- syslog-ng - lists.balabit.hu

RE: [syslog-ng]iptables & syslog-ng
by Nijs, Daniel 29 Aug '01

29 Aug '01

Hi Michael That did indeed fix the problem, are you running 1.5.9? Now I have to write rules for two src's which could cause more overhead, so I would like to know if this is a bug of some sort, or normal behavior. Thanks for your help, this really works well. Best regards, Daniel -----Original Message----- From: Michael Renner [mailto:robe@amd.co.at] Sent: Tuesday, August 28, 2001 4:10 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: Re: [syslog-ng]iptables & syslog-ng On Tue, 28 Aug 2001, Nijs, Daniel wrote: > Hello, > > I just set up an iptables based firewall on my syslog-ng host machine > (redhat 7.1), but ran into a small problem. When I run syslogd+klogd, I can > see iptables generating the logfiles. When I disable the standard syslog > daemon, and run syslog-ng+klogd, I do not see the data I am looking for, it > is almost like iptables isn't logging at all, but it has to, since it works > with the normal syslogd. I setup a generic rule, and a fallback, so > everything should work. When using the "logger" tool, and generating a fake > entry, everything seems ok, so I assume this is an issue between kernel > logging and syslog-ng. I am running 1.5.9 (not the official release). Any > help would be appreciated. Thanks Hi Daniel! It sounds like you have problems with your kernel-logs... do you receive any kernel messages at all? i dumped klogd at all and using the following syslog-ng-directive as source for my kernel messages: --- source srck { pipe("/proc/kmsg"); }; --- It works w/o a flaw for me and makes the klogd obsolete, another application which can't break :) greetz michael Michael Renner Inode Internet - Junior System Engineer _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

1 0

Compiling problem on Sun/Solaris
by Ari.Kuukka＠man.ac.uk 29 Aug '01

29 Aug '01

Hello, I am having problems compiling syslog-ng on Solaris. I have tried to compile several different versions of syslog-ng (1.4.12, 1.4.13 and 1.5.9) on both Solaris 7 and Solaris 8, using gcc version 2.95.2. However, every time I get the same error message below while running 'make': . . . gcc -DHAVE_CONFIG_H -I. -I/tmp/aek/syslog-ng-1.4.13/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c getopt.c gcc -DHAVE_CONFIG_H -I. -I/tmp/aek/syslog-ng-1.4.13/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c getopt1.c gcc -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/tmp/aek/syslog-ng-1.4.13/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/tmp/aek/syslog-ng-1.4.13/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/tmp/aek/syslog-ng-1.4.13/src' make: *** [all-recursive] Error 1 Many thanks for any suggestions about what is going wrong. -- Ari Kuukka University of Manchester Department of Imaging Science and Biomedical Engineering Telephone: (+44) 0161 275 5405 E-mail: ari.kuukka(a)man.ac.uk

3 2

RE: [syslog-ng]Compiling problem on Sun/Solaris
by Ari.Kuukka＠man.ac.uk 29 Aug '01

29 Aug '01

That helped, many thanks! -- Ari Kuukka -----Original Message----- From: Sander de Boer [mailto:boeraa@yahoo.com] Sent: Wednesday, August 29, 2001 11:53 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Compiling problem on Sun/Solaris I had the same problem on Solaris 8/x86. As far as I can remember I had to add libl.so to the Makefile where the libraries were specified, i.e. "-ll" Sander --- Ari.Kuukka(a)man.ac.uk wrote: > > Hello, > > I am having problems compiling syslog-ng on Solaris. > I have tried to compile several different > versions of syslog-ng (1.4.12, 1.4.13 and 1.5.9) on > both Solaris 7 and Solaris 8, using gcc version > 2.95.2. However, every time I get the same error > message below while running 'make': > > . > . > . > gcc -DHAVE_CONFIG_H -I. > -I/tmp/aek/syslog-ng-1.4.13/src -I. -O2 -Wall > -I/usr/local/include/libol > -D_GNU_SOURCE -c getopt.c > gcc -DHAVE_CONFIG_H -I. > -I/tmp/aek/syslog-ng-1.4.13/src -I. -O2 -Wall > -I/usr/local/include/libol > -D_GNU_SOURCE -c getopt1.c > gcc -O2 -Wall -I/usr/local/include/libol > -D_GNU_SOURCE -o syslog-ng main.o sources.o > center.o > filters.o destinations.o log.o cfgfile.o > cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o > afinet.o afinter.o afuser.o afstreams.o afprogram.o > utils.o syslog-names.o getopt.o getopt1.o > -lpthread -ldoor /usr/local/lib/libol.a -lsocket > -lnsl -lxnet > Undefined first referenced > symbol in file > yywrap cfg-lex.o > ld: fatal: Symbol referencing errors. No output > written to syslog-ng > collect2: ld returned 1 exit status > make[3]: *** [syslog-ng] Error 1 > make[3]: Leaving directory > `/tmp/aek/syslog-ng-1.4.13/src' > make[2]: *** [all-recursive] Error 1 > make[2]: Leaving directory > `/tmp/aek/syslog-ng-1.4.13/src' > make[1]: *** [all-recursive-am] Error 2 > make[1]: Leaving directory > `/tmp/aek/syslog-ng-1.4.13/src' > make: *** [all-recursive] Error 1 > > > Many thanks for any suggestions about what is going > wrong. > > -- > Ari Kuukka > University of Manchester > Department of Imaging Science and Biomedical > Engineering > Telephone: (+44) 0161 275 5405 > E-mail: ari.kuukka(a)man.ac.uk > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > __________________________________________________ Do You Yahoo!? Make international calls for as low as $.04/minute with Yahoo! Messenger http://phonecard.yahoo.com/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

1 0

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

1 0

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

1 0

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

1 0

Alexander T Hay/Nationwide/NWIE is out of the office.
by HAYA＠Nationwide.com 29 Aug '01

29 Aug '01

I will be out of the office starting 08/29/2001 and will not return until 09/04/2001. I am out of the office for the remainder of this week. If you need assistance of a technical nature please contact Sean Amon at 249-5489. All other questions can be directed to Patsy Short at 677-6350.

1 0

Small fix for init.d.RedHat contrib file
by Jacques THOMAS 29 Aug '01

29 Aug '01

Hi all, The script init.d.RedHat from the contrib directory kept complaining: Starting syslog-ng: basename: too many arguments Try `basename --help' for more information. when i used it to start syslog-ng. This annoying behavior can be fixed by replacing the line: daemon "$INIT_PROG $INIT_OPTS" by daemon --check $INIT_PROG "$INIT_PROG $INIT_OPTS" I had this problem on a RedHat 7.0, and thought the solution might be helpful for others. Regards, Jacques THOMAS.

1 0

iptables & syslog-ng
by Nijs, Daniel 28 Aug '01

28 Aug '01

Hello, I just set up an iptables based firewall on my syslog-ng host machine (redhat 7.1), but ran into a small problem. When I run syslogd+klogd, I can see iptables generating the logfiles. When I disable the standard syslog daemon, and run syslog-ng+klogd, I do not see the data I am looking for, it is almost like iptables isn't logging at all, but it has to, since it works with the normal syslogd. I setup a generic rule, and a fallback, so everything should work. When using the "logger" tool, and generating a fake entry, everything seems ok, so I assume this is an issue between kernel logging and syslog-ng. I am running 1.5.9 (not the official release). Any help would be appreciated. Thanks Best regards, Daniel

2 1

RE: [syslog-ng]syslog-ng 1.5.9
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 28 Aug '01

28 Aug '01

Bazsi, Very cool. Are the stats configurable by the users? Is it some sort of option statement that that will output every X amount of minutes? Is it switchable, on and off? If these questions are all answered in the docs just simply respond "RTFM". Thanks, Drew -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, August 28, 2001 10:19 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.5.9 Hi, We have released syslog-ng 1.5.9, now officially with the following changes: * finalized log statement processing flags * updated documentation * changed syslog-ng buffering, so writing log messages is buffered (sync(10) now means that ten messages are grouped and written with a single write() syscall) * implemented fsync() option to force an fsync(fd) to logfiles after each write * implemented quick&dirty stats reporting (this is not final, now reports number of dropped messages for the last minutes) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

syslog-ng 1.5.9
by Balazs Scheidler 28 Aug '01

28 Aug '01

Hi, We have released syslog-ng 1.5.9, now officially with the following changes: * finalized log statement processing flags * updated documentation * changed syslog-ng buffering, so writing log messages is buffered (sync(10) now means that ten messages are grouped and written with a single write() syscall) * implemented fsync() option to force an fsync(fd) to logfiles after each write * implemented quick&dirty stats reporting (this is not final, now reports number of dropped messages for the last minutes) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]syslog-ng 1.5.9
by Nijs, Daniel 27 Aug '01

27 Aug '01

I have 1.5.9 running without any issues. How do I replace my DEFAULT logpath though? I am aware of the flags (I am using them), but not sure how to implement a "catch all" rule. Could you post an example please? Thanks Best regards, Dan -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Saturday, August 25, 2001 9:23 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.5.9 Hi, I managed to make some free time to hack a bit on syslog-ng. The results are available at http://www.balabit.hu/~bazsi/syslog-ng-1.5.9.tar.gz . I published this release there, because I didn't have too much time to test it now, and it changes a couple of things. I verified each new functionality at least once, and it seems to work, but it doesn't warrant anything of course. The summary of changes: * finalized the new log processing, and log statement flags (the one instead of the kludgy DEFAULT filter) This changes configuration file format from 1.5.8, which changed it from 1.5.7. This one should be final. * updated the documentation to include reference information on nearly everything (even about the new log flags). If anything is missing, please let me know. I know its English is still not the best, proofreaders welcome. I'd be grateful, if some of you could test this release. ps: the lost messages feature is not yet implemented, it's the next on the top of my todo list. ps/2: the .tar.gz is not signed. I sign this mail, so it assigns at least some trust to the file as well. (since I'm announcing it), paranoids are directed to the diffs between 1.5.8 and 1.5.9 :) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

syslog-ng 1.5.9
by Balazs Scheidler 25 Aug '01

25 Aug '01

Hi, I managed to make some free time to hack a bit on syslog-ng. The results are available at http://www.balabit.hu/~bazsi/syslog-ng-1.5.9.tar.gz . I published this release there, because I didn't have too much time to test it now, and it changes a couple of things. I verified each new functionality at least once, and it seems to work, but it doesn't warrant anything of course. The summary of changes: * finalized the new log processing, and log statement flags (the one instead of the kludgy DEFAULT filter) This changes configuration file format from 1.5.8, which changed it from 1.5.7. This one should be final. * updated the documentation to include reference information on nearly everything (even about the new log flags). If anything is missing, please let me know. I know its English is still not the best, proofreaders welcome. I'd be grateful, if some of you could test this release. ps: the lost messages feature is not yet implemented, it's the next on the top of my todo list. ps/2: the .tar.gz is not signed. I sign this mail, so it assigns at least some trust to the file as well. (since I'm announcing it), paranoids are directed to the diffs between 1.5.8 and 1.5.9 :) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

log rotation
by Joseph K Gainey 24 Aug '01

24 Aug '01

syslog-ng allows me to to complex filtering and logging, because of this I get several different log files instead of one huge monolithic syslog. Is there anyway to have syslog-ng automatically rotate the logs base on size and/or time? Joe

3 2

annoying double-hostname in logfile
by Michael Renner 24 Aug '01

24 Aug '01

hi! i replaced syslogd on our master logserver with syslog-ng, because syslogd wasn't able to handle all the incoming syslog messages (receive queue was permanent around 65500 bytes, dropped 50-90% of the incoming messages). syslog-ng now works like a charm, there's only one cosmetic flaw: every hostname in the logfile is twice, seperated by a slash, like: Aug 24 15:50:34 baby.inode.at/baby.inode.at 2961721: 13w6d: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0/1:13, changed state to up the sending sysloggers are syslogds, ciscos, zyxels, etc. so (at least IMHO) its not a config setting on the remote syslogger how can i prevent syslogd from double-printing the hostnames? relevant syslog-ng.conf snippet is here: --- options { sync (0); log_fifo_size (1000); use_fqdn (yes); }; --- greetz Michael Renner Inode Internet - Junior System Engineer

2 1

Re: syslog-ng config problem
by Balazs Scheidler 24 Aug '01

24 Aug '01

On Fri, Aug 24, 2001 at 02:53:43PM +0200, Jean-charles wrote: > hello, > > as said i your documentation > i tried the DEFAULT filter > but i can an error : > > [root@zeus syslog-ng]# /etc/init.d/syslog-ng start > Starting system logging: syslog-ngunresolved reference: DEFAULT > Error initializing configuration, exiting. > > > ii syslog-ng 1.5.8-2 Next generation logging daemon 1.5.x changed DEFAULT semantics, which is undocumented. A summary of the new functions were posted on the syslog-ng mailing list. Check the archives. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]Customizing the timestap format
by Andrew Fort 24 Aug '01

24 Aug '01

Hi Erwan, http://marc.theaimsgroup.com/?l=syslog-ng&m=97991394300231&w=2 describes the functionality (available in syslog-ng 1.5.x development releases) you desire. >From: Erwan Conq [mailto:erwan.conq@nextenso.com] >Subject: [syslog-ng]Customizing the timestap format > >Hello, > >I'm pretty new using Syslog-ng. I'm wondering if it's possible >to modify >the format of the time stamp reported in the logs. >Who shall I do it ?

1 0

RE: [syslog-ng]Customizing the timestap format
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 24 Aug '01

24 Aug '01

In the 1.5.x line there is a template feature that will allow you to do some customization of your log output. You'll have to look through the previous posts or the code to get syntax. I don't think the docs have been updated to give a lot of info on it yet so you may have to fool around with it. If you do get to using it post some specific questions if you have problems and someone here will help you out. Please keep in mind that 1.5.x line is an alpha line and the syntax can change at anytime without much warning. If you watch the list though Bazsi is pretty good about giving a heads up on major changes like that. Regards, Drew -----Original Message----- From: Erwan Conq [mailto:erwan.conq@nextenso.com] Sent: Friday, August 24, 2001 11:34 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Customizing the timestap format Hello, I'm pretty new using Syslog-ng. I'm wondering if it's possible to modify the format of the time stamp reported in the logs. Who shall I do it ?

1 0

Customizing the timestap format
by Erwan Conq 24 Aug '01

24 Aug '01

Hello, I'm pretty new using Syslog-ng. I'm wondering if it's possible to modify the format of the time stamp reported in the logs. Who shall I do it ?

1 0

RE: Re[2]: [syslog-ng]Full pipe as destination
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 23 Aug '01

23 Aug '01

I agree with Herr Apelt. The need for immediate notification needs to be weighed against the traffic coming out of an already overburdened service. A separate process listening for such things coming from the internal source should be sufficient to catch the necessary information. What you don't want to do is send a stream of data from the internal source when you are already dropping messages. A statistical notification every 12 or 24 hours is great but there definitely would need to be some sort of immediate notification so action can be taken to correct any problems. I think using the internal channel would allow for the least amount of development work and still give a desired result. Regards, Drew -----Original Message----- From: Volker Apelt [mailto:volker_apelt@yahoo.de] Sent: Thursday, August 23, 2001 12:57 PM To: syslog-ng(a)lists.balabit.hu Subject: Re[2]: [syslog-ng]Full pipe as destination On Thu, 23 Aug 2001 10:44:50 +0200 Andreas Schulze <andreas.schulze(a)mediaways.net> wrote: > Dear Bazsi, > Brad Arlt schrieb: > > > logs are silently dropped in this case. I was thinking of implementing some > > > kind of automatic statistics message to report log losses, but that would > > > race against normal log traffic. do you have a better idea. > > statistics are a very good idea and for many syslog-ng users its > important to know as most as possible about messages dropped > (for which destination, etc.), messages transfered by source ond/or > destination and something more. > > I think the discussions about possible log destinations hasn't the real > impact in this context. > > as you say its important that we prevent the daemon from stucks > in-active with its internal statistics stuff. > the real problem here is, to implement the output method of the stat. > informations. > but answer the following question: "is it really mandatory to realize > a continuous output of statistical informations?" > I think not. > > decide to which logging destination the stats should be send. > I think the internal() log source is a better choice than brad's "oh > shit!" file, because we keep save the flexibility of syslog-ng's rule-based flow > control. but a separate log is ok. > > but don't send the stats continuously to internal(). do this e.g. at > midnight for the last 24h. realize a command line switch to disable this feature. Sending it to the internal() queue, with serverity=alert or crit, sounds good. To me, it is important to get the notification about dropped messages immediately, because it requires some reaction. Maybe with a 'maximum notifications per minute' brake to avoid race conditions or as "minimal notification time distance" implemented as a time stamp when the last emergency message was emitted. -- Volker Apelt Group of Prof. Dr. Ch. Griesinger Dipl. Chem. Johann Wolfgang Goethe Universitat +49 6172 31126 Frankfurt am Main, Germany va .@. org.chemie.uni-frankfurt.de (remove the dots, please) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]Full pipe as destination
by Andreas Schulze 23 Aug '01

23 Aug '01

Dear Bazsi, Brad Arlt schrieb: > On Tue, Aug 21, 2001 at 02:16:09PM +0200, Balazs Scheidler wrote: > > On Tue, Aug 21, 2001 at 01:26:27PM +0200, Peter Draexler wrote: > > > Peter Draexler schrieb: > > > > > > > Dear Bazsi, > > > > thank you for your info. This should help. > > > > Nevertheless, does syslog-ng log somewhere if it discards events or do you know > > > > another way to check this? > > > > This would be important to adapt log_fifo_size. Currently we only observe by > > > > chance that we lose information. > > > > logs are silently dropped in this case. I was thinking of implementing some > > kind of automatic statistics message to report log losses, but that would > > race against normal log traffic. do you have a better idea. statistics are a very good idea and for many syslog-ng users its important to know as most as possible about messages dropped (for which destination, etc.), messages transfered by source ond/or destination and something more. I think the discussions about possible log destinations hasn't the real impact in this context. as you say its important that we prevent the daemon from stucks in-active with its internal statistics stuff. the real problem here is, to implement the output method of the stat. informations. but answer the following question: "is it really mandatory to realize a continuous output of statistical informations?" I think not. decide to which logging destination the stats should be send. I think the internal() log source is a better choice than brad's "oh shit!" file, because we keep save the flexibility of syslog-ng's rule-based flow control. but a separate log is ok. but don't send the stats continuously to internal(). do this e.g. at midnight for the last 24h. realize a command line switch to disable this feature. if 24h is to long, implement a signal handler for e.g. SIGUSR1|2 that activates the stats output. so its possible for each user to decide the time on which he likes stats by sending a SIGUSR? to the daemon. > A single message saying "log queue full" written to the syslog facilty > at emerg would due it. And rather than compete have it win the race > always. Since we are already losing messages, it is more important > that we know we are losing messages than to know what messages have > been lost (if that makes sense). > > One could also have a seperate "oh shit!" log file that only gets > written to by syslog-ng internals and not through standard mechanisms. > A non-blocking write(2) could be used to ensure that these messages > didn't impeed on other logging (much). thx. for your help best regards -- ASL

2 1

RE: [Fwd: [syslog-ng]Full pipe as destination]
by Andrew Fort 22 Aug '01

22 Aug '01

>One could also have a seperate "oh shit!" log file that only gets >written to by syslog-ng internals and not through standard mechanisms. >A non-blocking write(2) could be used to ensure that these messages >didn't impeed on other logging (much). I prefer this option also (despite its lack of elegance :), it's the most system independant and allows the sysad to stick a log watcher on it or whatever. Also because it avoids the in-band race issue.

1 0

[Fwd: [syslog-ng]Full pipe as destination]
by Peter Draexler 22 Aug '01

22 Aug '01

Peter Draexler schrieb: > Dear Bazsi, > thank you for your info. This should help. > Nevertheless, does syslog-ng log somewhere if it discards events or do you know > another way to check this? > This would be important to adapt log_fifo_size. Currently we only observe by > chance that we lose information. > Best regards Peter > > Balazs Scheidler schrieb: > > > On Tue, Aug 14, 2001 at 08:45:35AM +0200, Peter Draexler wrote: > > > Hi, > > > > > > We are using syslog-ng on our logserver with multifunctional > > > logforwarding. > > > As a special type of destination we are using pipes as a special > > > interface to commercial applications. > > > > > > Here is our question: > > > What happens with the log events, if the pipe becomes > > > temp. unavailable (e.g. the reading end is dead or > > > the pipe is full)? > > > > > > IMHO you have to open() the pipe nonblocking, to avoid your > > > syslog stucks in-active, in the case one destination is broken. > > > I think this is true. Correct? > > > > it's true. > > > > > > > > What happens with your internal log buffers, if write() returns -1 > > > and errno set to EAGAIN? > > > You implement an internal buffering/queue and try to write the > > > outstanding log events some times later or you simply discard > > > the buffers as long as one destination is unreachable? > > > > messages are queued up to the value of log_fifo_size, which IIRC can be set > > on a per-destination basis. if the fifo is full, messages are discarded. > > > > > > > > A Hint for syslog-ng.1.5.8 on Solaris 8: > > > $DATE in destination templates returns nothing. > > > But $FULL|ISODATE works fine. > > > > this seems to be fixed in my CVS tree, though it's not yet released. > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > -- > Dr. Peter Dräxler > mediaWays GmbH > Hülshorstweg 30 > 33415 Verl > Tel. +49-5246-80-1888 > Fax +49-5246-80-2888 > peter.draexler(a)mediaways.net > ------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2