- syslog-ng - lists.balabit.hu

circular logging & control structure based destination
by Shawn Davenport 20 Apr '01

20 Apr '01

Hey Folks, Can syslog-ng do circular logging? If you are wondering what I mean by that, I'm referring to writing messages to a file, and when the destination reaches a limit, old messages are removed so the new ones can hang around for a bit. The limit could be file size, message date or time, or something else perhaps. For my needs, I would love to set a file size limit. Say 20megs per destination file. Also the idea of having the destination be chosen through a control structure like an if/then statement is very appealing. The idea being, if destination A is available (network connection, file w/ X amount of disk space, etc) then log there, otherwise check destination B, or the next, and so on... Having the destination be able to change dynamically would be ideal. Unfortunately I don't have the c knowledge to make that happen, so the best thing I've come up with is through the use of a few different syslog-ng.conf files and some perl to watch network connections. Kind of messy... Thoughts, ideas, rude comments? Finding a way to do the first one, and better way for the second would be great! Thanks... Shawn

3 2

Re: [syslog-ng]1.4.11 fixes SIGHUP problems?
by John_Delisle＠ceridian.ca 18 Apr '01

18 Apr '01

I'm not sure thats a bug, it may be a feature actually. If you look at /var/log/messages, theres an entry saying the new config is bad, and syslog-ng will continue running with the old config. This prevents lost syslog messages. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 jon(a)dumbo.pobox.com Sent by: To: syslog-ng(a)lists.balabit.hu syslog-ng-admin@lists. cc: balabit.hu Subject: Re: [syslog-ng]1.4.11 fixes SIGHUP problems? 2001/03/12 11:21 AM Please respond to syslog-ng i noticed one problem. if the configuration file is broken to the point syslog-ng will not start, HUP does not notice this ie. if you forget a semicolon somewhere kill -HUP syslog-ng-pid works w/o erros but kill syslog-ng-pid and syslog-ng dies... y On Fri, Mar 09, 2001 at 10:01:08AM +0100, Balazs Scheidler wrote: | Hi, | | I was wondering whether the 1.4.11 release did really fix the SIGHUP | problems many of you encountered? Some feedback would be useful. | | TIA, | -- | Bazsi | PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 | | _______________________________________________ | syslog-ng maillist - syslog-ng(a)lists.balabit.hu | https://lists.balabit.hu/mailman/listinfo/syslog-ng _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

6 7

Re: [syslog-ng]Linefeed in incoming messages
by Michael.Garvin＠carolinabroadband.com 18 Apr '01

18 Apr '01

> On 0, Balazs Scheidler <bazsi(a)balabit.hu> inscribed onto the electric medium... > > My question is, is there somewhere in the syslog-ng code where I can > > easily parse the incoming syslog message and replace linefeeds with > > something benign, such as spaces or tabs? Or is there another solution > > that would be better? In the meantime we're opening a bug with the > > vendor since I consider this their issue, but knowing vendors I'm not > > confident in their addressing the problem quickly. > > Vendor == cisco, perhaps? Not to name names, but... Yes. :-) One of their acquisitions to be precise. > > linefeeds take an important role in syslog messages, they terminate them. So > > I disagree. > > I just had to track this one down myself; the cisco vpn concentrator > is logging stuff with embedded newlines. The RH linux box was logging > the whole messages, but the Irix box wasn't. Hence clearly the > linefeed doesn't have any true bearing on the length of the syslog > message; it should be determined by the length of the incoming > message. Any imbedded newlines should be ignored; translated to > spaces (as the linux syslog does) or ^M (as the [patched] irix syslog > does.) Deja vu... This is exactly what we were running into. There's now an open TAC case with Cisco on it, since I call it a bug on their part. I'd tend to agree with Balazs on this point, to which end I added code to remove all but the final linefeed before processing. In 'src/sources.c' (I've included the existing line before and after for reference): closure->pos += n; start = closure->buffer; eol = closure->buffer + closure->pos; while (start++ < eol) if (start[-1] == '\n') start[-1] = ' '; eol = memchr(closure->buffer, '\0', closure->pos); It's not pretty, but so far it's gotten the job done. > "Be gracious in what you accept, and conservative in what you send." > (paraphrased sendmail quotation.) > > There's no RFC on syslog messages, is there? The Irix syslogd traces > its route all the way back to BSD 4.2, and the check that terminated > parsing when it hit a newline had been in there from the beginning. No, but there is a task force working on one if I recall. Better late than never? Thanks for the assistance, I think this is taken care of.

1 0

Re: [syslog-ng]Linefeed in incoming messages
by todd.glassey＠att.net 18 Apr '01

18 Apr '01

B-Man - one easy fix is to send the message length as an optional flag to the system, that is if this could be added to the "offensive piece of networking equipment". Then if the LF is detected before the EOM count is reached then there is some residual processing that this message will need , whatever that is. T. -- Regards, Todd > > My question is, is there somewhere in the syslog-ng code where I can > > easily parse the incoming syslog message and replace linefeeds with > > something benign, such as spaces or tabs? Or is there another solution > > that would be better? In the meantime we're opening a bug with the > > vendor since I consider this their issue, but knowing vendors I'm not > > confident in their addressing the problem quickly. > > linefeeds take an important role in syslog messages, they terminate them. So > syslog-ng takes its input packet, splits it by linefeeds and splits each of > these parts as separate messages. As you see it would be difficult to skip > processing linefeed characters because it would broke other syslog clients. > You may try looking around the function do_read_line() in sources.c and > change it the way that fits you, or wait for your vendor to fix the problem. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Linefeed in incoming messages
by Michael.Garvin＠carolinabroadband.com 18 Apr '01

18 Apr '01

We have a piece of network equipment which appears to be logging in a not entirely friendly fashion (to be politically correct), in that it is including a linefeed (0x0a ASCII hex) in log messages for formatting purposes. Unfortunately, from what I can tell syslog-ng 1.4.11 is getting confused with the linefeed, so the log message up to the linefeed is getting logged correctly but the part after the linefeed is being prepended to the next incoming message. Therefore the filter for this unit is applied to the first part, resulting in it being written to its file, but the filter for the next message is applied to the remainder (the next message plus the prepended remainder from the previous). (Yes, I know it's confusing, I've just spent a while tracking it down. I can provide additional detail if needed...) My question is, is there somewhere in the syslog-ng code where I can easily parse the incoming syslog message and replace linefeeds with something benign, such as spaces or tabs? Or is there another solution that would be better? In the meantime we're opening a bug with the vendor since I consider this their issue, but knowing vendors I'm not confident in their addressing the problem quickly. Thanks for any help... And thanks for syslog-ng! -- Michael Garvin mailto:mgarvin@carolinabroadband.com

3 2

Can't send log to destination machine
by Rodrigo Pace de Barros 17 Apr '01

17 Apr '01

Hi... that's my problem... I can generate logs and store them in the local machine, but when i try to configure the syslog-ng.conf with the DESTINATION sending the results to other machine, this doesn't work.... I've tried this in the syslog-ng.conf: destination log_host { udp (ip(xxx.xxx.xxx.xxx) port(xxxxx));}; and destination log_host { udp xxx.xxx.xxx.xxx,xxx }; |-------------| |-| IP Port How can i do that? Are them both incorrect? (or no?) Thank's for your help! Best regards... -- ---------------------- Rodrigo Pace de Barros - pace(a)acme-ids.org ---------------------- Acme! - Advanced Counter-measures Environment Computer Security Research Ciencia da Computacao - Unesp - S. J. Rio Preto - Brasil ----------------------

2 1

Compiling in Socksification with Syslog-ng
by Matt Weatherford 15 Apr '01

15 Apr '01

Forgive me if this is a faq, but has any one out there compiled in socksification with Syslog ng? Any pointers or gotchas or discussions of "where the landmines are buried" would be helpful... thanks, Matt

1 0

chmod() and template escaping for pipes
by Balazs Scheidler 14 Apr '01

14 Apr '01

Hi, The patch below adds chmod() calls for created directories and files so they are created with modes independent from the current umask. The other change adds the template-escape() option for pipes. This will be integrated into the next release. Index: affile.c =================================================================== RCS file: /var/cvs/syslog-ng/src/affile.c,v retrieving revision 1.35 diff -u -r1.35 affile.c --- affile.c 2001/03/30 15:02:31 1.35 +++ affile.c 2001/04/14 07:56:51 @@ -78,6 +78,7 @@ if (mkdir(name->data, dir_mode) == -1) return 0; chown(name->data, dir_uid, dir_gid); + chmod(name->data, dir_mode); } *p = '/'; p = strchr(p + 1, '/'); @@ -85,6 +86,7 @@ *fd = open(name->data, flags, mode); } chown(name->data, uid, gid); + chmod(name->data, mode); return *fd != -1; } Index: cfg-grammar.y =================================================================== RCS file: /var/cvs/syslog-ng/src/cfg-grammar.y,v retrieving revision 1.41 diff -u -r1.41 cfg-grammar.y --- cfg-grammar.y 2001/03/30 15:02:31 1.41 +++ cfg-grammar.y 2001/04/14 07:56:51 @@ -398,6 +398,7 @@ | KW_GROUP '(' string ')' { affile_set_group(last_dest_driver, $3); free($3); } | KW_PERM '(' NUMBER ')' { affile_set_perm(last_dest_driver, $3); } | KW_FILE_TEMPLATE '(' string ')' { affile_set_file_template(last_dest_driver, $3); free($3); } + | KW_TEMPLATE_ESCAPE '(' yesno ')' { affile_set_template_escape(last_dest_driver, $3); } ; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

syslog-ng problem description(again)
by Bencsath Boldizsar 13 Apr '01

13 Apr '01

So the exact problem was the following, who missed it: syslog-ng doesn't start if a unix socket soruce exists in the config file ( source src { unix-stream("/dev/log"); internal(); file("/proc/kmsg"); }; ) strace: [pid 14144] unlink("/dev/log") = -1 ENOENT (No such file or directory) [pid 14144] bind(4, {sin_family=AF_UNIX, path=" /dev/log"}, 110) = -1 EPERM (Operation not permitted) (Apr 12 19:02:24 db rsbac_adf_request_rc(): rsbac_get_attr() returned error -1017! Apr 12 19:02:24 db rsbac_adf_request(): request READ_WRITE_OPEN, caller_pid 15361, caller_prog_name syslog-ng, caller_uid 0, target-type IPC, tid ???-ID 134521299, attr sockaddr, value 3437575888, result NOT_GRANTED by RC) Two problems: why has the bind command 110 bytes path attribute, why not only "/dev/log". But: However why does rsbac stops at such ipc requests. workaround: delete unix-stream from the syslog-ng config file. problem on: 2.4.3+rsbac 1.2.1 pre 1 , 1.1.1, no problem on emergency kernel (I'm not really sure cause at one boot it said there is some problem but after that it worked) with: syslog-ng (potato,unstable) in debian, and syslog-ng 1.4.11 and 1.5.5a from source boldi

2 3

reopening of udp connections
by klaas.vangend＠philips.com 13 Apr '01

13 Apr '01

Hi, We use syslog-ng to log messages from our Linux PC to one or more Windows NT PCs running a propriatary tool to display and maintain log and statistics information of a Linux app. Approx every second a log message is sent using UDP. Unfortunately, if the NT log application is not running, the NT box returns an ICMP message, stating that the chosen UDP port number is not listened to. Then syslog-ng pauses sending UDP logs, and retries after 60 seconds. It also logs a message stating that the UDP connection was broken. (which isn't true because UDP doesn't create connections) If succesfull, it then sends all (?) accumulated log messages at once. If our NT app starts immediately after syslog-ng paused, we don't receive any logging for 59 seconds... This is unwanted behaviour for our system. I know that I can have syslog-ng retry more often, but I don't want retries. Every UDP packet should "just disappear" if not delivered, and every packet should be sent anyway, thus having "below second" responsetime. (This is what happens if NT didn't return those darn ICMP messages). How should I proceed? -- Groetjes, Klaas --------------------------------------------------------------------- Philips CryptoWorks 040-2722600 klaas.vangend(a)philips.com Sioux Technische Software Ontwikkeling BV 040-2677100 klaas.van.gend(a)sioux.nl

2 1

Re: question
by Balazs Scheidler 13 Apr '01

13 Apr '01

On Thu, Apr 12, 2001 at 04:03:08PM -0400, Andrew Ryder wrote: > Any planned support for injection into mysql logs? you could use the tamplate feature in 1.5.5 and pipes: destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO log (date, host) VALUES ('$YEAR-$MONTH-$DAY', '$HOST')\n") template-escape(yes) }; and run mysql client reading sql from the pipe: mysql -h <host> LOG < /tmp/mysql.pipe of course the pipe should be located some protected directory with appropriate permissions. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

log statement parsing
by John_Delisle＠ceridian.ca 12 Apr '01

12 Apr '01

Hi guys, Anyone know how syslog-ng handles the log statements when you have two log statements that would apply? I think this will make more sense after looking at the example. source s_src { unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514));}; destination d_messages { file("/var/log/messages"); }; destination d_test { file("/var/log/test"); }; filter f_test { host("testhost"); }; filter f_local7 { facility(local7); }; log { source(s_src); filter(f_test); filter(f_local7); destination(d_test); }; log { source(s_src); filter(f_local7); destination(d_messages); }; Would messages sent from host "testhost" with facility local7 go to just the first or both logs? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

2 1

Logrotate problems
by Simeon Johnston 12 Apr '01

12 Apr '01

I am trying to rotate the logs but am having problems with logrotate. This may not be a problem with syslog-ng. This is the command used. /var/log/logfile { postrotate /usr/bin/killall -HUP `cat /var/run/syslog-ng.pid` endscript } The problem with this is that the syslog-ng.pid file seems to be generated in whatever directory you started syslog-ng from instead of /var/run/*. Is this a configuration problem of the system? If a system problem how do I go about fixing it ( if this is not too far off topic )? Is there a simpler way to send an HUP signal? I am using Redhat-6.2 on an ALPHA with syslog-ng 1.4.11. Thanks, sim

2 3

Re: [syslog-ng]umask/perm (was: Re: One last try...)
by John_Delisle＠ceridian.ca 12 Apr '01

12 Apr '01

I take it that means it doesn't work yet? I'm not complaining, I love syslog-ng, but that should be in the release notes! =) John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 |--------+--------------------------------> | | Balazs Scheidler | | | <bazsi(a)balabit.hu> | | | Sent by: | | | syslog-ng-admin(a)lists.| | | balabit.hu | | | | | | | | | 2001/04/12 08:30 AM | | | Please respond to | | | syslog-ng | | | | |--------+--------------------------------> >-----------------------------------------------------------------------------------------------------------| | | | To: syslog-ng(a)lists.balabit.hu | | cc: | | Subject: Re: [syslog-ng]umask/perm (was: Re: One last try...) | >-----------------------------------------------------------------------------------------------------------| > > destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) > > create_dirs(yes) dir_perm(0755)); }; > > > > When it creates them instead of being 755 and 644, they are 700 and 600. > > > > Can anyone help? Is this a known issue? Has anyone got it working > > correctly? How is syslog-ng changing the perms, maybe I'm missing some > > system call or something! I'm open to suggestions/tips!! > > has explicit setting of modes ((f)chmod() vs. open() with mode_t) made > it into the source yet? nope. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

1 0

umask/perm (was: Re: One last try...)
by Gregor Binder 12 Apr '01

12 Apr '01

John_Delisle(a)ceridian.ca on Tue, Apr 10, 2001 at 03:09:51PM -0500: Hi everybody, > destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) > create_dirs(yes) dir_perm(0755)); }; > > When it creates them instead of being 755 and 644, they are 700 and 600. > > Can anyone help? Is this a known issue? Has anyone got it working > correctly? How is syslog-ng changing the perms, maybe I'm missing some > system call or something! I'm open to suggestions/tips!! has explicit setting of modes ((f)chmod() vs. open() with mode_t) made it into the source yet? Regards, -- Gregor Binder <gregor.binder(a)sysfive.com> http://sysfive.com/ sysfive.com GmbH UNIX. Networking. Security. Applications. PGP id: 0x20C6DA55 fp: 18AB 2DD0 F8FA D710 1EDC A97A B128 01C0 20C6 DA55

2 1

Re: syslog-g and bsdi
by Balazs Scheidler 11 Apr '01

11 Apr '01

> I was wondering if anyone has a compatible function to replace strptime. > this is a function that is not included in BSDI (4.0+ a least) > if no one has coded a replacement, i would be willing to add another patch > to fix it. > otherwise, you should take off "this has been compiled for bsdi" on the I was wondering if you tried compiling syslog-ng 1.5 which included such a compatibility strptime() function. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

Linux boxes periodically stop logging?
by James Snow 10 Apr '01

10 Apr '01

I apologize for the lack of technical detail in this post, but, for the moment I'm just trying to ascertain if I or my syslog-ng config are on drugs. Basically, I have a mixed array of Linux (RedHat 6.2 & 7) and FreeBSD (4.2-S) machines on which I'm running syslog-ng and logging to a central host. (FreeBSD 4.2-S) The problem is that the Linux boxes periodically stop logging. If I send the daemon a HUP, it comes back to life and data starts flowing again, but any log messages that would have appeared while the daemon was hosed are gone. Has anyone experienced anything like this before? Thanks in advance, -Snow

4 4

odd problem
by jon＠dumbo.pobox.com 10 Apr '01

10 Apr '01

i noticed yesterday that syslog-ng won't log to anything in a destination() section if one of them fails. we have a remote logging machine colocated somewhere...here is its config(just the useful stuff) destination macrogenerateddaily { tcp(208.210.124.50 port(514)); file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" dir_per m(0755) perm(0644)); }; destination macrogeneratedhourly { tcp(208.210.124.50 port(514)); file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY.$HOUR" d ir_perm(0755) perm(0644)); }; now....we lost internet connectivity (so the tcp link failed) unfortunately, it also stopped logging to the disk. does it log to destinations, then just die as soon as one fails?

4 6

error connecting to hosts
by Mariusz Bogumil 09 Apr '01

09 Apr '01

My syslog-ng generates me a lot of errors: Error connecting to remote host ( xxx.xxx.xxx.xxx) reatempting in 60 seconds Everything to be OK - only these starnge arrors. All generated massages are handled. I send then to remote host via TCP. I use Sol.2.6 Any suggestions??? Regards marbo

1 0

Re: [syslog-ng]perm and dir_perm not working?
by John_Delisle＠ceridian.ca 06 Apr '01

06 Apr '01

I should mention I've tried this running syslog-ng 1.4.10, 1.4.11, 1.5.5a. On linux kernel 2.4.1, gcc 2.95.2, glibc 2.2. Any help would be greatly appreciated!! John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 |--------+--------------------------------> | | John_Delisle(a)ceridian.| | | ca | | | Sent by: | | | syslog-ng-admin(a)lists.| | | balabit.hu | | | | | | | | | 2001/04/06 10:49 AM | | | Please respond to | | | syslog-ng | | | | |--------+--------------------------------> >-----------------------------------------------------------------------------------------------------------| | | | To: syslog-ng(a)lists.balabit.hu | | cc: | | Subject: [syslog-ng]perm and dir_perm not working? | >-----------------------------------------------------------------------------------------------------------| Hi all, I've been trying without any luck to have syslog-ng create dirs with 755 and files with 644 permissions. I've used the following line: destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) create_dirs(yes) dir_perm(0755)); }; But they are created with the permissions from my umask (022). ie files are 600, not 644. Is this a known issue? Is there a workaround? Any ideas?? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

perm and dir_perm not working?
by John_Delisle＠ceridian.ca 06 Apr '01

06 Apr '01

Hi all, I've been trying without any luck to have syslog-ng create dirs with 755 and files with 644 permissions. I've used the following line: destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) create_dirs(yes) dir_perm(0755)); }; But they are created with the permissions from my umask (022). ie files are 600, not 644. Is this a known issue? Is there a workaround? Any ideas?? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

2 1

Syslog Logging Delay
by Brian E. Seppanen 06 Apr '01

06 Apr '01

Here it stops again at approx 10:44 a.m. EST. Again UDP:514 is 65550. Packets are still coming. No logging. Tried logging via logger and no messages. 10:53 a.m. EST it starts again. vmstat doesn't indicate much disk activity blocking either in or out either before or after. After it picks up again the messages I logged via logger are logged. Utilization on the box is pretty steady. Swap neither grows, nor diminishes. Memory is used for the most part, maybe about 10MB free. Lots of shared memory. Graphs show loopback at 10:45 is quite active comparitively. This is from a dump of an rrdtool database monitoring loopback utilization. This doesn't correlate to other times when I've seen the problem though, specifically when it stopped logging at 10:10 p.m. EST. Normall readings for the graph are around 2.e+01.  <row><v> 2.8297444075e+01 </v><v> 2.8297444075e+01 </v></row>  <row><v> 5.7677917503e+01 </v><v> 5.7677917503e+01 </v></row>  <row><v> 9.0888004719e+01 </v><v> 9.0888004719e+01 </v></row> POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN, revents=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 6000) = 1 recvfrom(5, "<133>559901: 4w3d: %UBR7200-5-MA"..., 1024, 0, {sin_family=AF_INET, sin_port=htons(49364), sin_addr=inet_addr("24.247.48.35")}}, [16]) = 163 time(NULL) = 985880402 time(NULL) = 985880402 time(NULL) = 985880402 time(NULL) = 985880402 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 1 write(7, "Mar 29 10:40:02 24.247.48.35 559"..., 188) = 188 time(NULL) = 985880402 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 17, 4000) = 1 read(3, I don't know. Nothing to correlate it to stopping at 10:10:00 p.m. EST last night though... I'm just not seeing anything that sticks out to indicate where a problem might be. Can someone who is running a central logging server indicate how they have configured syslog-ng, as far as log_fifo_size, garbage collection options, number of objects alive at any one time after running for a while, sync options? I would appreciate it, greatly. Thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

3 12

RE: [syslog-ng]Cisco Logging
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 06 Apr '01

06 Apr '01

Richard, syslog-ng does a considerably better job at filtering than does syslogd. This can cause you problems if you are not looking at it correctly. syslogd will log up to a priority for a facility in the syslog.conf. syslog-ng will log only that facility given in the syslog-ng.conf. Cisco devices log at the info level by default. So only if you are getting something from the Cisco devices at the debug level. If you want the same behavior as in syslogd you need to set your filter to "priority(info..debug)". Regards, Drew > -----Original Message----- > From: Shaw, Richard W [SMTP:Richard.W.Shaw@team.telstra.com] > Sent: Friday, April 06, 2001 9:50 AM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: [syslog-ng]Cisco Logging > > Hi Guys > > I've just found syslog-ng and am testing/comparing it to our current > syslogd > so I can match the logging then push everything to a syslog server. > > My problem is that I'm getting no logs for Cisco devices, I don't even get > anything in the sys.log file(see below): > > syslogd.conf file : > local7.debug /var/log/cisco.log > > syslog-ng.conf file: > source src { > udp(); > tcp(); > sun-streams("/dev/log" door("/etc/.syslog_door")); > internal(); > }; > destination d_mail { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/mail.log" > create_dirs(yes) > ); }; > destination d_cisco { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/cisco.log" > create_dirs(ye > s)); }; > destination d_sshd { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sshd.log" > create_dirs(yes > )); }; > destination d_tac { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/tacplus.log" > create_dirs(y > es)); }; > > destination d_sys { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sys.log" > create_dirs(yes)) > ; }; > > filter f_mail { facility(mail); }; > filter f_cisco { facility(local7) and priority(debug); }; > filter f_sshd { match("sshd"); }; > filter f_tac { facility(local6); }; > > log { source(src); filter(f_mail); destination(d_mail); }; > log { source(src); filter(f_cisco); destination(d_cisco); }; > log { source(src); filter(f_sshd); destination(d_sshd); }; > log { source(src); filter(f_tac); destination(d_tac); }; > > > log { source(src); destination(d_sys); }; > > > Thanks in advance for any help > > Regards > Richard Shaw > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Cisco Logging
by Shaw, Richard W 06 Apr '01

06 Apr '01

Hi Guys I've just found syslog-ng and am testing/comparing it to our current syslogd so I can match the logging then push everything to a syslog server. My problem is that I'm getting no logs for Cisco devices, I don't even get anything in the sys.log file(see below): syslogd.conf file : local7.debug /var/log/cisco.log syslog-ng.conf file: source src { udp(); tcp(); sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination d_mail { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/mail.log" create_dirs(yes) ); }; destination d_cisco { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/cisco.log" create_dirs(ye s)); }; destination d_sshd { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sshd.log" create_dirs(yes )); }; destination d_tac { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/tacplus.log" create_dirs(y es)); }; destination d_sys { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sys.log" create_dirs(yes)) ; }; filter f_mail { facility(mail); }; filter f_cisco { facility(local7) and priority(debug); }; filter f_sshd { match("sshd"); }; filter f_tac { facility(local6); }; log { source(src); filter(f_mail); destination(d_mail); }; log { source(src); filter(f_cisco); destination(d_cisco); }; log { source(src); filter(f_sshd); destination(d_sshd); }; log { source(src); filter(f_tac); destination(d_tac); }; log { source(src); destination(d_sys); }; Thanks in advance for any help Regards Richard Shaw

1 0

perm() and dir_perm()
by John_Delisle＠ceridian.ca 04 Apr '01

04 Apr '01

Hi everyone! I'm having issues getting perm() and dirperm() working. Here is my destination line: destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) create_dirs(yes) dir_perm(0755)); }; The files are created with 600, and dirs with 700. Any ideas? My umask is 022. I've tried adjusting the above values (I added 22 to them) and it didn't make a difference. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

1 0