- syslog-ng - lists.balabit.hu

Error compiling 1.6.4 on OpenBSD 3.5-stable
by Steven J. Surdock 18 May '04

18 May '04

$ ./configure ... $ make ... gcc -DHAVE_CONFIG_H -I. -I/home/ssurdock/syslog-ng-1.6.4/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c macros.c macros.c: In function `format_tzofs': macros.c:118: error: `tm' undeclared (first use in this function) macros.c:118: error: (Each undeclared identifier is reported only once macros.c:118: error: for each function it appears in.) *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4/src. *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4/src (line 253 of Makefile). *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4/src (line 418 of Makefile). *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4 (line 168 of Makefile). $ Which seems to stem from the GLOBAL_TIMEZONE not being detected and tm not being defined in the "else" part of the #if: format_tzofs(char *dest, size_t left) { size_t length; #if HAVE_GLOBAL_TIMEZONE length = snprintf(dest, left - 1, "%c%02ld%02ld", timezone > 0 ? '-' : '+', (timezone < 0 ? -timezone : timezone) / 3600, (timezone % 3600) / 60); #else length = strftime(dest, left -1, "%z", tm); #endif return length; } And possibly the relevant config.log ... configure:1876: checking for global timezone variable configure:1895: gcc -c -g -O2 conftest.c 1>&5 configure: In function `foo': configure:1889: error: invalid lvalue in assignment configure: failed program was: #line 1881 "configure" ...

1 0

unparseable log message error
by Senga, Gene 18 May '04

18 May '04

hello, anyone familiar with this message? It seems to go in cycles in the syslog file until /var is full. unparseable log message: "<2048032048204803, 204803, 204803, 204803, 204803, b_blockn204803, 20480204803,204803, b_blocknr=42949672204803,204803, b_blocknr204803, b_blocknr=429496204803 , 204803204803, 204803, 204803, 204803, 204803, 204803, b_blockn204803,204803, b_blocknr=42949672204803, 2048 03, 204803, 204803, b_204803, 204803, b_block204803, 204803, 204803, 204803, 204803, 204803, 204803, 204803,2 04803, b204803, b_blocknr204803, 204803, 204803, 204803, b_blocknr204803, b_blocknr=4294967204803, 204803, 20 4803, 204803, b_blocknr204803, 204803, b_b204204803, 204803, 204803,204803, b_blocknr204803, 204803,204204803 , b_blocknr204803, b_blocknr204803,204803, b204803, b_204803, e=0x00000000, b_size=1024" Linux kernel 2.6.1-5 any help is appreciated. thanks, gene

1 0

TCP Connection Dropouts
by Philip Webster 18 May '04

18 May '04

Hello, I'm wondering about the resilience of syslog-ng to TCP connection dropouts. I've tested what happens when there is no connection available - syslog-ng buffers the output and continues to write to local files, ie. it doesn't block. But what happens if the TCP connection fails halfway through? So, for example, the three-way handshake has been completed, but there is no response after the first data packet is sent because the remote host (or router, switch, ISP ...) has stopped responding. I can't really test this, so does anyone know how syslog-ng handles it? Thanks Phil

2 2

Not Logging
by Asif Iqbal 17 May '04

17 May '04

Hi All I am using this as my conf file for my syslog-ng 1.6.3 w/ libol-0.3.13 to gather logs from cisco. But it is not logging. I am running it on Solaris 9. Notice I can get the log on local7 that points to /var/log/cisco IF I use Solaris's syslogd options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (yes); create_dirs (no); dir_perm(0755); perm(0644); chain_hostnames(no); keep_hostname (yes); }; source net { udp (ip(1.2.0.94) port(514)); }; # local7.crit;local7.warn;local7.info;local7.debug /var/log/cisco filter f_cisco { facility(local7) and level(debug...emerg); }; destination d_cisco { file("/var/log/cisco" create_dirs(yes)); }; log { source(net); filter(f_cisco); destination(d_cisco); }; My snoop/tcpdump gets the SYSLOG pkts fine. Any idea why is it not writng the log with syslog-ng but ONLY with syslogd? I never run both daemons at the same time Thanks for the help/suggestion -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu There's no place like 127.0.0.1

2 1

Where to get latest version og syslog-ng?
by me 17 May '04

17 May '04

Hi, I have problems compiling syslog-ng-1.9.1. As it looks like, the problem was/is known. My question is where to get the very latest version of syslog-ng? Thanks, /me old message of this mailinglist: -------------------------------- On Sun, Feb 16, 2003 at 08:54:17AM -0500, mclinden(a)informed.net wrote: > Greetings! > > The file src/fdread.h seems to be missing from the latest tarball of > syslog-ng-1.9.1 Please try the daily snapshots at http://www.balabit.com/downloads/syslog-ng/1.9/src-snapshot/ -- Bazsi -- "Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen! Jetzt aktivieren unter http://www.gmx.net/info

2 6

RE: [syslog-ng]TCP Connection Dropouts
by Rule, Ted 17 May '04

17 May '04

We had a Disaster Recovery test recently where I specifically tested this exact scenario, as I couldn't be sure that syslog-ng wouldn't block to local Unix Domain connections. The routed link between the central syslog-ng host and the local syslog-ng client was dropped to see what effect it would have - for both syslog-ng and all other applications. The only effect seemed to be that the client machine created an error message every time_reopen() seconds detailing how many messages had been lost due to the broken connection. To slightly reduce the number of errors caused by error messages, I specifically adjusted the client machine's configuration to avoid it sending any messages generated by syslog-ng itself up to the remote host. Ted > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Philip Webster > Sent: Monday May 17 2004 05:06 > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]TCP Connection Dropouts > > > Hello, > > I'm wondering about the resilience of syslog-ng to TCP > connection dropouts. > I've tested what happens when there is no connection > available - syslog-ng > buffers the output and continues to write to local files, ie. > it doesn't block. > > But what happens if the TCP connection fails halfway through? > So, for > example, the three-way handshake has been completed, but > there is no response > after the first data packet is sent because the remote host > (or router, > switch, ISP ...) has stopped responding. I can't really test > this, so does > anyone know how syslog-ng handles it? > > Thanks > Phil > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

Issue with syslog-ng and process-names with spaces
by Jason Haar 17 May '04

17 May '04

Hi there I don't know if this is a bug with syslog-ng-1.6.4 or NTsyslog (which generated the syslog record), but we have a problem with records generated by some NT applications showing up "corrupted" within syslog-ng. Namely it thinks the hostname is the process name. However, looking with a sniffer shows what is really going on: NTSyslog records generally look like: <(facility tag)>May 17 14:22:22 security[success] blah blah and syslog-ng records that as timestamp PTR-record security[success] blah blah However, what if the process name has spaces in it? It looks like <(facility tag)>May 17 14:22:22 trend user alert micro scanmail for microsoft \ exchange[warning]: (msg) syslog-ng records that as timestamp trend user alert micro scanmail... I think syslog-ng is looking at the first word as the process name, and if it doesn't "look like a process name", then it assumes it must be the hostname? Config is: options { use_dns(yes); use_fqdn(yes); dns_cache(no); time_reopen(10); keep_hostname(no); use_time_recvd(yes); log_fifo_size(100); mark(0); stats(0); sync(5); }; Does that sound correct, and is there something I can do to stop it? Thanks -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

3 2

Re: syslog-ng 1.6.4 packages for Solaris
by Balazs Scheidler 15 May '04

15 May '04

Thanks, I'm sure Solaris packages of syslog-ng will be useful. I'm also Cc-ing the syslog-ng mailing list where more people are listening. On Sat, May 15, 2004 at 03:48:01AM -0400, Steven M. Christensen wrote: > Greetings -- > > I had a number of requests for pre-compiled versions of > syslog-ng for Solaris systems from the users of my > sunfreeware.com site. > > I have added these packages for all the levels of Solaris > I support to that site. I hope this is of use to your > efforts. > > Regards, > > Steve Christensen >

1 0

RE: [syslog-ng]cisco host not being resolved
by Badat, Qassim, ALABS 15 May '04

15 May '04

I resolved it, the problem was due to DNS and missing reverse entries for these hosts. Guess what, it was the logs in the syslog-ng that led to its own resolution !!! _____ From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Badat, Qassim, ALABS Sent: Friday, May 14, 2004 11:58 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]cisco host not being resolved Hi, I am new to syslog-ng so excuse my ignorance. I have installed syslog-ng 1.6.2 on Solaris 8. I am getting the logs but the host names are not being resolved. . Strangely logs from another vendor's does have the names resolved by syslog-ng. Any idea whats causing the problem for cisco ? My syslog-ng.conf file: options { long_hostnames(off); sync(0); }; source sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source net { udp(); }; destination network { file("/var/log/syslog-ng"); }; log { source(net); destination(network); }; log { source(sys); destination(network); }; Regards, QB

3 2

RE: [syslog-ng]cisco host not being resolved
by Dmitri Smirnov 15 May '04

15 May '04

I think you can use use_dns(no) option to disable DNS resolution by syslog-ng Dmitri -----Original Message----- From: Badat, Qassim, ALABS [mailto:qbadat@att.com] Sent: Friday, May 14, 2004 3:05 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]cisco host not being resolved Nothing to do with syslog-ng. It's the DNS, there should exist both the A -record and the PTR for the host. That is you should be able to resolve NAME-to-IP and also IP-to-NAME.

1 0

RE: [syslog-ng]cisco host not being resolved
by Badat, Qassim, ALABS 15 May '04

15 May '04

Nothing to do with syslog-ng. It's the DNS, there should exist both the A -record and the PTR for the host. That is you should be able to resolve NAME-to-IP and also IP-to-NAME. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Asif Iqbal Sent: Friday, May 14, 2004 5:34 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]cisco host not being resolved Badat, Qassim, ALABS wrote: > I resolved it, the problem was due to DNS and missing reverse entries > for these hosts. Guess what, it was the logs in the syslog-ng that led > to its own resolution !!! Would you care to share the diff of the not working and working syslog.conf? I am having the same problem Thanks > > > > _____ > > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Badat, Qassim, > ALABS > Sent: Friday, May 14, 2004 11:58 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]cisco host not being resolved > > > > Hi, > > > > I am new to syslog-ng so excuse my ignorance. I have installed > syslog-ng 1.6.2 on Solaris 8. I am getting the logs but the host names > are not being resolved. . Strangely logs from another vendor's does > have the names resolved by syslog-ng. Any idea whats causing the > problem for cisco ? > > > > > > My syslog-ng.conf file: > > > > options { long_hostnames(off); sync(0); }; > > source sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); > internal(); }; > > source net { udp(); }; > > > > destination network { file("/var/log/syslog-ng"); }; > > > > log { source(net); destination(network); }; > > log { source(sys); destination(network); }; > > > > > > > > Regards, > > QB > -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu There's no place like 127.0.0.1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

IRC channel: #syslog-ng on FreeNode
by Andrew J Caines 14 May '04

14 May '04

Folks, Having failed to find an existing one, I've set up an IRC channel #thttpd on the FreeNode IRC network`[1], where I'm AJ_Z0 and AJC_Z0 (at home and work, respectively). It's registered with ChanServ. Please feel free to drop in to say hello, as well as share questions, answers and ideas about syslog-ng. If no-one responds straight away, don't feel slighted since not everyone is actively participating in the channel all the time. Hang around and someone will respond. In case you're not familiar with Internet Relay Chat (IRC), it's an old but very much alive collection of distributed networks, wherein your IRC client connects to any node and you join any of the channels (chat groups) and chat with everyone else in that channel on the network. It's a bit like some of the instant messenger groups, but without the proprietary protocols, poor client platform support, etc. For the record, I'm not involved with syslog-ng, except as a (fairly new) user. ----8<---- [1] irc.freenode.org - See http://freenode.org/ -Andrew- -- _______________________________________________________________________ | -Andrew J. Caines- Unix Systems Engineer A.J.Caines(a)halplant.com | | "They that can give up essential liberty to obtain a little temporary | | safety deserve neither liberty nor safety" - Benjamin Franklin, 1759 |

1 0

Problem with 1.6.2 on Solaris 8 - lwp_sema_wait(0xFEF0DE60)
by Wyner, Peter 14 May '04

14 May '04

All, I am running into an issue on a previously working syslog_ng 1.6.2 server. There were no configuration changes between when it worked and now (when it doesn't). The syslog sever will process a large number of packets for a period of time and then suddenly the processor utilization goes down to zero, files stop being written, and truss shows: door_call(6, 0xFFBED340) (sleeping...) signotifywait() (sleeping...) lwp_sema_wait(0xFEF0DE60) (sleeping...) I am collecting syslog on a high udp port: # # Syslog-ng example configuration file for Solaris # # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.solaris,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Solaris 2.5.1 and below uses the STREAMS driver, above extends it # with doors. For 2.5.1 remove the door() option from the source declaration. # options { log_fifo_size(1024); sync(0); dns_cache(yes); dns_cache_expire(60); use_dns(yes); chain_hostnames(no); keep_hostname(no); }; source local { sun-streams("/dev/log"); internal(); }; source std_udp { udp( port(52001) ); }; destination all { file("/var/log/messages"); }; destination dst1 { file("/syslog/dst1/current/$HOST" dir_perm(0755) perm(0644)); }; log { source(local); destination(all); }; log { source(std_udp); destination(dst1); }; Any ideas? Thanks, Peter

2 1

cisco host not being resolved
by Badat, Qassim, ALABS 14 May '04

14 May '04

Hi, I am new to syslog-ng so excuse my ignorance. I have installed syslog-ng 1.6.2 on Solaris 8. I am getting the logs but the host names are not being resolved. . Strangely logs from another vendor's does have the names resolved by syslog-ng. Any idea whats causing the problem for cisco ? My syslog-ng.conf file: options { long_hostnames(off); sync(0); }; source sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source net { udp(); }; destination network { file("/var/log/syslog-ng"); }; log { source(net); destination(network); }; log { source(sys); destination(network); }; Regards, QB

1 0

syslog-ng 1.6.4
by Balazs Scheidler 14 May '04

14 May '04

Hi, After the embarassing Solaris related problem in 1.6.3, I'm releasing 1.6.4 which fixes that issue, otherwise nothing else changed. It is being uploaded to our website and should be available tomorrow at the latest. Here's the NEWS file: News for the 1.6.4 release Fri, 14 May 2004 16:42:25 +0200 * fixed a STREAMS handling bug introduced by the IRIX compatibility patches integrated in 1.6.3 -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 14 May '04

14 May '04

Yes, patch is working well. Dmitri -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, May 14, 2004 3:13 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message Does this mean that the patch works well?

1 0

Syslog-ng will not configure properly on vanilla Red Hat
by Keg 14 May '04

14 May '04

syslog-ng needs the libol library, which I compiled and installed to it's default location, /usr/local/lib. When configuring syslog-ng I get this error: <snip> checking for strptime... yes checking for TCP wrapper library... -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.13... no configure: error: Required libol version not found Here is the library: syslog:/usr/local/lib #ls -la total 124 drwxr-xr-x 2 root root 4096 May 13 06:45 . drwxr-xr-x 23 root root 4096 Jan 10 10:55 .. -rw-r--r-- 1 root root 51408 May 13 06:45 libol.a -rwxr-xr-x 1 root root 698 May 13 06:45 libol.la lrwxrwxrwx 1 root root 14 May 13 06:45 libol.so -> libol.so.0.0.0 lrwxrwxrwx 1 root root 14 May 13 06:45 libol.so.0 -> libol.so.0.0.0 -rwxr-xr-x 1 root root 50799 May 13 06:45 libol.so.0.0.0 I added /usr/local/lib to /etc/ld.so.conf and ran ldconfig. (even rebooted as well) This did not work. I added /usr/local/lib to LD_LIBRARY_PATH, this did not work. I tried configuring with --with-libol=/usr/local and got same error. I tried configuring with --with-libol=/usr/local/lib and got same error. I tried configuring with --with-libol=/usr/local, however, this time I get this error: checking for TCP wrapper library... -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.13... configure: error: libol-config not found in the specified location libol-config is in /usr/local/bin: syslog:/usr/local/src/Syslog-Ng/syslog-ng-1.6.3 #ls -l /usr/local/bin/ -rwxr-xr-x 1 root root 1298 May 13 06:45 libol-config I have followed every doc as instructed. This is a vanilla RH 9 system with all updates. Thx for any help. cc

4 7

RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 14 May '04

14 May '04

Thank you, The patch fixed the problem with an error message about STREAMS. Dmitri -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, May 13, 2004 4:32 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Problem with 1.6.3 on Solaris. Message Can you test if this patch fixes it? For me it seems to work. diff -u -r1.16.4.1 afstreams.c --- src/afstreams.c 10 Mar 2004 18:43:28 -0000 1.16.4.1 +++ src/afstreams.c 13 May 2004 11:31:10 -0000 @@ -175,6 +175,7 @@ struct nonblocking_fd *io_stream_get(struct io_backend *backend, int fd, UINT8 *hostname_re, + UINT32 max_log_line, struct log_handler *pipe) { NEW(stream_fd, f); @@ -184,6 +185,7 @@ f->super.read = stream_read_callback; f->super.want_read = 1; f->pipe = pipe; + f->max_log_line = max_log_line; if (hostname_re == NULL) regcomp(&f->bad_hostname, "^$", REG_NOSUB | REG_EXTENDED); else @@ -239,7 +241,7 @@ close(fd); return ST_FAIL | ST_QUIT; } - self->stream_fd = io_stream_get(cfg->backend, fd, cfg->bad_hostname, c); + self->stream_fd = io_stream_get(cfg->backend, fd, + cfg->bad_hostname, cfg->log_msg_size, c); REMEMBER_RESOURCE(cfg->resources, &self->stream_fd->super); -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

Re: [syslog-ng]Syslog-ng will not configure properly on vanilla Red Hat
by Chris Paalman 13 May '04

13 May '04

If you look more carefully on the website you will notice that the files are sorted by filename and not by date. Thus you will find what you are looking for in the middle of the list. Chris Paalman >Reply-To: syslog-ng(a)lists.balabit.hu > > >I just realized it is looking for libol > 0.3.13, but the latest on the >site is 0.3.9 which it says to use with syslog-ng 1.6.3. > >Where can I get this newer version of libol???? >??

1 0

RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 13 May '04

13 May '04

Sorry for confusion - may be the solution will help someone in future as well. The problem I had was related to reverse lookups - I didn't have few zones registered in DNS and reverse lookup was taking 1-2 minutes.. During that time syslog-ng was dropping messages.. I guess it will be nice to isolate lookup function from messages processing if possible.. Thank you for your help and for really nice product! Sorry for confusion - 1.6.3 is working just fine! Dmitri -----Original Message----- From: Dmitri Smirnov Sent: Thursday, May 13, 2004 11:13 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message Tried to increase UDP udp_max_buf to 524288 (from 262144) - doesn't help. STATS reports 0 lost messages... ;( Plus 1.6.3 hangs for me after 200-300 messages (3-5 minutes)... 1.6.1 doesn't hang but losing messages :( Dmitri -----Original Message----- > > Another problem with syslog-ng in general (1.6.1 or later) - we're > started to lose about 10% of syslog messages. > The config file is not too big and messages do arrive on server for > sure (confirmed with snoop) but every few minutes syslog-ng is losing > some of them. Any recommendation on tuning or troubleshooting? if the packet arrives to the log host but syslog-ng does not receive it (e.g. your STATS line shows 0 dropped messages), it is possible that the UDP receive buffer is too small. try increasing the UDP receive buffer, it should be possible with some OS dependant tools (ndd comes to mind on Solaris)

1 0

RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 13 May '04

13 May '04

Tried to increase UDP udp_max_buf to 524288 (from 262144) - doesn't help. STATS reports 0 lost messages... ;( Plus 1.6.3 hangs for me after 200-300 messages (3-5 minutes)... 1.6.1 doesn't hang but losing messages :( Dmitri -----Original Message----- > > Another problem with syslog-ng in general (1.6.1 or later) - we're > started to lose about 10% of syslog messages. > The config file is not too big and messages do arrive on server for > sure (confirmed with snoop) but every few minutes syslog-ng is losing > some of them. Any recommendation on tuning or troubleshooting? if the packet arrives to the log host but syslog-ng does not receive it (e.g. your STATS line shows 0 dropped messages), it is possible that the UDP receive buffer is too small. try increasing the UDP receive buffer, it should be possible with some OS dependant tools (ndd comes to mind on Solaris)

1 0

Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 13 May '04

13 May '04

Looks like version 1.6.3 is not working well on Solaris 8. Few minutes after the start it generates hundreds of messages like: syslog.err syslog-ng[27013]: do_stream_read: STREAMS device gave too long line I think it is the result of changes related to HP-UX and pad_size (from 10k to 256 bytes ?) Another problem with syslog-ng in general (1.6.1 or later) - we're started to lose about 10% of syslog messages. The config file is not too big and messages do arrive on server for sure (confirmed with snoop) but every few minutes syslog-ng is losing some of them. Any recommendation on tuning or troubleshooting? Dmitri

2 2

RE: [syslog-ng]min options needed for logserver?
by Hamilton, Andrew 10 May '04

10 May '04

Unfortunately, optimizing it is really particular to your setup and what you are trying to do. You can use no options and take just defaults or you can have 15 different ones. It is difficult to tell what minimum you need without knowing how your system is configured and what you want it to do. A start might be just to use no options and work from there. Regards, Drew -----Original Message----- From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] Sent: Monday, May 10, 2004 1:09 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]min options needed for logserver? To aid in understanding and minimize complexity I'd like to use the minimum options in syslog-ng.conf possible. Different examples I've seen use lots of different options so I'm not sure which ones are crucial. What is a good smallest set of vital options for a log server? Chris _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

min options needed for logserver?
by seberino＠spawar.navy.mil 10 May '04

10 May '04

To aid in understanding and minimize complexity I'd like to use the minimum options in syslog-ng.conf possible. Different examples I've seen use lots of different options so I'm not sure which ones are crucial. What is a good smallest set of vital options for a log server? Chris _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

how to push sulogs/utmp/wtmp to central logserver
by Nilesh Naik 10 May '04

10 May '04

Hello All is it possible to push sulogs/wtmp/utmp etc logfiles from the hosts running solaris 7/8/9, to the redhat linux box running syslog-ng ? if this is possible kindly guide me how can i configure the same and how to rotate the sulog/wtmp/utmp etc log files on solaris regards Prashant __________________________________ Do you Yahoo!? Win a $20,000 Career Makeover at Yahoo! HotJobs http://hotjobs.sweepstakes.yahoo.com/careermakeover

1 0