- syslog-ng - lists.balabit.hu

bind_inet_socket() error
by Walt Rich 23 Oct '04

23 Oct '04

I'm getting the following error when attempting to start syslog-ng: # ./S74syslog start io.c: bind_inet_socket() bind failed 172.16.65.61:514 Cannot assign requested address Error initializing configuration, exiting. here is the line in the syslog-ng.conf file that is setting up a the corresponcidg source: source net_tcp { tcp( ip(172.16.65.61) port(514) ); }; Does anyone know what the error means and how I can get around it? I appreciate any help you can provide. Thanks!

2 1

Re: [syslog-ng]Problems in Solaris 2.7 with truncated message
by Hernan Cortez 21 Oct '04

21 Oct '04

Hi Angelita, Yes, indeed the "\n" is a test to break the sentence. If you see the second template the $MSG between "-" appears truncated also. Any ideas? I don't think is a configuratiion problem. The binaries are from www.sunfreeware.com, may be i need to compile instead... HC Angelita Soares de Camargos To: syslog-ng(a)lists.balabit.hu <anghelasc(a)gmail.com> cc: Sent by: Subject: Re: [syslog-ng]Problems in Solaris 2.7 with truncated message syslog-ng-admin@lists .balabit.hu 20-10-2004 17:42 Please respond to syslog-ng Hernan, did you try erase the first "\n" in this sentence? .... '$PROGRAM', \n '$MESSAGE' );\n") .... I use a template to insert into mysql and it work fine. ****** destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date,time,program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG','$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes)); }; ****** On Wed, 20 Oct 2004 14:26:10 -0300, Hernan Cortez <hcortez(a)adexus.cl> wrote: > > Opss. Wrong subject. excuse me. > > Hi, I'm trying to install syslog-ng 1.6.4 in Solaris 2.7. > The binaries install and works OK, but the messages appear to be truncated. > By example the following sentece: > > destination d_mysql { > file("/var/log/dblog/fulllog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$SEC" > template("INSERT INTO logs (host, facility, priority, level, tag, > date, time, program, msg) > VALUES ( '$HOST', '$FACILITY', > '$PRIORITY','$LEVEL', '$TAG','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC', > '$PROGRAM', \n '$MESSAGE' );\n") > owner(root) group(root) perm(0600) > dir_perm(0700) create_dirs(yes) > template-escape(yes)); > }; > > In the log it appears without the ");\n" (last 3 characters), so the > insert in the mysql doesn't work. I do the test in with the following > destination: > > template("-$MSG--") > > In this case the last character "-" doesn't appear. > > Any idea? > Does syslog have a buffer problem? > > Thanks in advance, > > HC > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng]Problems in Solaris 2.7 with truncated message
by Hernan Cortez 20 Oct '04

20 Oct '04

Opss. Wrong subject. excuse me. Hi, I'm trying to install syslog-ng 1.6.4 in Solaris 2.7. The binaries install and works OK, but the messages appear to be truncated. By example the following sentece: destination d_mysql { file("/var/log/dblog/fulllog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$SEC" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY','$LEVEL', '$TAG','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC', '$PROGRAM', \n '$MESSAGE' );\n") owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) template-escape(yes)); }; In the log it appears without the ");\n" (last 3 characters), so the insert in the mysql doesn't work. I do the test in with the following destination: template("-$MSG--") In this case the last character "-" doesn't appear. Any idea? Does syslog have a buffer problem? Thanks in advance, HC

2 1

Re: Welcome to the "syslog-ng" mailing list
by Hernan Cortez 20 Oct '04

20 Oct '04

Hi, I'm trying to install syslog-ng 1.6.4 in Solaris 2.7. The binaries install and works OK, but the messages appear to be truncated. By example the following sentece: destination d_mysql { file("/var/log/dblog/fulllog.$YEAR.$MONTH.$DAY.$HOUR.$MIN.$SEC" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY','$LEVEL', '$TAG','$YEAR-$MONTH-$DAY','$HOUR:$MIN:$SEC', '$PROGRAM', \n '$MESSAGE' );\n") owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) template-escape(yes)); }; In the log it appears without the ");\n" (last 3 characters), so the insert in the mysql doesn't work. I do the test in with the following destination: template("-$MSG--") In this case the last character "-" doesn't appear. Any idea? Does syslog have a buffer problem? Thanks in advance, HC syslog-ng-request@lists .balabit.hu To: hcortez(a)adexus.cl Sent by: cc: syslog-ng-admin(a)lists.b Subject: Welcome to the "syslog-ng" mailing list alabit.hu 20-10-2004 14:08 Welcome to the syslog-ng(a)lists.balabit.hu mailing list! To post to this list, send your email to: syslog-ng(a)lists.balabit.hu General information about the mailing list is at: https://lists.balabit.hu/mailman/listinfo/syslog-ng If you ever want to unsubscribe or change your options (eg, switch to or from digest mode, change your password, etc.), visit your subscription page at: https://lists.balabit.hu/mailman/options/syslog-ng/hcortez%40adexus.cl You can also make such adjustments via email by sending a message to: syslog-ng-request(a)lists.balabit.hu with the word `help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You must know your password to change your options (including changing the password, itself) or to unsubscribe. It is: h0e0c0i0 If you forget your password, don't worry, you will receive a monthly reminder telling you what all your lists.balabit.hu mailing list passwords are, and how to unsubscribe or change your options. There is also a button on your options page that will email your current password to you. You may also have your password mailed to you automatically from the Web page noted above.

1 0

Re: [syslog-ng]syslog-ng loses messages
by Aaron watkins 20 Oct '04

20 Oct '04

On Wed, 20 Oct 2004 14:45:50 +0100, Watkins, Aaron <aaron.watkins(a)newsint.co.uk> wrote: > > Dave Johnson syslog-ng(a)lists.balabit.hu > Mon, 11 Oct 2004 14:43:24 -0500 > > ------------------------------------------------------------------------ > -------- > > The two questions are: > 1) where in the process do messages 0,1 get lost > 2) where in the process do messages x get lost when high load > This is exactly the question. Did you manage to set up the test case on your system. If so, what sort of results did you get? > In theory, since using TCP this shouldn't be the problem... ? > I am assured that we have a highly reliable network, and as you mentioned, with TCP it shouldn't be an issue. The fact that it is consistently two messages that get dropped implies that it is unlikely to be a network problem. However, maybe it is dropped at the kernel level? > *--------------------------* > * Can we try using "logger" as opposed to "event_pipe" in the while > loop? > * Can we `snoop -p -o /tmp/outout port 1515` on server2 and see if the > packets get sent? > * If that doesn't work, can we try without the templates? > * Where are the messages lost? system1 local files? system2 local > files? system2 pipe output? > * Solarisms? nscd running? kernel-revs? > > ---- It is worth noting that the system1 local copy of the events includes these lost events; it is somewhere in between sys1 and sys2 that it goes. Unfortunately, we have one of those corporate setups where I don't have the privileges to be able to run most of the other options, maybe someone else will have some ideas? Thanks, Aaron > > Anybody else have any ideas? > > On Fri, 8 Oct 2004 12:22:45 +0100, Aaron watkins > <aaron.j.watkins(a)gmail.com> wrote: > > Dave, > > > > > Dave Johnson syslog-ng(a)lists.balabit.hu > > > Thu, 7 Oct 2004 10:47:14 -0500 > > > > > > We have a couple solaris boxes that do logging with pipes and we log > a > > > large amount of data, thats why I'm interested in these tests. I > can > > > see if I can setup a quick testbed next week. > > > > > > ********** > > > > > > Otherwise, I'm wondering if the packets are throttled, what > happens.. IE: > > > > > > --------------------------- > > > cat > /tmp/smallsleep.c <<ENDHERE > > > #include <unistd.h> > > > > > > main () { > > > usleep(50000); /* 20 hz */ > > > } > > > ENDHERE > > > gcc -o /tmp/smallsleep /tmp/smallsleep.c > > > ----------------------------- > > > in the do -> done segment of your for loop add `/tmp/smallsleep` > > > > > > How does this impact lost messages? > > > > > > > In the situation where the receiving server is killed while the > > sending server has stopped sending messages (ie. during the sleep 1 > > command), there is no affect (ie. Message 0 and 1 are still lost). > > > > In the situation where the receiving server is killed while the > > sending server is still sending messages, the throttling you suggested > > reduces the number of messages that are lost to 2 (similar to the > > first test). > > > > Test 1: Message 12 and 13 lost > > Test 2: Message 25 and 26 lost > > > > It's an improvement, but unfortunately, its still not quite reliable > > enough and when used in practice, I'm unsure if our events (which will > > be asynchronous by their very nature) could possibly be throttled... > > > > Do you have any more ideas??? > > > > Thanks, > > > > > > Aaron Watkins > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > > The Newspaper Marketing Agency: Opening Up Newspapers: > > www.nmauk.co.uk > > This e-mail and all attachments are confidential and may be privileged. If you have received this e-mail in error, notify the sender immediately. Do not use, disseminate, store or copy it in any way. Statements or opinions in this e-mail or any attachment are those of the author and are not necessarily agreed or authorised by News International (NI). NI Group may monitor emails sent or received for operational or business reasons as permitted by law. NI Group accepts no liability for viruses introduced by this e-mail or attachments. You should employ virus checking software. News International Limited, 1 Virginia St, London E98 1XY, is the holding company for the News International group and is registered in England No 81701 > >

1 0

Problem compiling syslog-ng 1.5.26
by Chris Vaughan 20 Oct '04

20 Oct '04

Hello, I am trying to compile syslog-ng 1.5.26 on a Red Hat Linux 7.3 system, in order to use template() destinations so that I can log to a mysql database. While running the make command, it fails as follows: syslog-ng-1.5.26]# make Making all in src make[1]: Entering directory `/usr/local/install/syslog-ng-1.5.26/src' make all-recursive make[2]: Entering directory `/usr/local/install/syslog-ng-1.5.26/src' Making all in . make[3]: Entering directory `/usr/local/install/syslog-ng-1.5.26/src' gcc -g -O2 -Wall -I/usr/local/install/libol-0.3.14/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o -lresolv -lfl /usr/local/install/libol-0.3.14/src/.libs/libol.a -lnsl sources.o: In function `do_read_line': /usr/local/install/syslog-ng-1.5.26/src/sources.c:91: undefined reference to `MIN' sources.o: In function `make_log_reader': /usr/local/install/syslog-ng-1.5.26/src/sources.c:169: undefined reference to `MAX' cfg-lex.o: In function `append_string': /usr/local/install/syslog-ng-1.5.26/src/cfg-lex.l:239: undefined reference to `MIN' affile.o: In function `do_init_dest_writer': /usr/local/install/syslog-ng-1.5.26/src/affile.c:287: undefined reference to `MAX' affile.o: In function `append_string': /usr/local/install/syslog-ng-1.5.26/src/affile.c:558: undefined reference to `MIN' affile.o: In function `expand_macro': /usr/local/install/syslog-ng-1.5.26/src/affile.c:654: undefined reference to `MIN' afinet.o: In function `do_init_afinet_dest': /usr/local/install/syslog-ng-1.5.26/src/afinet.c:461: undefined reference to `MAX' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/usr/local/install/syslog-ng-1.5.26/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/install/syslog-ng-1.5.26/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/install/syslog-ng-1.5.26/src' make: *** [all-recursive] Error 1 What is going wrong here? What should I do to correct this? *************************************************************** This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of the Department of Lands. This email message has been swept by MIMEsweeper for the presence of computer viruses. ***************************************************************

2 1

Syslog forwarding with TCP.
by Davis, Jay 20 Oct '04

20 Oct '04

We are using syslog-ng in a test lab environment to get syslog messages out of the testlab into another environment. So several systems are forwarding messages to a bastion host of sorts, which then forwards by traversing a firewall to another host. The messages have to traverse a firewall (NAT). We decided to use TCP because it is a bit easier to get past the security guys. We have noticed behavior which is the nature of TCP. Of several (lines) of a syslog message ending up in the same packet (using a sniffer). Although interesting, this is not the problem. We have noticed that some messages are getting lost. So the questions. a) Can we change something to have one message per packet with syslog-ng settings. b) Has anyone else seen this behavior (or is anyone even using TCP)? c) Any other clues as to why a TCP session that is stable would drop packets?

1 0

Stats dropped ??
by Jörgen Ekstedt 19 Oct '04

19 Oct '04

Hi everyone! I have a problem with syslog-ng reporting stats-dropped? What does this mean ?? Anyone got any clues??

2 1

syslog-ng configure and tcp_wrappers
by José Pedro Oliveira 19 Oct '04

19 Oct '04

Hi, Right now syslog-ng is built using the dynamic tcp_wrappers library. $ ldd syslog-ng libnsl.so.1 => /lib/libnsl.so.1 (0x0583f000) libresolv.so.2 => /lib/libresolv.so.2 (0x0029d000) libwrap.so.0 => /usr/lib/libwrap.so.0 (0x00d87000) ^^^^^^^^ libc.so.6 => /lib/tls/libc.so.6 (0x00bcb000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x00bb3000) In some configurations the /usr/lib directory may not be available (eg: mount by nfs) when the daemon is started. Would it be possible to modify the syslog-ng configure file to use the static tcp_wrappers library instead? A possible patch is attached. Note that it may not be the best solution as I am not a autotools expert (it does work in Red Hat/Fedora distros though). Thanks in advance, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

1 0

syslog-ng snapshots broken
by José Pedro Oliveira 19 Oct '04

19 Oct '04

Hi, The last syslog-ng snapshot is from 2004-10-06. Could this be fixed? And also (maybe) delete libol-0.3.13 and syslog-ng-1.6.4 snapshots? Thanks in advance, jpo Snapshots directory: http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/ -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

1 0

Re: problem with syslog-ng and door
by jesse.keefe＠convergys.com 18 Oct '04

18 Oct '04

Balazs, An Etherlite is a console concentrator. Basically, it's a serial connection from the server back to the etherlite. We use a piece of software called conserver to access our system consoles over this etherlite connection. When one of these ports hang, syslog-ng hangs (I'm assuming because it's trying to write out to the console) and this causes su commands and others to hang. If you'd like, send me an email offline and I can give you some more background. Thanks for responding to this. Jesse Keefe Sr Analyst, Open Systems Convergys Corp 513-723-3689

1 0

syntax error line 1
by Chet Harvey 16 Oct '04

16 Oct '04

Hmmm...getting an error: $ /usr/local/sbin/syslog-ng syntax error at 1 Parse error reading configuration file, exiting. (line 1) here is what the conf looks like: options { use_fqdn(yes); keep_hostname(yes); use_dns(yes); long_hostnames(off); use_time_recvd(no); chain_hostnames(no); log_fifo_size(300); mark(0); sync(0); }; source src { unix-dgram("/var/run/log"); udp(); internal(); file ("/dev/klog"); }; # local0.* %/var/log/filter.log filter f_1 { facility(local0) and level(debug...emerg); }; destination d_1 { file("/var/log/filter.log"); }; log { source(local); filter(f_1); destination(d_1); }; # local7.* %/var/log/dhcpd.log filter f_2 { facility(local7) and level(debug...emerg); }; destination d_2 { file("/var/log/dhcpd.log"); }; log { source(local); filter(f_2); destination(d_2); }; # *.notice;kern.debug;lpr.info;mail.crit;news.err;local0.none;local7.none %/var/log/system.log filter f_3 { facility(mail) and level(crit...emerg); }; filter f_4 { facility(news) and level(err...emerg); }; filter f_5 { not facility(local0); }; filter f_6 { not facility(local7); }; filter f_7 { level(notice...emerg); }; filter f_8 { facility(kern) and level(debug...emerg); }; filter f_9 { facility(lpr) and level(info...emerg); }; destination d_3 { file("/var/log/system.log"); }; log { source(local); filter(f_3); filter(f_4); filter(f_5); filter(f_6); filter (f_7); filter(f_8); filter(f_9); destination(d_3); }; # security.* %/var/log/system.log filter f_10 { facility(security) and level(debug...emerg); }; log { source(local); filter(f_10); destination(d_3); }; # auth.info;authpriv.info;daemon.info %/var/log/system.log filter f_11 { facility(auth) and level(info...emerg); }; filter f_12 { facility(authpriv) and level(info...emerg); }; filter f_13 { facility(daemon) and level(info...emerg); }; log { source(local); filter(f_11); filter(f_12); filter(f_13); destination (d_3); }; # *.emerg * filter f_14 { level(emerg); }; destination d_4 { file("*"); }; log { source(local); filter(f_14); destination(d_4); }; TIA, Chet

1 0

RE: [syslog-ng]syslog2ng util?
by Walt Rich 15 Oct '04

15 Oct '04

I've installed syslog-ng both Solaris and Red Hat Linux. That utility should be located in the 'contrib' subdirectory, where you untarred syslog-ng. For example: Syslog-ng-1.6.5\contrib -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Chet Harvey Sent: Friday, October 15, 2004 4:41 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog2ng util? Hey all, I am haveing a heck of a time converting our syslog.confs to syslog-ng. I keep reading about a util that seemed to have been available in 1.5.x called syslog2ng. I am running freebsd syslog-ng version 1.6.5 but cant seem to find it.... any suggestions?? Chet _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

syslog2ng util?
by Chet Harvey 15 Oct '04

15 Oct '04

Hey all, I am haveing a heck of a time converting our syslog.confs to syslog-ng. I keep reading about a util that seemed to have been available in 1.5.x called syslog2ng. I am running freebsd syslog-ng version 1.6.5 but cant seem to find it.... any suggestions?? Chet

2 2

FW: Filtering host IP addresses
by Chris Vaughan 15 Oct '04

15 Oct '04

I figured this out, creating an extra filter for these hosts, using boolean expressions and variables. -----Original Message----- From: Chris Vaughan Sent: Friday, 15 October 2004 3:15 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Filtering host IP addresses Greetings, I have recently set up syslog-ng on a host to record logs from the cisco switches deployed around the office I work in. I have set the switches to be filtered by IP address, which has created a problem. One pod of switches in a low numbered vlan has management addresses, 10.x.xxx.11 to 14. I have found that the log files for these switches are being tainted by logs from switches with addresses ending with such octets as 121, in the log for switch 10.x.xxx.12 or 143 in the log for switch 10.x.xxx.14. How do I stop events from the switches with the three digit end octets entering data into the logs for these four switches, .11 to .14? *************************************************************** This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of the Department of Lands. This email message has been swept by MIMEsweeper for the presence of computer viruses. ***************************************************************

1 0

Filtering host IP addresses
by Chris Vaughan 15 Oct '04

15 Oct '04

Greetings, I have recently set up syslog-ng on a host to record logs from the cisco switches deployed around the office I work in. I have set the switches to be filtered by IP address, which has created a problem. One pod of switches in a low numbered vlan has management addresses, 10.x.xxx.11 to 14. I have found that the log files for these switches are being tainted by logs from switches with addresses ending with such octets as 121, in the log for switch 10.x.xxx.12 or 143 in the log for switch 10.x.xxx.14. How do I stop events from the switches with the three digit end octets entering data into the logs for these four switches, .11 to .14? *************************************************************** This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of the Department of Lands. This email message has been swept by MIMEsweeper for the presence of computer viruses. ***************************************************************

1 0

Snort and Syslog-ng
by Walt Rich 14 Oct '04

14 Oct '04

I need to create a source for snort using syslog-ng. I'm trying to get all snort alerts logged to one specific file, and only want to see the snort alerts and not any others. Any assistance is appreciated. Thanks! ________________________________ | Walt Rich | Sr. Network Engineer | Parago, Inc. | 972.538.7253 | walt.rich(a)parago.com |

1 0

syslog-ng problem
by Pavel Urban 14 Oct '04

14 Oct '04

Hello, we are having a problem with syslog-ng ver. 1.6.2. On one RedHat Linux ES 3, I've seen that it sends SYN, receives ACK and immediately sends RST. Anybody seen this behaviour? 20:26:34.610520 192.168.30.28.5140 > 192.168.30.162.5140: S 1768598228:1768598228(0) win 5840 <mss 1460,sackOK,timestamp 885631 0,nop,wscale 0> (DF) 20:26:34.610660 192.168.30.162.5140 > 192.168.30.28.5140: . ack 1 win 62928 <nop,nop,timestamp 1022214670 497333> (DF) 20:26:34.610711 192.168.30.28.5140 > 192.168.30.162.5140: R 611445588:611445588(0) win 0 (DF) 20:27:22.610006 192.168.30.28.5140 > 192.168.30.162.5140: S 1768598228:1768598228(0) win 5840 <mss 1460,sackOK,timestamp 890431 0,nop,wscale 0> (DF) 20:27:22.610152 192.168.30.162.5140 > 192.168.30.28.5140: . ack 1 win 62928 <nop,nop,timestamp 1022239252 497333> (DF) 20:27:22.610195 192.168.30.28.5140 > 192.168.30.162.5140: R 611445588:611445588(0) win 0 (DF) When I try eg telnet, it works just fine. 20:30:56.617785 192.168.30.28.32908 > 192.168.30.162.5140: S 2089428237:2089428237(0) win 5840 <mss 1460,sackOK,timestamp 911833 0,nop,wscale 0> (DF) [tos 0x10] 20:30:56.617995 192.168.30.162.5140 > 192.168.30.28.32908: S 1997864569:1997864569(0) ack 2089428238 win 5792 <mss 1380,sackOK,timestamp 1022348859 911833,nop,wscale 0> (DF) 20:30:56.618051 192.168.30.28.32908 > 192.168.30.162.5140: . ack 1 win 5840 <nop,nop,timestamp 911833 1022348859> (DF) [tos 0x10] 20:31:01.079466 192.168.30.28.32908 > 192.168.30.162.5140: F 1:1(0) ack 1 win 5840 <nop,nop,timestamp 912279 1022348859> (DF) [tos 0x10] 20:31:01.079677 192.168.30.162.5140 > 192.168.30.28.32908: F 1:1(0) ack 2 win 5792 <nop,nop,timestamp 1022351145 912279> (DF) 20:31:01.079717 192.168.30.28.32908 > 192.168.30.162.5140: . ack 2 win 5840 <nop,nop,timestamp 912279 1022351145> (DF) [tos 0x10] -- *********************************************************************** Pavel Urban (pavel.urban(a)imaginet.cz) IOL system disaster Internet OnLine, owned by Cesky Telecom, a.s. (www.ct.cz) *********************************************************************** Vegetables should not operate electronic equipment. Computer Stupidities, http://rinkworks.com/stupid/ ***********************************************************************

1 2

Re: Problem with syslog-ng and door
by jesse.keefe＠convergys.com 14 Oct '04

14 Oct '04

Actually, We've found out that part of the problem involves our console server solution. When an etherlite hangs, it causes the console with syslog-ng to hang. If we clear the port on the etherlite, the problem resolves. The native syslogd doesn't have this problem. Any thoughts? Jesse Keefe Sr Analyst, Open Systems Convergys Corp 513-723-3689

2 1

line end
by Thomas Richter 14 Oct '04

14 Oct '04

Hi, syslog-ng seem to have a problem to log lines ending with 0x0d ^M \n isdnlog makes his entries this way. The result was very strange lines ... wkr Thomas Richter -- dss1://49.431.801306 Wot're we going to do tonight, Brain ? gsm://49.179.5192431 The same thing we do every night, Pinky . icq://124849926 Try to TAKE OVER THE WORLD ! mailto:richter@thomas-richter.de http://www.thomas-richter.de

2 5

patch: add socket(SO_RCVBUF) option
by Dmitry Karasik 14 Oct '04

14 Oct '04

Hello, I'm playing with syslog-ng under high IO loads, and while doing so I found that increasing UDP receive buffer helps ( not surprisingly though ) a lot. Here, I have a feature request, to add such an option to the config file. Below I included a patch that adds such an option to the set of udp() command sub-options. While I realize that this function is very much useful also outside of udp, I though that to complement the setsockopt setup() properly I have also to add support for SO_SNDBUF, and support not only for source() but also for destination() drivers, etc etc, and this would clearly make an overkill patch. Probably you can think of something more elegant. -- Sincerely, Dmitry Karasik --- catpipe Systems ApS *BSD solutions, consulting, development www.catpipe.net +45 7021 0050 diff -ruN syslog-ng-1.6.5/src/afinet.c syslog-ng-1.6.5.patched/src/afinet.c --- syslog-ng-1.6.5/src/afinet.c Thu Aug 5 13:35:12 2004 +++ syslog-ng-1.6.5.patched/src/afinet.c Tue Oct 12 13:37:49 2004 @@ -221,6 +221,13 @@ l->flags = set_flags(l->flags, AFINET_TCP_KEEPALIVE_MASK, AFINET_TCP_KEEPALIVE_SHIFT, v); } +void afinet_src_set_so_rcvbuf(struct log_source_driver *c, UINT32 v) +{ + CAST_SUBTYPE(afsocket_source, l, c); + + l->so_rcvbuf = v; +} + static int do_open_afinet_connection(struct afsocket_source *c, struct io_fd *client, @@ -333,6 +340,13 @@ struct io_fd *client = make_io_fd(cfg->backend, fd, NULL); int res; + if ( self-> super.so_rcvbuf > 0) { + if ( setsockopt( client-> super.fd, SOL_SOCKET, SO_RCVBUF, &self-> super.so_rcvbuf, sizeof(self-> super.so_rcvbuf)) < 0) { + notice("Error setsockopt(SO_RCVBUF,%i):%s\n", self-> super.so_rcvbuf, strerror(errno)); + return ST_FAIL | ST_QUIT; + } + } + self->super.num_connections = 1; conn = make_afinet_source_connection(client, NULL, &self->super, self->super.super.super.next); res = LOG_HANDLER_INIT(conn, cfg, NULL); @@ -391,6 +405,7 @@ self->super.flags = flags; self->super.connections = make_object_queue(); self->super.max_connections = 10; + self->super.so_rcvbuf = 0; return &self->super.super; } diff -ruN syslog-ng-1.6.5/src/afsocket.h syslog-ng-1.6.5.patched/src/afsocket.h --- syslog-ng-1.6.5/src/afsocket.h Thu May 6 10:57:52 2004 +++ syslog-ng-1.6.5.patched/src/afsocket.h Tue Oct 12 13:21:09 2004 @@ -90,6 +90,7 @@ (super log_source_driver) (vars (flags simple UINT32) + (so_rcvbuf simple UINT32) (bind_addr object address_info) (max_connections simple UINT32) (num_connections simple UINT32) @@ -135,6 +136,7 @@ void afinet_src_set_mac(struct log_source_driver *c, UINT32 v); void afinet_src_set_encrypt(struct log_source_driver *c, UINT32 v); void afinet_src_set_tcp_keepalive(struct log_source_driver *c, UINT32 v); +void afinet_src_set_so_rcvbuf(struct log_source_driver *c, UINT32 value); void afinet_dest_set_localip(struct log_dest_driver *c, const char *ip); void afinet_dest_set_localport(struct log_dest_driver *c, UINT32 port, const char *service,const char *proto); diff -ruN syslog-ng-1.6.5/src/afsocket.h.x syslog-ng-1.6.5.patched/src/afsocket.h.x --- syslog-ng-1.6.5/src/afsocket.h.x Thu May 6 11:02:39 2004 +++ syslog-ng-1.6.5.patched/src/afsocket.h.x Tue Oct 12 13:32:00 2004 @@ -37,6 +37,7 @@ struct address_info *bind_addr; UINT32 max_connections; UINT32 num_connections; + int so_rcvbuf; struct object_queue *connections; int (*(open_connection))(struct afsocket_source *self, struct io_fd *, struct address_info *a); }; diff -ruN syslog-ng-1.6.5/src/cfg-grammar.y syslog-ng-1.6.5.patched/src/cfg-grammar.y --- syslog-ng-1.6.5/src/cfg-grammar.y Thu May 6 10:57:52 2004 +++ syslog-ng-1.6.5.patched/src/cfg-grammar.y Tue Oct 12 13:17:10 2004 @@ -82,7 +82,7 @@ %token KW_GC_IDLE_THRESHOLD KW_CREATE_DIRS KW_SANITIZE_FILENAMES %token KW_DIR_OWNER KW_DIR_GROUP KW_DIR_PERM KW_TEMPLATE KW_TEMPLATE_ESCAPE %token KW_OWNER KW_GROUP KW_PERM KW_KEEP_ALIVE KW_TCP_KEEP_ALIVE KW_MAX_CONNECTIONS -%token KW_LOCALIP KW_IP KW_LOCALPORT KW_PORT KW_DESTPORT +%token KW_LOCALIP KW_IP KW_LOCALPORT KW_PORT KW_DESTPORT KW_SO_RCVBUF %token KW_COMPRESS KW_MAC KW_AUTH KW_ENCRYPT %token KW_DNS_CACHE KW_DNS_CACHE_SIZE %token KW_DNS_CACHE_EXPIRE KW_DNS_CACHE_EXPIRE_FAILED @@ -299,6 +299,7 @@ : source_afinet_option | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3 ,"udp"); free($3); } | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "udp"); free($3); } + | KW_SO_RCVBUF '(' NUMBER ')' { afinet_src_set_so_rcvbuf( last_source_driver, $3); } ; source_afinet_option diff -ruN syslog-ng-1.6.5/src/cfg-lex.l syslog-ng-1.6.5.patched/src/cfg-lex.l --- syslog-ng-1.6.5/src/cfg-lex.l Thu Aug 5 13:35:12 2004 +++ syslog-ng-1.6.5.patched/src/cfg-lex.l Tue Oct 12 13:23:32 2004 @@ -108,6 +108,7 @@ { "pad_size", KW_PAD_SIZE }, { "spoof_source", KW_SPOOF_SOURCE }, { "spoof-source", KW_SPOOF_SOURCE }, + { "so_rcvbuf", KW_SO_RCVBUF }, /* source or destination items */ { "file", KW_FILE },

2 1

RE: [syslog-ng]how to pull M$ eventlogger events to syslog-ng server ?
by Hall J D (ISeLS) 14 Oct '04

14 Oct '04

> From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Phani Achanta > Sent: 14 October 2004 07:47 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]how to pull M$ eventlogger events to > syslog-ng server ? > > Hi all, > > I have been looking for a non-commercial tool/utility that can > acts like a bridge between Windows NT event logger and syslog-ng > deamon. i.e is there a way to make all the windows servers to log the > events to a unix/linux syslog server > deamon. > > I have googled enough but disappointed to find that there are > only some commercial s/w which have to be installed on the windowz > boxes which will log > them to unix servers but all of these are commercial products. Am i > missing anything from the open source world. > Take a look at http://sourceforge.net/projects/ntsyslog/ we use it on our windows boxes to log to syslog-ng. Works great. Jonathan > --Venkata Achanta

3 2

how to pull M$ eventlogger events to syslog-ng server ?
by Phani Achanta 14 Oct '04

14 Oct '04

Hi all, I have been looking for a non-commercial tool/utility that can acts like a bridge between Windows NT event logger and syslog-ng deamon. i.e is there a way to make all the windows servers to log the events to a unix/linux syslog server deamon. I have googled enough but disappointed to find that there are only some commercial s/w which have to be installed on the windowz boxes which will log them to unix servers but all of these are commercial products. Am i missing anything from the open source world. I want to ask you all if there is any freeware tool that can do this with out having to do much changes to the windows machine (i.e installing lot of other s/w ) I dont want to reinvent the wheel,so please let me know if you are aware of any tool that does this. if there is nothing else, i am planning to do this 1)use win32::EventLog from CPAN and write a perl deamon that watches for new events and 2) pushes them to a mysql DB on *nix server / converted into the syslog-ng format and logged by the syslog-ng server I want some input/suggestions on this if there is no freeware available. I am also looking for collbarators for making this contribution to the open source happen ASAP. I know windows event logger is not built/designed the way syslog is designed. but i think this would be a invaluable gift to sys admins and network admins who are maintaining heterogenous OSs in their facility Feel free to correct me if i am missing somethings here. Thanks in advance for all the future informative replies i will be getting for this e-mail, --Venkata Achanta

1 0

Syslog-ng conf file
by Sp0ng3b0b 13 Oct '04

13 Oct '04

Can someone post their syslog-ng.conf file? I just got it installed and need a little help with the conf file. I would like to see some examples. I will be logging from network devices (cisco), sun and linux servers, snort, and other devices. Thanks.

2 1

Re: [syslog-ng]syslog-ng loses messages
by Aaron watkins 11 Oct '04

11 Oct '04

Dave, > Dave Johnson syslog-ng(a)lists.balabit.hu > Thu, 7 Oct 2004 10:47:14 -0500 > > We have a couple solaris boxes that do logging with pipes and we log a > large amount of data, thats why I'm interested in these tests. I can > see if I can setup a quick testbed next week. > > ********** > > Otherwise, I'm wondering if the packets are throttled, what happens.. IE: > > --------------------------- > cat > /tmp/smallsleep.c <<ENDHERE > #include <unistd.h> > > main () { > usleep(50000); /* 20 hz */ > } > ENDHERE > gcc -o /tmp/smallsleep /tmp/smallsleep.c > ----------------------------- > in the do -> done segment of your for loop add `/tmp/smallsleep` > > How does this impact lost messages? > In the situation where the receiving server is killed while the sending server has stopped sending messages (ie. during the sleep 1 command), there is no affect (ie. Message 0 and 1 are still lost). In the situation where the receiving server is killed while the sending server is still sending messages, the throttling you suggested reduces the number of messages that are lost to 2 (similar to the first test). Test 1: Message 12 and 13 lost Test 2: Message 25 and 26 lost It's an improvement, but unfortunately, its still not quite reliable enough and when used in practice, I'm unsure if our events (which will be asynchronous by their very nature) could possibly be throttled... Do you have any more ideas??? Thanks, Aaron Watkins

2 1