- syslog-ng - lists.balabit.hu

newbie questions about hostname related options
by seberino＠spawar.navy.mil 21 Oct '03

21 Oct '03

I got syslog-ng working and am happy with it but I had one question about necessary syslog-ng.conf options that is bugging me. I don't know what hostname related options are necessary for a little log server with 3 clients: use_fqdn keep_hostname long_hostnames chain_hostnames I remember NEEDING chain_hostnames(off) to solve a problem but I wonder: 1. if problem could have been solved with another option in list above 2. what are minimum options that make a good little syslog-ng installation. (I wonder if keep_hostname(yes) solves 99% of the problems and is good enough. I don't know.) Any help would be greatly appreciated. Sincerely, Chris -- _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

3 5

Where did netmask() come from ?
by Wayne Sweatt 16 Oct '03

16 Oct '03

I did not have a clue about this function. This should do just what I want in getting the logs from clients on various networks logged into different log directories. Thanks to Mr Verde! So when did this added netmask() function appear? Is the documentation old? What version of syslog-ng/libol was this introduced in? Does the on-line documentation need updating? Thanks, Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Sort/filter logs on source IP address
by Wayne Sweatt 15 Oct '03

15 Oct '03

I've asked this question before in a slightly different manner (Can I run multiple instances of Syslog-NG - One for Mac OS X, one for other UNIX...), but still have not a satisfactory answer to that on, so.. I'd thought I'd ask a similar question and hope for a more definitive answer: Is there a way to filter or regexp match an incoming UDP log by IP Address so that logging clients from certain networks go to certain log directories/destinations ? For example, I want to log everything from 128.128.1.0 in /var/log/NetworkA, and log everything from 128.128.2.0 in /var/log/NetworkB/. I know host() will operate on hostname, but I don't want to have to maintain a list of hosts to match against - I want it be dynamic, so when a new client is added, it can log automatically to the appropriate directory. Syslog-ng has the source IP with each log, so this shouldn't be a problem, right? I am using the latest version of syslog-ng, and UDP as the protocol. Reminder: I do not want to know about TCP Wrappers, I don't want to block IPs, just direct logs from certain IP subnets to certain directories/file-systems. Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

3 2

Re: bug in syslog-ng?
by Balazs Scheidler 15 Oct '03

15 Oct '03

On Tue, Oct 14, 2003 at 11:33:10AM +0200, Marc Silver wrote: > Hi Balázs, > > I just upgraded from syslog-ng-1.6.0rc2 to syslog-ng-1.6.0rc4 and have > noticed that there is now an odd binary character in my pix log files. > Is this a bug, or something new in syslog-ng? A quick strace shows: > > write(10, "Oct 14 11:25:40\0 pixname %PIX-4-"..., 133) = 133 > > As you can see, it's writing a \0 after the datestamp, which it didn't > seem to be doing before. > > Any information you could provide on this would help. it is definitely a bug, and is caused by the new PIX date stamp parsing code. This patch seems to fix the bug for me: diff -u syslog-ng/src/log.c:1.31 syslog-ng/src/log.c:1.32 --- syslog-ng/src/log.c:1.31 Fri Oct 3 16:16:38 2003 +++ syslog-ng/src/log.c Wed Oct 15 10:26:44 2003 @@ -99,6 +99,7 @@ tm.tm_isdst = -1; lm->date = ol_string_alloc(16); strftime(lm->date->data, 16, "%b %e %H:%M:%S", &tm); + lm->date->length--; src[20] = ':'; src += 21; left -= 21; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Annie Chaiyakul/it/idecpharm/US is out of the office.
by Annie Chaiyakul 15 Oct '03

15 Oct '03

I will be out of the office starting 10/13/2003 and will not return until 10/20/2003. I will out of office until 10/13/03. For immediate issues, please contact the IT help desk and for urgent UNIX specific needs, please contact Emily Yau. Thank you.

1 0

1.6.0rc4 released
by Balazs Scheidler 09 Oct '03

09 Oct '03

Hi, I've released version 1.6.0rc4 with the following NEWS entry: News for the 1.6.0rc4 release Fri, 3 Oct 2003 16:00:47 +0200 * close stderr when going into background * set the fd for file sources into nonblocking mode to avoid blocking in the case both klogd and syslog-ng is reading /proc/kmsg * added support to parse PIX timestamps A couple of parsing errors reported earlier are _not_ fixed in this release as they would change the parsing code, and I don't want to get it wrong in the stable series. I'll post a patch instead which can be tested by interested parties. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 2

syslog-ng filename expansion - 1.6.0rc3
by James B. Davis 08 Oct '03

08 Oct '03

Hi, I've tried in vain to get underscores in the filename expansion but all I get is the last variable. For example: destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY-$YEAR-$MONTH-$DAY" owner(root) group(nms) perm(0640) dir_perm(0750) create_dirs(yes) ); }; Works but changing the "-" with "_" leaves me with files named "$DAY" rather than the whole string. Using "." works ok but it is real messy when you need fqdn. thx jbd -- James Davis Lead Systems Administrator Douglas County Government Information Technology Department 100 Third Street, Castle Rock CO 80104 USA cell 303.994.8881 fax 303.688.6908 direct 303.663.7654 http://www.douglas.co.us/ mailto:jdavis@douglas.co.us

1 0

bug report: interlaced messages
by Thomas Morin 03 Oct '03

03 Oct '03

Hi, I've just run into a problem I had already seen during my tests for the previous bug report I sent : I see pieces of logs that appear in the middle of other messages. Example: $ grep 'Sep 22 06:17:0' messages Sep 22 06:17:01 ker0009901 )<38>Sep 22 06:17:01 cron(pam_unix)[1173]: session closed for user mail We see, in the middle of a message, the beginning of a syslog header ( "<..>" ) and the message that follows does not belong to the 'messages' destination, and we see that it is actually missing from the 'auth.log' file : $ grep 'Sep 22 06:17:0' auth.log Sep 22 06:17:01 ker0009901 cron(pam_unix)[1173]: session opened for user mail by (uid=0) Sep 22 06:17:01 ker0009901 cron(pam_unix)[1174]: session opened for user root by (uid=0) Sep 22 06:17:02 ker0009901 cron(pam_unix)[1174]: session closed for user root (no "session closed" for user mail) This kind of problem might be a security issue if it can be triggered easily. I'm no expert here, but this looks a bit similar to the other bug I've just reported, since the same thing (interlaced messages) is happening when syslog-ng receives UDP syslog messages not NULL terminated of which size exceeds log_msg_size. Regards, -Thomas PS: this is syslog-ng 1.6.0, version 1.6.0rc1+20030310 (debian package), running on Linux 2.6.0-test5 -- == Thomas Morin == Ingénieur Consultant Atlantide - www.ago.fr - thomas.morin(a)ago.fr == PGP Id:8CEA233D Key FP:503BF6CFD3AE8719377B832A02FB94E08CEA233D --

2 3

syslog-ng writes two files
by Serge Torop 03 Oct '03

03 Oct '03

Hello! I'm using Linux RH 9.0, libol 0.3.9 and syslog-ng 1.6.0rc3. In my syslog-ng.conf: destination d_fetchmail { file("/var/log/fetchmail/fetchmaillog.$DAY.$MONTH.$YE$ Then syslog-ng operate the log it writes two files: 1. fetchmaillog.03.10.2003 2. fetchmaillog.31.12.2002 with different contents. Is writing fetchmaillog.31.12.2002 bug, then 3 Oct 2003 now? -- Serge P. Torop St.Petersburg, Russia

2 1

Still - "Assertion `i == nfds' failed."
by Dennis Skinner 30 Sep '03

30 Sep '03

Still looking for help with this. What other information can I provide? It has been running for a week inside a screen in debug mode, but I would really like to get it working properly. Still getting this error: syslog-ng: io.c:270: io_iter: Assertion `i == nfds' failed. syslog-ng version 1.6.0rc3 libol 0.3.10 RedHat 9 I only have 3 sources: internal and 2 udp sources (no /proc/kmsg or /dev/log). It runs fine for a short while and then dies with the above error. Sometimes it runs for a minute or so and sometimes for 15-20 mins without a problem before it dies (logging properly from the various servers while it runs). I had setup the local syslogd to pass its messages to syslog-ng via udp. I stopped syslogd (and klogd) and getting same problem. Tried running both using chroot option and not, same thing. Seems to run forever in debug mode. I can see it does garbage collection every now and then. > So you have three sources and a single file destination? Or you also log to > remote hosts uding TCP or UDP? No, I have 2 destinations....other servers are sending logs here. source s_local { internal(); }; source s_int1_udp { udp(ip("10.0.1.123") port(514)); }; source s_int2_udp { udp(ip("192.168.1.123") port(514)); }; destination d_sort_program_host { file("/export/syslog-ng/var/log/$HOST/$PROGRAM.$MONTH$DAY$YEAR" group("logs") perm(0640) create_dirs(yes) dir_perm(0750) ); }; destination d_sort_host { file("/export/syslog-ng/var/log/$HOST/$MONTH$DAY$YEAR" group("logs") perm(0640) create_dirs(yes) dir_perm(0750) ); }; log { source(s_local); source(s_int1_udp); destination(d_sort_program_host); }; log { source(s_int2_udp); destination(d_sort_host); }; -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

2 1

Can I run multiple Syslog-ng instances on different ports?
by Wayne Sweatt 29 Sep '03

29 Sep '03

I was interested in running 2-3 instances of Syslog-ng on a single system, with a single interface. I would use different port numbers for each, of course. The reason was to separate logs from different client OS types. We have a different team that supports Mac OS X, for example, and would like to keep a separate directory tree of logs for those systems. The syslog-ng.conf file would be pushed out to the different *NIX Oses with Cfengine, and then Syslog-ng could keep the logs separate and then could be parsed those logs with my scripts and email the appropriate admins. Is the running 2-3 concurrent instances ok? Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Destination program: Syslog-ng stops writing to program
by K Resar 29 Sep '03

29 Sep '03

I've setup syslog-ng to output its messages to a destination program. However, when the server gets heavily loaded [1] either syslog-ng stops writing messages to the program's STDIN or the program stops reading these messages. Has anyone else experienced this behavior? If this appears to be a known problem that cannot be resolved, a solution for me would be to output all messages received with some sort of a destination file driver, but keeping the PRI portion of the syslog message intact. Does this functionality currently exist? Keith. 1: Or perhaps just for the fun of it too -- this has happened at times when I would not expect the log server to be getting too many messages. --

1 0

RE: [syslog-ng]permissions being changed for certain devices
by Clemson, Chris 29 Sep '03

29 Sep '03

> > everytime i restart syslog-ng i have to chmod the /dev/null > file or squid > > goes nuts and spawns off loads of its own processes, which > eventually hangs > > the machine. > > > > all 3 files are referenced in /etc/syslog-ng.conf as destinations. > > if syslog-ng has access to the files (i chmod /dev/null to > 666), why should > > it change the permissions to block other programs? > > > > i am running this on SuSE 8.0. > > use perm(-1) for those files. ah, thank you! however, http://www.balabit.com/products/syslog_ng/reference/x354.html doesn't actually explain how to use them. for example, if i had a line: destination null { file("/dev/null"); }; where would i put the perm(-1) option? wherever i stick it, it seems to complain! thanks! chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

permissions being changed for certain devices
by Clemson, Chris 29 Sep '03

29 Sep '03

ever since i upgraded to syslog-ng 1.6.0rc3 from 1.4.14, when syslog-ng is restarted something wierd happens. I get 3 error messages: Sep 29 11:56:47 proxy syslog-ng[1614]: Changing permissions on special file /dev/xconsole Sep 29 11:56:47 proxy syslog-ng[1614]: Changing permissions on special file /dev/tty10 Sep 29 11:56:47 proxy syslog-ng[1614]: Changing permissions on special file /dev/null in particular, it changes /dev/null to rw access for root only. q1: why does it do this? and q2: how to i stop it? everytime i restart syslog-ng i have to chmod the /dev/null file or squid goes nuts and spawns off loads of its own processes, which eventually hangs the machine. all 3 files are referenced in /etc/syslog-ng.conf as destinations. if syslog-ng has access to the files (i chmod /dev/null to 666), why should it change the permissions to block other programs? i am running this on SuSE 8.0. thank you! chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 1

recall issue on coosbay server
by Wang, Zhenyu Z 27 Sep '03

27 Sep '03

Hi, I've asked the question about some strange result when running syslog-ng-1.6.0rc3 on coosbay server. Syslog-ng couldn't create log files, but generate wild files in current work directory. --sample config file- # Simple syslog-ng.conf file. options {use_fqdn(no);sync(0);}; source s_sys { unix-stream("/dev/log"); internal(); }; destination d_security { file("/usr/local/var/log/security" create_dirs(yes)); }; destination d_messages { file("/usr/local/var/log/messages" create_dirs(yes)); }; destination d_console { usertty("root"); }; filter f_authpriv { facility(auth, authpriv); }; filter f_messages { level(info .. emerg) and not facility(auth, authpriv); }; filter f_emergency { level(emerg); }; log { source(s_sys); filter(f_authpriv); destination(d_security); }; log { source(s_sys); filter(f_messages); destination(d_messages); }; log { source(s_sys); filter(f_emergency); destination(d_console); }; --end- [root@power sbin]#./syslog-ng [root@power sbin]# ls ? stunnel syslog-ng ... [root@power sbin]# cat ? Sep 27 13:53:56 s_sys@power syslog-ng[28098]: syslog-ng version 1.6.0rc3 starting Sep 27 13:53:56 s_sys@power syslog-ng[28098]: syslog-ng version 1.6.0rc3 starting Any idea on why this file is created but normal log files fail to be exist? Thanks zhen

1 0

UDP Template
by Gianpiero Porchia 26 Sep '03

26 Sep '03

Hi, I would like to do log relaying, using syslog-ng. But I need to change the log format. The problem is that the "template" directive is not available for the udp destination (even for the tcp destination). Could you suggest me some work around to do that? Thanks in advance. - gian P.S I've thought on a work around, but it doesn't work fine. Hence the "template" directive is available for the pipes, I've used a pipe destination to send the logs. Then, I'm using the same pipe, as source, and I'm relaying the logs from it, to another log server. But syslog-ng thinks that the logs are coming from the server, and I get the following (ie, it uses the standard log format, after the pipe): Message Before the pipe -------------------- [X.Y.Z.K] ufs: [ID 213553 kern.notice] NOTICE: realloccg /u00: file system full Message After the pipe --------------------- Sep 25 18:12:11 Figth_cluB_01 [X.Y.Z.K] ufs: [ID 213553 kern.notice] NOTICE: realloccg /u00: file system full I'm using this configuration: # CONF ############################################# source s_net { udp(); }; source s_pipe_per_NI { pipe(/var/chroot/syslog-ng/dev/pipe_per_NI); }; destination relay_to_NI { udp("A.B.C.D" ); }; destination d_pipe_per_NI { pipe("/dev/pipe_per_NI" template("[$HOST] $MSG\n") ); }; log { source(s_net); destination(d_pipe_per_NI); # Here, I can apply the template }; log { source(s_pipe_per_NI); destination(relay_to_NI); # Here, syslog-ng applies the standard log format :( }; # END CONF ############################################# _____ Ing. Gianpiero Porchia Security Engineer ATS - Advanced Telecom Systems Designing, Testing, Managing Network Quality Via Salgari, 17 - 41100 Modena - ITALY Tel +39 059 821332 Fax +39 059 821492 Cel +39 335 330413 E-mail: gianpiero.porchia(a)atsweb.it messenger.msn.com: http://messenger.msn.com/, gianpiero.porchia(a)atsweb.it Web site: http://www.atsweb.it PGP Key ID: 0xCAE064A4 (pgpkeys.mit.edu:11371) Fingerprint: 080D AD88 C18A FCA3 91BC 0DF2 F05F 7489 CAE0 64A4

2 1

help: syslog-ng config to consolidate logs
by Daniel Flick 26 Sep '03

26 Sep '03

Based on several net searches, I am running the following syslog-ng config in an attempt to consolidate Cisco PIX logs (23 of them) to a RH 9 server. Syslog-ng appears to be working and is in the running process list. I am very new to syslog-ng so I have no idea how to check into this in more detail. Is there a service log file or configuration validator? I have read the docs but I seem to be missing something that will help to piece this all together. I was expecting the following results: Syslog-ng to listen on UDP 514 for syslog messages. Incoming messages get filtered on host IP and a new directory is created for each host with a filename consisting of the month and day followed by pix.log. I previously had all my PIX firewalls logging to local 7 on HPUX using syslog without a problem (albeit to the same file). I have made no changes to the pix save the change in IP address to the new server. I have turned off RH 9's syslog service and am still getting logs from the server so I believe that syslog-ng is working but no directories are created for the firewalls. I have verified that the server is listening on UDP 514 and no firewall is currently being run on the server. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source net { udp(); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_csco { file("/var/log/$HOST/$MONTH.$DAY.pix.log"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(net); filter(f_filter7); destination(d_csco); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; Thanks for any help you may provide. Also, is there a search-able list archive out there? I downloaded 14MB html file but it was much less than useful. Thanks, Daniel Flick DFMCO dflick(a)dfmco.com

1 0

Omot STATS dropped 0
by Florian Lindner 25 Sep '03

25 Sep '03

Hello, can I omit these messages somehow? I think they are useful if there are any drops, but there are always 0. Sep 25 21:50:47 s_sys@bastet syslog-ng[420]: STATS: dropped 0 Thx, Florian

1 0

Central log server rotate problem
by Tobias 25 Sep '03

25 Sep '03

I'm trying to set up a central logserver with syslog-ng, and so far that is working great. Next thing to do is to rotate the log-files using newsyslog. This is where i run into problems. The syslog-ng.conf is in a sense "general", since a good filtering configuration on the server can be used for several machines. New machines can start logging remotely without changing the log server configuration. The problem is that the newsyslog.conf requires configurations of the following type: /var/log/pflog 600 3 250 * ZB /var/run/pflogd.pid My log files reside in directories like these: drwxrwx--- 2 root wheel 512 Sep 25 14:18 guardian drwxrwx--- 2 root wheel 512 Sep 25 13:00 logger where the directories are named after the hosts. The guardian directory looks like: -rw-rw---- 1 root wheel 479 Sep 25 14:00 cron.log -rw-rw---- 1 root wheel 3359 Sep 25 14:18 daemon.log -rw-rw---- 1 root wheel 851 Sep 25 14:12 messages -rw-rw---- 1 root wheel 1776 Sep 25 13:40 pflog.log -rw-rw---- 1 root wheel 187 Sep 25 14:18 secure.log How do you tell newsyslog that all files should be rotated without specifying the directorynames? Do you use a script of some kind or what? According to the documentation a filename must be entered on each row in the newsyslog.conf. Thanks in advance Tobias Persson

1 0

syslog-ng vs. msyslog
by Christoph.Eckart＠COMPUTACENTER.COM 25 Sep '03

25 Sep '03

Hello everybody, I am currently working on setting up a centralized monitoring server.I have been testing syslog-ng and msyslog simultaneously on two servers. I am unable to see much of a difference between their capabilities.Is their some advantage which syslog-ng has over the other available syslog versions? I am sure the experience of other users on the forum can help me decide better. Thanks Christoph Eckart

1 0

sending snmptraps w/ snmptrap
by MGruber＠metzler.com 23 Sep '03

23 Sep '03

Hi! I am trying to send an snmptrap if a critical or error-Message occures. I found some scripts in the net which told me to use destination traps {program("/usr/local/sbin/sendtrap.sh"); }; with following script #!/bin/sh while read line; do snmptrap .... done It has the problem that I can not manipulate the snmptrap statement, I tried further: destination d_send_trap { pipe("/tmp/snmptrap.pipe" template("snmptrap ..... '$HOST' '$FACILITY' '$PRIORITY' ... '$MSG'\n") template-escape(yes)); now I have the trouble how I get the statement from the pipe into execution. Does anyone have something in this kind working ? Thanks in advance Matthias Gruber ------------------------------------------------------------------------------------ Dipl.-Inform. Matthias Gruber MCNE(mult.), MCSE, CIP, IT-Project+ Bankhaus B. Metzler seel. Sohn & Co. KGaA ++ Informationssysteme/Systemtechnik ++ Tel.: +49 69 2104 4330 Fax: +49 69 2104 4040 Große Gallusstr. 18 60311 Frankfurt MGruber(a)Metzler.com

2 1

Annie Chaiyakul/it/idecpharm/US is out of the office.
by Annie Chaiyakul 23 Sep '03

23 Sep '03

I will be out of the office starting 09/22/2003 and will not return until 09/26/2003. I will out of office until 09/26/03. For immediate issues, please contact the IT help desk and for urgent UNIX specific needs, please contact Emily Yau. Thank you.

1 0

Dropping UDP logs - need ideas
by Wayne Sweatt 22 Sep '03

22 Sep '03

OK. I figured it out: Im stupid. The Kiwi SyslogGen was set for random on the priority, and I was not logging .debug level logging. (info..emerg) So, as far I've experienced, Solaris * only really needs to have the udp receive high water mark raised to 64k: ndd -set /dev/udp udp_recv_hiwat 65536 All is well. -Wayne

1 0

Dropping UDP logs - need ideas
by Wayne Sweatt 22 Sep '03

22 Sep '03

Syslog-ng'ers, I have a Solaris 8 Syslog-ng logger in production which runs and tests out fine. Now, I've built another Sparc/Solaris 8 system on an Ultra 10 and I am dropping UDP logs at about a 5-15% rate. I am testing just as before with Kiwi's Syslog generator. When I send a burst of 100 logs, I see the loss of logs. I had this problem with the first server, but I simply maxed out the udp_recv_hiwat to 65536, and all was well, even with 500 log bursts. This new server has been configured the same way. The only difference is the hardware. I even tried the previous version of Syslog-ng used - no help. Here's what I have: Latest Syslog-ng, compiled with sun-door, and tcp-wrappers 400Mhz UltraSparcII CPU 500M memory 2 x 72G SCSI drives (10k rpm) 10/100M ether interface running at 100fdx Here's the sad part: I tested with the old syslogd, and it logged only 73% of the UDP logs. (Had one entry, plus a "repeated 72 times" line) So it looks like a system problem, just not sure where it is. I tried upping the sync(), and it didn't seem to help either. I have the /var partition on it's own 10K SCSI drive, so I doubt it's a disk I/O issue - iostat looks ok too. I tries turning the use_dns() on/off too. It doesn't even log with it off, I guess because I have the dns_cache on which must conflict.(?) I have plenty of memory and swap. Actually I've ge the system JASS'ed out, so I'm not running much of anything process-wise, except Syslog-ng. Any debugging suggestions? Oh, yeah. I've upped the log_fifo_size, and - no help. Using TCP is not option now, so that won't be a solution for me. Help! While I wait for replies, I'll think I'll count bytes seen on the interface by netstat... or snoop... Thanks gang. Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Information Request - GLPed
by Rui Teixeira 22 Sep '03

22 Sep '03

It appears that Syslog-ng is really what i'm looking for. With Syslog-ng i do not need to change the code of the services (pop3, ssh, etc) so that they can generate to the syslog facility the log in XML format. If i can make a template in Syslog-ng, my work is simplified and inforced in quality. My question now is in the GPLed licensing. For what i know this kind of licensing makes me possible to change the code (even if i don't need) and distribute it freely (even if my intentions are only to make an academic work). For this i only need to state that the code was changed and offer no warraty, right??. So the bottom line is that i can use freely the code of Syslog-ng to the academic work? (and it appears that i only need to make the template). (i have no ideas at least for now to make the final program commercial) Thanks again for your help RR >You would not need to modify the source, as you can use a template to >format the log messages in xml or in any other syntax (sql, html, ...) >However, if you look at the source, you can see that it is GPLed. > >Rui Teixeira wrote: >> This is just a quick example of the possibilities of crossing the >> information in a quick and easy way. >> >> The main reason for me to write to this list is my interest in using >> Syslog-ng to generate (if possible) my XML format and to send the data >> to a secure machine where the infrormation will be kept. >> >> My biggest questions are: >> - can i change the syslog-ng code >> to a academic work >> - does the team behind syslog-ng >> intend to make a simmilar system in a near future >> - and if is it viable to use >> Syslog-ng to write my XML standard and send it to a secure machine >> >> Thanks in advance >> >> Rui Teixeira

2 1