- syslog-ng - lists.balabit.hu

different message shows up on loghost than on client
by Nate Campi 10 Nov '01

10 Nov '01

I have syslog-ng loghosts in out datacenters that receive messages via UDP from mostly solaris syslogd. The loghosts in the datacenters then relay the messages over TCP/stunnel to a central loghost for archiving/analysis/input into database. The problem is that a message like this on a solaris 2.6 box: Nov 7 04:05:45 ballys ctld 5.0.6[22164]: [0] Error: unable to read header - Status: NoMoreData. ...will arrive (via UDP) on my linux loghost (syslog-ng 1.4.12) like this: Nov 7 04:05:45 ballys.hotwired.com 5.0.6[22164]: [0] Error: unable to read header - Status: NoMoreData. I have no idea why it would cut out the program name (ctld) like that. Is this a known issue? This is really messing up my log tables, and I'd like to keep all the data straight in the database. Here's my options from the linux loghost: options { use_fqdn(yes); long_hostnames(off); keep_hostname(no); use_dns(yes); sync(0); }; Plus, when did it become an option to buffer messages with sync? Is is only the in devel branch? I'd like to set sync(5) or something to take it easy on the disk. TIA, -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 The only way to convince some people that HTML is about content, not style is with a 2x4 <PLANK>.

2 3

elegant swatch solution
by Nate Campi 10 Nov '01

10 Nov '01

I found a clean way to use swatch to watch all your syslog messages from syslog-ng. Normally you need to tell swatch to tail a file, so if you want swatch to watch all your logs you have to either send all messages to one file or run multiple instances of swatch. I came up with this tonight: # hack to get swatch to read from stdin destination swatch { program("/usr/bin/swatch --read-pipe=\"cat /dev/fd/0\""); }; # send all logs to swatch log { source(src); destination(swatch); }; The source "src" is all my logs on that box. This works like a charm, and if syslog-ng is restarted, so is swatch, so you don't need to worry about HUP'ing/restarting swatch - ever! This way you can let swatch monitor your logs instead of using match() directives - since swatch has built in throttling on alerts I find it nicer to use. swatch keeps my pager from going nuts after the first message which caused the alarm, subsequent messages are ignored for a defined amount of time, using the "throttle feature". -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 "Only two things are infinite, the universe and human stupidity, and I'm not sure about the former" -- Albert Einstein.

1 0

Re: [syslog-ng]Documentation/manual etc..
by bretwatson＠charteredsemi.com 09 Nov '01

09 Nov '01

Great, looks like in the next week or so I should be able to get out a first draft of teh manual.. The fun part will come with getting examples etc.. Cheers, Bret Balazs Scheidler <bazsi(a)balabit.hu> 09/11/2001 04:51 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: syslog-ng(a)lists.balabit.hu cc: (bcc: WATSON Bret/Mgr/CSM/ST Group) Subject: Re: [syslog-ng]Documentation/manual etc.. On Fri, Nov 09, 2001 at 11:09:44AM +0800, bretwatson(a)charteredsemi.com wrote: > Hi Baltasar, > some questions on the options list.... > > I've dug through the cfg-lex.l file and found it is looking for a bunch of > options - some of which exist int eh current docs.. so some questions: > > What does "Keep_hostname" do? to not touch the hostname part of the received message, and leave it intact. > is "use_fqdn" the same as "long_hostnames"? no, long_hostnames is an alias to chain_hostnames, the latter being the preferred one. (this ambiguity caused me to change it) use_fqdn means to use fully qualified domain names, otherwise the domain is chopped after the first '.' character in the hostname. > What does "gc_threshold" do? gc_threshold is the same as gc_busy_threshold > What does "create_dir" do? if macro expansion is used in destination filenames, directory references to non-existing directories can be made, if create_dir is true, those directories are automatically created. > > and what about the following? are any enabled? > localip, ip, localport, port, destport, owner, group, perm, dir_owner, > dir_group, dir_perm, keep-alive, keep_alive, max-connections, mac, > authentication, encrypt, required, allow, deny. compress mac, authentication, encrypt and compress each accept one of triple as argument: required, allow or deny, though none of these are currently implemented. All the other options are (or supposed to be ) working: localip & localport: specifies the source ip & port of a connection (before connection is made, useful if your box has several IPs) ip means localip for sources destport: specifies the destination port for destinations owner, group, perm: file permission information for created files dir_owner, dir_group, dir_perm: directory permission information for created dirs keep-alive, keep_alive: do not drop connections when the config is reloaded max-connections: how many concurrent connections are permitted at a time -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Documentation/manual etc..
by bretwatson＠charteredsemi.com 09 Nov '01

09 Nov '01

Hi Baltasar, some questions on the options list.... I've dug through the cfg-lex.l file and found it is looking for a bunch of options - some of which exist int eh current docs.. so some questions: What does "Keep_hostname" do? is "use_fqdn" the same as "long_hostnames"? What does "gc_threshold" do? What does "create_dir" do? and what about the following? are any enabled? localip, ip, localport, port, destport, owner, group, perm, dir_owner, dir_group, dir_perm, keep-alive, keep_alive, max-connections, mac, authentication, encrypt, required, allow, deny. compress Thanks, Bret

2 1

RE: weird... please help
by bretwatson＠charteredsemi.com 09 Nov '01

09 Nov '01

Thanks, that works... Cheers, Bret "Baltasar Cevc" <baltasar(a)cevc-topp.de> 09/11/2001 06:01 Sent by: syslog-ng-admin(a)lists.balabit.hu Please respond to syslog-ng To: <syslog-ng(a)lists.balabit.hu> cc: (bcc: WATSON Bret/Mgr/CSM/ST Group) Subject: RE: [syslog-ng]weird... please help Hi, Bret! > But what happens is that everything ends up in teh "all" destination instead of the vpn destination.... It should end to be shown in both... Try to add ".*" to your host check regexp. Perhaps it doesn't match because there is something more than the single host IP. And for the all destination: you could use a third filter like this to prevent VPN messages getting there like this: filter fallb { not (filter (f_vpnhosts) or filter (f_vpnhosts2)); }; bye.baltasar ::: B A L T A S A R C E V C mailto: baltasar(a)cevc-topp.de Tel.: +49 89 99020515 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

weird... please help
by bretwatson＠charteredsemi.com 08 Nov '01

08 Nov '01

Hmm I'm stuffed up I guess, but I can't work out where... Please help!!! Thanks, Bret Here is my syslog-ng.conf file options { sync(0); time_reopen(10); log_fifo_size(100); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source net { udp(); }; destination all { file("/var/adm/messages"); }; destination vpn { file("/usr/log1/vpn.log"); }; filter f_vpnhosts { host("203.126.246.216") or host("203.126.246.217") or host("203.126.246.218"); }; filter f_vpnhosts2 { host("10.84.3.10"); }; log { source(net); filter(f_vpnhosts); destination(vpn); }; log { source(net); filter(f_vpnhosts2); destination(vpn); }; log { source(local); destination(all); }; log { source(net); destination(all); }; Here is the log lines I'm trying to re-direct to the vpn.log Nov 7 08:15:55 10.84.3.10/10.84.3.10 [1:33947706:Gate7520:CHARTERED 01:203.126.246.216]2001/11/07 16:27:41 Isakmp ScSA: Rekey Phase 2: Loc:10.200.*.*, Rem:10.84.3.50 (66.68.164.196) But what happens is that everything ends up in teh "all" destination instead of the vpn destination....

2 1

Documentation/manual etc..
by bretwatson＠charteredsemi.com 08 Nov '01

08 Nov '01

Hi All, I'm looking to have a go at a configuration manual for Syslog-ng.. the reason being that the current one sucks (sorry, but true).. It will be for teh stable branch only For starters I'm pulling variables from the c code... so here are the globals.. chain_hostnames keep_hostname mark_freq sync_freq time_reopen time_reap log_fifo_size use_time_recvd use_fqdn use_dns create_dirs uid gid perm dir_uid dir_gid dir_perm gc_busy_threshold gc_idle_threshold Can someone tell me what inputs these configs take and what their function is? - some are in the docs, but some (like create_dirs) are not... I'll post to this list as it comes together... Cheers, Bret

2 1

link error
by Holger.Woehle＠arcor.net 06 Nov '01

06 Nov '01

Hello, i want to compile syslog-ng under linux kernel 2.4.13 glibc 2.2.4 . After ./configure, i get following error running make: make[3]: Entering directory `/usr/src/syslog-ng-1.4.14/src' gcc -O2 -Wall -I/usr/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o utils.o syslog-names.o /usr/lib/libol.a -lnsl cfg-lex.o: In function `yylex': cfg-lex.o(.text+0x4ae): undefined reference to `yywrap' cfg-lex.o: In function `input': cfg-lex.o(.text+0xa28): undefined reference to `yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all-recursive-am] Error 2 make: *** [all-recursive] Error 1 anonybody a idea where the bug sits ? with regards cu Holgi

2 1

syslog-ng messages sent to outside prog
by Nate Campi 06 Nov '01

06 Nov '01

I setup a match line to match the string "attackalert" from portsentry, and I pipe this off to a script that mails it to me. This works great, but I get emails with "<29>" prepended to it. Example: <29>Nov 5 12:46:37 skitzo portsentry[121]: attackalert: Host 209.202.221.43 has been blocked via dropped route using command: "/usr/local/sbin/iptables -I INPUT -s 209.202.221.43 -j DROP" I just setup sqlsyslogd to output to a mysql database from a program() destination, and it prepends the <29> to the messages sent there as well. I checked out http://www.ietf.org/rfc/rfc3164.txt and it looks like this is a priority. How can I keep this from showing up in the output? I hacked sqlsyslogd to print the string from 4 chars into the timestamp, so my mysql inputs are clean, but what do I do to clean up the mail? -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79

4 6

RE: [syslog-ng]syslog-ng messages sent to outside prog
by Robert Glad 06 Nov '01

06 Nov '01

Relax man, this is not one of those eLiTe-BBSes in the early nineties.. ;) Robert -----Original Message----- From: Snortball [mailto:snortball@hotmail.com] Sent: den 6 november 2001 16:53 To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng messages sent to outside prog I'M VERY VERY SORRY! This was supposed to go to the sender, not the list....I promise I'll stop being stupid.... ----- Original Message ----- From: "Snortball" <snortball(a)hotmail.com> To: <syslog-ng(a)lists.balabit.hu> Sent: Tuesday, November 06, 2001 9:25 AM Subject: Re: [syslog-ng]syslog-ng messages sent to outside prog > Hi, > > Is there any chance that I can get a copy of your mail script? I can't seem > to get one to work. Yes, I'm a newbie.....but I'm trying! > > Thanks, > > Sb > ----- Original Message ----- > From: "Nate Campi" <nate(a)campin.net> > To: <syslog-ng(a)lists.balabit.hu> > Sent: Monday, November 05, 2001 6:03 PM > Subject: [syslog-ng]syslog-ng messages sent to outside prog > > > > I setup a match line to match the string "attackalert" from portsentry, > > and I pipe this off to a script that mails it to me. > > > > This works great, but I get emails with "<29>" prepended to it. Example: > > > > <29>Nov 5 12:46:37 skitzo portsentry[121]: attackalert: Host > > 209.202.221.43 has been blocked via dropped route using command: > > "/usr/local/sbin/iptables -I INPUT -s 209.202.221.43 -j > > DROP" > > > > I just setup sqlsyslogd to output to a mysql database from a program() > > destination, and it prepends the <29> to the messages sent there as > > well. > > > > I checked out http://www.ietf.org/rfc/rfc3164.txt and it looks like this > > is a priority. How can I keep this from showing up in the output? I > > hacked sqlsyslogd to print the string from 4 chars into the timestamp, > > so my mysql inputs are clean, but what do I do to clean up the mail? > > -- > > Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 > > Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

NEWBIE question: Email as destination
by Snortball 05 Nov '01

05 Nov '01

Hello all, Sorry if this has already been covered, but I can't find the answer in any docs. I am trying to have syslog-ng send certain syslog messages via email so that I don't have to bother with a log watcher like swatch, etc. I tried different combinations of: destination email { pipe("/bin/mail"); }; But that just overwrote the mail bianry (not fun). Any advice? TIA Sb

2 2

syslog-ng and Cisco boxes
by Brian D. Olesen 05 Nov '01

05 Nov '01

I am in the process of setting up a syslog server for a large number of Cisco boxes, and have faced some difficulties which may be due to an error in syslog-ng 1.4.13 on Solaris 8 regarding the source statement. source net { udp(); }; As far as I can understand from the documentation, this ought to listen to all incoming udp packets on port 514. Contrary to the documentation, I never got this to work at all. I even tried to stop the native syslogd, but to no avail. source net { udp(ip("xxx.xxx.xxx.22") port(514)); }; Stating the service ip address and syslog port works perfectly. On the Cisco IOS side, it took me some time to realize that logging source-interface Ethernet0 is essential to do remote logging. This is the interface with the ip address which have access to the remote syslog host. Other experiences, especially best practices, with syslog-ng and Cisco boxes are greatly appreciated. Best regards, Brian D. Olesen UNIX Administrator Orange DK

6 6

issues using NOT in an filter.
by Matthew Schumacher 05 Nov '01

05 Nov '01

Hello all, I can't seem to figure this out. I want to log level(info) and facility(authpriv) to my messages file, but I don't want to see facility(local4). Now some of the facility(local4) messages are level(info) but I still don't want them. Anyway, I was trying something like this and it doesn't work: filter f_messages { (level(info) or facility(authpriv)) not facility(local4); }; I tried using () to clean it up and that doesn't work. In all of the combinations I tried it simply will not parse the config file with NOT in the filter unless I put an and in front of it like this: "and not" Anyone have a sec to help me out with this? Thanks, schu

2 1

RE: [syslog-ng]question about flags + fix to compile under solaris (PATH_SYSCONFDIRprob)
by Nicholas Berry 02 Nov '01

02 Nov '01

I have also noticed this problem with PATH_SYSCONFDIR in src/config.h. After running the configure script, PATH_SYSCONFDIR is defined in src/config.h, but when running `make`, something (perhaps autoconf) removes PATH_SYSCONFDIR from src/config.h and causes the compile to fail. After re-adding '#define PATH_SYSCONDIR "/usr/local/etc/syslog-ng"' back into src/config.h, everything compiles fine. Also, defining "--sysconfdir=<alternate dir>" when running the configure script is not reflected in src/config.h I'm using autoconf 2.13, automake 1.4, make 3.79, m4 1.4, and gcc 2.95.3 all under Solar 8 SPARC. Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Asher Yanich [mailto:ayanic01@cs.fiu.edu] Sent: Friday, November 02, 2001 9:41 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]question about flags + fix to compile under solaris (PATH_SYSCONFDIRprob) I am currently running syslog-ng 1.5.7 and using the DEFAULT keyword. I see that this is removed from the newer 1.5.x releases in favor of flags. I cant seem to find any documentation on the syntax or usage. Can someone help me out? Also, I had not been able to compile any syslog-ng 1.5.x releases for awhile, I finally fixed the compilation problem. --- syslog-ng.h Wed Jul 25 05:20:53 2001 +++ /depot/syslog-ng/src/syslog-ng-1.5.13/src/syslog-ng.h Fri Nov 2 11:42:39 2001 @@ -34,7 +34,7 @@ #define PATH_SYSLOG_NG_CONF "syslog-ng.conf" #define PATH_PIDFILE "syslog-ng.pid" #else -#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "/syslog-ng.conf" +#define PATH_SYSLOG_NG_CONF "/syslog-ng.conf" #define PATH_PIDFILE "/var/run/syslog-ng.pid" #endif -asher yanich _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

question about flags + fix to compile under solaris (PATH_SYSCONFDIR prob)
by Asher Yanich 02 Nov '01

02 Nov '01

I am currently running syslog-ng 1.5.7 and using the DEFAULT keyword. I see that this is removed from the newer 1.5.x releases in favor of flags. I cant seem to find any documentation on the syntax or usage. Can someone help me out? Also, I had not been able to compile any syslog-ng 1.5.x releases for awhile, I finally fixed the compilation problem. --- syslog-ng.h Wed Jul 25 05:20:53 2001 +++ /depot/syslog-ng/src/syslog-ng-1.5.13/src/syslog-ng.h Fri Nov 2 11:42:39 2001 @@ -34,7 +34,7 @@ #define PATH_SYSLOG_NG_CONF "syslog-ng.conf" #define PATH_PIDFILE "syslog-ng.pid" #else -#define PATH_SYSLOG_NG_CONF PATH_SYSCONFDIR "/syslog-ng.conf" +#define PATH_SYSLOG_NG_CONF "/syslog-ng.conf" #define PATH_PIDFILE "/var/run/syslog-ng.pid" #endif -asher yanich

1 0

syslog record size limitation?
by Ed.Schernau＠guardent.com 02 Nov '01

02 Nov '01

Hello all, Solaris 8. I'm logging some rather long text entries via TCP, and they are getting chopped off at 1024 characters. Is this a limitation of syslog-ng itself, or Solaris native syslog? Any help appreciated. Ed

1 0

STATS: dropped 59
by Thomas Kaehn 02 Nov '01

02 Nov '01

Hi, syslog-ng seems to drop log-messages (syslog-ng[16854]: STATS: dropped 59). How can I avoid this, besides from using syslog-ng and TCP on all hosts? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

3 2

RE: [syslog-ng]Re: Level/Priority of 'none'
by Denis Doublet 02 Nov '01

02 Nov '01

-----Message d'origine----- De : Brad Stockdale [mailto:bradsprt@greenepa.net] Envoyé : vendredi 2 novembre 2001 02:09 À : syslog-ng(a)lists.balabit.hu Objet : [syslog-ng]Re: Level/Priority of 'none' Hello all, I'm a newbie to syslog-ng, and am trying to convert our local servers from sysklogd to syslog-ng... I'm having a bit of a problem, though... I might just be blind to the answer of this question, though... It seems pretty simple... In the syslog.conf file that is currently in place (the default redhat one), there's a line that reads: >*.info;mail.none;news.none;authpriv.none /var/log/messages Seems logical... How do I do the same thing in syslog-ng? Try destination d_local { file("/var/adm/messages/"); }; filter no_mail { not facility(mail); }; filter no_news { not facility(news); }; filter no_authpriv { not facility(authpriv); }; filter info { level(info .. emerg); }; log { source(s_local); filter no_mail; filter no_news; filter no_authpriv; filter info; destination(d_local); }; The syslog.conf manpages state: >The keyword none stands for no priority of the given facility. So, if I'm understanding this right, syslog was receiving a facility name, but no level/priority setting? And this mapped to "none." i.e : filter f_critical { level(crit .. emerg) or facility(syslog); }; Does this help you? Does syslog-ng provide a similar thing? Or do these daemons really send out the facility and level/priority, but it's some default one? Thanks for any help in advance... I'm sure this is an easy thing to fix, but just don't know the internals of syslog or syslog-ng very well yet... I've always just used the default configuration and left things alone... Thanks in advance, Brad _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: Level/Priority of 'none'
by Brad Stockdale 02 Nov '01

02 Nov '01

Hello all, I'm a newbie to syslog-ng, and am trying to convert our local servers from sysklogd to syslog-ng... I'm having a bit of a problem, though... I might just be blind to the answer of this question, though... It seems pretty simple... In the syslog.conf file that is currently in place (the default redhat one), there's a line that reads: >*.info;mail.none;news.none;authpriv.none /var/log/messages Seems logical... How do I do the same thing in syslog-ng? The syslog.conf manpages state: >The keyword none stands for no priority of the given facility. So, if I'm understanding this right, syslog was receiving a facility name, but no level/priority setting? And this mapped to "none." Does syslog-ng provide a similar thing? Or do these daemons really send out the facility and level/priority, but it's some default one? Thanks for any help in advance... I'm sure this is an easy thing to fix, but just don't know the internals of syslog or syslog-ng very well yet... I've always just used the default configuration and left things alone... Thanks in advance, Brad

1 0

$HOST Variable in syslog-ng.conf
by Mike Kelland 30 Oct '01

30 Oct '01

When syslog-ng recieves a tcp syslog from another host, it tags the front of the message with '127.0.0.1/127.0.0.1/' before the host ip that the message actually came from. It also makes the host variable for that message '127.0.0.1' instead of the host the message actually came from. So if I'm logging all messages from syslog-ng to a file called $HOST.txt, all of my tcp syslog messages (ie messages coming from another syslog-ng) are logged to 127.0.0.1.txt . Does anyone know of a workaround to this problem? Thanks, Mike

1 0

syslog-ng's matching vs a perl-regex match
by Seth Vidal 30 Oct '01

30 Oct '01

Hi all, I am using syslog-ng version 1.4.12 on red hat linux 7.1. I have been doing some matches to get certain events out of my logs and have certain programs react to them. I was wondering if it would be faster to pipe ALL output to a perl script and have it do its own regex matching. I'm not sure how fast syslog-ng's matching is and if I take a performance hit by using it. thanks -sv

3 2

Chroot syslog-ng
by Jerome Poggi 29 Oct '01

29 Oct '01

Did somebody have any experiences of chroot syslog-ng on Linux or other operating system ? Thanks, -- Jerome POGGI Jerome.Poggi(a)hsc.fr Herve Schauer Consultants -=- Consultant en sécurité informatique http://www.hsc.fr/ Tel : +33 141 409 700

2 1

Linelength problems..
by Robert Glad 29 Oct '01

29 Oct '01

Hello all, I have a problem with syslog-ng that is quite strange. We have been running syslog-ng for a while now, it has worked fine but today i noticed one thing that is not that good at all. It seems like when loglines get too long, syslog-ng just truncates them. I looked around in the sources and found a define in syslog-ng.h, MAX_LOG_LINE. I boosted it up to 4096, recompiled, deployed the new binary but the problem remains.. Any ideas? Regards.. Robert

2 1

Syslog-ng's memory footprint growing constantly on DEC alpha
by Wim-Jan Hilgenbos 29 Oct '01

29 Oct '01

Hi, I have quite a lot of trouble with syslog-ng. More specific with the memory footage. It grows within a day to a size of over 130M after which it stops logging except for its own internal messages and then a short time later it dies. I have tried all kinds of combinations of compilers/compiler options. motivated in part by the unaligned messages and the former emails on this list. I'm able to get rid of the analigned access messages by using the native compiler, but I can't get a stable memory-size. My idea is that log messages are only partially freed. When I look at the core I see a lot of 'tails of logmessages' varying in length from 2 to 15 chars. The whole application becomes more stable and grows slower when I use the '-taso' option of the native compiler, which directs the loader to load the modules in 31-bit address space. Debug output shows a stable number of Objects in memory, around 290. I've used serveral versions: 1.4.8, 1.4.12, 1.4.13, 1.5.7, 1.5.10, 1.5.11 and probably some more (I'm not at my workstation now ;-< We use Compaq True64. The message load of the appl. we're develloping is rather high so we use syslog-ng exclusively for that application. We don't use NIS+. Does anyone have any solutions? Thnx in advance. Wim-Jan Hilgenbos

2 2

Syslog-ng Log Files
by Denis Doublet 29 Oct '01

29 Oct '01

Hi, With syslog-ng, is there anyway to take the facility, level,date,hostname in the log message ? We log in a fifo file, and without facility end level, the message log can't be sorted, every messages have the same form. We tried many syntaxes, like destination probe_netcool { pipe("/var/adm/netcool_pipe"); "$LEVEL" }; or destination probe_netcool { pipe("/var/adm/netcool_pipe"); '$LEVEL' }; and many others, but every syntax we tried generated a "Syntax error reading config file, using old configuration" message. I must avoid syntax like : destination probe_netcool { file("/var/adm/$HOST.log"); }; because only one fifo can be scanned (question of licences..) Thank you Denis

1 0