- syslog-ng - lists.balabit.hu

syslog-ng 1.3.14
by Balazs Scheidler 04 Feb '00

04 Feb '00

I've released $subject with some bugfixes. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

problems after upgrading to v.2.3 linux kernel
by Brian Johnson 03 Feb '00

03 Feb '00

I've been running syslog-ng on linux 2.2.14 for awhile, and it's been working fine, I just upgraded to 2.3.40 and not syslog-ng dies shortly after starting. I'm running syslog-ng 1.3.13 (I was running 1.3.12 and that had the same problem). when I run syslog-ng -d -v I get this: io.c: listening on fd 3 io.c: Preparing fd 4 for reading syslog-ng version 1.3.13 starting io.c: Preparing fd 5 for writing io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing Garbage collecting while idle... Objects alive: 126, garbage collected: 0 io.c: Preparing fd 8 for reading io.c: sockaddr2info(): Unsupported address family 18154. Aborted in my syslog-ng.conf file I have: options { long_hostnames(on); sync(0); }; source src { unix-stream("/dev/log"); file("/proc/kmsg"); internal(); }; and my destinations are all just various normal files... is this a bug, or something I'm doing wrong? this exact configuration did work fine with the linux 2.2.14 kernel...

2 1

Solaris and Syslog-ng
by Victor Barahona 02 Feb '00

02 Feb '00

-----BEGIN PGP SIGNED MESSAGE----- Hi After read the hole archive from 1999-february to nowadays (big job) I have no clear if the stable brunch have or not Solaris support. Let's go with the problem. I'm using sparc-solaris7 and syslog-ng 1.2.3 When I run syslog-ng I have: bash-2.02# syslog-ng parse error at 11 Parse error reading configuration file, exiting. The 11 line refers to the source line. Here is my config file: # options { sync(0); time_reopen(10); log_fifo_size(100); }; source local { sun-door("/etc/.syslog_door"); internal(); }; #################### Destinos de brezo: destination piolin { tcp("piolin" port(514)); }; destination todo { file("/var/adm/toto"); }; #################### Filtros filter xferlog { match(xferlog); }; #######################Logs locales log { source(local); filter(xferlog); destination(piolin); }; log { source(local); destination(todo); }; ------------------------- Something is wrong with doors in this case. Any ideas? -- ------------------------------------------------------------------------ Victor Barahona..........................http://www.sdi.uam.es/~barahona Soporte Seguridad en red.................http://www.sdi.uam.es/utc/ss Unidad Tecnica de Comunicaciones Universidad Autonoma de Madrid Spain Tlf.- 91 397 5525 PGP ID-0x8750AB79 ------------------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use MessageID: uAR2CWNoCZXvbiqWdA6lZ5yPp19i6bZt iQA/AwUBOJgl50oW8ByHUKt5EQIBFgCfWjgP6h3chD2FYrgyA7uOSrnSbFkAoL7Y b92Xc6mnnxyFGSFwCxkAc7LP =rdre -----END PGP SIGNATURE-----

3 4

syslog-ng 1.3.13 doesn't compile on alpha systems
by Arnaud Launay 02 Feb '00

02 Feb '00

Hi, Compiling 1.3.13 on alpha fails there: gcc -DHAVE_CONFIG_H -I. -I/usr/src/syslog-ng-1.3.13/src -I. -O2 -Wall -I/usr/include/libol -D_GNU_SOURCE -c affile.c affile.c: In function `expand_macro': affile.c:332: warning: cast to pointer from integer of different size affile.c:345: warning: cast to pointer from integer of different size affile.c:363: warning: cast to pointer from integer of different size affile.c: In function `expand_macros': affile.c:444: conversion to non-scalar type requested affile.c:446: conversion to non-scalar type requested make[1]: *** [affile.o] Error 1 make[1]: Leaving directory `/usr/src/syslog-ng-1.3.13/src' make: *** [all-recursive] Error 1 Seems to me like 64-bits pb. -- Arnaud Launay - Directeur technique EdenJob Tél: 01 41 92 91 50 Email: launay(a)edenjob.com Visitez notre site emploi: http://www.apr-job.com Fax: 01 41 92 91 54

2 1

syslog-ng 1.3.13 & libol 0.2.13 released
by Balazs Scheidler 17 Jan '00

17 Jan '00

Hi, I've released the latest development version of syslog-ng & libol. This release hopefully fixes some bugs, so if you had problems earlier, you should grab this release. I've also updated the documentation, though it's still not finished. http://www.balabit.hu/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

Re: [jkane@pobox.com: [syslog-ng] Solaris Streams support]
by Balazs Scheidler 13 Jan '00

13 Jan '00

On Thu, Jan 13, 2000 at 10:22:32AM -0700, John Arthur Kane wrote: > Hmm, the mailing list seems to be dead. > > Could you take a look at the message below. The 1.3.12 release solves > all of my problems in 1.3.5, EXCEPT now it cannot accept local syslog > entries on Solaris 2.6. > > Thanks it's not dead, I've been busy recently. STREAMS support is not gone, you should check out the config.log file. STREAMS support is enabled if you have sys/strlog.h and stropts.h, door support is added, if you have -ldoor available, and it contains a door_create() function. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Lost connections not reopened
by Andreas Zymny 13 Jan '00

13 Jan '00

I have the same problems as Gary Carroll on FreeBSD 3.x and 4.0-CURRENT with syslog-ng 1.3.12 and 1.2.8. I compiled an installed the latest stable from syslog-ng, while the 1.3.x doesn't run stable on my machines, but the 1.2.8 has the same problem. Lost connections are not automatically reopened, and all log entries are lost. Why are all log entries are lost? Is it possible to store all log entries in an file or an stream, so they can sent when the connection is reopened? Best regards, Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

1 0

Solaris Streams support
by John Arthur Kane 11 Jan '00

11 Jan '00

[hmm, may be a duplicate, but I did not see it come through the list] Well, I have been gone for a month and I just grabbed 1.3.12 (upgrading from 1.3.5). However, when I try to run it, it complains: sun-streams support not compiled in (STREAM=/dev/log) Error initializing configuration, exiting. I can't find an option to turn on sun-streams, it appeared to be the default in 1.3.5. The lines in the conf file that cause this are: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; Thanks!

1 0

Solaris Streams support
by John Arthur Kane 11 Jan '00

11 Jan '00

Well, I have been gone for a month and I just grabbed 1.3.12 (upgrading from 1.3.5). However, when I try to run it, it complains: sun-streams support not compiled in (STREAM=/dev/log) Error initializing configuration, exiting. I can't find an option to turn on sun-streams, it appeared to be the default in 1.3.5. The lines in the conf file that cause this are: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; Thanks!

1 0

Error Message
by Andreas Zymny 10 Jan '00

10 Jan '00

This Error-Message I found in my syslog logfile: assertion "i < nfds" failed: file "io.c", line 172 There is an other problem in the "io.c" source. On my computer, the syslog-nd often dies with a message in the syslog logfile: Jan 6 11:09:10 syslog-ng[6929]: io.c: do_write: write() failed (errno 32), Broken pipe Jan 7 15:20:14 syslog-ng[11521]: io.c: do_write: write() failed (errno 32), Broken pipe Jan 7 16:46:57 syslog-ng[13775]: io.c: do_write: write() failed (errno 32), Broken pipe Jan 10 11:35:00 syslog-ng[19065]: io.c: do_write: write() failed (errno 32), Broken pipe Only an "kill -9" can kill the syslog-ng, and I can't reproduce this error. On both server (my machine an the log server) is FreeBSD installed (3.3 on my machine, 4.0 on the Server). Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

1 0

Lost tcp connections not reopened
by Gary Carroll 06 Jan '00

06 Jan '00

Hi, this is a problem with syslog-ng.1.3.12 on Solaris.... System 1 forwards using tcp to System 2, both using syslog-ng. System 2 syslog-ng is hupped (kill -HUP `cat syslog-ng.pid`) and reinitializes as normal. System 1 loses tcp connection and writes internal message "Connection broken, reopening in 60 seconds". BUT the connection is not reopened and the forwarded data is lost until System 1 syslog-ng is hupped. Then everything is OK again. It would be really nice if the connection were reopened automatically. Thanks, Gary Carroll

1 0

Re: syslog-ng digest, Vol 1 #132 - 2 msgs
by Andreas Zymny 05 Jan '00

05 Jan '00

On Wed, 5 Jan 2000 syslog-ng-admin(a)venus.terrasoft.hu wrote: > When replying, please edit your Subject line so it is more specific than > "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Filter operator "not" does not work (Andreas Zymny) > 2. Re: Filter operator "not" does not work (Balazs Scheidler) > > --__--__-- > > Message: 1 > Date: Tue, 4 Jan 2000 17:56:59 +0000 (GMT) > From: Andreas Zymny <anzy(a)du.gtn.com> > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Filter operator "not" does not work > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, > > I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" > operator for the filters doesn't work in the 1.3.11 version. > > bash-2.03# /usr/sbin/syslogd > parse error at 13 > Parse error reading configuration file, exiting. > > Andreas Zymny (Technik) > [a.zymny(a)dpn.de] > -- > DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 > Bismarckstr. 120 fax: +49 203 3093 112 > D-47057 Duisburg http://www.dpn.de > > > --__--__-- > > Message: 2 > Date: Tue, 4 Jan 2000 18:10:52 +0100 > From: Balazs Scheidler <bazsi(a)balabit.hu> > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re: [syslog-ng] Filter operator "not" does not work > Reply-To: syslog-ng(a)lists.balabit.hu > > On Tue, Jan 04, 2000 at 05:56:59PM +0000, Andreas Zymny wrote: > > Hi, > > > > I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" > > operator for the filters doesn't work in the 1.3.11 version. > > > > bash-2.03# /usr/sbin/syslogd > > parse error at 13 > > Parse error reading configuration file, exiting. > > Version 1.3.11 had a major problem in the parser, which I have fixed in the > just released 1.3.12. Please test this release too. I think, there is still a problem in the parser, while this line doesn't work: filter f_all { host("install1") not match("sshd"); }; When the "not" is exchanged with by "and" or "or", all works fine. Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

2 1

Re: syslog-ng digest, Vol 1 #132 - 2 msgs
by Andreas Zymny 05 Jan '00

05 Jan '00

On Wed, 5 Jan 2000 syslog-ng-admin(a)venus.terrasoft.hu wrote: > When replying, please edit your Subject line so it is more specific than > "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Filter operator "not" does not work (Andreas Zymny) > 2. Re: Filter operator "not" does not work (Balazs Scheidler) > > --__--__-- > > Message: 1 > Date: Tue, 4 Jan 2000 17:56:59 +0000 (GMT) > From: Andreas Zymny <anzy(a)du.gtn.com> > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Filter operator "not" does not work > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, > > I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" > operator for the filters doesn't work in the 1.3.11 version. > > bash-2.03# /usr/sbin/syslogd > parse error at 13 > Parse error reading configuration file, exiting. > > Andreas Zymny (Technik) > [a.zymny(a)dpn.de] > -- > DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 > Bismarckstr. 120 fax: +49 203 3093 112 > D-47057 Duisburg http://www.dpn.de > > > --__--__-- > > Message: 2 > Date: Tue, 4 Jan 2000 18:10:52 +0100 > From: Balazs Scheidler <bazsi(a)balabit.hu> > To: syslog-ng(a)venus.terrasoft.hu > Subject: Re: [syslog-ng] Filter operator "not" does not work > Reply-To: syslog-ng(a)lists.balabit.hu > > On Tue, Jan 04, 2000 at 05:56:59PM +0000, Andreas Zymny wrote: > > Hi, > > > > I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" > > operator for the filters doesn't work in the 1.3.11 version. > > > > bash-2.03# /usr/sbin/syslogd > > parse error at 13 > > Parse error reading configuration file, exiting. > > Version 1.3.11 had a major problem in the parser, which I have fixed in the > just released 1.3.12. Please test this release too. Fine, I will get the new version, and test it. Yesterday, I send your syslog-ng a "kill -HUP" to initiate the reload of the configuration file (with the "not" operator). The syslog-ng doesn't shutdown the process, and doesn't told me, that there is an configuration error. He was still using the older - and correct - configuration file. Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

1 0

Filter operator "not" does not work
by Andreas Zymny 04 Jan '00

04 Jan '00

Hi, I'm setting up your syslog-ng on an FreeBSD 4.0, and the "not" operator for the filters doesn't work in the 1.3.11 version. bash-2.03# /usr/sbin/syslogd parse error at 13 Parse error reading configuration file, exiting. Andreas Zymny (Technik) [a.zymny(a)dpn.de] -- DPN Verbund-Zentrale GTN mbH fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg http://www.dpn.de

2 1

syslog-ng 1.3.11 and libol 0.2.11
by Balazs Scheidler 03 Jan '00

03 Jan '00

Hi, I've released syslog-ng 1.3.11 and libol 0.2.11, which hopefully fixes some source pipe related problems (HP-UX), and some problems with dropped destinations connections not reopened. HP-UX problems may have been fixed, but I'm not sure, if all of them. Source pipes are reopened if an EOF is received on them, but I don't know if this is the correct behaviour. If it doesn't work on HP-UX, please send me a syscall-trace on logger, the original syslogd and syslog-ng, which includes strings received and sent over a pipe. (under linux this is default, but the max. length of strings can be set with the -s switch, Solaris has this feature too, so I'm sure HP-UX is able to do this as well). -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

TCP problems patch
by Balazs Scheidler 29 Dec '99

29 Dec '99

Hi, I tried to fix the TCP related bugs reported by many people. There are two patches, one against libol0.2.10, and one against syslog-ng1.3.10, please test if these fix the encountered problems, or not. diff -urN libol-0.2.10/src/io.c libol-0.2.11/src/io.c --- libol-0.2.10/src/io.c Thu Dec 16 18:15:39 1999 +++ libol-0.2.11/src/io.c Mon Dec 27 23:53:38 1999 @@ -232,16 +232,16 @@ WRITE_FD(fd); else { verbose("io_iter(): POLLHUP on inactive fd!\n"); - closekill_fd(fd, CLOSE_EOF); + close_fd(fd, CLOSE_EOF); } continue; } if (fds[i].revents & POLLPRI) { - closekill_fd(fd, CLOSE_PROTOCOL_FAILURE); + close_fd(fd, CLOSE_PROTOCOL_FAILURE); continue; } if (fds[i].revents & (POLLNVAL | POLLERR)) - closekill_fd(fd, CLOSE_POLL_FAILED); + close_fd(fd, CLOSE_POLL_FAILED); if (fds[i].revents & POLLOUT) if (fd->want_write && fd->write) WRITE_FD(fd); @@ -270,7 +270,7 @@ } } if (!nfds && !nco) { - verbose("io_iter(): no waiting fds and no callouts! exiting...\n"); + werror("No listening fds and no pending events, exiting...\n"); return 0; } return 1; @@ -486,7 +486,7 @@ res = BUF_FLUSH(self->buffer, &w.super); if (ST_CLOSEDP(res)) { - closekill_fd(fd, ST_FAILUREP(res) ? CLOSE_PROTOCOL_FAILURE : CLOSE_EOF); + close_fd(fd, ST_FAILUREP(res) ? CLOSE_PROTOCOL_FAILURE : CLOSE_EOF); } } diff -urN libol-0.2.10/src/pkt_buffer.c libol-0.2.11/src/pkt_buffer.c --- libol-0.2.10/src/pkt_buffer.c Thu Dec 16 18:12:21 1999 +++ libol-0.2.11/src/pkt_buffer.c Mon Dec 27 23:49:20 1999 @@ -109,8 +109,8 @@ } } else { - werror("pkt_buffer::do_flush(): Error flushing data\n"); - return ST_FAIL | ST_CLOSE; + verbose("pkt_buffer::do_flush(): Error flushing data\n"); + return ST_CLOSE; } } return ST_OK | ST_GOON; this against syslog-ng: diff -urN syslog-ng-1.3.10/src/log.c syslog-ng-1.3.11/src/log.c --- syslog-ng-1.3.10/src/log.c Mon Nov 22 19:26:16 1999 +++ syslog-ng-1.3.11/src/log.c Mon Dec 27 23:45:02 1999 @@ -116,9 +116,15 @@ src = oldsrc; left = oldleft; } + + while (left && *src == ' ') { + src++; /* skip whitespace */ + left--; + } oldsrc = src; oldleft = left; + while (left && *src != ':' && *src != '[') { src++; left--; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Preserving the Source device attributes while forwarding messages
by Ofer_Aaronson＠amat.com 29 Dec '99

29 Dec '99

Hello , I'm a new member of this list and trying to forward messages by invoking a logger command : The following is an example of a message received at the NMS system . Source Message temp00r1 %LINK-3-UPDOWN: Interface BRI1/3:1, changed state to down It would automatically invoke a logger command : % logger -p local7.notice -t temp00r1 %LINK-3-UPDOWN: Interface BRI1/3:1, changed state to down This command is run on hostname: Host-A The syslog-ng.conf file on Host-A looks like : options { long_hostname(off); }; destination temp00r1{ udp("Host-B" port(514)); }; filter temp00r1 { program("temp00r1"); }; log ( source(local); filter(temp00r1); destination(temp00r1); }; The above 'logger' command is received at "Host-B" host the follows : Date IP Host Facility Priority Message Time Address Name Source Source ------------------------------------------------------------------------------------------------------------------------ 12/22/99 2:19 Host-A's IP Host-A LOCAL7 NOTICE Dec 22 2:18:37 Host-A temp00r1: %LINK-3-UPDOWN: Interface BRI1/3:1, changed state to down The desired received message would be : 12/22/99 2:19 temp00r1's IP temp00r1 LOCAL7 NOTICE Dec 22 2:18:37 temp00r1 %LINK-3-UPDOWN: Interface BRI1/3:1, changed state to down Is there anyway to make syslog-ng initiate the Trap as like it is the original device . Any idea / help would be highly appreciated . Thanks , Ofer Aaronson --------------- Network Management Architecture Manager Global Network Services Applied Materials Inc. mailto://Ofer_Aaronson@amat.com/

2 1

using syslog-ng for syslog forwarding
by Markus Warg 29 Dec '99

29 Dec '99

Hi all, has anybody tried the following: redirect logging to a single log host (simple so far) with tcp. Use syslog-ng both for the log host and the log clients. What happens if the connection between client and host times out? Does syslog-ng store messages until it can successfully connect to the log host again or are those messages lost? Sorry if this was discussed before, but I could not find it in my current mailing list archive. regards, Markus -- DPN Verbund-Zentrale http://www.dpn.de/ fon: +49 203 3093 101 Bismarckstr. 120 fax: +49 203 3093 112 D-47057 Duisburg Deutsches Provider Network Markus.Warg(a)dpn.de

4 5

Feature request =)
by Nigel Bovey 22 Dec '99

22 Dec '99

Now that the $HOST thing is working great, how about a new feature for making directories if they don't exist. Eg, I'll be switching a large number of machines to point towards the new syslog host, and instead of having to go through and create the directories for each host, it'd be nice for the program to auto create them if needed. Obviously, this should be configurable. Its no biggie, but just thought it'd be a nice feature =) --- Nigel Bovey IHUG Network Operations Team

2 2

use_dns problem
by Nigel Bovey 22 Dec '99

22 Dec '99

With 1.3.10 if you have use_dns(no) it still looks things up in the hosts file. Other than that, its working great. --- Nigel Bovey IHUG Network Operations Team

1 0

syslog-ng 1.3.10.. kern coming up user.
by John Wingenbach 21 Dec '99

21 Dec '99

I have configured my local client and my loghost to use syslog-ng v 1.3.10. The client is setup to send all syslog messages to the loghost and the loghost then breaks them apart mainly by facility. What I am seeing is that when I issue a "logger -p kern.notice testing kern.notice" it shows up locally as a user message. Here is the client config file: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/var/log/messages"); }; filter kernfilter { facility(kern); }; filter f_user { facility(user); }; destination loghost { udp("sysloguser" port(514)); }; destination ttys { usertty("*"); }; destination kern { file ("/var/log/kern"); }; destination user { file ("/var/log/user"); }; log { source(local); destination(all); }; log { source(local); destination(loghost); }; log { source(local); filter(kernfilter); destination(kern); }; log { source(local); filter(f_user); destination(user); }; -- John C. Wingenbach Broadband Technologies Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

3 2

Re: syslog-ng performance question
by Balazs Scheidler 21 Dec '99

21 Dec '99

> About how many messages per second do you think syslog-ng can process? > > I know it depends on a lot of factors, but have you done any testing? Sending messages in an infinite loop from shell script causes no problem. Even if several scripts are running at the same time. However if this is done from within a compiled C program, it may lose messages if non-connection-oriented messages are used (udp, and unix-dgram). Sending messages from C meant about 3000 accepted messages per second. (e.g. messages which were actually written to the logfile), while the C program sent about 25000 messages per second. Lost messages are caused by garbage collection. While it runs, syslog-ng doesn't fetch messages from the kernel queue. You can set the number of allocated objects when the gc runs with the gc_threshold option. The larger this value is, the longer the gc phase will run (of course if it's larger it runs less times). So syslog-ng can work with at most 3000 messages per second if used with connectionless protocols. Connection oriented protocols will block the sending process while the message is sent. Messages are not lost, but overall system performance decreases because of logging. I measured this on my Celeron 300A running at 450Mhz (100Mhz FSB, 128k full-speed cache, 64MB 100Mhz SDRAM) with a threshold value of 1000. I think threshold should be set to largest burst you are counting for. 3000 messages / second means about 300000 bytes log info per second, 18megs in a minute, 1 gigs in an hour, and 24 gigs in a day. (using an estimate of 100 bytes per message) I may try to add more options to finetune gc phase in the future. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng 1.3.10
by George Madden 20 Dec '99

20 Dec '99

I just downloaded the latest version of syslog-ng (1.3.10) and libol-0.2.10. I having a problem when sending a kill -HUP to it on both RedHat 6.1 and FreeBSD 3.2R. It won't restart. The CPU load goes up and it won't take a kill. I have to do a kill -9 to stop the process. Has anyone else had any problems?

1 0

Filters not working at all?
by John Wingenbach 20 Dec '99

20 Dec '99

I have syslog-ng V 1.3.8 installed on Solaris 2.6 system. I can't seem to get the range specification for filters to work properly (e.g. level(debug..emerg))). Instead only a single level is stored in the file. Here is my current syslog config file: source s_all { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; filter f_warning { level(warning..emerg); }; filter f_debug { level(debug..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_emerg { level(emerg); }; filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon); }; filter f_auth { facility(auth); }; filter f_lpr { facility(lpr); }; filter f_news { facility(news); }; filter f_kern { facility(kern); }; filter f_uucp { facility(uucp); }; filter f_cron { facility(cron); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_SanUser { not facility(user); }; destination d_all { file("/var/log/messages"); }; destination d_ttys { usertty("*"); }; destination d_console { file ("/dev/console"); }; destination d_kernfile { file ("/var/log/kern"); }; destination d_syslogfile { file ("/var/log/syslog"); }; destination d_userfile { file ("/var/log/user"); }; destination d_mailfile { file ("/var/log/mail"); }; destination d_mailcritfile { file ("/var/log/mail.crit"); }; destination d_mailwarnfile { file ("/var/log/mail.warning"); }; destination d_daemonfile { file ("/var/log/daemon"); }; destination d_authfile { file ("/var/log/auth"); }; destination d_lprfile { file ("/var/log/lpr"); }; destination d_newsfile { file ("/var/log/news"); }; destination d_uucpfile { file ("/var/log/uucp"); }; destination d_cronfile { file ("/var/log/cron"); }; destination d_local0file { file ("/var/log/local0"); }; destination d_local1file { file ("/var/log/local1"); }; destination d_local2file { file ("/var/log/local2"); }; destination d_local3file { file ("/var/log/local3"); }; destination d_local4file { file ("/var/log/local4"); }; destination d_local5file { file ("/var/log/local5"); }; destination d_local6file { file ("/var/log/local6"); }; destination d_local7file { file ("/var/log/local7"); }; log { source(s_all); filter(f_emerg); filter(f_SanUser); destination (d_ttys); }; #log { source(s_all); # filter (f_kernnotice); filter (f_authnotice); # destination (d_console); }; #log { source(s_all); # filter(f_ErrSanUser); filter (f_kerndebug); filter (f_daemonnotice); filter (f_mail); # destination (d_syslogfile); # }; log { source(s_all); filter (f_kern); filter (f_debug); destination (d_kernfile); }; log { source(s_all); filter (f_user); filter (f_debug); destination (d_userfile); }; log { source(s_all); filter (f_mail); filter (f_debug); destination (d_mailfile); }; log { source(s_all); filter (f_mail); filter (f_crit); destination (d_mailcritfile); }; log { source(s_all); filter (f_mail); filter (f_warning); destination (d_mailwarnfile); }; log { source(s_all); filter (f_daemon); filter (f_debug); destination (d_daemonfile); }; log { source(s_all); filter (f_auth); filter (f_debug); destination (d_authfile); }; log { source(s_all); filter (f_lpr); filter (f_debug); destination (d_lprfile); }; log { source(s_all); filter (f_news); filter (f_debug); destination (d_newsfile); }; log { source(s_all); filter (f_uucp); filter (f_debug); destination (d_uucpfile); }; log { source(s_all); filter (f_cron); filter (f_debug); destination (d_cronfile); }; log { source(s_all); filter (f_local0); destination (d_local0file); }; log { source(s_all); filter (f_local1); filter (f_debug); destination (d_local1file); }; log { source(s_all); filter (f_local2); destination (d_local2file); }; log { source(s_all); filter (f_local3); destination (d_local3file); }; log { source(s_all); filter (f_local4); filter (f_debug); destination (d_local4file); }; log { source(s_all); filter (f_local5); filter (f_debug); destination (d_local5file); }; log { source(s_all); filter (f_local6); filter (f_debug); destination (d_local6file); }; log { source(s_all); filter (f_local7); filter (f_debug); destination (d_local7file); }; -- John C. Wingenbach Broadband Technologies Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

3 2

Re: syslog-ng-1.2.3 compile problem on HP-UX 10.20
by Balazs Scheidler 19 Dec '99

19 Dec '99

On Sun, Dec 19, 1999 at 04:14:35PM +0100, Ralf Hildebrandt wrote: > Hi! > > Just a single error keeps me from building syslog-ng: > > make[1]: Entering directory /mnt/disk4/gnu/syslog-ng-1.2.3/src' > gcc -DHAVE_CONFIG_H -I. -I/users2/gnu/syslog-ng-1.2.3/src -I. -O2 -Wall > -I/users2/local/include/libol -c afstreams.c > afstreams.c: In function do_kill_door': > afstreams.c:60: warning: implicit declaration of function door_revoke' > afstreams.c: In function do_stream_read': > afstreams.c:106: structure has no member named pri' > afstreams.c: In function do_init_afstreams_source': > afstreams.c:209: I_CONSLOG' undeclared (first use in this function) > afstreams.c:209: (Each undeclared identifier is reported only once > afstreams.c:209: for each function it appears in.) > afstreams.c:246: too few arguments to function close_fd' > afstreams.c:206: warning: unused variable st' > afstreams.c: At top level: > afstreams.c:65: warning: make_door_fd' defined but not used > make[1]: *** [afstreams.o] Error 1 > make[1]: Leaving directory /mnt/disk4/gnu/syslog-ng-1.2.3/src' > make: *** [all-recursive] Error 1 > HP-UX doesn't have doors and STREAMS, it seems that the configure script doesn't detect this correctly. Try to set HAVE_SYS_STRLOG_H and HAVE_STROPTS_H to 0 in config.h and rebuild. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0