- syslog-ng - lists.balabit.hu

Difficulty with source(net) on Solaris 8 [syslog-ng-1.4.9a]
by Ken Paris 13 Sep '01

13 Sep '01

Thanks for your reply Shawn, I tried your sample config, and still get no messages logged from external sources. ps -aef | grep syslog kparis@dv-netlog$ proc syslog-ng. root 23643 1 0 10:55:03 ? 0:00 /usr/local/sbin/syslog-ng - f /usr/local/etc/syslog-ng.conf -p /var/run/syslog-n in the log I get only Sep 12 10:55:03 dv-netlog syslog-ng[23643]: syslog-ng version 1.4.9a starting when I snoop interface and change a cisco config, I get: kparis@netlog$ sudo snoop 112.139.47.241 Using device /dev/hme (promiscuous mode) 112.139.47.241 -> netlog SYSLOG C port=57785 <5>660: Sep 12 10:52 Still confused ... Megs of thanks, Ken Paris

2 1

RE: [syslog-ng]Difficulty with source(net) on Solaris 8 [syslog-n g-1.4.9a]
by Shawn Davenport 11 Sep '01

11 Sep '01

Hey Ken, Give this a try as your syslog-ng.conf file, options { sync(0); keep_hostname(yes); chain_hostnames(no); log_fifo_size(30000); }; source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_net_udp { udp(); }; destination d_local { file("/logs/messages"); }; log { source(s_local); source(s_net_udp); destination(d_local); }; Note: the source s_net_udp will set syslog-ng to accept ALL incoming UPD(514) messages from ANY host. The cisco conf looks ok, and yes both syslogd and -ng can be running at the same time, at least I've had no problems doing that on Solaris. If the above does work for you, and gets the cisco messages into /var/adm/messages let me know and I can toss a few more examples your way... such as other destinations and filters, and sources. Best of luck. Shawn -----Original Message----- From: Ken Paris [mailto:kparis@netstars.org] Sent: Tuesday, September 11, 2001 12:28 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Difficulty with source(net) on Solaris 8 [syslog-ng-1.4.9a] Greetings. I must request your assistance. First I wish to say that I greatly appreciate the professional level of this list. I am looking forward to getting syslog-ng functioning properly, as it will greatly reduce my workload. It compiled .... I thought the rest would be easy ;-) I have read through most of the archived list, and thought I had this baby down, but I cannot get syslogs comming from sources other than from the local system to appear. I have tested with the following script and log everything except level(emerg), which is correct, and odly I do not get any facility(kern), which I thought I would, but which is also not quite so important at the moment. ... but still none from external sources. for f in {kern,user,daemon,auth,syslog,local0,local1,local2,local3,local4,local5,loca l6,l ocal7} do for i in {debug,info,notice,warning,err,crit,alert,emerg} do logger -p $f.$i "Facility $f Level $i" echo "Facility $f Level $i" done done Works great! My main goal is to receive and filter syslogs from Cisco routers, switches, and firewalls. If the standard syslogd is running I can see those external log entries in /var/adm/messages. They look like this: Sep 10 16:41:34 [112.139.47.241.225.185] 645: Sep 10 16:36:52: %SYS-5-CONFIG_I: Configured from console by kparis on vty0 (112.139.47.250) Sep 10 17:03:43 [112.139.47.241.225.185] 646: Sep 10 16:59:00: %SYS-5-CONFIG_I: Configured from console by kparis on vty1 (112.139.47.250) Sep 10 20:30:42 [112.139.47.244.196.210] 2036: Sep 10 20:25:25.921: %SYS-5- CONFIG_I: Configured from console by kparis on vty0 (112.139.47.250) Sep 10 20:30:57 [112.139.47.244.196.210] 2037: Sep 10 20:25:40.997: %SYS-5- CONFIG_I: Configured from console by kparis on vty0 (112.139.47.250) ( I still don't get the format of the host stamp [112.139.47.244.196.210] .... but I believe this is a syslogd thing, and don't think it's the culprit here. ) ( Clarification: Can the standard syslogd be running at the same time as syslog- ng? I have tried it both ways ) If I snoop the interface, I can see the syslog packets arrive. I fear I am missing something fairly basic. I believe I am having difficulty with the "source net", but I can't seem to find what is wrong when compared to the many examples I have seen on this list. None of the "source net" entries shown, nor any variation I can think of, seems to work. I have also tried changing "/etc/.syslog_door" to "/var/run/syslog_door", but this makes no difference either. If I can provide any more clues, I certainly will if I know how. Any help would be appreciated. ********************* Begin Config Stuff *************** Cisco Logging Config: logging buffered 9000 debugging logging rate-limit console 10 except errors logging source-interface FastEthernet1/0 logging 172.16.7.250 ( The default here is logging facility local7. I have also tried logging facility local6, which should werk too ... I am avoiding kern like the plague ) Platform: SunOS 172.16.7.250 5.8 Generic_108528-09 sun4u sparc SUNW,Ultra-5_10 Version: syslog-ng-1.4.9a syslog-ng config: ( with which I expect to see any message that arrives except level(emerg) ) # /usr/local/etc/syslog-ng.conf # Start command: /usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf - p /var/run/syslog-ng.pid # Re-start command: kill -HUP `cat /var/run/syslog-ng.pid` # Begin # -------- OPTIONS --------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; # -------- SOURCES --------------- #source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp (ip(0.0.0.0) port(514)); }; # Didn't werk ... seperate out for clarity source src { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source int { internal(); }; source net { udp(ip(172.16.7.250) port(514)); }; #source net { udp(); }; #source net { sun-streams("/dev/log" door("/etc/.syslog_door")); udp(ip (0.0.0.0) port(514)); }; # Something is not right in the source department ! # # -------- DESTINATIONS ---------- destination d_default { file("/var/adm/log/$MONTH/default"); }; # Many more places in mind # # -------- FILTERS --------------- filter f_debug { level(debug .. alert) and facility(kern, daemon, user, auth, syslog, local0, local1, local2, local3, local4, local5, local6, local7); }; # Catch all for now... I got a book of "matches" in my pocket # # -------- ACTIONS --------------- log { source(src); filter(f_debug); destination(d_default); }; # Add loggers to match added sources log { source(net); filter(f_debug); destination(d_default); }; log { source(int); filter(f_debug); destination(d_default); }; #log { source(src); filter(DEFAULT); destination(d_default); }; # Blast ... All that reading, and I think I still need some help # End Megs of thanks, Ken Paris Sr. Network Systems Engineer, Bluestar Solutions, Inc. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Difficulty with source(net) on Solaris 8 [syslog-ng-1.4.9a]
by Ken Paris 11 Sep '01

11 Sep '01

Greetings. I must request your assistance. First I wish to say that I greatly appreciate the professional level of this list. I am looking forward to getting syslog-ng functioning properly, as it will greatly reduce my workload. It compiled .... I thought the rest would be easy ;-) I have read through most of the archived list, and thought I had this baby down, but I cannot get syslogs comming from sources other than from the local system to appear. I have tested with the following script and log everything except level(emerg), which is correct, and odly I do not get any facility(kern), which I thought I would, but which is also not quite so important at the moment. ... but still none from external sources. for f in {kern,user,daemon,auth,syslog,local0,local1,local2,local3,local4,local5,local6,l ocal7} do for i in {debug,info,notice,warning,err,crit,alert,emerg} do logger -p $f.$i "Facility $f Level $i" echo "Facility $f Level $i" done done Works great! My main goal is to receive and filter syslogs from Cisco routers, switches, and firewalls. If the standard syslogd is running I can see those external log entries in /var/adm/messages. They look like this: Sep 10 16:41:34 [112.139.47.241.225.185] 645: Sep 10 16:36:52: %SYS-5-CONFIG_I: Configured from console by kparis on vty0 (112.139.47.250) Sep 10 17:03:43 [112.139.47.241.225.185] 646: Sep 10 16:59:00: %SYS-5-CONFIG_I: Configured from console by kparis on vty1 (112.139.47.250) Sep 10 20:30:42 [112.139.47.244.196.210] 2036: Sep 10 20:25:25.921: %SYS-5- CONFIG_I: Configured from console by kparis on vty0 (112.139.47.250) Sep 10 20:30:57 [112.139.47.244.196.210] 2037: Sep 10 20:25:40.997: %SYS-5- CONFIG_I: Configured from console by kparis on vty0 (112.139.47.250) ( I still don't get the format of the host stamp [112.139.47.244.196.210] .... but I believe this is a syslogd thing, and don't think it's the culprit here. ) ( Clarification: Can the standard syslogd be running at the same time as syslog- ng? I have tried it both ways ) If I snoop the interface, I can see the syslog packets arrive. I fear I am missing something fairly basic. I believe I am having difficulty with the "source net", but I can't seem to find what is wrong when compared to the many examples I have seen on this list. None of the "source net" entries shown, nor any variation I can think of, seems to work. I have also tried changing "/etc/.syslog_door" to "/var/run/syslog_door", but this makes no difference either. If I can provide any more clues, I certainly will if I know how. Any help would be appreciated. ********************* Begin Config Stuff *************** Cisco Logging Config: logging buffered 9000 debugging logging rate-limit console 10 except errors logging source-interface FastEthernet1/0 logging 172.16.7.250 ( The default here is logging facility local7. I have also tried logging facility local6, which should werk too ... I am avoiding kern like the plague ) Platform: SunOS 172.16.7.250 5.8 Generic_108528-09 sun4u sparc SUNW,Ultra-5_10 Version: syslog-ng-1.4.9a syslog-ng config: ( with which I expect to see any message that arrives except level(emerg) ) # /usr/local/etc/syslog-ng.conf # Start command: /usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf - p /var/run/syslog-ng.pid # Re-start command: kill -HUP `cat /var/run/syslog-ng.pid` # Begin # -------- OPTIONS --------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; # -------- SOURCES --------------- #source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp (ip(0.0.0.0) port(514)); }; # Didn't werk ... seperate out for clarity source src { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source int { internal(); }; source net { udp(ip(172.16.7.250) port(514)); }; #source net { udp(); }; #source net { sun-streams("/dev/log" door("/etc/.syslog_door")); udp(ip (0.0.0.0) port(514)); }; # Something is not right in the source department ! # # -------- DESTINATIONS ---------- destination d_default { file("/var/adm/log/$MONTH/default"); }; # Many more places in mind # # -------- FILTERS --------------- filter f_debug { level(debug .. alert) and facility(kern, daemon, user, auth, syslog, local0, local1, local2, local3, local4, local5, local6, local7); }; # Catch all for now... I got a book of "matches" in my pocket # # -------- ACTIONS --------------- log { source(src); filter(f_debug); destination(d_default); }; # Add loggers to match added sources log { source(net); filter(f_debug); destination(d_default); }; log { source(int); filter(f_debug); destination(d_default); }; #log { source(src); filter(DEFAULT); destination(d_default); }; # Blast ... All that reading, and I think I still need some help # End Megs of thanks, Ken Paris Sr. Network Systems Engineer, Bluestar Solutions, Inc.

1 0

Firewall syslog-ng.conf?
by Bob Tanner 08 Sep '01

08 Sep '01

hostA 192.168.100.1-+ | hostB | 192.160.100.3-+--> local logger <---> firewall <--> VPN <--> central logger | 192.168.100.100 <public IP> hostC | 192.168.100.3-+ I'm trying to setup a centralized syslog server for several geographically diverse locations. The hostA, hostB, hostC computers all log to local logger (192.168.100.100). And this server logs to the central logger. I'm a little confused on what settings I need: long_hostnames or chain_hostnames? Looking at the web, it seems like they are aliases for the same functionality. keep_hostname(no), because I want hostA/local logger in the log files collected at the central logger? Others, I played with, but I cannot get the combo to work right. use_dns(yes)? use_fqdn(yes)? If I was the logs in central logger to look like hostA/local logger, which commands so I turn on? If I get this to work, I'll add it to the sample configs. -- Bob Tanner <tanner(a)real-time.com> | Phone : (952)943-8700 http://www.mn-linux.org | Fax : (952)943-8500 Key fingerprint = 6C E9 51 4F D5 3E 4C 66 62 A9 10 E5 35 85 39 D9

1 0

problem solved...
by ved 08 Sep '01

08 Sep '01

err, just found the problem, i have to also stop klogd, and then start syslog-ng before klogd. pretty basic =)

1 0

iptables stops logging on syslog-ng restart
by ved 08 Sep '01

08 Sep '01

if i restart syslog-ng (witch i need to to rotate the logs) it seems that the iptables firewall hits don't get logged anymore.., even if i stop and then restart it it still doesn't logs.. but reboot is fine. it's a strange problem but maybe anyone has had the same situation, tanks. PS: i'm compiling 1.5.10 right now to upgrade the version i have witch is 1.4.13.

1 0

SMP RH7.1
by Christopher_Leonardos＠triumph.com 07 Sep '01

07 Sep '01

I have two DELL 2450 Server's, each with 2 1Ghz Processors, 2GB of RAM, and two pairs of 36GB mirrored drives on a PErc 3/si RAID Controller running RH 7.1 with a SMP Kernel Question: Will I really get any additional performance from the extra processor using SYSLOG-NG? Thanks!! Christopher Leonardos Security Engineer Interliant Inc. 12 Gill Street Woburn, MA 01801 781-756-3761 781-756-3737 FAX christopher_leonardos(a)interliant.com

5 4

syslog-ng: broken pipe
by Ravi Malghan 07 Sep '01

07 Sep '01

Hello: I have installed syslog NG 1.4.11. Every now and then I have to restart the both the server and client syslog-ng b'cos the client doesnot send any messages. The errors I see on the server side look as follows Aug 13 22:45:00 local@iadrse01/iadrse01 syslog-ng[2410]: io.c: do_write: write() failed (errno 32), Broken pipe Aug 13 22:45:00 local@iadrse01/iadrse01 syslog-ng[2410]: Connection broken, reopening in 60 seconds I also see this error in the /var/adm/messages after a while Aug 14 14:09:51 local@iadcor01 syslog-ng[3614]: Error accepting AF_INET connection from: 216.182.213.206:36010, opened connections: 10, max: 10 Has anybody else seen this happening? TIA Ravi

5 20

Re: [syslog-ng]More information on time_reopen, continuous reconnects, and syslog-ng 1.4.12.
by matthew.copeland＠honeywell.com 06 Sep '01

06 Sep '01

I think that part of the problem with this patch is that fd->super.alive doesn't get set to zero. I could be wrong, but I traced through the original code using gdb and then I received your patch. So after trying the patch and finding that it didn't work, I went back and looked at the output of the script file. The first time the socket times out, fd->super.alive gets set to 0 and the second poll doesn't happen. Then, when you go into the for loop if continues back fd->super.alive is zero. If this is the setup to get it to setup the callback for reconnecting later, maybe we should do the POLLERR check when we do the fd->super.alive check, and set fd->super.alive = 0 if we get into that if statement. What do you think? I have included the script output session of my walk through the code using gdb. (compressed this time.) Matthew M. Copeland > > > Index: io.c > > =================================================================== > > RCS file: /var/cvs/libol/src/io.c,v > > retrieving revision 1.25 > > diff -u -r1.25 io.c > > --- io.c 2001/08/26 21:28:18 1.25 > > +++ io.c 2001/09/05 20:39:02 > > @@ -231,7 +231,7 @@ > > if (!fd->super.alive) > > continue; > > > > - if (fds[i].revents & POLLHUP) { > > + if (fds[i].revents & (POLLHUP|POLLERR|POLLNVAL)) { > > if (fd->want_read && fd->read) > > READ_FD(fd); > > else if (fd->want_write && fd->write) > > @@ -246,10 +246,12 @@ > > close_fd(fd, CLOSE_PROTOCOL_FAILURE); > > continue; > > } > > + /* > > if (fds[i].revents & (POLLNVAL | POLLERR)) { > > close_fd(fd, CLOSE_POLL_FAILED); > > continue; > > } > > + */ > > if (fds[i].revents & POLLOUT) > > if (fd->want_write && fd->write) > > WRITE_FD(fd); > > > > > > -- You may be sure that when a man begins to call himself a "realist," he is preparing to do something he is secretly ashamed of doing. -- Sydney Harris

1 0

Thanks!
by Christopher_Leonardos＠triumph.com 06 Sep '01

06 Sep '01

Cool. Thanks for the feedback. The short-term plan is to deploy a syslogd per customer on incrementally higher ports(since the hardware supports specifying the syslog port), or build a CGI frontend in PERL that will parse a single flat file from a single syslogd. The longer term goal is going to be to build a connector to send the data from syslog-ng directly into an Oracle 8i database. Everything is so "cost" sensitive these days, who knows what the final solution will look like. Regards, Christopher Leonardos Security Engineer Interliant Inc. 12 Gill Street Woburn, MA 01801 781-756-3761 781-756-3737 FAX christopher_leonardos(a)interliant.com

1 0

AIX - Broken Connection
by Roman Ernst 05 Sep '01

05 Sep '01

Maybe someone can help me with the following question: After an established syslog-ng connection between 2 AIX boxes I have the problem that if terminating the physical network connection the connection state stays ESTABLISHED... My problem: I want to recognize connection problems at my logging server... when a syslog-ng client can't connect to the logging server anymore the server should send an alert-email. Unfortunately at the server-side there is no log that the connection the the client has been closed/broken,... Is there any possibility to see when the connection between client <-> server is broken??? Thanks a lot in advance! Roman

1 0

Compile error on Solaris 7
by Ripley, Scott 05 Sep '01

05 Sep '01

When trying to compile 1.5.10, I get the following error in make: make[3]: Entering directory `/export/home/root/syslog-ng-1.5.10/src' gcc -DHAVE_CONFIG_H -I. -I/export/home/root/syslog-ng-1.5.10/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c main.c main.c:47: `PATH_SYSCONFDIR' undeclared here (not in a function) configure says everything is fine, and I compiled 1.5.9 without any problems. I also tried defining the variable in the shell. What's odd is if I go to line 47 of main.c, it says: static char cfgfilename[128] = PATH_SYSLOG_NG_CONF; Any suggestions? Scott Ripley DNS Administrator - House Information Resources U.S. House of Representatives 202.226.2833 - mailto:scott.ripley@mail.house.gov <mailto:scott.ripley@mail.house.gov>

1 0

Apologies
by HAYA＠Nationwide.com 05 Sep '01

05 Sep '01

All, I would like to apologize to everyone on the list for the Out of Office responses you received from me last week. A recent upgrade to our mail system reset all of my preferences and the Out of Office agent default setting of respond to Internet mail was implemented. It won't happen again. My thanks to Balazs for heading this off quickly to reduce list overhead. Alex

1 0

Re: [syslog-ng]syslog-ng cannot run in Solaris 2.7
by Sander 05 Sep '01

05 Sep '01

Hi, What hardware are you using and what compiler? I've got syslog-ng running on Solaris8/x86 with no problem. Sander de Boer 2001-09-04 16:51:02, "Shirley Siu (Utako)" <utako(a)sftw.umac.mo> wrote: >Hi, > >Sorry, this may be an already answered question, but I tried to search in >the archives and cannot find a solution. > >I have just installed syslog-ng 1.4.12 in a Solaris 2.7 machine. I started >it and it died quietly without any message. Then I tried the "-d" option, >and use logger to feed a test message (e.g. logger test test), it >immediately cores dump: > >syslog-ng version 1.4.12 starting >io.c: Preparing fd 5 for writing >Segmentation fault (core dumped) > >The conf file is just the syslog-ng.conf.solaris file. > >Can anybody help? > >Thanks. > >Shirley > > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng > >

2 1

Re: [syslog-ng]self-defined facility/priority?
by Sander 04 Sep '01

04 Sep '01

Hi, The official facility/priority can, as far as I know, not simply be extended. You can log to pipe from your own scripts an programs, so that will in some way provide with your own 'facility' (the facility being the name of the pipe) and the priority being in the message. Hope this helps, Sander de Boer 2001-09-04 18:02:32, "Shirley Siu (Utako)" <utako(a)sftw.umac.mo> wrote: >Hi again, > >Can we define our own "facility" or "priority" and used in the >syslog-ng.conf file? If it is possible, is there a sample? > >Thanks. > >Shirley > > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng > >

2 1

compress()
by jamie rishaw 04 Sep '01

04 Sep '01

Hi, This is probably a question more for the coders than the list in general, but: I'm currently running 1.4.12 on FreeBSD as a central server, and wanted to know, if/when compress() was going to be implemented? Also, compress() begs the question: will compression be on the fly, or after rotation to another file (e.g. file("/logs/routers/$YEAR-$MONTH/$DAY/$HOST"); ). I guess the question to follow would be for the list at large: Has anyone come up with clever/interesting ways to archive/move old logs? TIA jamie -- jamie rishaw <jamie(a)playboy.com> sr. wan/unix engineer/ninja // playboy enterprises inc. [opinions stated are mine, and are not necessarily those of the bunny] "UNIX was not designed to stop people from doing stupid things, because that would also stop them from doing clever things." -- Doug Gwyn

1 0

syslog-ng cannot run in Solaris 2.7
by Shirley Siu (Utako) 04 Sep '01

04 Sep '01

Hi, Sorry, this may be an already answered question, but I tried to search in the archives and cannot find a solution. I have just installed syslog-ng 1.4.12 in a Solaris 2.7 machine. I started it and it died quietly without any message. Then I tried the "-d" option, and use logger to feed a test message (e.g. logger test test), it immediately cores dump: syslog-ng version 1.4.12 starting io.c: Preparing fd 5 for writing Segmentation fault (core dumped) The conf file is just the syslog-ng.conf.solaris file. Can anybody help? Thanks. Shirley

1 1

syslog-ng 1.5.10
by Balazs Scheidler 03 Sep '01

03 Sep '01

Hi, I've released syslog-ng 1.5.10 with the following changes: News for the 1.5.10 release Mon, 3 Sep 2001 18:47:48 +0200 The 1.5.9 version was released in a hurry, some features were not fully completed, and an appropriate NEWS entry was not written. So this one summarizes the changes both in 1.5.9 and 1.5.10: * finalized log statement processing flags * changed syslog-ng buffering, so writing log messages is buffered (sync(10) now means that ten messages are grouped and written with a single write() syscall) * implemented fsync() option to force an fsync(fd) to logfiles after each write * implemented quick&dirty stats reporting (now configurable with the stats() global option) * updated documentation, now includes recent changes as well (log processing, fsync and stats) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

making on alpha running osf1-40f
by GMS SB 30 Aug '01

30 Aug '01

Hello, Is there anybody who has a Makefile for alpha/osf1-40f I don't seem to be able to get a reliable working syslog-ng. I'm running syslog 1.4.x and 1.5.x on an compaq ds-20 and on a es-40 I've been using the native cc and gcc 2.95.3. With cc i used the -misalign switch (on both syslog and libol). When i run my stresstest, the core grows to about 120 M and then stops logging. It keeps running and give it's verbose messages. I've been seeing messages that kill -HUP worked/ was fixed, but it works like a quit. Also i ran it with -vd and made it core. Garbage collection output seems alright. It contains parts of messages and a lot of "127." and "127.0.0.1". Also the expression @..@ gives a lot of hits. The gcc version seems to work, but it complains a lot about unaligned traps, hence the -misalign switch with cc. Nobody trusts it because of that. It grew 0.03 M overnight, but the stresstest stopped. I'm about to let it core now and will report what i find. I am losing credit for syslog here so please give me some hints at this adres or at syslog-ng(a)onecht.net. tia

1 0

RE: [syslog-ng]logs get filled by "STATS: dropped 0" ?
by Andrew Fort 30 Aug '01

30 Aug '01

Ved, Balazs posted this message about the logging every second in the 1.5.9 dev release. As 1.5.9 is a development version, some things are unfinished, but the link below should point you in the right direction to changing the frequency of the STATS: messages :). I would imagine this will be made into a configuration knob when either balazs or someone else gets time to add the patch.. http://marc.theaimsgroup.com/?l=syslog-ng&m=99898987009711&w=2 -----Original Message----- From: ved [mailto:ved@netmadeira.com] Sent: Thursday, 30 August 2001 8:02 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]logs get filled by "STATS: dropped 0" ? I'm looking to change from my normal syslogd to syslog-ng but when i start it, it writes this message: syslog-ng[13668]: STATS: dropped 0 every second... so my logs increase in size very rapidly, how can i stop this or what is causing it?

1 0

logs get filled by "STATS: dropped 0" ?
by ved 29 Aug '01

29 Aug '01

I'm looking to change from my normal syslogd to syslog-ng but when i start it, it writes this message: syslog-ng[13668]: STATS: dropped 0 every second... so my logs increase in size very rapidly, how can i stop this or what is causing it?

1 0

Getting AIX systems to log to a Solaris host
by ampeterson 29 Aug '01

29 Aug '01

I am trying to get all of our AIX systems to log all of their system messages to a Solaris system. I have syslog-ng complied on both the Solaris and AIX platforms. I have syslog-ng working just fine on Solaris, however, I am having problems getting AIX to log to a Solaris system. Is anyone familiar with how to configure the syslog-ng.conf file on the Solaris side and on the AIX side so AIX will log it's system messages to Solaris (and yes I have already configured the odm to pass system messages to syslog on AIX)? Here is a short, simple version of the syslog-ng.conf file that I have setup on the Solaris side: > # Global options > options { sync(0); time_reopen(10); log_fifo_size(100); }; > # Sources > source all { tcp(ip("0.0.0.0") port(10514)); udp(ip("0.0.0.0") port(514)); > internal(); sun-streams("/dev/log" door("/etc/.syslog_door")); }; > # > # Destinations > destination auth-log { file("/var/log/syslog-ng/auth-log"); }; > # > # filters > filter f_auth { facility(auth) and level(notice); }; > # > # Logs > # Loghost > log { source(all); filter(f_auth); destination(auth-log); }; I have tried to add the unix-dgram / unix-stream segment in to accept calls from AIX, but it doesn't work: > #Sources > source all { unix-dgram("/dev/log"); tcp(ip("0.0.0.0") port(10514)); > udp(ip("0.0.0.0") port(514)); internal(); sun-streams("/dev/log" > door("/etc/.syslog_door")); }; and also > #Sources > source all { unix-stream("/dev/log"); tcp(ip("0.0.0.0") port(10514)); > udp(ip("0.0.0.0") port(514)); internal(); sun-streams("/dev/log" > door("/etc/.syslog_door")); }; I've have also tried a more generic approach for both Solaris and AIX, but it doesn't work: > #Sources > source all { unix-stream("/dev/log"); internal(); }; After I added the unix-dgram and unix-stream segment on the first example and started syslog-ng, my device file /dev/log on Solaris and the /etc/.syslog_door file were replaced with incorrect files. I looked through the discussion threads, and I haven't been able to find any discussion concerning this matter. I apologize in advance if I missed this discussion thread. Thank you for your help! Anna Maria Peterson Micron Technology, Inc. Unix System Manager Mail Stop 964 8000 S. Federal Way Boise, Idaho 83707 (208) 363-2196

1 0

RE: [syslog-ng]Alexander T Hay/Nationwide/NWIE is out of the offi ce.
by Ohrberg, Mick 29 Aug '01

29 Aug '01

...or put a filter on the mailing list blocking ANYTHING that contains the words 'out of office' or any permutation thereof. /Mick -----Original Message----- From: Michael Renner [mailto:robe@amd.co.at] Sent: Wednesday, August 29, 2001 11:13 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Alexander T Hay/Nationwide/NWIE is out of the office. On Wed, 29 Aug 2001 HAYA(a)Nationwide.com wrote: > I will be out of the office starting 08/29/2001 and will not return until > 09/04/2001. > > I am out of the office for the remainder of this week. If you need > assistance of a technical nature please contact Sean Amon at 249-5489. All > other questions can be directed to Patsy Short at 677-6350. > could somebody please nuke this stu^H^H^Hnice person from the mailinglist? thanks greetz michael _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

4 3

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

3 2

RE: [syslog-ng]iptables & syslog-ng
by Nijs, Daniel 29 Aug '01

29 Aug '01

is there anything I can change on my redhat box to alter this behavior? -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Wednesday, August 29, 2001 10:33 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]iptables & syslog-ng On Wed, Aug 29, 2001 at 08:53:26AM -0400, Nijs, Daniel wrote: > Hi Michael > > That did indeed fix the problem, are you running 1.5.9? Now I have to write > rules for two src's which could cause more overhead, so I would like to know > if this is a bug of some sort, or normal behavior. Thanks for your help, > this really works well. redhat klogd is using unix-dgram sockets while the libc can send both unix-stream and unix-dgram. If you are using unix-stream only the libc will be able to log. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1