- syslog-ng - lists.balabit.hu

syslog-ng unknown messages in my syslog.log file(HP-UX)
by daniel＠waku-2.com 13 Feb '03

13 Feb '03

Hello everyone, I've just received syslog messages that I completely don't understand. Does anybody know why this messages have been sent to syslog.log file. And also if there is any problem with my server machine. And what I should do to solve the problem. Feb 13 16:21:23 hpd002 syslog: libtt[18108]: ttdt_Xt_input_handler(): tttk_message_receive(): TT_ERR_NOMP^INo ttsession pr ocess is running, probably because tt_open() has not been called yet. If this code is returned from tt_open() it means tts ession could not be started, which generally means ToolTalk is not installed on this system. Feb 13 16:21:23 hpd002 syslog: libtt[18117]: ttdt_Xt_input_handler(): tttk_message_receive(): TT_ERR_NOMP^Ittsession ^Cv^C ^M^CZ^CX^B*^S.^Ml^B5^BD^B"^B\^B9^Bq^AB^Q=^U*^AAtt_open() ^B*^LD^BQ^Oo^B3^Bj^BD^B"^BH^B"^B1^BF^B*^L4^Hv^BE^B7^ABtt_open() ^ B)^Bg^B1^BL^CR^A[^Ch^B*^UT^B3^Bj^B=^Oj^M^G^BM^AAttsession ^B*^KN^S.^BE^B+^BH^B"^BF^B"^B$^HS^V!^BE^B ^Bh^AA^RJ^Om^BM ToolTa lk ^B*^B1^BL^CV^CX^Ce^C Thanks in advance Daniel

2 1

syslog-ng hanging bringing machine in trouble
by Peter Bieringer 13 Feb '03

13 Feb '03

Hi, I have here a big problem on one of my machine and it looks like that it is caused by syslog-ng. It has similar problems like already written here: http://lists.balabit.hu/pipermail/syslog-ng/2003-January/004432.html Machine: Red Hat Linux 7.3 with all updates Running kernel: currently 2.4.18-18.7.x extended with Openwall patch 128 MByte memory syslog-ng: 1.5.26 (but also happen with latest 1.4.x) pam is using a local running LDAP server. >From time to time (let say distance 2-3 weeks or even 8 hours) syslog suddenly stops logging like this evening: Feb 11 19:10:44 gromit syslog-ng[17700]: STATS: dropped 0 Feb 11 19:20:44 gromit syslog-ng[17700]: STATS: dropped 0 Feb 11 19:30:45 gromit syslog-ng[17700]: STATS: dropped 0 <-- Feb 11 20:00:47 gromit syslog-ng[6771]: syslog-ng version 1.5.26 starting Feb 11 20:00:48 gromit syslog-ng: syslog-ng startup succeeded Feb 11 20:00:48 gromit syslog-ng: klogd startup succeeded Feb 11 20:00:53 gromit ldap: slapd startup succeeded I've detected this about 20 min later with following reproducable: System load increases over 1 (normally, machine has no load) "ps -ax" hangs after displaying some processes, "top" will sometimes start, sometimes hang Last times I saw also some CROND entries by "ps -ax", one with stat "D". syslog-ng configuration is nothing special, destinations are files (divided by yyyymm), sources are source s_local { internal(); unix-stream("/dev/log" keep-alive(yes) max-connections(100)); unix-stream("/var/spool/postfix/dev/log" keep-alive(yes) max-connections(100)); file("/proc/kmsg"); }; options { use_dns(no); use_fqdn(no); use_time_recvd(no); chain_hostnames(no); mark(0); sync(0); }; Last week I've disabled postfix's LDAP usage completly to check whether it's a LDAP problem here. In former cases (postfix with LDAP lookups) postfix will hang completly, a TCP connects, but no HELO string was displayed. So the big question: 1) is this a syslog-ng related problem? 2) is this a LDAP problem? I've already increased threads. I don't believe it's a DNS problem because on machine itself a caching DNS server is running. One note: machine is IPv6 enabled. I hope someone could point me to some solutions or proper debugging methods. Machine is semiproductive since end of September (with syslog-ng), but since the beginning such troubles occur. BTW: is this ok, that if syslog-ng restarts, crond don't log anymore until restarted? Thank you very very much, Peter -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto: pb at bieringer dot de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/

6 19

syslog-ng restart: postfix/nqmgr logline missing on next received e-mail
by Peter Bieringer 13 Feb '03

13 Feb '03

Hi again, during yesterdays problem my postfix statistics reporting tool (pflogstats) reported about incomplete logging in 4 cases. In all 4 cases I have syslog-ng restarted before. Example: Feb 12 22:22:54 syslog-ng[1871]: syslog-ng version 1.5.26 going down Feb 12 22:22:54 syslog-ng[5317]: syslog-ng version 1.5.26 starting Feb 12 22:22:54 syslog-ng: syslog-ng startup succeeded Feb 12 22:23:01 crond: crond shutdown succeeded <- already learnt :-( Feb 12 22:23:02 crond: crond startup succeeded Missing nqmgr: Feb 12 22:29:58 (7 minutes later, first received e-mail after syslog-ng restart) postfix/smtpd[5507]: C12F31386E: client=outgoing3... postfix/cleanup[5521]: C12F31386E: message-id=<20030212180349.... postfix/smtpd[5507]: disconnect from outgoing3... postfix/pipe[5525]: C12F31386E: to=<pbieringer@... Normally (e.g. next delivered e-mail): Feb 12 22:29:59 postfix/cleanup[5521]: 3AEAD1386F: message-id=<20030212180... postfix/pipe[5525]: C12F31386E: to=<pbieringer@aer... postfix/nqmgr[19977]: 3AEAD1386F: from=<bugtraq-r.... <--!!!!! postfix/smtp[5530]: 3AEAD1386F: to=<pbieringer(a)aerasec.de>,... Where is the nqmgr log line lost in first event? Is this a well-known issue (feature or bug)? If yes, how can this be fixed? Pls. don't tell me that I have to restart every service after I restart syslog-ng (already known: crond, now postfix, which one is still missing?). This would be a very unnice "feature". If bug is in a common used glibc-version, then imho a workaround by syslog-ng would be required. I don't like to loose loglines, you sure not, too. Does this also happen if old syslogd would be used? Don't believe so. It's all very strange...looks like I have to switch back to syslog, loosing all the nice features :-( Peter, wondering -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto: pb at bieringer dot de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/

4 8

Betr.: Re: [syslog-ng]How to distribute Syslog-ng?
by EDL.Essed＠belastingdienst.nl 13 Feb '03

13 Feb '03

Balazs, It worked, after changing all Makefiles to read DESTDIR = /tmp/staging (Couldn't get "make DESTDIR=/tmp/staging install" to work, see below). Thanks, Esteban. $ make DESTDIR=/tmp/staging install No suffix list. Making install in src Making install in . /bin/sh /home/essee05/src/syslog-ng-1.5.26/mkinstalldirs /usr/local/sbin mkdir /usr/local/sbin mkdir: cannot access /usr/local: Permission denied *** Error exit code 2 Stop. *** Error exit code 1 Stop. *** Error exit code 1 Stop. *** Error exit code 1 Stop. ___________________________________________ Esteban Essed B/CICT, Sector Continuiteit MPS/Midrange WBC-F305 Tel: (055 - 528) 3654 ___________________________________________ wok, n.: Something to thwow at a wabbit. ___________________________________________ |---------+--------------------------------> | | "Balazs Scheidler" | | | <bazsi(a)balabit.hu> | | | Verzonden door: | | | syslog-ng-admin@lists| | | .balabit.hu | | | | | | | | | 13-02-2003 12:40 | | | Antwoord a.u.b. aan | | | syslog-ng | | | | |---------+--------------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | Aan: syslog-ng(a)lists.balabit.hu | | cc: | |Onderwerp: Re: [syslog-ng]How to distribute Syslog-ng? | >-------------------------------------------------------------------------------------------------------------------------------| On Thu, Feb 13, 2003 at 11:27:57AM +0100, EDL.Essed(a)belastingdienst.nl wrote: > Hi, > > I want to build Syslog-ng on one machine but use it on another. > > Is it enough if I copy the binary syslog-ng and the configfile > syslog-ng.conf? > Or do I need more? > > I want to do this for AIX and for HP-UX machines. try using the DESTDIR feature of the makefile distributed with syslog-ng: make DESTDIR=/tmp/staging install this copies binary files using /tmp/staging directory as root. you only need to tar and untar its contents on the destination host. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

1 0

How to distribute Syslog-ng?
by EDL.Essed＠belastingdienst.nl 13 Feb '03

13 Feb '03

Hi, I want to build Syslog-ng on one machine but use it on another. Is it enough if I copy the binary syslog-ng and the configfile syslog-ng.conf? Or do I need more? I want to do this for AIX and for HP-UX machines. Thanks for any help, Esteban Essed. ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

3 2

Re: [syslog-ng]Re: syslog-ng
by Ted_Rule＠flextech.co.uk 13 Feb '03

13 Feb '03

Could this be worked round in general with a kill -HUP syslog-ng at the end of the "ifup" script for those instances where syslog-ng starts before networking itself? I would imagine this should ensure syslog-ng is "notified" of the "change of state" of the machine, causing it to refresh its IP sockets. In addition a daily HUP to rotate logs should also effectively heal the problem within 24 hours? Ted ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

1 0

DTSESSION messages in syslog file
by daniel＠waku-2.com 13 Feb '03

13 Feb '03

Hi I have received the messeges below in my syslog.log file. Feb 12 11:24:39 hpd002 DTSESSION: pamauthenticate status=0 Feb 12 11:24:39 hpd002 DTSESSION: pam_acct_status status=0 Does this mean there is a problem with my computer? If so, please let me know the problem. Also please tell me what exactly must have happened for the messege to be displayed in syslog.log file. My OS is HP-UX 11.i Thanks in advance Daniel Ojwang

1 0

Re: syslog-ng
by seberino＠spawar.navy.mil 12 Feb '03

12 Feb '03

Roberto Thanks. Are you saying if you start syslog-ng before networking and iptables that syslog-ng won't start??? So basically you must start it AFTER filtered network up or else apply your patch? Is that right? chris On Wed, Feb 12, 2003 at 10:10:39AM +0100, Roberto Nibali wrote: > Hello Seberino, > > > I saw your name on the syslog-ng mailing list > > I saw your name on a lot of mailinglists lately, IIRC :) > > > and was hoping I could humbly ask you a newbie question about it > > I'm only on the list since January this year but I've been working with > syslog-ng for about 2 years now, so I might be able to help you. > > > if you don't mind. I read manual and could not find > > this question answered... > > The manual is rather sparse with words and assumes that the reader is already > very familiar with other daemons and Unix processing. > > > Can I just start syslog-ng daemon from /etc/rc.d/rc.local > > (in Linux) like this... > > I'm not so sure what Linux distribution you use but I can hardly imagine that > you start daemons from ../rc.local. There must be a /etc/rc.d/init.d/syslog-ng > and then some softlinks from your runlevel dir to /etc/rc.d/init.d/syslog-ng > > > /usr/local/sbin/syslog-ng & > > There is no need to send it in the background since it is a daemon. It will > fork() and then the calling process will _exit(). > > > i.e. 1. Do I need any switches on command line? > > I do not know your node's requirements and I also do not know your architectural > approach to logging so it's kind of difficult to make accurate suggestions. What > you could do is invoke syslog-ng with --help as option and read through those: > > # ./syslog-ng --help > Usage: syslog-ng [options] > Accept and manage system log messages > > Options: > -s, --syntax-only Only read and parse config file > -d, --debug Turn on debugging messages > -v, --verbose Be a bit more verbose > -F, --foreground Don't fork into background > -f <fname>, --cfgfile=<fname> Set config file name, > default=/etc/syslog-ng/syslog-ng.conf > -V, --version Display version number (syslog-ng 1.5.26) > -p <fname>, --pidfile=<fname> Set pid file name, > default=/var/run/syslog-ng.pid > -C <dir>, --chroot=<dir> Chroot to directory > -u <user>, --user=<user> Switch to user > -g <group>, --group=<group> Switch to group > # > > Feel free to submit any of those to your syslog-ng start command line :) > > > 2. Is there any danger in not starting logging > > sooner in boot process?? > > From you email I cannot see exactly at which point you start the syslog-ng but > I recommend you to start it early enough or you might loose some important > messages. There is a problem with starting it early and having strict packet > filter rules and interface link state down. It's a feature in syslog-ng that it > will not restart in that case. I've done a simplistic but very useful (for our > purposes) patch: > > --- syslog-ng-1.5.26-template/src/afinet.c Wed Feb 5 16:04:56 2003 > +++ syslog-ng-1.5.26-template-tA/src/afinet.c Thu Feb 6 13:52:33 2003 > @@ -491,7 +491,11 @@ > return ST_OK | ST_GOON; > } > else { > +#if 0 > if (errno == ECONNREFUSED) { > +#else > + if ( 1 ) { > +#endif > io_callout(self->cfg->backend, > self->cfg->time_reopen, > make_driver_reinit(&self->super.super.super, self->cfg)); > > So if you get your question answered may I humbly ask you to send this to Nate > Campi <mailto:nate@campin.net> for a possible inclusion into the FAQ? He might > add it or might not, depending on how generous he is towards newbie questions :) > > HTH and best regards, > Roberto Nibali, ratz > -- > echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-9973 Fax: Email: seberino(a)spawar.navy.mil _______________________________________

2 1

Re: syslog-ng
by seberino＠spawar.navy.mil 12 Feb '03

12 Feb '03

I'm not that worried about missing stuff if syslog-ng started late since I don't reboot that often. Regardless, do you just start it with /path/syslog-ng & ??? ...or... are there necessary command line switches you us that are a good idea??? chris On Tue, Feb 11, 2003 at 09:27:35PM -0500, Michael Rogan wrote: > Chris, > > That works but you may find some things don't get logged because it wasn't started earlier. > > You can create a script and put it in /etc/init.d/syslog-ng (check the syslog one on how to write start and stop scripts, basically just change syslog to syslog-ng). > > Put a comment near the top like > # chkconfig: 2345 20 80 > # description: Syslog-ng for logging > > When you run > chkconfig --add syslog-ng > > The comment tells it to put it in the init startups 2,3,4,5 and at level 20 (near the beginning of the boot process) and 80 at stop (near the end of the shutdown). > > You may want to do a > chkconfig --del syslog > to stop syslog from starting. > > Michael > > BTW: Do you guys get to use our devices there yet? Being in information systems to the Navy I would guess you would have seen them. > > Michael J. Rogan > BlackBerry Engineering Supervisor > Research In Motion > www.rim.net > www.blackberry.net > > > > -------------------------- > Sent from my BlackBerry Wireless Handheld (www.BlackBerry.net) > > > -----Original Message----- > From: seberino(a)spawar.navy.mil <seberino(a)spawar.navy.mil> > To: Michael Rogan <mrogan(a)rim.net> > Sent: Tue Feb 11 20:04:43 2003 > Subject: syslog-ng > > Michael > > I saw your name on the syslog-ng mailing list > and was hoping I could humbly ask you a newbie question about it > if you don't mind. I read manual and could not find > this question answered... > > Can I just start syslog-ng daemon from /etc/rc.d/rc.local > (in Linux) like this... > > > /usr/local/sbin/syslog-ng & > > > i.e. 1. Do I need any switches on command line? > 2. Is there any danger in not starting logging > sooner in boot process?? > > Thanks! > > Chris > > -- > _______________________________________ > > Dr. Christian Seberino > SPAWAR Systems Center San Diego > Code 2872 > San Diego, CA 92152-6147 > U.S.A. > > Phone: (619) 553-9973 > Fax: > Email: seberino(a)spawar.navy.mil > _______________________________________ -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-9973 Fax: Email: seberino(a)spawar.navy.mil _______________________________________

1 0

[PATCH] missing rm for distclean target in libol-0.3.9
by Roberto Nibali 11 Feb '03

11 Feb '03

Hello, Following patchlet adds the removal of utils/make_class when a make distclean is invoked. I've tramped over it when I wanted to enhance libol and syslog-ng a bit: --- libol-0.3.9/utils/Makefile.in 2003-01-31 11:08:43.000000000 +0100 +++ libol-0.3.9-ratz/utils/Makefile.in 2003-02-11 18:07:49.000000000 +0100 @@ -172,7 +172,7 @@ clean-generic: distclean-generic: - -rm -f Makefile $(CONFIG_CLEAN_FILES) + -rm -f Makefile $(CONFIG_CLEAN_FILES) $(SCRIPTS) -rm -f config.cache config.log stamp-h stamp-h[0-9]* maintainer-clean-generic: Another problem is that libol-0.3.9 is shipped with two files which will get deleted after a distclean making the diff of the two vanilla trees (libol-working, libol-orig) a little pain. Would you consider removing the following two files from the source tree for 0.3.10, please? o libol.spec o src/olconfig.h The same issues arise with the syslog-ng vanilla tree. I hope I am not missing something trivial here. Another question: I'm currently having a lot of problems with different GNU automake releases installed on my development server. I reckon you know what I mean (the LIBOBJ -> AC_LIBOBJ mess introduced in 1.5x). Have you already made any plans on moving to newer GNU automake tools? Regards, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq'|dc

1 0

Modification to slowly start destination programs
by Keith Resar 11 Feb '03

11 Feb '03

In my current syslog-ng setup there are many destination programs. When syslog-ng restarts these all load at once, causing the system to grind to a halt. As a solution, I'd like syslog-ng to spawn these programs more slowly, perhaps one every few seconds. After a quick glance through the source it wasn't obvious to me where I should make this modification. Any hints on what part of the source destination programs are executed? Thanks, Keith Resar. --

3 4

RE: [syslog-ng]1.5.26 and RedHat8
by Madziarczyk, Jonathan 11 Feb '03

11 Feb '03

Thanks! -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Tuesday, February 11, 2003 9:12 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]1.5.26 and RedHat8 On Mon, Feb 10, 2003 at 02:44:20PM -0600, Madziarczyk, Jonathan wrote: > I didn't come across anything like this while scouring the archives, but > maybe someone has some ideas. > > So I just installed 1.5.26 onto a fresh RH8 install and I'm trying to > use my previous init.d script (see below) that I got from an "old > school" post from Binder. I'm not a rocket scientist when it comes to > linux, but according to the man pages the latest NG is still looking for > the config file in /etc/syslog-ng/syslog-ng.conf. I'm getting the > following error message when I try to run my init.d file. > Starting syslog-ng: Cannot open configuration file > /usr/local/etc/syslog-ng/syslog-ng.conf for reading > Parse error reading configuration file, exiting. (line 1) > I don't see anything in the script that looks like it should point it to > the usr/local dir....... > > So what am I missing? Or is there just a newer copy of an init script > that I can mooch? You can: a) modify your init script to use the -f option to specify your config file location ("/usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf") b) symlink /etc/syslog-ng/syslog-ng.conf to /usr/local/etc/syslog-ng/syslog-ng.conf ("mkdir -p /usr/local/etc/syslog-ng && ln -s /etc/syslog-ng/syslog-ng.conf /usr/local/etc/syslog-ng/syslog-ng.conf") c) recompile syslog-ng to use /etc/syslog-ng/syslog-ng.conf as the config file ("./configure --sysconfdir=/etc" if I remember correctly). Any of the above should solve your problem. -- Nate Campi http://www.campin.net _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

1.5.26 and RedHat8
by Madziarczyk, Jonathan 11 Feb '03

11 Feb '03

I didn't come across anything like this while scouring the archives, but maybe someone has some ideas. So I just installed 1.5.26 onto a fresh RH8 install and I'm trying to use my previous init.d script (see below) that I got from an "old school" post from Binder. I'm not a rocket scientist when it comes to linux, but according to the man pages the latest NG is still looking for the config file in /etc/syslog-ng/syslog-ng.conf. I'm getting the following error message when I try to run my init.d file. Starting syslog-ng: Cannot open configuration file /usr/local/etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. (line 1) I don't see anything in the script that looks like it should point it to the usr/local dir....... So what am I missing? Or is there just a newer copy of an init script that I can mooch? JM : ######################################################################## ######## # # Program: syslog-ng init script # # Description: # # This is an init script for syslog-ng on the Linux platform. # # It totally relies on the Redhat function library and works the same # way as other typical Redhat init scripts. # # # Platforms (tested): Linux (Redhat 6.1) # # # Author: Gregor Binder <gbinder(a)sysfive.com> # # Last Changed: October 10, 2000 # # Copyright (c) 2000 by sysfive.com GmbH, All rights reserved. # Modded as needed for aesthetic porpoises -JM ######################################################################## ######## ######################################################################## ######## # configuration # INIT_PROG="/usr/local/sbin/syslog-ng" # Full path to daemon INIT_OPTS="-v -p /var/log/syslog-ng.pid" # options passed to daemon PATH=/bin:/sbin:/usr/bin:/usr/local/sbin:/usr/sbin INIT_NAME=`basename "$INIT_PROG"` # Source Redhat function library. # . /etc/rc.d/init.d/functions # Source config if [ -f /etc/sysconfig/syslog ] ; then . /etc/sysconfig/syslog else KLOGD_OPTIONS="-2" fi # Uncomment this if you are on Redhat and think this is useful # #. /etc/sysconfig/network # #if [ ${NETWORKING} = "no" ] #then # exit 0 #fi RETVAL=0 umask 077 ulimit -c 0 # See how we were called. case "$1" in start) echo -n "Starting $INIT_NAME: " daemon --check $INIT_PROG "$INIT_PROG $INIT_OPTS" RETVAL=$? echo -n "Starting Kernel Logger and Syslog-ng v.1.4.12: " [ -x "/sbin/klogd" ] && daemon klogd $KLOGD_OPTIONS echo [ $RETVAL -eq 0 ] && touch "/var/lock/subsys/${INIT_NAME}" ;; stop) echo -n "Stopping $INIT_NAME: " killproc $INIT_PROG RETVAL=$? echo -n "Stopping Kernel Logger and Syslog-ng v.1.4.12: " [ -x "/sbin/klogd" ] && killproc klogd echo [ $RETVAL -eq 0 ] && rm -f "/var/lock/subsys/${INIT_NAME}" ;; status) status $INIT_PROG RETVAL=$? ;; restart|reload) $0 stop $0 start RETVAL=$? ;; *) echo "Usage: $0 {start|stop|status|restart|reload}" exit 1 esac exit $RETVAL

2 1

syslog-ng crash
by Elad Levy 10 Feb '03

10 Feb '03

Hello, I am using syslog-ng 1.4.17. I have a few clients writing to remote log server. whenever I disconnect the client, the server dies, and vice versa. I am using udp for log writing. maybe I miss some options configuration. Does anyone has any ideas ? Elad. -- http://fastmail.fm - Access your email from home and the web

1 0

Re: syslog-ng digest, Vol 1 #953 - 2 msgs
by Michaelian Ennis 10 Feb '03

10 Feb '03

Grahm, I am sorry but I don't think syslog-ng is the solution for your problem. Ian -- Michaelian Ennis <mennis(a)corvus.net> Corvus Technologies

1 0

转让市话通一台500元(还有300话费) 和CDMA一台750元请电:25384100咨询
by 30000emails=15$ 09 Feb '03

09 Feb '03

2 1

3000万个邮箱地址加群发软件150元一套,详情请电0755-26368636咨询
by 30000emails=15$ 08 Feb '03

08 Feb '03

1 0

PRIVATE
by GRAHAM MAKO 08 Feb '03

08 Feb '03

Good Day, With warm heart I offer my friendship and my greetings, and I hope this letter meets you in good health. It will be surprising to you to receive this proposal from me since you do not know me personally. However, I am sincerely seeking your confidence in this transaction, which I propose with my free mind and as a person of integrity. My name is Mr.Graham Mako, the first son of Zuma Mako,one of the most popular black farmers from Zimbabwe, murdered in the land dispute in my country. As led by my instinct, I decided to contact you through email, after searching for your contacts via the internet, as it is the only means I can contact anybody since I am cutting off ties with Zimbabwe for security and safety reasons. However,I apologize if this is not acceptable to you. The purpose of this letter is to seek your most needed assistance in a business venture with my family. Due to the the land and political problems in Zimbabwe, as a result of President Robert Mugabe's introduction of new Land Act Reform wholly affecting the rich white farmers and the few rich black farmers, and his desire to hold on to power for life, my father forsaw the danger that came into Zimbabwe. Before he was murdered, he withdrew all of our business foreign accounts in dollars and sold up our shares in major companies. We then went to Johannesburg, South Africa to deposit the sum of US$14.5 million (Fourteen million, Five Hundred thousand US dollars), in a private security and finance company. This money was deposited with this Private Security and finance company for safety and security reasons, and was to be used for the purchase of land, new machines and chemicals establishment of new farms in Botswana and Swaziland. President Mugabe's support for the violent zimbabwean war veterans and some lunatics in the society, led to the murder of my beloved father and other innocent lives. I was continually threatened to abandon my inheritance from my father after he was murdered. I resisted for a while, but when the danger became unbearable, and I survived two murder attempts, I fled Zimbabwe to South Africa where I was arrested and detained for eight(8 good month)in jail.I fled south Africa for The Netherlands with the help of the present prison command chief officer in Charge(P.C.C.O) I am currently staying in the Netherlands where I am seeking political asylum. In fact my decision to come here to seek asylum, is because the security and finance company from South Africa, has a branch here, and they have moved the deposit from their office in Johannesburg to the Netherlands. I need to transfer this money to an account and invest part of the money. Since the law of Netherlands prohibits a refugee (asylum seeker) to open any bank account or be involved in any financial transaction, this is why I am seeking a genuine and reliable partner, whose account this money can be transferred, hence this proposal to you.You have to understand that this decision taken by me entrusting my families future into your hands, as a result of the safe keeping of this money. If you accept to assist me, all I want you to do for me, is to assist with arrangements to claim the deposit from the security and finance company from their office here in The Netherlands, as it has now been transfered from Johannesburg, South Africa to their branch here. The company will be legally informed of your representation to my family. For your assistance, I have two options for you. Firstly you can choose to have 10% of the money for your assistance, and helping me open an account for the money to be deposited here, or you can go into partnership with me for the proper profitable investment of the money in your country. Whichever the option you want, please notify me in your reply. I have also set aside 1%($145,000,00) of this money for all kinds of expenses that come our way in the process of this transaction, and 4% ($580,000,00) for Charity donation. If you prefer to accept the 10% for assisting with opening an account, then 85%will be left in the account here for my family. Please, I want you to maintain the absolute secrecy for the purpose of this transaction. I look forward to your reply and co-operation, and I thank you in advance as I anticipate your co-operation. Thanks and God bless. Sincerely, Graham Mako.

1 0

Syslog into DB
by Max Clark 07 Feb '03

07 Feb '03

Hi all, I read an interesting article about dumping data from syslog-ng into a database. I was wondering... Specifically geared towards a sendmail style maillog... Are there any tools available to parse logs and report similar to the pflogsumm tool? Thanks in advance, Max -- "The number of UNIX installations has grown to 10, with more expected." Unix Programmer's Manual, 2nd Ed., June 12, 1972

1 0

File Sizes
by Jacob Steinberger 06 Feb '03

06 Feb '03

Forgive me if this is a simple question, but, can syslog-ng handle file rotation? I see there are options for the fifo sizes but no tuning for log rotation or file sizes. If this isnt currently available, can syslog-ng follow inode changes if the file it's writing to is changed/deleted? Thanks in advance, Jacob

2 1

OK to start syslog-ng from rc.local (without command line switches?)
by seberino＠spawar.navy.mil 06 Feb '03

06 Feb '03

Is there any danger in just starting /usr/local/sbin/syslog-ng from rc.local??? It will get started *later* than if I messed with startup scripts but then again... logging ain't really vital for kernel to run right??? Are there any vital switches or should I just do plain ol' /usr/local/sbin/syslog-ng & ?? Thanks, Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-9973 Fax: Email: seberino(a)spawar.navy.mil _______________________________________

1 0

more syslog_ng config file on HP-UX ...
by Ola.Fjallman＠adb.ds.sll.se 06 Feb '03

06 Feb '03

Hello again, after reading docs and asking around I produced following config file : options { sync(0); time_reopen(10); log_fifo_size(100); }; source stdlog { pipe("/dev/log" pad_size(2048)); udp(); tcp(ip("192.168.0.1") port(514)); internal(); }; destination everything { udp("127.0.0.1" port(999)); tcp("127.0.0.1" port(999)); file("/tmp/logfile" sync(0) log_fifo_size(10)); }; log { source(stdlog); destination(everything); }; But when running syslog_ng I get this error : parse error at 3 Parse error reading configuration file, exiting. I'm running HP-UX 11.11 on my server. By the way, udp and tcp, is there any reason for running both? Regards, Ola

1 0

where docs on *REMOTE* logging using ssh??
by seberino＠spawar.navy.mil 05 Feb '03

05 Feb '03

Where can I find docs on setting up secure (SSH) remote syslog-ng logging? Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2363 49590 Lassing Road, Room A339 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-7940 Fax: (619) 553-1269 Email: seberino(a)spawar.navy.mil _______________________________________

3 6

Re: [syslog-ng]Please help with simple syslog-ng.conf creation questions....
by seberino＠spawar.navy.mil 05 Feb '03

05 Feb '03

Is there any danger in just starting /usr/local/sbin/syslog-ng from rc.local??? It will get started *later* than if I messed with startup scripts but then again... logging ain't really vital for kernel to run right??? Are there any vital switches or should I just do plain ol' /usr/local/sbin/syslog-ng & ?? Thanks, Chris On Tue, Feb 04, 2003 at 03:55:37PM -0500, Hamilton, Andrew wrote: > Forgot to mention that you need to change your startup scripts in RedHat to > work with > syslog-ng. It is fairly simple. Look in /etc/rc.d/init.d. > > Regards, > > Drew > > -----Original Message----- > From: seberino(a)spawar.navy.mil > To: Hamilton, Andrew > Cc: syslog-ng(a)lists.balabit.hu > Sent: 2/3/2003 3:23 PM > Subject: Re: [syslog-ng]Please help with simple syslog-ng.conf creation qu > estions.... > > Andrew > > Thanks again for all your help. I combined all your tips > to make a simple "just put everything in /var/log/messages for now" > version of /etc/syslog-ng/syslog-ng.conf.... > > ---- > source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); > internel();}; > destination dest {file("/var/log/messages");}; > log {source(src); destination(dest);}; > ---- > > Can I ask you a few more questions about this? > > I called my identifiers "src" and "dest". I assume it does not > matter what I call these as long as I use those same identifiers > in log line??? > > Since Red Hat is not set up to use syslog-ng by default, I assume I must > remove syslogd and klogd from startup "things to do list" and start > /usr/local/sbin/syslog-ng from /etc/rc.d/rc.local myself??? > > If I want syslog-ng to accept remote messages from remote syslog-ng > daemons, > must I add something else to syslog-ng.conf above such as item > regarding port #514 UDP??? (syslog is tied to this port). I need to ask > > this because the word "remote" is NOT even mentioned in the syslog-ng > docs???!?!? > > Thanks again, > > Chris > > > > On Mon, Feb 03, 2003 at 08:28:32AM -0500, Hamilton, Andrew wrote: > > It depends on what you want to do. I think it is a good idea to run > kernel > > messages through syslog-ng. I have less overhead and less to worry > about. > > The source you have is correct. > > > > Regards, > > > > Drew > > > > -----Original Message----- > > From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] > > Sent: Friday, January 31, 2003 6:59 PM > > To: Hamilton, Andrew > > Cc: syslog-ng(a)lists.balabit.hu > > Subject: Re: [syslog-ng]Please help with simple syslog-ng.conf > creation > > qu estions.... > > > > > > Andrew > > > > Thanks! There is lots to learn since config file much > > more complicated now. > > > > Do you run syslog-ng daemon AND klogd too??? > > > > FAQ says to have syslog-ng handle kernel messages I must > > kill klogd and add this to syslog-ng.conf.... > > > > source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internel(); > }; > > > > I assume this is a good idea. Perhaps that is what you do??? > > > > Thanks again, > > > > Chris > > > > > > On Thu, Jan 30, 2003 at 02:14:27PM -0500, Hamilton, Andrew wrote: > > > Nope. But you can do this: > > > > > > source s_all{ unix-stream("/dev/log"); internal(); }; > > > destination d_messages { file("/var/log/messages"); }; > > > > > > log { source(s_all); destination(d_messages); }; > > > > > > That should do it. If you are using Solaris you should use > > > > > > source local { sun-streams("/dev/log" door("/etc/.syslog_door")); > > > internal(); }; > > > > > > Look in the syslog-ng/doc directory for sample configs. > > > > > > > > > Regards, > > > > > > Drew > > > > > > -----Original Message----- > > > From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] > > > Sent: Thursday, January 30, 2003 2:01 PM > > > To: syslog-ng(a)lists.balabit.hu > > > Subject: [syslog-ng]Please help with simple syslog-ng.conf creation > > > questions.... > > > > > > > > > configure;make;make install of syslog-ng source did not create > > > /etc/syslog-ng directory with > > > /etc/syslog-ng.conf ready to go. > > > > > > I assume I must create this directory and file > > > myself??? > > > > > > syslog-ng has *tons* of features. Please tell > > > me how I can just throw everything into /var/log/messages. > > > I don't require fancy stuff just yet. > > > > > > In old syslog.conf this would be: > > > > > > *.info /var/log/messages > > > > > > Will syslog-ng recognize a one line syslog-ng.conf > > > containing this old style config??? > > > > > > thanks, > > > > > > Chris > > > -- > > > _______________________________________ > > > > > > Dr. Christian Seberino > > > SPAWAR Systems Center San Diego > > > Code 2363 > > > 49590 Lassing Road, Room A339 > > > San Diego, CA 92152-6147 > > > U.S.A. > > > > > > Phone: (619) 553-7940 > > > Fax: (619) 553-1269 > > > Email: seberino(a)spawar.navy.mil > > > _______________________________________ > > > > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > > > -- > > _______________________________________ > > > > Dr. Christian Seberino > > SPAWAR Systems Center San Diego > > Code 2872 > > San Diego, CA 92152-6147 > > U.S.A. > > > > Phone: (619) 553-9973 > > Fax: > > Email: seberino(a)spawar.navy.mil > > _______________________________________ > > -- > _______________________________________ > > Dr. Christian Seberino > SPAWAR Systems Center San Diego > Code 2872 > San Diego, CA 92152-6147 > U.S.A. > > Phone: (619) 553-9973 > Fax: > Email: seberino(a)spawar.navy.mil > _______________________________________ -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-9973 Fax: Email: seberino(a)spawar.navy.mil _______________________________________

1 0

RE: Re: [syslog-ng]HP-UX syslog_ng server configfile
by Ola.Fjallman＠adb.ds.sll.se 05 Feb '03

05 Feb '03

ok, thanks! Another dumb question : dows this line replace the whole source src { ... udp(); tcp(); } and if so, I suspect that my other lines : udp(); tcp(ip("192.168.0.1") port(514)); tcp(); internal(); goes within the source stdlog {} Regards, Ola -----Original Message----- From: bazsi [mailto:bazsi@balabit.hu] Sent: den 5 februari 2003 14:59 To: syslog-ng Cc: bazsi Subject: Re: [syslog-ng]HP-UX syslog_ng server configfile On Wed, Feb 05, 2003 at 02:46:07PM +0100, Ola.Fjallman(a)adb.ds.sll.se wrote: > "io.c: bind_unix_socket(): /dev/log not a socket > Error initializing configuration, exiting." > > > Does anyone have any idea what this means? As I have understood > /dev/log is correct unix-stream on HP-UX. no, it is a pipe(), each message padded to 2048 bytes. Here's an excerpt from the INSTALL file: HP-UX (HP-UX 11.0) ------------------ HP-UX uses a named pipe called /dev/log for log transport, and you can use this with the pipe() driver with an additional option. HP-UX pads all incoming messages to 2048 bytes by default, so you need to specify this: source stdlog { pipe("/dev/log" pad_size(2048)); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0