- syslog-ng - lists.balabit.hu

AIX compatability issue?
by John_Delisle＠ceridian.ca 23 Feb '01

23 Feb '01

Hi, I'm running a central syslog-ng server with the following syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source s_remote { udp(ip(0.0.0.0) port(514)); }; destination d_mesg { file("/var/log/messages"); }; destination d_powerpay { file("/var/log/powerpay"); }; filter f_powerpay { facility(local1); }; log { source(s_sys); destination(d_mesg); }; log { source(s_remote); filter(f_powerpay); destination(d_powerpay); }; log { source(s_remote); destination(d_mesg); }; I have serveral AIX servers that don't seem to get logged. I'm sending messages with facility set to local1. If I comment out the second log line above I get messages from the AIX servers to my messages file. When I enable the second log line as it is above I get nothing. I've tested sending messages from other platforms with facility set to local1 and they get logged in the correct file as expected. Any ideas? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909

2 1

RE: [syslog-ng]Trying to send log over network
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 23 Feb '01

23 Feb '01

Thanks, Bazsi. I wasn't paying attention to what I was writing.... Drew > -----Original Message----- > From: Balazs Scheidler [SMTP:bazsi@balabit.hu] > Sent: Thursday, February 22, 2001 12:13 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Trying to send log over network > > > What is the address of your loghost and the address of the clients? I'm > > looking at your two configs and I want to make sure that the destination > for > > the problem machine is ok. Do you have a 192.168.1.19 host on your > network > > and is it listening for tcp connections on port 514? In the loghost > config > > you reference a source of 192.168.1.1 which tells me that your loghost > is > > 192.168.1.1. If you are trying to establish a connection to a host > using > > the tcp/ip you also need to make sure that the host is listening for > tcp/ip > > connections. The loghost config is listening for tcp/ip on 192.168.1.1 > port > > 10001 and you are trying to make a tcp connection with 192.168.1.19 on > port > > 514. Is this what you are intending, if so this won't work. Change > your > > destination in your client to read destination d_bg > > {tcp("192.168.1.1:10001") }; That should at least let you log to that > > loghost. > > > destination d_bg { tcp("192.168.1.19:514"); }; > > destination tcp drivers should look like this: > > destination d_bg { tcp("192.168.1.19" port(514)); }; > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Destination Not Working
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 23 Feb '01

23 Feb '01

I haven't looked at the docs recently but it is my understanding, and someone here can point it out if I am wrong, but match is used for matching on the message part of the log line. It doesn't match on the host. Instead use filter cisco-ubr2 { host("192.168.1.2); }; Regards, Drew > -----Original Message----- > From: Brian E. Seppanen [SMTP:seppy@chartermi.net] > Sent: Friday, February 23, 2001 2:08 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Destination Not Working > > I have several routers set up to log to a central host. All of them work > without issue. I have the following destination, set up. > > destination blah.cisco { file("/var/log/cisco/blah-cisco.$PRIORITY" > owner("admin") group("apache") perm(0640));}; > > and the following filter > > filter cisco-ubr2 { match("192.168.1.2");}; > > Which is supposed to log as follows > > log { source(udp_src); filter(cisco-ubr2); destination(blah.cisco);}; > > I get no errors, but the following is logging to /var/log/messages which > is my default. > > Feb 22 13:50:05 192.168.1.2 120: 00:18:04: %UBR7200-5-UNREGSIDTIMEOUT: > > the udp_src is working for every other router, as are the filters and > destinations. This is the only one that isn't working. > > This one has confused me for some time, any ideas greatly appreciated. > > > Brian Seppanen > Charter Communications > Regional Data Center 906-228-4226 ext 23 > Marquette, MI seppy(a)chartermi.net > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Destination Not Working
by Brian E. Seppanen 23 Feb '01

23 Feb '01

I have several routers set up to log to a central host. All of them work without issue. I have the following destination, set up. destination blah.cisco { file("/var/log/cisco/blah-cisco.$PRIORITY" owner("admin") group("apache") perm(0640));}; and the following filter filter cisco-ubr2 { match("192.168.1.2");}; Which is supposed to log as follows log { source(udp_src); filter(cisco-ubr2); destination(blah.cisco);}; I get no errors, but the following is logging to /var/log/messages which is my default. Feb 22 13:50:05 192.168.1.2 120: 00:18:04: %UBR7200-5-UNREGSIDTIMEOUT: the udp_src is working for every other router, as are the filters and destinations. This is the only one that isn't working. This one has confused me for some time, any ideas greatly appreciated. Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

1 0

syslog-ng and libol rpms
by Seth Vidal 22 Feb '01

22 Feb '01

Hi folks, I rebuilt the syslog-ng 1.4.10 and libol 0.2.20 rpms under rh 7 - I also added a syslog-ng init script that starts klogd as well. I used some of the default spec that came with syslog-ng and some of my own. Just thought someone might find these useful. i386 and srpms are here: http://www.dulug.duke.edu/~skvidal/syslog-ng/ if anyone has any suggestions on ways to improve the spec files or the init script let me know. thanks -sv -- The old "give 'em a Linux box and they think they're Jean-Luc Picard" syndrome. -A.S.R

1 0

using the program() destination to send mail
by John_Delisle＠ceridian.ca 22 Feb '01

22 Feb '01

Has anyone got some code handy that can send email when a specific error is logged? Ideally I'd like to mail an admin with the hostname, error, etc. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909

1 0

RE: [syslog-ng]Trying to send log over network
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 21 Feb '01

21 Feb '01

1. No syslog-ng runs as its own daemon. Works much better this way. 2. If the answer to 1 was yes it would make a difference. But since it isn't then no. 3. Could you post a sample of your config file? That might be helpful. Also could you post part of your strace results? That would at least give us info on where to look for your problem. Random thoughts...do you have some sort of port monitor that could be blocking your default ports? I have seen that before. Regards. Drew > -----Original Message----- > From: Simeon Johnston [SMTP:simeonuj@eetc.com] > Sent: Tuesday, February 20, 2001 11:26 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Trying to send log over network > > I used strace although I didn't get much out of it. I have never used it > before. > I think that it is not being allowed to initiate a connection or it is > trying but > is not allowed to connect to the logserver so it stops. I have a few more > questions. > 1. Does syslog-ng need an entry in the inetd/xinetd configuration? I > didn't see > anything about it in the manual. > 2. Would this disallow any information from getting through if there > wasn't an > entry? > 3. Any other thoughts? > > Any help would be appreciated. > > sim > > > Balazs Scheidler wrote: > > > On Wed, Feb 14, 2001 at 10:07:51AM -0600, Simeon Johnston wrote: > > > I put the new rule in and it didn't give any errors when I started it. > But > > > there seems to be another problem. I don't know why but it looks like > the > > > daemon doesn't even start. I restart it with the bootup script and > everything > > > appears to run OK but then I do a "ps ax" and the process isn't there. > I then > > > start it manually and it gives me this error. > > > > > > Error creating AF_INET socket (Success) > > > Error initializing configuration, exiting. > > > > > > What is this? > > > > a truss or strace output should help you out here. > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

6 6

DNS Caching
by Gaël Roualland 21 Feb '01

21 Feb '01

Hello, We've been using syslog-ng here for a while as a remote loghost for several high-volume servers and the loghost would stay at a high load and often lose some log lines. We have name resolution enabled and it turned out to be one of the big performance hit. Using a local DNS cache together with nscd and name service files tuning made things a lot better but syslog-ng was still spending lots of time doing reverse name resolution. So I tried to add a simple DNS caching code to syslog-ng itself, and it really improved the overall performance : the syslog-ng process now uses between 10 to 20% of cpu time, whereas it used to be around 100%. As this is an issue that could affect many users, it might be a good idea to have this feature in syslog-ng (maybe as an option ?). The attached patch is my implementation of it. The algorithm used is quite simple (flat fixed-size hash, with refresh and aging) and should be sufficient regarding the fact that a loghost will probably always lookup the same set of hosts. I'd be glad to know what you think of it and if it can be intregated in the main release (it might need some work to fit nicer than now). Gaël. -- Gaël Roualland -+- gael.roualland(a)oleane.net diff -ruN syslog-ng-1.4.10/src/Makefile.am syslog-ng-1.4.10.nscache/src/Makefile.am --- syslog-ng-1.4.10/src/Makefile.am Wed Nov 29 12:04:29 2000 +++ syslog-ng-1.4.10.nscache/src/Makefile.am Mon Feb 19 19:11:59 2001 @@ -65,6 +65,7 @@ afuser.c \ afstreams.c \ afprogram.c \ + nscache.c \ utils.c \ syslog-names.c diff -ruN syslog-ng-1.4.10/src/main.c syslog-ng-1.4.10.nscache/src/main.c --- syslog-ng-1.4.10/src/main.c Wed Nov 29 12:04:29 2000 +++ syslog-ng-1.4.10.nscache/src/main.c Mon Feb 19 19:17:56 2001 @@ -29,6 +29,7 @@ #include "format.h" #include "werror.h" #include "queue.h" +#include "nscache.h" #include <sys/types.h> #include <sys/wait.h> @@ -144,7 +145,8 @@ signal(SIGHUP, sig_hup); signal(SIGTERM, sig_term); signal(SIGCHLD, sig_child); - + nscache_init(); + while (io_iter(&backend->super)) { if (exit_main_loop) break; @@ -156,6 +158,10 @@ } notice("SIGHUP received, restarting syslog-ng\n"); + + nscache_flush(); + nscache_init(); + restarting = 1; backend->newconfig = make_syslog_config(cfgfilename, &backend->super); diff -ruN syslog-ng-1.4.10/src/nscache.c syslog-ng-1.4.10.nscache/src/nscache.c --- syslog-ng-1.4.10/src/nscache.c Thu Jan 1 01:00:00 1970 +++ syslog-ng-1.4.10.nscache/src/nscache.c Mon Feb 19 19:12:09 2001 @@ -0,0 +1,134 @@ +#include <netdb.h> +#include <netinet/in.h> +#include <arpa/inet.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <time.h> +#include "nscache.h" + +/* Simple NS cache, using a flat hash table (NOT thread safe). + * This is designed to be used with a fixed set of ip adresses. + * Inspired from similar caches in ippl, iplog... + * Gaël Roualland <gael.roualland(a)iname.com>, 2001. */ + +#define NSCACHE_SIZE 1000 +#define NSCACHE_EXPIRE 3600 +#undef NSCACHE_DEBUG + +struct nsentry { + struct in_addr addr; + char * name; + time_t used; + time_t created; +}; + +static struct nsentry * nscache = NULL; + +void nscache_init() { + int i; + + if (nscache != NULL) + nscache_flush(); + + if ((nscache = malloc(NSCACHE_SIZE * sizeof(struct nsentry))) == NULL) + return; + + for (i = 0; i < NSCACHE_SIZE; i++) { + nscache[i].addr.s_addr = INADDR_NONE; + nscache[i].name = NULL; + nscache[i].created = -1; + nscache[i].used = -1; + } +} + +void nscache_flush() { + int i; + + if (nscache == NULL) + return; + + for (i = 0; i < NSCACHE_SIZE; i++) { + if (nscache[i].name != NULL) + free(nscache[i].name); + } + + free(nscache); + nscache = NULL; +} + +static char * nsresolve(struct in_addr addr) { + struct hostent *host; + + if ((host = gethostbyaddr((char *) &addr, + sizeof(struct in_addr), + AF_INET)) != NULL && + host->h_name != NULL) + return strdup(host->h_name); + return NULL; +} + +char *nscache_lookup(struct in_addr in) { + int h, k, old, new; +#ifdef NSCACHE_DEBUG + int iter = 0; +#endif + time_t now = time(NULL); + time_t oldest = now; + + k = h = ntohl(in.s_addr) % (NSCACHE_SIZE - 1) + 1; + old = new = -1; + + do { + if (nscache[k].created > 0 && nscache[k].addr.s_addr == in.s_addr) { /* found it! */ + if (now - nscache[k].created >= NSCACHE_EXPIRE) { + /* entry has expired, update it */ +#ifdef NSCACHE_DEBUG + fprintf(stderr, "updating entry for %s...\n", inet_ntoa(in)); +#endif + if (nscache[k].name != NULL) + free (nscache[k].name); + nscache[k].name = nsresolve(in); + nscache[k].created = now; + } + nscache[k].used = now; +#ifdef NSCACHE_DEBUG + fprintf(stderr, "FOUND! %s <=> %s (%d iters)...\n", inet_ntoa(in), + nscache[k].name, iter); +#endif + return nscache[k].name; + } + if (nscache[k].created < 0 && new < 0) + new = k; /* use this to save new entry if not found */ + else { + if (nscache[k].used <= oldest) { + old = k; + oldest = nscache[k].used; + } + } + k = (h + k) % NSCACHE_SIZE; +#ifdef NSCACHE_DEBUG + iter++; +#endif + } while (k > 0); + + /* not found, add to cache */ + if (new < 0) { + /* no new entries ? use oldest. */ + if (old < 0) + old = 0; /* shouldn't happen.. */ +#ifdef NSCACHE_DEBUG + fprintf(stderr, "NOT FOUND! Replacing %s..\n", inet_ntoa(nscache[old].addr)); +#endif + if (nscache[old].name != NULL) + free(nscache[old].name); + new = old; + } +#ifdef NSCACHE_DEBUG + fprintf(stderr, "NOT FOUND! %s... (adding as %d)\n", inet_ntoa(in), new); +#endif + nscache[new].name = nsresolve(in); + nscache[new].created = nscache[new].used = now; + nscache[new].addr.s_addr = in.s_addr; + return nscache[new].name; +} diff -ruN syslog-ng-1.4.10/src/nscache.h syslog-ng-1.4.10.nscache/src/nscache.h --- syslog-ng-1.4.10/src/nscache.h Thu Jan 1 01:00:00 1970 +++ syslog-ng-1.4.10.nscache/src/nscache.h Mon Feb 19 19:12:11 2001 @@ -0,0 +1,8 @@ +#ifndef NSCACHE_H +#define NSCACHE_H + +void nscache_init(); +void nscache_flush(); +char * nscache_lookup(struct in_addr in); + +#endif diff -ruN syslog-ng-1.4.10/src/sources.c syslog-ng-1.4.10.nscache/src/sources.c --- syslog-ng-1.4.10/src/sources.c Wed Nov 29 12:04:29 2000 +++ syslog-ng-1.4.10.nscache/src/sources.c Mon Feb 19 19:14:20 2001 @@ -40,7 +40,7 @@ #undef CLASS_DEFINE #include "sources.c.x" - +#include "nscache.h" /* CLASS: (class (name log_reader) @@ -155,15 +155,13 @@ if (a && a->super.isa == &inet_address_info_class) { CAST(inet_address_info, inet_addr, a); - struct hostent *hp; char *hname, *p; - hp = usedns ? gethostbyaddr((char *) &(inet_addr->sa.sin_addr), sizeof(struct in_addr), AF_INET) : NULL; - if (!hp) { + hname = usedns ? nscache_lookup(inet_addr->sa.sin_addr) : NULL; + if (!hname) { return ol_string_use(inet_addr->ip); } else { - hname = hp->h_name; if (!usefqdn) { p = strchr(hname, '.'); if (p) *p = 0;

4 3

Trying to send log over network
by Simeon Johnston 20 Feb '01

20 Feb '01

I am trying to send logs over our network but am having trouble with the rules. I have set up a host to accept the logs and I am trying to set up the sender. This is the destination rule so far. destination d_bg { tcp(ip(192.168.1.19) port(514)); }; When I try to start syslog-ng it gives me this error. parse error at 31 Parse error reading configuration file, exiting. Line 31 is the above rule. This is the complete config of syslog-ng so far. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; destination d_cons { file("/var/log/ng/kern.log"); }; destination d_mesg { file("/var/log/ng/messages"); }; destination d_auth { file("/var/log/ng/secure"); }; destination d_mail { file("/var/log/ng/maillog"); }; destination d_spol { file("/var/log/ng/spooler"); }; destination d_boot { file("/var/log/ng/boot.log"); }; destination d_mlal { file("/var/log/ng/emerg.log"); }; destination d_dhcp { file("/var/log/ng/dhcpd.log"); }; destination d_ipchains { file("/var/log/ng/ipchains.log"); }; destination d_bg { tcp(ip(192.168.1.19) port(514)); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_dhcp { match("dhcpd"); }; filter f_ipchains { match("ipchains"); }; filter f_tcplog { level(debug); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_dhcp); destination(d_dhcp); }; log { source(s_sys); filter(f_ipchains); destination(d_ipchains); }; log { source(s_sys); filter(f_tcplog); destination(d_bg); }; Any help would be appreciated. sim

3 5

syslog-ng duplicating messages
by Matt Studley 20 Feb '01

20 Feb '01

hello. I am having a slight problem with syslog-ng. It is running fine on all of our servers, however we did set up a logging host to keep an archive of other servers logs. It is using udp as the protocol to send the logger messages to the loghost. When the messages comes through to the loghost and is filtered to the appropriate destination, it always appears twice. For example the following is common to 99% of all the logs on the loghost: Feb 16 13:13:47 sun08 su: 'su root' succeeded for mjs on /dev/pts/24 Feb 16 13:13:47 sun08 su: 'su root' succeeded for mjs on /dev/pts/24 Feb 16 14:27:19 sun08 login: pam_authenticate: error Authentication failed Feb 16 14:27:19 sun08 login: pam_authenticate: error Authentication failed Feb 19 08:06:33 sun08 su: pam_authenticate: error Authentication failed Feb 19 08:06:33 sun08 su: pam_authenticate: error Authentication failed Feb 19 08:06:33 sun08 su: 'su root' failed for tvd on /dev/pts/12 Feb 19 08:06:33 sun08 su: 'su root' failed for tvd on /dev/pts/12 This is not happening on the local servers. Anyone have any suggestions? Thanks in advance for your help. Matt Studley American Mathematical Society Systems Administrator

1 0

sync within tcp
by Matthew Copeland 19 Feb '01

19 Feb '01

I am using the following for my config file. I have been told that you can sync a tcp connection to a certain number of lines, and I thought this was how you do it, but it dies on the first line that has the sync with a parse error. If I move it to its own line, outside of the tcp, it dies parsing there. Can someone please tell me where I am messing up here? Thanks, Matthew M. Copeland options { long_hostnames(off); log_fifo_size(1440000); }; source src { unix-stream("/dev/log"); internal(); }; destination normal_messages { tcp("129.235.66.4" port(999) sync(10)); }; destination immediate_messages { tcp("129.235.66.4" port(999) sync(0)); }; filter f_gs_alert { match("GS_ALERT"); }; log { source (src); filter(f_gs_alert); destination(immediate_messages); }; log { source(src); filter(DEFAULT); destination(normal_messages); };

1 0

syslogging with perl
by Bernd Jucknischke 14 Feb '01

14 Feb '01

Hi all! I've just been facing a strange problem. Attached you'll find a perl script. I've been running this script on different machines with different results (the path to perl has been adapted, of course): machinetype logging daemon OS Perl result pc syslogd Debian unstable 5.6 doesn't work Sun syslogd Solaris 2.6 5.004_4 works Sun syslog-ng Solaris 2.6 5.004_4 doesn't work Did anybody ever experience problems like that? I'd say it's perl related, but I'm not sure; any hint or advice is appreciated. TIA, Bernd

2 3

Re: [syslog-ng]Trying to send log over network
by Simeon Johnston 14 Feb '01

14 Feb '01

Same problem sim Don Armstrong wrote: > On Tue, 13 Feb 2001, Simeon Johnston wrote: > > I am trying to send logs over our network but am having trouble with the > > rules. I have set up a host to accept the logs and I am trying to set > > up the sender. This is the destination rule so far. > > > > destination d_bg { tcp(ip(192.168.1.19) port(514)); }; > > This should be > > destination d_bg {tcp(ip(192.168.1.19); port 514););}; > > Don Armstrong > > --------------------------------------------------- > UC Riverside | .naidnE elttil atah I > Residential Computing | > http://resnet.ucr.edu | http://www.donarmstrong.com > ---------------------------------------------------

2 1

Re: [syslog-ng]syslog-ng performance problem
by Balazs Scheidler 13 Feb '01

13 Feb '01

> I think the server has enough CPU and memory resources (Pentium III 650 > with 1Gb RAM) to handle the logs incoming from the web servers as it > works fine at the beginning without loosing messages and the performace > decreases progressively instead of from the beginning. I think I could > solve the problem with the appropiate gc_idle_threshold() and > gc_busy_threshold() settings (now I using the default values), but I'm > not sure if it would be the solution and in this case I don't know how > to calculate the right values for these para meters. > > Any advice? What about first upgrading to 1.4.10 ? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]syslog-ng performance problem
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Feb '01

13 Feb '01

You need to upgrade to a new version. This was a well known problem on some of the earlier 1.4 versions of syslog-ng for some OS's. Subsequent releases have cleared this up. Look at http://www.balabit.hu/en/products/syslog-ng/ That is the syslog-ng home page. Regards Drew > -----Original Message----- > From: Santiago Gomez Cano [SMTP:santiago.gomez@tiscalinet.es] > Sent: Tuesday, February 13, 2001 12:16 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]syslog-ng performance problem > > Hi > > I'm using the syslog-ng 1.40rc3-3 deb package running on a Debian > GNU/Linux box collectin logs from 3 different web serves. > > When starting the syslgog-ng daemon it begins using a reasonable CPU > amount (about 2 or 4%), sleeping most of the time and running when > someone access our web pages and the logging server receives logs from > the web servers. The CPU usage increases to 5 or 6% after one hour > running and keeps on growing up to saturate the server with a 99.99% CPU > usage about two or three ours after the start. > > I think the server has enough CPU and memory resources (Pentium III 650 > with 1Gb RAM) to handle the logs incoming from the web servers as it > works fine at the beginning without loosing messages and the performace > decreases progressively instead of from the beginning. I think I could > solve the problem with the appropiate gc_idle_threshold() and > gc_busy_threshold() settings (now I using the default values), but I'm > not sure if it would be the solution and in this case I don't know how > to calculate the right values for these para meters. > > Any advice? > > -- > Santiago Gomez Cano > Systems Administrator / Administrador de Sistemas > santiago.gomez(a)tiscali.es > Tiscali Telecomunicaciones, S.A. > www.tiscali.es > T. +34 918370546 > T. +34 699459573 > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

syslog-ng performance problem
by Santiago Gómez Cano 13 Feb '01

13 Feb '01

Hi I'm using the syslog-ng 1.40rc3-3 deb package running on a Debian GNU/Linux box collectin logs from 3 different web serves. When starting the syslgog-ng daemon it begins using a reasonable CPU amount (about 2 or 4%), sleeping most of the time and running when someone access our web pages and the logging server receives logs from the web servers. The CPU usage increases to 5 or 6% after one hour running and keeps on growing up to saturate the server with a 99.99% CPU usage about two or three ours after the start. I think the server has enough CPU and memory resources (Pentium III 650 with 1Gb RAM) to handle the logs incoming from the web servers as it works fine at the beginning without loosing messages and the performace decreases progressively instead of from the beginning. I think I could solve the problem with the appropiate gc_idle_threshold() and gc_busy_threshold() settings (now I using the default values), but I'm not sure if it would be the solution and in this case I don't know how to calculate the right values for these para meters. Any advice? -- Santiago Gómez Cano Systems Administrator / Administrador de Sistemas santiago.gomez(a)tiscali.es Tiscali Telecomunicaciones, S.A. www.tiscali.es T. +34 918370546 T. +34 699459573

1 0

strange logfile appearance
by Wiktor Wodecki 06 Feb '01

06 Feb '01

ello, I'm in the test-phase of my loggingserver. and syslog-ng started to create a logfile I don't understand why it did that. This is my conf, it's a fairly easy setup. (striped other unimportant stuff) options { long_hostnames(yes); sync(0); time_reap(10); use_time_recvd(yes); use_dns(yes); use_fqdn(yes); create_dirs(yes); log_fifo_size(10000); chain_hostnames(yes); }; source oldserver { udp(ip(xxx.xxx.xxx.xxx) port(514)); }; destination blackhole { file("/var/log/frontier/$YEAR$MONTH/$HOST"); }; destination blackhole_auth { file("/var/log/frontier/$YEAR$MONTH/$HOST-auth"); }; destination blackhole_crit { file("/var/log/frontier/$YEAR$MONTH/$HOST-crit"); }; destination blackhole_emerg { file("/var/log/frontier/$YEAR$MONTH/$HOST-emerg"); }; destination blackhole_err { file("/var/log/frontier/$YEAR$MONTH/$HOST-err"); }; destination blackhole_messages { file("/var/log/frontier/$YEAR$MONTH/$HOST-messages"); }; destination blackhole_warn { file("/var/log/frontier/$YEAR$MONTH/$HOST-warn"); } log { source(oldserver); destination(blackhole); }; log { source(oldserver); filter(f_auth); destination(blackhole_auth); }; log { source(oldserver); filter(f_crit); destination(blackhole_crit); }; log { source(oldserver); filter(f_emerg); destination(blackhole_emerg); }; log { source(oldserver); filter(f_err); destination(blackhole_err); }; log { source(oldserver); filter(f_messages); destination(blackhole_messages); }; log { source(oldserver); filter(f_warn); destination(blackhole_warn); }; The syslog-ng ran for the last 10 days without problems, however today I discovered three new logfiles. -rw------- 1 root root 119 Feb 1 10:43 last -rw------- 1 root root 60 Feb 1 05:45 last-messages -rw------- 1 root root 60 Feb 1 05:45 last-warn erwin:/var/log/frontier/200102# cat last Feb 1 05:45:23 last/ns2.xxx.net message repeated 2 times Feb 1 10:43:27 last/ns2.xxx.net message repeated 1 time erwin:/var/log/frontier/200102# cat last-messages Feb 1 05:45:23 last/ns2.xxx.net message repeated 2 times erwin:/var/log/frontier/200102# cat last-warn Feb 1 05:45:23 last/ns2.xxx.net message repeated 2 times The box the logs came from is a sparc10 with solaris5.8. The orginal logfile statements were: Feb 1 05:45:23 sparky last message repeated 2 times ... Feb 1 10:47:50 sparky last message repeated 1 time There are plenty of other "last message repeated..." lines in sparky's logfile, so I don't see a reason *why* those both got logged seperately. The first logentry repeated a warn-message, the other one a notice-message. Can anyone give me a hint please? The version I use is 1.4.10 on linux. (syslog-ng doesn't run yet on the sparc10. I export the logs via the goold old "*.crit,*.warn,etc,etc. @hostname way") -- Regards, Wiktor Wodecki, Unix Administration | Wapme-Systems AG Tel.: +49-211-748450 | Muensterstrasse 248 Fax: +49-211-74845176 | 40470 Duesseldorf E-Mail: wodecki(a)wapme-systems.de | http://www.wapme-systems.de

1 1

Core
by Brian E. Seppanen 01 Feb '01

01 Feb '01

Syslog-ng dumped on the 29th, and running gdb --core=core gives the following. What's signal 6? Any ideas appreciated. Core was generated by `syslog-ng -f /usr/local/etc/syslog-ng.conf -p /var/run/syslog-ng.pid'. Program terminated with signal 6, Aborted. #0 0x40068dd1 in ?? () This is on a redhat 7.0 box. Syslog-ng 1.4.10. Thanks... Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

2 1

Re: bug? OR dont seem to work right.
by Samuel Krempp 29 Jan '01

29 Jan '01

You could not reproduce it ? maybe it is specific to my platform then.. PC Debian Woody (up to date), syslog-ng deb package version 1.4.10-1.. Here is more details on my setup and results, and I attach my complete syslog-ng.conf (only the begining of my syslog-ng.conf differs from debian's default config), and a full piece of 'try.log'. ------------------- filter f_tunnel { program("tunnel"); }; filter f_dhcp { program("dhcp"); }; filter f_squid { program("squid"); }; filter f_ssh { facility(local3); }; filter f_separe { program("(tunnel)|(dhcp)|(squid)"); }; filter f_try { filter(f_separe) or filter(f_ssh); }; log { source(src); filter(f_ssh); destination(sshlog); }; log { source(src); filter(f_separe); destination(separelog); }; log { source(src); filter(f_try); destination(trylog); }; ------------------- ----------- ssh.log is ok (full of sshd messages...) ----- separe.log : allright (dhcp, squid and stunnel messages only.) Jan 19 16:13:41 zamok dhcpd-2.2.x: DHCPACK on 138.231.138.32 to 52:54:05:f5:26:39 via eth0Jan 19 16:14:17 zamok stunnel[6495]: Connection closed: 191 bytes sent to SSL, 39 bytes sent to socket Jan 19 16:14:21 zamok stunnel[6500]: tunnel-pop connected from 212.232.35.241:3636 Jan 19 16:14:26 zamok stunnel[6500]: Connection closed: 938 bytes sent to SSL, 69 bytes sent to socket Jan 19 16:14:32 zamok stunnel[6514]: tunnel-pop connected from 138.231.137.11:1663 ----- try.log : how come ? (chosen bits : ) Jan 19 16:13:33 zamok syslog-ng[6453]: syslog-ng version 1.4.10 starting Jan 19 16:13:33 zamok imapd[6455]: connect from kino.crans.org Jan 19 16:13:35 zamok imapd[6458]: Logout user=szakacs host=localhost.crans.org [127.0.0.1] Jan 19 16:13:37 zamok sshd2[386]: connection from "138.231.137.199" Jan 19 16:13:37 zamok sshd[6460]: log: Generating 768 bit RSA key. Jan 19 16:14:17 zamok cucipop[6496]: arlais 127.0.0.1 0, 0 (0), 0 (0) Jan 19 16:14:17 zamok stunnel[6495]: Connection closed: 191 bytes sent to SSL, 39 bytes sent to socket Can you see where the problem comes from ? that would be very helpful for me to be able to use 'or' correctly.. -- Sam

2 1

Re: iptables/netfilter and syslog-ng
by Samuel Krempp 27 Jan '01

27 Jan '01

For syslog-ng to receive kernel logs, you need to either add a source for /proc/kmsg, or (better) run klogd. (it's almost written in the documentation..) klogd is better because it translates the kernel logs using System.map. The trick, on my debian, is that installing the package syslog-ng removes sysklogd, which contained both the old syslog and klogd, so I simply copied by hand the klogd daemon in /usr/local/sbin.. hth -- Sam

2 1

combining filters : completely broken ?
by Samuel Krempp 27 Jan '01

27 Jan '01

Okay, I've already posted a message about the bad behaviour of ORing filters on my debian (and got no response, perhaps I should have restrained pine from sending attachments vith MIME, but well.) I realise now that combining filters like this : destination newsnotice { file("/var/log/news/news.notice" owner("news") group("adm") perm(0640)); }; filter f_news { facility(news); }; filter f_notice { level(notice); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; will also break syslog (news.notice, suddenly, becomes very quite.. not growing at all.. strangely I suspect syslog-ng) I think combining filters wihtin syslog is broken, at least on my plaform, but not only. In a previous message, by michael.senn(a)cmg.nl, I read this : """ I have done some very basic testing with the not filter and suggest that you try spliting the not into it's own filter then combine them in the log statement as follows. It works for me with matching in an error message. """ Now, is there any good reason to accept this specificity about the 'not' from syslog-ng ? isnt this rather a sign that syslog-ng is broken when it comes to combining filters ?? I liked syslog-ng very well, but if filters cant be combined properly, it's much less useful.. aren't those a trivial thing to fix ?? or maybe syslog-ng depends on something for combining filters, and this 'something' is not really the same across different distribs ?? -- Samuel

1 1

iptables/netfilter and syslog-ng
by Laurence J. Lane 27 Jan '01

27 Jan '01

I'm having trouble with iptables (Linux kernel 2.4.x) logging with syslog-ng. sysklogd is logging as expected. As far as I can see, a syslog-ng config like this is logging everything except iptables: source src { unix-stream("/dev/log"); internal(); }; destination testing { file("/root/testing"); }; log { source(src); destination(testing); }; I've tried syslog levels 0-7 with iptables, but syslog-ng still doesn't show the traffic. Anyone have an idea of I'm doing wrong? -- ljlane(a)nontoxic.org

1 1

RE: [syslog-ng]Filter Problem
by Michael Senn 26 Jan '01

26 Jan '01

I am guess from your email that all of the or's in the filter work correctly and it is just the 'not facility(local7)' that is the probel area. I have done some very basic testing with the not filter and suggest that you try spliting the not into it's own filter then combine them in the log statement as follows. It works for me with matching in an error message. >My intent with the following filter, etc. is to exclude messages coming in >from facility local7 from being logged to /var/adm/messages. It does not >seem to work as those messages are making it there. Can anyone spot what >might be wrong with the filter/destination/log stanza(s)? >filter f_var_adm { level(emerg,alert,crit,err) > or ( facility(kern) and level(debug) ) > or ( facility(daemon) and level(notice) ) > or ( facility(local2) and level(notice) ) > or ( facility(auth) and level(notice,info) ) > or ( facility(mail) and level(crit) ) ; }; filter not_local7 { not facility(local7) ; }; >destination d_var_adm { file("/var/adm/messages"); }; ># Log all messages conforming to the f_var_adm filter to /var/adm/messages >log { source(stdlog); filter(not_local7); > filter(f_var_adm); > destination(d_var_adm); > }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

RE: [syslog-ng]Filter Problem
by John A. Parker 26 Jan '01

26 Jan '01

> > My intent with the following filter, etc. is to exclude > > messages coming in > > from facility local7 from being logged to /var/adm/messages. > > It does not > > seem to work as those messages are making it there. Can > > anyone spot what > > might be wrong with the filter/destination/log stanza(s)? > > > > filter f_var_adm { level(emerg,alert,crit,err) > > or ( facility(kern) and level(debug) ) > > or ( facility(daemon) and level(notice) ) > > or ( facility(local2) and level(notice) ) > > or ( facility(auth) and level(notice,info) ) > > or ( facility(mail) and level(crit) ) > > and not ( facility(local7) ); }; > >are any of the messages arriving from local7 in emerg, alert, crit, or err >level? Yes.

1 0

RE: [syslog-ng]Filter Problem
by Andrew Fort 26 Jan '01

26 Jan '01

> My intent with the following filter, etc. is to exclude > messages coming in > from facility local7 from being logged to /var/adm/messages. > It does not > seem to work as those messages are making it there. Can > anyone spot what > might be wrong with the filter/destination/log stanza(s)? > > filter f_var_adm { level(emerg,alert,crit,err) > or ( facility(kern) and level(debug) ) > or ( facility(daemon) and level(notice) ) > or ( facility(local2) and level(notice) ) > or ( facility(auth) and level(notice,info) ) > or ( facility(mail) and level(crit) ) > and not ( facility(local7) ); }; are any of the messages arriving from local7 in emerg, alert, crit, or err level?

1 0