 1

[Fwd: RE: [syslog-ng]Syslog-NG 1.6.6 memory leak when sending UDP logs]
by Balazs Scheidler 08 Mar '05

08 Mar '05

Hi, Some more information about the memory leak. The last fix seems to have fixed for others. Thanks for the report Bryan. So as it seems the spoof related memory leak seems to have been fixed by my last patch. Henry's problem seems to be related but a different bug either in syslog-ng or in libnet. -------- Forwarded Message -------- > From: Ignatow, Bryan <Bryan.Ignatow(a)acs-inc.com> > To: Balazs Scheidler <bazsi(a)balabit.hu> > Subject: RE: [syslog-ng]Syslog-NG 1.6.6 memory leak when sending UDP > logs > Date: Fri, 4 Mar 2005 11:57:46 -0600 > > > A private reply - my home e-mail address is subscribed, not my work. > Feel free to forward to the list. > > We use syslog-ng on some very busy Syslog servers. About 1M logs a > day on average on the largest one. We UDP forward with spoofing over > 300K of those messages a day on average. > > We have been seeing memory problems since we first implemented 1.6.4, > and I recently upgraded to 1.6.6. and libol 0.3.15 (from 0.3.13) and > have been using libnet 1.1.2.1. We compile from source. The system > is a Fedora Core 1 reasonably fully patched, running > 2.4.22-1.2199.nptlsmp on a dual HyperThreaded P4 3GHz with 2 GB of > memory. Well... I am not sure if they were memory leaks, but the > process would keel over when it reached about 3GB of virtual (2GB > resident) in size. Restarting the process would clear the memory > problem. > > I decided since the upgrade to 1.6.6 didn't fix it, I would subscribe > to the mailing list and see what was out there (a shocking concept I > know... but I am a maverick). That is where I ran across this thread. > > I saw the note in the archive from Feb 28th with the patch to afinet.c > adding the "ol_string_free(msg_line);" line I gave this a shot and it > has really helped. We are holding steady at: > > PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU > COMMAND > 4316 root 15 0 1220 1216 756 S 0.0 0.0 5:33 0 > syslog-ng > > We started somewhere around 1023K resident and have not moved up > hardly at all in the 4 days since we put this code in place. Before > we were moving up 8K every 2 seconds. > > Hope this helps, > > Bryan > > > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs > Scheidler > Sent: Friday, March 04, 2005 11:20 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Syslog-NG 1.6.6 memory leak when sending UDP > logs -- Bazsi

2 1

Syslog: Router konfiguration
by kblumer＠gmx.ch 08 Mar '05

08 Mar '05

Hi all I tried to get syslog messages from a router, but I do not get any messages. From ohter Systems it works. Does it something have to do with my syslog configuration on the routers (operational state = inactive)? TK>show syslog base SYSLOG Base Information ----------------------- Configured Maximum # of Poll iteration State hosts allowed timer ---------- ------------- -------------- Enabled 5 5 Operational # of Active # of Active # of Syslog State Seq Hosts Non-seq Hosts Messages Sent ----------- ----------- ------------- ------------- DOWN 0 0 0 TK>show syslog hosts SYSLOG Configured Hosts ----------------------- Host Ip Operational Address State Time Sequencing ---------------- ------------ --------------- 10.xx.xx.xx INACTIVE ENABLED If yes, how can I ACTIVATE the Operational State ? Thanks in advance -- Lassen Sie Ihren Gedanken freien Lauf... z.B. per FreeSMS GMX bietet bis zu 100 FreeSMS/Monat: http://www.gmx.net/de/go/mail

2 1

not proper logs
by jack alex 08 Mar '05

08 Mar '05

Dear All, Iam using syslog-ng! I facing problem in my log rotation for postgres, it is not rotation properly. I am using syslog-ng package for loging. My logs for postgres looks like this, code: -rw-r--r-- 1 root root 10M Feb 28 23:24 postgres.log.20 -rw-r--r-- 1 root root 0 Feb 28 20:16 postgres.log.21 -rw-r--r-- 1 root root 10M Feb 28 20:15 postgres.log.22 -rw-r--r-- 1 root root 0 Feb 28 17:04 postgres.log.23 -rw-r--r-- 1 root root 10M Feb 28 17:03 postgres.log.24 -rw-r--r-- 1 root root 0 Feb 28 13:52 postgres.log.25 -rw-r--r-- 1 root root 10M Feb 28 13:51 postgres.log.26 -rw-r--r-- 1 root root 0 Feb 28 10:56 postgres.log.27 -rw-r--r-- 1 root root 10M Feb 28 10:55 postgres.log.28 -rw-r--r-- 1 root root 0 Feb 28 08:40 postgres.log.29 -rw-r--r-- 1 root root 0 Mar 2 00:12 postgres.log.3 That's after rotation it generates two files one with 0MB size and another with is of 10MB, so, why it is generating 0MB size log files?? Does it supports syslogng package for loging? If yes then what is the difference is its configuration from normal syslog package. Any help appreciated. -jack __________________________________ Celebrate Yahoo!'s 10th Birthday! Yahoo! Netrospective: 100 Moments of the Web http://birthday.yahoo.com/netrospective/

1 0

2 configuration questions
by ARGEXT-HIDALGO, FRANCISCO 07 Mar '05

07 Mar '05

Hi, I would like to ask you about two things: 1. I have a central syslog-ng server logging everything as IP's because we need it that way, but for php-syslog-ng I would like to see them as hostnames. It is possible to resolve hostnames to some destinations only? 2. We have one syslog-ng server in each region and each of them logs to the central server, I would like to be able to log each region to a diferent file. I think I can do it by sending from a different facility from each region. Unfortunatelly reconfiguring every router and switch from the network is not an option, so I was thinking I could do it if each regional server resends it's logs with a particular facility, changing the original one that it received from it's routers. Is this possible?, if not, do you know another way to do it?, I was thinking that I could send each region to a different port of the central syslog, but I prefer not changing the current configuration if possible. Thank you, Francisco

1 0

Fedora Core 3, SELinux, and syslog-ng
by Mike Pepe 05 Mar '05

05 Mar '05

I'm wondering if anyone knows the magic incantation you need in order to make FC3 with selinux turned on to like syslog-ng. it won't let syslog-ng access /proc/kmesg and therefore prevents it from working. If I turn off selinux, of course, it works fine. This selinux stuff is nice, but hard to figure out!

3 2

Re: [syslog-ng]Syslog-NG 1.6.6 memory leak when sending UDP logs
by henry＠shoelacecity.com 05 Mar '05

05 Mar '05

>There is no version 1.2.2, the latest version is 1.1.2.1 (or 1.1.3 which >is BETA) My bad, (typo) 1.1.2(.1) to be specific. >This patch fixes the byte order issue, and I'm still hunting the memory >leak with your configuration: > >diff -u -r1.25.4.6 afinet.c >--- afinet.c 5 Aug 2004 11:35:12 -0000 1.25.4.6 >+++ afinet.c 3 Mar 2005 12:26:47 -0000 >@@ -617,11 +617,10 @@ > ADDRESS2SOCKADDR(msg->saddr, sizeof(src_addr), (struct sockaddr *) &src_addr); > ADDRESS2SOCKADDR(self->super.dest_addr, sizeof(dst_addr), (struct sockaddr *) >&dst_addr); > >- > libnet_clear_packet(self->lnet_ctx); > >- udp = libnet_build_udp(src_addr.sin_port, >- dst_addr.sin_port, >+ udp = libnet_build_udp(ntohs(src_addr.sin_port), >+ ntohs(dst_addr.sin_port), > LIBNET_UDP_H + msg_line->length, > 0, > msg_line->data, I applied the patch, and recompiled. You are not going to beleive this: Data is STILL getting to the destination properly - despite the ntohs function. Yes, I checked the binary to be certain it recompiled, and threw a printf statement in there to be certain. It would seem that the ntohs function has no effect.

2 1