- syslog-ng - lists.balabit.hu

Re: [syslog-ng] (syslog-ng): unaligned access: (SOLVED)
by Balazs Scheidler 27 May '00

27 May '00

> Looks like there's yet another, I'll dig into it again today and send some > more, unless you're still working on one of the two I already sent. I thought this fixed both, since this malloc debugger allocated memory chunks on a 4 bytes boundary (instead of 8), if memory was accessed later it could cause this at several places. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: [syslog-ng] (syslog-ng): unaligned access: (SOLVED)
by Balazs Scheidler 26 May '00

26 May '00

> pid 29068 (syslog-ng): unaligned access: va=0x14001645c pc=0x12001b2b0 > ra=0x12001b2b0 op=stt > pid 29068 (syslog-ng): unaligned access: va=0x14001644c pc=0x12001b018 > ra=0x12001b018 op=stq > pid 29068 (syslog-ng): unaligned access: va=0x140016454 pc=0x12001b028 > ra=0x12001b028 op=stt > pid 29068 (syslog-ng): unaligned access: va=0x140016454 pc=0x12001b030 > ra=0x12001b030 op=ldq > pid 29068 (syslog-ng): unaligned access: va=0x14001644c pc=0x12001b040 > ra=0x12001b040 op=ldq > 0x12000f3f0 288 conn->queue_node = I've got this one, it's caused by the optional malloc debugger which was errouneously included even in --with-debug was not given (it was not 64bit clean). The new libol version 0.2.17 should fix this. http://www.balabit.hu/downloads/libol/0.2/libol-0.2.17.tar.gz -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

syslog-ng 1.4.4 and libol 0.2.17
by Balazs Scheidler 26 May '00

26 May '00

Hi, I've released syslog-ng 1.4.4: NEWS for syslog-ng 1.4.4 * file permission specifiers readded for pipe() * fixed a configure.in bug on systems without snprintf() * updated documentation (New chapter: Finetuning, added some things about DEFAULT filter evaluation) NEWS for libol 0.2.17 * will not compile in the malloc debugger if --with-debug is specified, caused unaligned memory accesses on Alpha -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

A Bug and few sugestions..
by Felix Meulenkamp 26 May '00

26 May '00

Hi... I'm running Syslog-ng 1.4.3 as a loghost and on a workstation behind a gateway... both RedHat 6.1 hmmm problems i've found... '#' seems to work not correctly... i've comment a few things in my syslog-ng.conf... and if the comment was not at the beginning of a line.. i got a parsing error.. '#' seems not to comment out log, source, ... -statements.... if i comment out the destination and filter rule for ppp from the standart debian example syslog-ng.conf .... i got a parsing error... saying something like... ppp was an unresolve identifer... and here my sugestions... what about ...say 'virtual pipes'.... or bracket rules... what i meen is... if you have a logingstatement like this log {source(src1); filter(f_1); source(src2); destination(dst1); }; (this seems to work on my maschine... throu this is not documented) and you now want to filter src2 with another filter.... when filter f_2 will filter both.... and not just the 2nd source... There would be something like a internal pipe helpy... So you define a pipe and use this to curving around the 2nd source and filter... or what would be even better... to create brackets around the 2nd source and filter... so the filter will just afect src2.... customized macros... what about just defining your own macros... say like constants... for example you can define LOGDIR="/var/log"; and then in a destination-rule it will sound like destination warn {file("$LOGDIR/warn");}; ....or just... FNW="not filter(warn);"; but i thing macros an const have to be captalized by definition... Felix... ICQ: 5227897/samon007 PS:Thanxs for writing this great programm...

3 3

Ignoring previously handled/filtered messages
by John Goggan 26 May '00

26 May '00

Hello all. I am new to syslog-ng (today) and have a question. I have looked through all of the documentation that I can find -- as well as scanned the mailing list archives, and cannot find a solution. In fact, I see that Un L'Unique had this same problem last month, and it was partially discussed, but there was no final answer. Basically, it seems that there should be an easy way to make syslog-ng NOT resend messages that have already been sent to some other log. Here is what I am trying to do... I have several daemons (we'll shorten the list to just ftpd and named for this example) that currently send daemon.info messages. I want each application to have its own log file. So, I have tried configuring them like this: destination ftpd { file("/var/log/ftplog"); }; destination named { file("/var/log/namedlog"); }; destination daemon { file("/var/log/daemonlog"); }; filter f_ftpd { program("ftpd"); }; filter f_named { program("named"); }; filter f_daemon { facility(daemon); }; log { source(src); filter(f_ftpd); destination(ftpd); }; log { source(src); filter(f_named); destination(named); }; log { source(src); filter(f_daemon); destination(daemon); }; This makes messages for ftpd go to ftpdlog and for named go to namedlog. The problem is that they still also go to the daemonlog since they are daemon.info messages. What I want is a way to tell syslog-ng that I do NOT want it to also send those to the daemonlog file. It seems that there should be a directive to say "send these to this log ONLY if they haven't already been handled." I did try doing this for the daemon filter: filter f_daemon { facility(daemon) and not filter(f_ftpd) and not filter(f_named); }; ...but this does not work. I still get the ftpd and named messages in daemonlog (as well as ftpdlog and namedlog). This is exactly what Un L'Unique experienced last month when he said that the "not filter" did not appear to be working for him. I get the same behavior -- it does not work for me. This is, however, not even a good system even if it DID work, because then I would have to specific each and ever "not filter" for other daemons that are handled and remember to add them each time I add logging for a new daemon. It would just be so much better if the facility(daemon) could be told to only log daemon messages that were NOT already logged elsewhere. I believe that this can be done (and is the default behavior) in standard syslog. I tried working with the filter(DEFAULT) command, but this also did not seem to do what I wanted since I can't tell it to JUST do it for facility(daemon). Thank you! - John...

4 4

RE: Re [syslog-ng] Ignoring previously handled/filtered messages
by Hamilton, Andrew Mr. 26 May '00

26 May '00

I like the configuration option as well. I would like to be able to duplicate some but not others. Of course we all want as fine a grain of control as we can get. I do all the filtering and parsing and reporting on a considerable amount of log information, and while several places need to see some of the same logs, for the most part only the sysadmins are interested in it. I make the reports I generate from the logs available on the local intranet for whoever is interested, but I don't get to make all of it available. The security people are funny about that. For the stuff I want duplicated I can easily add a second or a third or a ... destination() to a log function and get my duplication that way. Matter of fact I prefer to do this as it gives ME the control over the logging. Anyway just my $.02 worth. Thanks Drew > -----Original Message----- > From: offset [SMTP:offset@privacyx.com] > Sent: Thursday, May 25, 2000 7:31 PM > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re [syslog-ng] Ignoring previously handled/filtered messages > > I like the idea of having syslog messages duplicated. > > In a very large enterprise you have multiple groups wanting access to > the same information. > > System administration is looking for availability related logs > Security administration is looking for security related logs. > Groups above may having overlapping facility and level requirements. > > Such as SysAdmins needing kern.notice for kernel output, and SecAdmins > needing this log to catch Solaris stack executable buffer overflow > attempts. > > If I were in security parsing syslog output, I would not want the system > administration group grabbing all the content with nothing left for the > security administrators to pull from. This is especially true for > environments where system administration and security administration for > a server has been separated into different groups with different > management reporting structures. > > Perhaps as a compromise, a configuration setting in syslog-ng that > controls fall-through. > > -- offset -- > > John Goggan wrote: > > > ger wrote: > > > try > > > filter f_daemon { facility(daemon) and not program(name);}; > > > > > > where "name" is whatever program you're trying to filter out. > > > > Thanks to Ger and Ilya for their responses. While this does work, it > really > > seems like a poor way to do it to me -- and, I believe, is also quite a > bit > > different from the way standard syslog handles things. The problem is > that it > > should just be easy to make it so that messages are handled only ONCE > and then > > not sent to additional logs unless specifically desires. How many > people > > really want the same syslog message sent to multiple logs most of the > time? > > It just seems that the default (which does this) is the opposite of what > most > > would want. > > > > Plus, what needs to be done to get around this just doesn't make any > sense. > > This means that if I want separate logs for imapd, named, telnetd, and > ftpd > > (to name just a few common daemons) -- and I want any other daemons that > pop > > up to still go to a daemon.log, I have to do this in my filter section: > > > > filter f_imapd { program("imapd"); }; > > filter f_named { program("named"); }; > > filter f_telnetd { program("telnetd"); }; > > filter f_ftpd { program("ftpd"); }; > > filter f_auth { facility(auth) > > and not program("imapd") > > and not program("named") > > and not program("telnetd") > > and not program("ftpd"); }; > > filter f_daemon { facility(daemon) > > and not program("imapd") > > and not program("named") > > and not program("telnetd") > > and not program("ftpd"); }; > > filter f_messages { level(info..warn) > > and not facility(auth, authpriv, mail, news); > > and not program("imapd") > > and not program("named") > > and not program("telnetd") > > and not program("ftpd"); }; > > > > That just seems like a really bad design! I have to make sure that I > keep all > > of the names updated in several different locations. If I want to add a > log > > for just one more daemon, I have to add it to at least 3 other filters > besides > > its own filter! > > > > Aren't other people experiencing such problems? Or is no one out there > using > > syslog-ng to filter out specific daemons while still catching the > unlisted > > daemons in a daemon.log file? > > > > There must be a better way... > > > > - John... > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > ---------------------------------------------------------------- > > > > > > > > > > > > > > Link is external to the Privacyx.com System > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re [syslog-ng] Ignoring previously handled/filtered messages
by offset 25 May '00

25 May '00

I like the idea of having syslog messages duplicated. In a very large enterprise you have multiple groups wanting access to the same information. System administration is looking for availability related logs Security administration is looking for security related logs. Groups above may having overlapping facility and level requirements. Such as SysAdmins needing kern.notice for kernel output, and SecAdmins needing this log to catch Solaris stack executable buffer overflow attempts. If I were in security parsing syslog output, I would not want the system administration group grabbing all the content with nothing left for the security administrators to pull from. This is especially true for environments where system administration and security administration for a server has been separated into different groups with different management reporting structures. Perhaps as a compromise, a configuration setting in syslog-ng that controls fall-through. -- offset -- John Goggan wrote: > ger wrote: > > try > > filter f_daemon { facility(daemon) and not program(name);}; > > > > where "name" is whatever program you're trying to filter out. > > Thanks to Ger and Ilya for their responses. While this does work, it really > seems like a poor way to do it to me -- and, I believe, is also quite a bit > different from the way standard syslog handles things. The problem is that it > should just be easy to make it so that messages are handled only ONCE and then > not sent to additional logs unless specifically desires. How many people > really want the same syslog message sent to multiple logs most of the time? > It just seems that the default (which does this) is the opposite of what most > would want. > > Plus, what needs to be done to get around this just doesn't make any sense. > This means that if I want separate logs for imapd, named, telnetd, and ftpd > (to name just a few common daemons) -- and I want any other daemons that pop > up to still go to a daemon.log, I have to do this in my filter section: > > filter f_imapd { program("imapd"); }; > filter f_named { program("named"); }; > filter f_telnetd { program("telnetd"); }; > filter f_ftpd { program("ftpd"); }; > filter f_auth { facility(auth) > and not program("imapd") > and not program("named") > and not program("telnetd") > and not program("ftpd"); }; > filter f_daemon { facility(daemon) > and not program("imapd") > and not program("named") > and not program("telnetd") > and not program("ftpd"); }; > filter f_messages { level(info..warn) > and not facility(auth, authpriv, mail, news); > and not program("imapd") > and not program("named") > and not program("telnetd") > and not program("ftpd"); }; > > That just seems like a really bad design! I have to make sure that I keep all > of the names updated in several different locations. If I want to add a log > for just one more daemon, I have to add it to at least 3 other filters besides > its own filter! > > Aren't other people experiencing such problems? Or is no one out there using > syslog-ng to filter out specific daemons while still catching the unlisted > daemons in a daemon.log file? > > There must be a better way... > > - John... > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng > > ---------------------------------------------------------------- > > > > > > > Link is external to the Privacyx.com System >

1 0

Newbie Look'en for some Direction...
by Mike Novak 24 May '00

24 May '00

Hey All I have recently started to install syslog-ng on some boxs and am having trouble finding good documentaion.....i was hoping that one of you might be able to point me in a good diriection Thanx Novak

2 1

syslog and "...last message repeated..."
by John A. Parker 23 May '00

23 May '00

A slightly off subject question. I've installed syslog-ng on a central AIX server, setup to receive and process log messages from all of the other servers in our network. In our environment, we want to be able to watch for messages of a common theme that might be coming from disparate systems. As part of the implementation, in addition to simply logging the messages, I have syslog-ng forwarding (through named pipes) all of the messages on to a daemon we've implemented that performs the desired "collection" work. (In addition to lots of other things of course.) My question is this: Is there anyway to stop the distributed syslogd daemons from aggregating messages? Having a message with the string "abcd..." repeated is easy to track, no matter the sourcing system. Having the same message from system "a", followed by some other messages from systems "b"-"z", followed by "...last message repeated 2 times..." from system "a" makes keeping track of message counts very complicated. Thanks in advance! John --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

2 1

Localized datestamps
by Gero Krueger 23 May '00

23 May '00

Hi syslog-ng users/developers ! I've got a linux box running here running the lastest syslog-ng. I'm using the messages syslog-ng generates as input for my project and noticed a strange effect: Some daemons (especially the PAM-library) produce loglines with a localized (here: german) monthname. This is very uncomfortable for my work. How can that happen if syslog-ng generates them ? Does anyone know how to get all datestamps in english ? -- < Gero Krueger | DeTeCSM > < Tel. : +49-541-333-2488 | IVS Osnabrueck > < Fax : +49-541-333-2940 | Hannoversche Str. 6-8 > < mailto: krueger(a)obk.telekom.de | 49084 Osnabrueck >

2 1

Solaris 2.5.1
by Gero Krueger 22 May '00

22 May '00

Hello syslog-ng users/developers ! I've got problems to compile syslog-ng 1.4.3 under solaris 2.5.1 (using gcc 2.95.1): [make...] gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.4.3/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c snprintf.c snprintf.c: In function `dopr': snprintf.c:200: warning: subscript has type `char' snprintf.c:224: warning: subscript has type `char' snprintf.c: In function `snprintf': snprintf.c:715: argument `__builtin_va_alist' doesn't match prototype snprintf.c:95: prototype declaration snprintf.c:715: number of arguments doesn't match prototype snprintf.c:95: prototype declaration make[3]: *** [snprintf.o] Error 1 Any ideas ? -- < Gero Krueger | DeTeCSM > < Tel. : +49-541-333-2488 | IVS Osnabrueck > < Fax : +49-541-333-2940 | Hannoversche Str. 6-8 > < mailto: krueger(a)obk.telekom.de | 49084 Osnabrueck >

2 2

(syslog-ng): unaligned access:
by James Hamilton 22 May '00

22 May '00

I fired up syslog-ng on my alpha OpenBSD 2.6 loghost and got this. I have no what to make of it. I'm running syslog-ng 1.4.3 and libol.0.2.16. Is this a problem, perhaps similar to ger(a)tinet.ie's post earlier this month? pid 4179 (syslog-ng): unaligned access: va=0x140017a5c pc=0x120013be4 ra=0x120013be4 op=stq pid 4179 (syslog-ng): unaligned access: va=0x140017a4c pc=0x120013a38 ra=0x120013a38 op=stq pid 4179 (syslog-ng): unaligned access: va=0x140017a54 pc=0x120013a40 ra=0x120013a40 op=stq pid 4179 (syslog-ng): unaligned access: va=0x140017a4c pc=0x120013a48 ra=0x120013a48 op=ldq pid 4179 (syslog-ng): unaligned access: va=0x140017adc pc=0x120013be4 ra=0x120013be4 op=stq pid 4179 (syslog-ng): unaligned access: va=0x140017acc pc=0x120013a38 ra=0x120013a38 op=stq pid 4179 (syslog-ng): unaligned access: va=0x140017ad4 pc=0x120013a40 ra=0x120013a40 op=stq pid 4179 (syslog-ng): unaligned access: va=0x140017acc pc=0x120013a48 ra=0x120013a48 op=ldq James Hamilton

2 1

Configuring syslog-ng
by Kalusniak, Jeff 19 May '00

19 May '00

Can anyone help??? I can start syslog-ng (1.4.3), but nothing spits out to /var/adm/messages. Thank You! Jeff Kalusniak Goliath Falls Inc.

1 0

Problems with kernel logging
by Brian K. Mohr 17 May '00

17 May '00

Greetings: Sorry if this rehashes old territory--I've seen this issue addressed in the list archives. Unfortunately, I've reached an impasse. I'm currently running syslog-ng on a test system, with all logs being sent to a single file so that I can monitor what syslog-ng is (or isn't) doing. As far as I can tell, all facilities are being logged except for 'kern.*'. I'm running it on Red Hat 6.2 (intel) as a drop-in replacement for syslogd (it is started prior to klogd, version 1.3-3). As suggested in a prior posting on this topic, I've run 'strace -f' on klogd with both syslogd and syslog-ng (and ipchains logging all denied packets so there should be plenty of logging to kern.info) with the following result: ===syslogd sample=== read(0, "<6>Packet log: input DENY eth0 P"..., 4095) = 121 time([958581388]) = 958581388 write(1, "<6>May 17 12:36:28 kernel: Packe"..., 146) = 146 ===syslog-ng sample=== read(0, "<6>Packet log: input DENY eth0 P"..., 4095) = 114 connect(1, {sin_family=AF_UNIX, path="/dev/log"}, 10) = -1 EPROTOTYPE (Protocol wrong type for socket) time([958581560]) = 958581560 write(1, "<6>May 17 12:39:20 kernel: Packe"..., 139) = -1 ENOTCONN (Transport endpoint is not connected) It would appear that klogd is _trying_ to log to /dev/log, but fails when syslog-ng is running. I do see kernel messages sent from remote hosts (still running syslogd) in the destination file, just not for the local host. source local { unix-stream("/dev/log"); internal(); }; # no kern.* source net { udp(ip(0.0.0.0) port(514)); }; # kern facility OK Any suggestions? Thanks in advance! --Brian -- Brian Mohr email: bkmohr(a)princeton.edu Systems Administrator phone: (609) 258-2618 Atmospheric and Oceanic Sciences fax: (609) 258-2850 Princeton University

3 4

Re: syslog-ng on BSDI 2.1
by Balazs Scheidler 17 May '00

17 May '00

> For assorted reasons we're using a BSDI 2.1 system and I would like to > install syslog-ng on it. I have got 1.4.3 working with the exception of > kernel logging. It turns out that there is also a special device "/dev/klog" > which you can read the kernel syslog messages from, but when I add it with > a file("/dev/klog") in a source statement, the messages are not flagged > as LOG_KERN but instead defaulting to LOG_USER. > > I presume it's because bsdi 2.1 doesn't put <nnn> at the front of these > messages. The behaviour of /dev/klog does not appear to be documented, > and I don't have source around. My guess is that it's encoding the pri > in some other way. Any ideas? You could use another source for kernel messages: source s_kernel { file("/dev/klog"); }; destination d_kernel { file("/var/log/kern.log"); }; log { source(s_kernel); destination(d_kernel); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 3

syslog protocol
by John 11 May '00

11 May '00

Hi, The way I went about finding a bit more information out was to write a small perl program that listened on port 514 and printed out anything that was forwarded to it. Basically, I believe the format is something like: <number>then the message here blah blah.... Looks like syslog uses the number to work out what the log message is. Below is a small list of a few: 38 auth.info 32 auth.none 34 auth.crit 33 auth.alert 39 auth.debug 37 auth.notice 35 auth.err 32 auth.emerg 36 auth.warn 32 auth.panic 35 auth.error 78 cron.info 72 cron.none So, write a perl script to send the information to the log server. Mail me if you want the full list of numbers. I probably have a perl script lying around some where too. Cheers, John

3 3

RE: [syslog-ng] syslog-ng on AIX 4.x
by John A. Parker 09 May '00

09 May '00

Mick, I'm not sure what doesn't work for you. I haven't actually tried "kill -HUP ...", but I use "kill -1 ..." (equivalent to HUP) all the time and the syslog-ng daemon refreshes as I would have expected. John At 02:02 PM 05/08/2000 -0500, you wrote: >Another thing that threw me off was the fact that >a kill -HUP didn't seem to do what it's supposed to... --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

1 0

RE: [syslog-ng] performance
by Hamilton, Andrew Mr. 09 May '00

09 May '00

I get at least 2 gigs per day and have no obvious performance problems. I also use that same machine to run one of our network monitoring tools and have seen no performance problems associated with either one. It is a Sun Ultra 30. Drew > -----Original Message----- > From: Balazs Scheidler [SMTP:bazsi@balabit.hu] > Sent: Monday, May 08, 2000 2:37 PM > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re: [syslog-ng] performance > > > How syslog-ng deals with high-volume logging? The old syslogd is > very bad > > in this respect; if you feed it with lots of logs, the system slows down > > horribly. > > So, how does syslog-ng behaves in such cases? > > I don't have exact numbers, and I know a couple of places where CPU usage > could be improved in syslog-ng. Nevertheless syslog-ng is used at least at > one site where there's more than 2gigs of logs a day. > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > url: http://www.balabit.hu/pgpkey.txt > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng] syslog-ng on AIX 4.x
by Ohrberg, Mick 08 May '00

08 May '00

John, Since I posted this message, I got it running as well. I was just being silly, I guess. Of course the 'door' doesn't work on AIX, and neither did socket, but dgram did it. Another thing that threw me off was the fact that a kill -HUP didn't seem to do what it's supposed to... Thanks! -----Original Message----- From: John A. Parker [mailto:jap54@cornell.edu] Sent: Monday, May 08, 2000 10:58 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng on AIX 4.x Mick, I have syslog-ng running on AIX 4.3.3 and it seems to be working fine. John >Dear syslog-ng users, > >Is there anyone out there who has successfully installed and used syslog-ng >on an AIX machine? I use it in Solaris 2.6, and it works great! As a >Solaris-user, I really don't know where to look for the syslog-equivalent in >AIX. Syslog-ng compiles great under AIX, but using the logger doesn't give >me the expected result... > >Anyone? > >Thanks in advance! > >-- >Mick Öhrberg >EMTS System Administrator, UMB >(816)860-1064 --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

1 0

performance
by Florin Andrei 08 May '00

08 May '00

How syslog-ng deals with high-volume logging? The old syslogd is very bad in this respect; if you feed it with lots of logs, the system slows down horribly. So, how does syslog-ng behaves in such cases? -- Florin Andrei mailto:florin@linuxstart.com http://members.linuxstart.com/~florin/ tel: +40-93-261162

5 6

Unaligned trap errors on Alpha-Linux
by Ger 08 May '00

08 May '00

Hi, I'm seeing a high number of unaligned trap errors on Redhat 6.2 on an Alpha. Kernel is 2.2.14-6.0, and I'm running syslog-ng-1.4.3 with libol-0.2.16. The errors look like the following: May 8 13:02:35 zathras syslog-ng(972): unaligned trap at 000000012000fed0: 0000 00012012bb1c 29 10 May 8 13:02:35 zathras syslog-ng(972): unaligned trap at 000000012000fe80: 0000 00012012bb34 29 1 Anyone got any ideas? Thanks, Ger.

1 0

syslog-ng on AIX 4.x
by John A. Parker 08 May '00

08 May '00

Mick, I have syslog-ng running on AIX 4.3.3 and it seems to be working fine. John >Dear syslog-ng users, > >Is there anyone out there who has successfully installed and used syslog-ng >on an AIX machine? I use it in Solaris 2.6, and it works great! As a >Solaris-user, I really don't know where to look for the syslog-equivalent in >AIX. Syslog-ng compiles great under AIX, but using the logger doesn't give >me the expected result... > >Anyone? > >Thanks in advance! > >-- >Mick Öhrberg >EMTS System Administrator, UMB >(816)860-1064 --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54(a)cornell.edu 607-255-9356 607-255-8521 (Fax)

2 1

mysql patch
by Florin Andrei 08 May '00

08 May '00

I remember that someone said that there is a mysql patch for syslog-ng. Anyone knows its status? -- Florin Andrei mailto:florin@linuxstart.com http://members.linuxstart.com/~florin/ tel: +40-93-261162

2 2

syslog protocol
by Florin Andrei 08 May '00

08 May '00

Suppose i want to write some apps wich can log over net to a syslog server. Not to the local syslog daemon, but directly to the remote daemon. Where can i find some docs on the syslog protocol? -- Florin Andrei mailto:florin@linuxstart.com http://members.linuxstart.com/~florin/ tel: +40-93-261162

1 0

Re: [syslog-ng] performance
by Balazs Scheidler 08 May '00

08 May '00

> How syslog-ng deals with high-volume logging? The old syslogd is very bad > in this respect; if you feed it with lots of logs, the system slows down > horribly. > So, how does syslog-ng behaves in such cases? I don't have exact numbers, and I know a couple of places where CPU usage could be improved in syslog-ng. Nevertheless syslog-ng is used at least at one site where there's more than 2gigs of logs a day. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0