- syslog-ng - lists.balabit.hu

AW: [syslog-ng]logfile save problem (again ;)
by Buerger, Manfred 18 Jul '02

18 Jul '02

Hello, For test purposes i have changed my configuration, as you told me to do: now i try $HOST, $SOURCEIP and $SOURCE_IP for the destination folder, but nothing works! Take a look at my config, please: # Syslog-ng configuration. # # what the default options are for files that it writes # options { sync(0); time_reopen(10); log_fifo_size(100); }; source src { unix-stream("/dev/log"); internal(); udp(ip("0.0.0.0") port(514)); }; filter f_messages { facility(local7); }; filter f_bootlog { facility(local7); }; filter f_authlog { facility(local7); }; #i know that this filter config doesn´t make sense; its only for testing purposes! destination messages { file("/var/log/syslog-ng/$SOURCE_IP/messages" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; destination bootlog { file("/var/log/syslog-ng/$SOURCEIP/boot.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; destination authlog { file("/var/log/syslog-ng/$HOST/secure.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_bootlog); destination(bootlog); }; log { source(src); filter(f_authlog); destination(authlog); }; The results of this config: destination messages (with $SOURCE_IP in the pathname) writes the file "messages" to "/var/log/syslog-ng/messages" destination bootlog (with $SOURCEIP in the pathname) writes the file "boot.log" to "/var/log/syslog-ng/boot.log" destination authlog (with $HOST in the pathname) works fine for Cisco network components! e.g. the logfile is stored in "/var/log/syslog-ng/10.146.18.3".Well!!! As i wrote in an earlier mail it don´t work with enterasys/cabletron stuff. They build folders like this: /var/log/syslog-ng # ll total 79 drwxr-x--- 2 root root 72 Jul 9 17:56 %CLI-E-FACUNKNWN, drwxr-x--- 2 root root 72 Jul 13 20:16 %CLI-E-INCMPCMD, drwxr-x--- 2 root root 72 Jul 9 19:05 %CLI-W-MODNOTFOUND, drwxr-x--- 2 root root 72 Jul 17 07:38 %CONFIG-E-SEARCH, drwxr-x--- 2 root root 72 Jul 14 00:23 %CONFIG-I-NOCHANGES, At least please take a look at the Syslogmessages sent by different network components! The Enterasys/Cabletron components send messages like this: Jul 17 09:10:48 %STP-I-PORT_STATUS,/10.146.12.16 Port status change detected: et.1.7 - Port Down The Cisco´s use another formatting: Jul 18 09:31:02 10.146.18.3/10.146.18.3 5392: 3w2d: %AMDP2_FE-5-EXCESSCOLL: Ethernet1/0 TDR=2, TRC=0 Could this cause the problem?? What can I do?? (perhaps some important information: i am using syslog-ng version 1.4.14) Thank you in advance manfred bürger -----Ursprüngliche Nachricht----- Von: Balazs Scheidler [mailto:bazsi@balabit.hu] Gesendet: Mittwoch, 17. Juli 2002 13:35 An: syslog-ng(a)lists.balabit.hu Betreff: Re: [syslog-ng]logfile save problem (again ;) On Wed, Jul 17, 2002 at 11:33:41AM +0200, Buerger, Manfred wrote: > hello, > > i have changed my config as you told me to do: > > destination local7 { > file("/var/log/syslog-ng/$SOURCEIP/local7.log" > sync(0) log_fifo_size(10) create_dirs(yes) > owner(root) group(system) perm(0660) dir_perm(0770)); > }; > > but i have still the same problem! > the message: "Jul 17 02:19:19 %STATIC-W-GWAYNOTREACH,/10.146.18.5 Gateway > 172.28.3.126 is not reachable." > is stored in "/var/log/syslog-ng/%STATIC-W-GWAYNOTREACH,/local7.log" and not > in "/var/log/syslog-ng/10.146.18.5/local7.log" !!! Are you sure you have reloaded the configuration? SOURCE_IP always inserts IP addresses, as the following snippet shows: case M_SOURCE_IP: { char *ip; if (msg->saddr) { CAST(inet_address_info, addr, msg->saddr); ip = inet_ntoa(addr->sa.sin_addr); } else { ip = "127.0.0.1"; } length = append_string(dest, left, ip, strlen(ip), escape); break; } -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Syslog-ng doesn't parse certain log messages
by Michael Renner 17 Jul '02

17 Jul '02

Hi! It seems that our syslog-ng (1.5.18, upgraded from 1.5.14 today) stopped logging messages from some routers. It seems to be a syslog-ng problem because the routers don't have anything in common (except that all of them are ciscos, but completely different hardware/ios versions). My configuration (only the relevant parts of the configfile are shown): --- options { sync (0); log_fifo_size (1000); use_fqdn (yes); chain_hostnames(no); stats (3600); use_time_recvd(no); use_dns(no); }; source netrout { udp(ip(213.229.60.108) port(514)); }; destination router { file("/var/log/router/$HOST/$YEAR-$MONTH-$DAY" create_dirs(yes) template("$DATE $HOST $MSG\n")); }; destination unknown { file("/var/log/unknown/$HOST/$YEAR-$MONTH-$DAY" create_dirs(yes) template("$DATE $HOST $MSG\n")); }; filter f_router { facility(local1,local2,local3,local4,local5,local6,local7); }; log { source(netrout); filter(f_router); destination(router); flags(final); }; log { source(netrout); destination(unknown); flags(fallback); }; --- "tcpdump -i eth0 -n -X -s0 port 514 and src 195.58.180.178" shows the following ouptut: This is a packet which doesn't get logged: 15:35:02.920137 195.58.180.178.54088 > 213.229.60.108.514: udp 129 0x0000 4500 009d 3294 0000 fc11 017d c33a b4b2 E...2......}.:.. 0x0010 d5e5 3c6c d348 0202 0089 545b 3c31 3733 ..<l.H....T[<173 0x0020 3e32 3733 3332 3136 3a20 4a75 6c20 3137 >2733216:.Jul.17 0x0030 2031 353a 3335 3a30 322e 3135 3520 4d45 .15:35:02.155.ME 0x0040 542d 4453 543a 2025 4c49 4e45 5052 4f54 T-DST:.%LINEPROT 0x0050 4f2d 352d 5550 444f 574e 3a20 4c69 6e65 O-5-UPDOWN:.Line 0x0060 2070 726f 746f 636f 6c20 6f6e 2049 6e74 .protocol.on.Int 0x0070 6572 6661 6365 2056 6972 7475 616c 2d41 erface.Virtual-A 0x0080 6363 6573 7338 3135 2c20 6368 616e 6765 ccess815,.change 0x0090 6420 7374 6174 6520 746f 2075 70 d.state.to.up --- "tcpdump -i eth0 -n -X -s0 port 514 and src 195.58.172.146" shows the following ouptut: This is a packet which gets correctly logged: 15:36:49.431070 195.58.172.146.9914 > 213.229.60.108.514: udp 123 0x0000 4500 0097 2c3a 0000 fc11 0ffd c33a ac92 E...,:.......:.. 0x0010 d5e5 3c6c 26ba 0202 0083 7d61 3c31 3733 ..<l&.....}a<173 0x0020 3e31 3538 3431 3837 3a20 4a75 6c20 3137 >1584187:.Jul.17 0x0030 2031 353a 3336 3a34 382e 3532 3020 4d45 .15:36:48.520.ME 0x0040 542d 4453 543a 2025 4c49 4e45 5052 4f54 T-DST:.%LINEPROT 0x0050 4f2d 352d 5550 444f 574e 3a20 4c69 6e65 O-5-UPDOWN:.Line 0x0060 2070 726f 746f 636f 6c20 6f6e 2049 6e74 .protocol.on.Int 0x0070 6572 6661 6365 2053 6572 6961 6c31 3a32 erface.Serial1:2 0x0080 2c20 6368 616e 6765 6420 7374 6174 6520 ,.changed.state. 0x0090 746f 2064 6f77 6e to.down --- I doubt that there's a permission problem on the syslog-ng side (All dirs have the permissions bits 700, logfiles 600; everything owned by root:root), the local syslog messages (internal()) don't show any suspicious messages (none at all). Can you give me a hint on how to resolve this problem? mfg/best regards -- Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at/ Michael Renner - Junior System Engineer m.renner(a)inode.at, Tel.: +43 59999 0 Fax.: +43 59999 6599 Buero Wien - Millennium Tower Handelskai 94-96/43 - A-1200 Wien Buero Graz - Schmiedlstrasse 1 - A-8042 Graz Buero Sbg - Schillerstrasse 30 - A-5020 Salzburg Buero Ibk - Eduard Bodem Gasse 5-7 - A-6020 Innsbruck

1 0

AW: [syslog-ng]logfile save problem (again ;)
by Buerger, Manfred 17 Jul '02

17 Jul '02

hello, i have changed my config as you told me to do: destination local7 { file("/var/log/syslog-ng/$SOURCEIP/local7.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; but i have still the same problem! the message: "Jul 17 02:19:19 %STATIC-W-GWAYNOTREACH,/10.146.18.5 Gateway 172.28.3.126 is not reachable." is stored in "/var/log/syslog-ng/%STATIC-W-GWAYNOTREACH,/local7.log" and not in "/var/log/syslog-ng/10.146.18.5/local7.log" !!! i hope you can help me once more manfred bürger -----Ursprüngliche Nachricht----- Von: Balazs Scheidler [mailto:bazsi@balabit.hu] Gesendet: Dienstag, 16. Juli 2002 10:21 An: syslog-ng(a)lists.balabit.hu Betreff: Re: [syslog-ng]logfile save problem (again ;) On Tue, Jul 16, 2002 at 09:48:45AM +0200, Buerger, Manfred wrote: > hello, > > I have allready posted my syslog-ng problem to this mailinglist on friday; > now, I hope I can make things more clear: > > I am using Suse8.0 with syslog-ng to monitor enterasys ans cabletron network > equipment (switches, routers.... ); and have some problems with the > configuration: > > in my syslog-ng.conf: > > destination local7 { > file("/var/log/syslog-ng/$HOST/local7.log" > sync(0) log_fifo_size(10) create_dirs(yes) > owner(root) group(system) perm(0660) dir_perm(0770)); > }; > > because of this configuration a system message like: > "Jul 15 13:56:28 %STP-I-PORT_STATUS,/10.146.12.16 Port status change > detected: et.3.6 - Port Up" > should be stored in "/var/log/syslog-ng/10.146.12.16/local7.log" > but it´s stored in: "/var/log/syslog-ng/%STP-I-PORT_STATUS,/local7.log". destination local7 { file("/var/log/syslog-ng/$SOURCEIP/local7.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; here's the list of macros you can use: { "FACILITY", M_FACILITY }, { "PRIORITY", M_LEVEL }, { "LEVEL", M_LEVEL }, { "TAG", M_TAG }, { "DATE", M_DATE }, { "FULLDATE", M_FULLDATE }, { "ISODATE", M_ISODATE }, { "YEAR", M_YEAR }, { "MONTH", M_MONTH }, { "DAY", M_DAY }, { "HOUR", M_HOUR }, { "MIN", M_MIN }, { "SEC", M_SEC }, { "WEEKDAY", M_WEEKDAY }, { "UNIXTIME", M_UNIXTIME }, { "R_DATE", M_DATE_RECVD }, { "R_FULLDATE", M_FULLDATE_RECVD }, { "R_ISODATE", M_ISODATE_RECVD }, { "R_YEAR", M_YEAR_RECVD }, { "R_MONTH", M_MONTH_RECVD }, { "R_DAY", M_DAY_RECVD }, { "R_HOUR", M_HOUR_RECVD }, { "R_MIN", M_MIN_RECVD }, { "R_SEC", M_SEC_RECVD }, { "R_WEEKDAY", M_WEEKDAY_RECVD }, { "R_UNIXTIME", M_UNIXTIME_RECVD }, { "S_DATE", M_DATE_STAMP }, { "S_FULLDATE", M_FULLDATE_STAMP }, { "S_ISODATE", M_ISODATE_STAMP }, { "S_YEAR", M_YEAR_STAMP }, { "S_MONTH", M_MONTH_STAMP }, { "S_DAY", M_DAY_STAMP }, { "S_HOUR", M_HOUR_STAMP }, { "S_MIN", M_MIN_STAMP }, { "S_SEC", M_SEC_STAMP }, { "S_WEEKDAY", M_WEEKDAY_STAMP }, { "S_UNIXTIME", M_UNIXTIME_STAMP }, { "HOST_FROM", M_HOST_FROM }, { "FULLHOST_FROM", M_FULLHOST_FROM }, { "HOST", M_HOST }, { "FULLHOST", M_FULLHOST }, { "PROGRAM", M_PROGRAM }, { "MSG", M_MESSAGE }, { "MESSAGE", M_MESSAGE }, { "SOURCEIP", M_SOURCE_IP } you might also use HOST_FROM or FULLHOST_FROM if you want hostnames instead of IPs (though it requires use_dns(yes)) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

getting duplicated entries in messages-file
by Reinhold.Farsch＠HVBInfo.com 17 Jul '02

17 Jul '02

Hi, maybe there is a posting covering my question... I installed syslog-ng 1.4.15 on a Solaris 8 box. I use an default configfile from the contrib directory. Every time there is a log message I get up to four entries in my logfile. Is anybody using this configfile? Where is the problem? Regards Reinhold # syslog-ng configuration file. # # This should behave pretty much like the original syslog on SunOS. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/messages"); }; destination d_mail { file("/var/log/syslog"); }; destination d_auth { file("/var/log/authlog"); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { level(err) or (level(notice) and facility (auth, kern)); }; filter f_filter2 { level(err) or (facility(kern) and level(notice)) or (facility(daemon) and level(notice)) or (facility(mail) and level(crit)); }; filter f_filter3 { level(alert) or (facility(kern) and level(err)) or (facility(daemon) and level(err)); }; filter f_filter4 { level(alert); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(kern) and level(notice); }; filter f_filter7 { facility(mail) and level(debug); }; filter f_filter8 { facility(user) and level(err); }; filter f_filter9 { facility(user) and level(alert); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_mlop); }; log { source(s_sys); filter(f_filter4); destination(d_mlrt); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_auth); }; log { source(s_sys); filter(f_filter7); destination(d_mail); }; log { source(s_sys); filter(f_filter8); destination(d_cons); destination(d_mesg); }; log { source(s_sys); filter(f_filter9); destination(d_mlop); destination(d_mlrt); }; Mit freundlichen Grüßen Reinhold Farsch HVBInfo GmbH Abt. INF5M2 - Unix Systeme :: Am Tucherpark 12, 80538 München :: phone: +49(0)89-378-31892 :: fax: +49(0)89-378-23375 :: e-mail: Reinhold.Farsch(a)HVBInfo.com

1 0

remote logging problem syslog-ng logging between routable public networks (?)
by Adam Tworkowski 16 Jul '02

16 Jul '02

Hi, I've searched high and low and I can't find the answer to the following scenario: I would like to be able to use a remote logging host across the internet (I reckognize that security concerns of not using a VPN). I *am* able to do syslog-ng to syslog-ng remote logging on the same network segment. There is no issue here. I cannot log across a LAN extension or across the internet at large. I've tried UDP and TCP. I've even successfully sniffed packets on the remote log server that were sent across the internet. Is there an issue with bridges, routers or ARP and syslog-ng? As far as I can tell, the only difference between the various hosts I am trying to log from is geographic location and network location. Same OS. Same versions, same syslog-ng.conf. I am using Debian 3.0 with syslog-ng 1.5.18. Thanks in advance. Adam Tworkowski

3 2

(no subject)
by gino latino 16 Jul '02

16 Jul '02

HI *, there was someone who tried syslog-ng 1.4.15 undev FreeBSD 4.6-RELEASE???? I tried and the result was unsuccesfull.... This is the configuration: ########################################################################## options { long_hostnames(off); keep_hostname(no); sync(0); use_dns(no); log_fifo_size(1000); gc_idle_threshold(100); gc_busy_threshold(3000); }; ########################################################################## source src { unix-dgram("/var/run/log"); internal(); udp(ip(0.0.0.0) port(514)); }; ########################################################################### ###Destination #Sorting degl'hosts # destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; # destination all { file("/var/log/all.log" owner(root) group(root) perm(0640)); }; # destination send_trap_prova { program("/home/bigjim/send_trap_prova"); }; # ############################################################################ ####Filtering # filter f_prova { host ("10.11.5.37") and not match ("message repeated"); }; # ############################################################################# ###Logging # log { source(src); destination(hosts); }; # log { source(src); destination(all); }; # log { source(src); filter(f_prova); destination(send_trap_prova); }; # ############################################################################# The attachment is the core dump file. Thnz Cheers ___________________________________ There is no 'patch' for stupidity _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com

3 6

logfile save problem (again ;)
by Buerger, Manfred 16 Jul '02

16 Jul '02

hello, I have allready posted my syslog-ng problem to this mailinglist on friday; now, I hope I can make things more clear: I am using Suse8.0 with syslog-ng to monitor enterasys ans cabletron network equipment (switches, routers.... ); and have some problems with the configuration: in my syslog-ng.conf: destination local7 { file("/var/log/syslog-ng/$HOST/local7.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; because of this configuration a system message like: "Jul 15 13:56:28 %STP-I-PORT_STATUS,/10.146.12.16 Port status change detected: et.3.6 - Port Up" should be stored in "/var/log/syslog-ng/10.146.12.16/local7.log" but it´s stored in: "/var/log/syslog-ng/%STP-I-PORT_STATUS,/local7.log". what can i do?? Please help me!!! Thanks in advance manfred

2 1

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 15 Jul '02

15 Jul '02

Hi Bazsi, Thanks for your reply first of all! And sorry for the second email in HTML secondly. This one should be ok (I tested :-). Ok, let's go to the point. I've never used strace but I'll try it. Yes, my program is using buffer and actually that's the first thing I checked. But I'm pretty sure it's not there. This is somewhat related to pipe openning. If I make sure syslog-ng opens the pipe before my program, then everything is OK. The code in my program is something like this: . . initializing . . while(1) { open pipe #block here until syslog-ng open the pipe while(1) { select on the pipe #block here until the pipe is ready for read or timeout (5 sec) next if timeout last if other side close the pipe #jump out the loop and try to open pipe again read and process the message #normal } } Bazsi, you see anything wrong here? Thanks, Andy -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, July 15, 2002 10:59 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Strang behaviour of syslog-ng (and my program) On Mon, Jul 15, 2002 at 10:32:08AM -0400, Antai Ning wrote: > Hi Gents, > > I'm posting the question again because I really need an answer for it, > > Thanks a lot, can you check whether strace shows anything insane? are you using buffering in your perl program? syslog-ng uses a read/write pipe, and writes messages as soon as the pipe becomes writable. if the pipe is not writable (as indicated by poll), messages are buffered in a fifo, whose size is controlled by log_fifo_size(). -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Sorry, this is a test. Just ignore it.
by Antai Ning 15 Jul '02

15 Jul '02

Sorry guys, try to see if I'm still in HTML...

1 0

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 15 Jul '02

15 Jul '02

1 0

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 15 Jul '02

15 Jul '02

2 1

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 15 Jul '02

15 Jul '02

Hi Gents, I'm posting the question again because I really need an answer for it, Thanks a lot, Andy -----Original Message----- From: Antai Ning [mailto:aning@jetnet.ca] Sent: Wednesday, July 10, 2002 1:38 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Strang behaviour of syslog-ng (and my program) Hi Gurus, I got some strange phenomemon with syslog-ng. Here is what I'm doing. I configured syslog-ng to forward certain type of messages to a pipe. (say, ALERT). I wrote a program in perl to read from the pipe and print them out. The perl program first try to open the pipe and it'll block at the open function untill syslog-ng has some messages to write to the pipe. Then the perl program reads using IO::File can_read() function, with a 5 seconds timeout. So the function looks like this: $sel->can_read(5). Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my supprise, the perl program got only 2 of the 10! Then I send another 1 valid message to this syslog-ng after 5 minutes, and I got not only this message, but also the 8 I lost last time! This happens only for the first 10 messages (which includes the opening of the pipe). Everything is fine after the first round. It looks like it's related to the pipe opening and messages get queued somewhere until later messages trigger the queue to flush. So what's really happening inside? And is there a solution? Thanks, Andy Cofiguration: syslog-ng 1.4.11 on Redhat linux 7.2. And here is the syslog-ng globla option look like. (Sorry I can't post all the configuration because of obvious reasons :) ) But there is no options set for specific source, destionation or filter. options { use_dns (no); # Don't perform DNS lookups use_fqdn (no); # Don't use full hostname create_dirs (yes); # Create any necessary dirs for files use_time_recvd (yes); # Use our time, not the remote device time log_fifo_size(10000); # Queue 10000 msgs on a blocked dest sync(0); # Flush the queues as fast as possible # Tweak the sync parameter if the disks are # going wild and thrashing the machine chain_hostnames(on); # Chain hostname/IP information in log line }; source s_UDP { udp( ip(192.168.1.1) port(514) ); };

2 1

RE: [syslog-ng]Message aggregation
by Kevin Welch 15 Jul '02

15 Jul '02

I would have to agree with that accessment, it would definately make my perl scripts more complicated. I guess that given the choice I would prefer the detail over the summarization. Probably should have spent a bit more time thinking about why exactly I wanted that feature. Thanks for the response. -- Kevin -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Monday, July 15, 2002 6:33 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Message aggregation On Tue, Jul 09, 2002 at 07:02:19PM -0400, Kevin Welch wrote: > I know this issue has been discussed before, but I never saw an answer other > than 'syslog-ng doesnt do that'. > > Perhaps someone could provide insight as to why syslog-ng doesnt aggregate > messages received? Is this on a feature list for future releases? > > Thanks for your time. It might be implemented once I have time, though IMHO message aggregation makes log analysis more difficult, especially if you have multiple cascaded log relays. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Message aggregation
by Kevin Welch 15 Jul '02

15 Jul '02

I know this issue has been discussed before, but I never saw an answer other than 'syslog-ng doesnt do that'. Perhaps someone could provide insight as to why syslog-ng doesnt aggregate messages received? Is this on a feature list for future releases? Thanks for your time. -- Kevin

2 1

Re: [syslog-ng]dns caching
by Michael Renner 13 Jul '02

13 Jul '02

At 12:16 09.07.2002 +0200, you wrote: >i've been using syslog-ng for a while, and now that i've setup dnscache >(from djb) to use syslog instead of his own loggin method (multilog), i've >found a funny thing that fulls my log files. (dnscache pc and syslog-ng >hosting pc are different machines, i log through network). > >1- when a dnscache-request is made, dnscache issues a message to syslog-ng. >2- syslog-ng writes down to the syslog file the new entry, but it does a dns >lookup (because the log entry is coming from a machine on the network). >3- loop forever :) > >i don't want to use the use_dns(off) option of syslog-ng, because i wan't >ips translated. Is there a way that syslog-ng could cache the dns querys, so >id doesn't do one dns lookup for each line? This was discussed previously on this list; dns caching shouldn't be the job of syslog-ng and would need much "unnecessary" code in syslog-ng; there are other programs which are more capable of doing this (dnscache from djb). I would suggest that you stick with multilog because dnscache is quite verbose and logging these rather unnecessary messages via syslog-ng would waste lots of cpu cycles (you don't log your apache access-logs via syslog, do you?) mfg/best regards -- Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at/ Michael Renner - Junior System Engineer m.renner(a)inode.at, Tel.: +43 59999 0 Fax.: +43 59999 6599 Buero Wien - Millennium Tower Handelskai 94-96/43 - A-1200 Wien Buero Graz - Schmiedlstrasse 1 - A-8042 Graz Buero Sbg - Schillerstrasse 30 - A-5020 Salzburg Buero Ibk - Eduard Bodem Gasse 5-7 - A-6020 Innsbruck

2 1

[nate@campin.net: Re: Thanks for syslog-ng info]
by Dale Amon 12 Jul '02

12 Jul '02

1 0

syslog-ng compile errors
by Dale Amon 12 Jul '02

12 Jul '02

sed: can't read /usr/src/syslog-ng-1.5.18/utils/Makefile.in: No such file or directory creating syslog-ng.spec creating src/config.h src/config.h is unchanged > /usr/src/syslog-ng-1.5.18# ls /usr/src/syslog-ng-1.5.18/utils/ Makefile > /usr/src/syslog-ng-1.5.18# make Making all in src make[1]: Entering directory `/usr/src/syslog-ng-1.5.18/src' cd /usr/src/syslog-ng-1.5.18 && autoheader make all-recursive make[2]: Entering directory `/usr/src/syslog-ng-1.5.18/src' Making all in . make[3]: Entering directory `/usr/src/syslog-ng-1.5.18/src' make_class <main.c >main.c.xT /bin/sh: /usr/local/bin/make_class: \: bad interpreter: No such file or directory make[3]: *** [main.c.x] Error 126 make[3]: Leaving directory `/usr/src/syslog-ng-1.5.18/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/syslog-ng-1.5.18/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/src/syslog-ng-1.5.18/src' make: *** [all-recursive] Error 1

2 3

configuration problem: destination where the logfiles are saved
by Buerger, Manfred 12 Jul '02

12 Jul '02

hello, i have installed syslog-ng on Suse Linux 8.0, and i want to monitor the network components (switches, routers...). i have allready done the configuration in the syslog-ng.conf. with cisco components it works fine! the logs are correct stored in "/var/log/syslog-ng/$HOST/messages" . for each network host a seperate directory is generated, where the logs are stored! But this don´t work with enterasys and cabletron network equipment! instead of the host, the message itself bilds the directory: myhost:/var/log/syslog-ng # ls -ll total 2 drwxr-x--- 2 root root 72 Jul 9 17:56 %CLI-E-FACUNKNWN, drwxr-x--- 2 root root 72 Jul 9 22:40 %CLI-E-IVCMD, drwxr-x--- 2 root root 72 Jul 9 19:05 %CLI-E-IVPORTLIST, drwxr-x--- 2 root root 72 Jul 9 19:03 %SYS-I-BKPLANEOFFLINED, drwxr-x--- 2 root root 72 Jul 9 19:05 %SYS-I-DSCVMOD, drwxr-x--- 2 root root 72 Jul 9 19:05 %SYS-I-HOTSWAPIN, drwxr-x--- 2 root root 72 Jul 9 18:50 %SYS-I-HOTSWAPOUT, drwxr-x--- 2 root root 72 Jul 9 19:05 %SYS-I-HOTSWAP_INRXD, drwxr-x--- 2 root root 72 Jul 9 18:50 %SYS-I-HOTSWAP_OUTRXD, drwxr-x--- 2 root root 72 Jul 9 19:05 %SYS-I-INITPORT, drwxr-x--- 2 root root 72 Jul 9 18:19 %SYS-W-PWRFAIL, drwxr-x--- 2 root root 72 Jul 3 10:52 %TELNETD-W-IDLE_TIMEOUT, drwxr-x--- 2 root root 72 Jul 6 12:07 %TELNETD-W-LOGINFAIL, drwxr-x--- 2 root root 72 Jul 9 19:06 %VLAN-I-ADDSUCCESS, drwxr-x--- 2 root root 72 Jul 4 00:22 %WAN-I-MSG, drwxr-x--- 2 root root 72 Jul 9 10:13 10.146.18.3 the last directory "10.146.18.3" is correct, it contains the logs of a cisco device. how can i configure syslog-ng, that also the enterasys/cabletron devices build correct directory structure, like the cisco device does ??? thanks in advance manfred

1 0

Re: [syslog-ng]Syntax question
by Michael Earls 11 Jul '02

11 Jul '02

the pipe template is not supported in that ver, u need to switch to 1.5.x release >>> mdodson(a)coremetrics.com 07/11/02 11:26AM >>> I am using syslog-ng-1.4.15 with libol-0.2.23 on RH72 On Thu, 2002-07-11 at 10:15, Michael Earls wrote: > what ver of syslog-ng, b/c template() destinations are only supported by > the 1.5.x releases. > > michael > > >>> mdodson(a)coremetrics.com 07/11/02 11:01AM >>> > > > Every time I start syslog-ng I receive a "Parse error reading > configuration file, exiting." It points to the following line in my > config: > > destination d_pipe { pipe("/tmp/mysql.pipe" template("INSERT INTO logs > (host, facility, priority, level, tag, date, time, program, msg) VALUES > ('$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG');\n") > template_escape(yes)); }; > > > Can anyone tell me what is wrong with this syntax? > Sorry for this newbie question but I can't seem to get the syntax right. > > > Thanks, > Mdodson > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://lists.balabit.hu/mailman/listinfo/syslog-ng> > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > <http://www.campin.net/syslog-ng/faq.html> > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 2

Re: [syslog-ng]Syntax question
by Michael Earls 11 Jul '02

11 Jul '02

what ver of syslog-ng, b/c template() destinations are only supported by the 1.5.x releases. michael >>> mdodson(a)coremetrics.com 07/11/02 11:01AM >>> Every time I start syslog-ng I receive a "Parse error reading configuration file, exiting." It points to the following line in my config: destination d_pipe { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ('$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG');\n") template_escape(yes)); }; Can anyone tell me what is wrong with this syntax? Sorry for this newbie question but I can't seem to get the syntax right. Thanks, Mdodson _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Syntax question
by Matthew Dodson 11 Jul '02

11 Jul '02

Every time I start syslog-ng I receive a "Parse error reading configuration file, exiting." It points to the following line in my config: destination d_pipe { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ('$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG');\n") template_escape(yes)); }; Can anyone tell me what is wrong with this syntax? Sorry for this newbie question but I can't seem to get the syntax right. Thanks, Mdodson

1 0

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 11 Jul '02

11 Jul '02

syslog-ng 1.4.11 on Redhat linux 7.2. And here is the syslog-ng globla option look like. (Sorry I can't post all the configuration because of obvious reasons :) ) But there is no options set for specific source, destionation or filter. options { use_dns (no); # Don't perform DNS lookups use_fqdn (no); # Don't use full hostname create_dirs (yes); # Create any necessary dirs for files use_time_recvd (yes); # Use our time, not the remote device time log_fifo_size(10000); # Queue 10000 msgs on a blocked dest sync(0); # Flush the queues as fast as possible # Tweak the sync parameter if the disks are # going wild and thrashing the machine chain_hostnames(on); # Chain hostname/IP information in log line }; source s_UDP { udp( ip(192.168.1.1) port(514) ); }; destination d_alert { pipe ("/usr/local/var/ALERT"); }; filter f_alert { match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ..."); }; log { source(s_UDP); filter(f_alert); destination(d_alert); }; Thanks, Andy -----Original Message----- From: Michael Earls [mailto:Michael.Earls@chmcc.org] Sent: Thursday, July 11, 2002 10:13 AM To: aning(a)jetnet.ca; syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Strang behaviour of syslog-ng (and my program) What ver of syslog-ng? and what distro are u running syslog-ng on? what does your config look like? michael >>> aning(a)jetnet.ca 07/11/02 09:49AM >>> Just add a little more info, if I send the first 10 messages a little bit slower, say delay 10 msec in between, then it doesn't happen. -----Original Message----- From: Antai Ning [mailto:aning@jetnet.ca] Sent: Wednesday, July 10, 2002 1:38 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Strang behaviour of syslog-ng (and my program) Hi Gurus, I got some strange phenomemon with syslog-ng. Here is what I'm doing. I configured syslog-ng to forward certain type of messages to a pipe. (say, ALERT). I wrote a program in perl to read from the pipe and print them out. The perl program first try to open the pipe and it'll block at the open function untill syslog-ng has some messages to write to the pipe. Then the perl program reads using IO::File can_read() function, with a 5 seconds timeout. So the function looks like this: $sel->can_read(5). Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my supprise, the perl program got only 2 of the 10! Then I send another 1 valid message to this syslog-ng after 5 minutes, and I got not only this message, but also the 8 I lost last time! This happens only for the first 10 messages (which includes the opening of the pipe). Everything is fine after the first round. It looks like it's related to the pipe opening and messages get queued somewhere until later messages trigger the queue to flush. So what's really happening inside? And is there a solution? Thanks, Andy

1 0

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 11 Jul '02

11 Jul '02

syslog-ng 1.4.11 on Redhat linux 7.2. And here is the syslog-ng globla option look like. (Sorry I can't post all the configuration because of obvious reasons :) ) But there is no options set for specific source, destionation or filter. options { use_dns (no); # Don't perform DNS lookups use_fqdn (no); # Don't use full hostname create_dirs (yes); # Create any necessary dirs for files use_time_recvd (yes); # Use our time, not the remote device time log_fifo_size(10000); # Queue 10000 msgs on a blocked dest sync(0); # Flush the queues as fast as possible # Tweak the sync parameter if the disks are # going wild and thrashing the machine chain_hostnames(on); # Chain hostname/IP information in log line }; source s_UDP { udp( ip(192.168.1.1) port(514) ); }; destination d_alert { pipe ("/usr/local/var/ALERT"); }; filter f_alert { match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ...") or match("blah, blah ..."); }; log { source(s_UDP); filter(f_alert); destination(d_alert); }; Thanks, Andy -----Original Message----- From: Michael Earls [mailto:Michael.Earls@chmcc.org] Sent: Thursday, July 11, 2002 10:13 AM To: aning(a)jetnet.ca; syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Strang behaviour of syslog-ng (and my program) What ver of syslog-ng? and what distro are u running syslog-ng on? what does your config look like? michael >>> aning(a)jetnet.ca 07/11/02 09:49AM >>> Just add a little more info, if I send the first 10 messages a little bit slower, say delay 10 msec in between, then it doesn't happen. -----Original Message----- From: Antai Ning [mailto:aning@jetnet.ca] Sent: Wednesday, July 10, 2002 1:38 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Strang behaviour of syslog-ng (and my program) Hi Gurus, I got some strange phenomemon with syslog-ng. Here is what I'm doing. I configured syslog-ng to forward certain type of messages to a pipe. (say, ALERT). I wrote a program in perl to read from the pipe and print them out. The perl program first try to open the pipe and it'll block at the open function untill syslog-ng has some messages to write to the pipe. Then the perl program reads using IO::File can_read() function, with a 5 seconds timeout. So the function looks like this: $sel->can_read(5). Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my supprise, the perl program got only 2 of the 10! Then I send another 1 valid message to this syslog-ng after 5 minutes, and I got not only this message, but also the 8 I lost last time! This happens only for the first 10 messages (which includes the opening of the pipe). Everything is fine after the first round. It looks like it's related to the pipe opening and messages get queued somewhere until later messages trigger the queue to flush. So what's really happening inside? And is there a solution? Thanks, Andy

1 0

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Michael Earls 11 Jul '02

11 Jul '02

What ver of syslog-ng? and what distro are u running syslog-ng on? what does your config look like? michael >>> aning(a)jetnet.ca 07/11/02 09:49AM >>> Just add a little more info, if I send the first 10 messages a little bit slower, say delay 10 msec in between, then it doesn't happen. -----Original Message----- From: Antai Ning [mailto:aning@jetnet.ca] Sent: Wednesday, July 10, 2002 1:38 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Strang behaviour of syslog-ng (and my program) Hi Gurus, I got some strange phenomemon with syslog-ng. Here is what I'm doing. I configured syslog-ng to forward certain type of messages to a pipe. (say, ALERT). I wrote a program in perl to read from the pipe and print them out. The perl program first try to open the pipe and it'll block at the open function untill syslog-ng has some messages to write to the pipe. Then the perl program reads using IO::File can_read() function, with a 5 seconds timeout. So the function looks like this: $sel->can_read(5). Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my supprise, the perl program got only 2 of the 10! Then I send another 1 valid message to this syslog-ng after 5 minutes, and I got not only this message, but also the 8 I lost last time! This happens only for the first 10 messages (which includes the opening of the pipe). Everything is fine after the first round. It looks like it's related to the pipe opening and messages get queued somewhere until later messages trigger the queue to flush. So what's really happening inside? And is there a solution? Thanks, Andy

1 0

RE: [syslog-ng]Strang behaviour of syslog-ng (and my program)
by Antai Ning 11 Jul '02

11 Jul '02

Just add a little more info, if I send the first 10 messages a little bit slower, say delay 10 msec in between, then it doesn't happen. -----Original Message----- From: Antai Ning [mailto:aning@jetnet.ca] Sent: Wednesday, July 10, 2002 1:38 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]Strang behaviour of syslog-ng (and my program) Hi Gurus, I got some strange phenomemon with syslog-ng. Here is what I'm doing. I configured syslog-ng to forward certain type of messages to a pipe. (say, ALERT). I wrote a program in perl to read from the pipe and print them out. The perl program first try to open the pipe and it'll block at the open function untill syslog-ng has some messages to write to the pipe. Then the perl program reads using IO::File can_read() function, with a 5 seconds timeout. So the function looks like this: $sel->can_read(5). Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my supprise, the perl program got only 2 of the 10! Then I send another 1 valid message to this syslog-ng after 5 minutes, and I got not only this message, but also the 8 I lost last time! This happens only for the first 10 messages (which includes the opening of the pipe). Everything is fine after the first round. It looks like it's related to the pipe opening and messages get queued somewhere until later messages trigger the queue to flush. So what's really happening inside? And is there a solution? Thanks, Andy

1 0

Strang behaviour of syslog-ng (and my program)
by Antai Ning 10 Jul '02

10 Jul '02

Hi Gurus, I got some strange phenomemon with syslog-ng. Here is what I'm doing. I configured syslog-ng to forward certain type of messages to a pipe. (say, ALERT). I wrote a program in perl to read from the pipe and print them out. The perl program first try to open the pipe and it'll block at the open function untill syslog-ng has some messages to write to the pipe. Then the perl program reads using IO::File can_read() function, with a 5 seconds timeout. So the function looks like this: $sel->can_read(5). Then I send 10 valid messages to syslog-ng from a remote machine by UDP. To my supprise, the perl program got only 2 of the 10! Then I send another 1 valid message to this syslog-ng after 5 minutes, and I got not only this message, but also the 8 I lost last time! This happens only for the first 10 messages (which includes the opening of the pipe). Everything is fine after the first round. It looks like it's related to the pipe opening and messages get queued somewhere until later messages trigger the queue to flush. So what's really happening inside? And is there a solution? Thanks, Andy

1 0

RE: [syslog-ng]dns caching
by Torres Gallardo, Diego 09 Jul '02

09 Jul '02

>>id doesn't do one dns lookup for each line? >This was discussed previously on this list; sorry then, but i didn't find any archives of this list > I would suggest that you stick with multilog because dnscache is quite verbose and logging these rather unnecessary messages via syslog-ng of course the loggin messages from dnscache are quite overhelming, surely if i comment out some of this information from the source code of dnscache and recompile there won't be much loss... >would waste lots of cpu cycles (you don't log your apache access-logs via syslog, do you?) right, i don't have an apache server on the router box :)

1 0

dns caching
by Torres Gallardo, Diego 09 Jul '02

09 Jul '02

i've been using syslog-ng for a while, and now that i've setup dnscache (from djb) to use syslog instead of his own loggin method (multilog), i've found a funny thing that fulls my log files. (dnscache pc and syslog-ng hosting pc are different machines, i log through network). 1- when a dnscache-request is made, dnscache issues a message to syslog-ng. 2- syslog-ng writes down to the syslog file the new entry, but it does a dns lookup (because the log entry is coming from a machine on the network). 3- loop forever :) i don't want to use the use_dns(off) option of syslog-ng, because i wan't ips translated. Is there a way that syslog-ng could cache the dns querys, so id doesn't do one dns lookup for each line? _____________________________________ Diego Torres Gallardo Departamento Radar División de Navegación y Vigilancia AENA dtgallardo(a)aena.es (+34) 913215472

1 0

question about syslog-ng to MySQL
by Martin Hess 08 Jul '02

08 Jul '02

Hi all! I'm pretty new here in the hole syslog-ng world; so I have a litte question witch might sounds stupid for you... but any help would be great! I successfuly set up syslog-ng to log into the MySQL database. But now I want to filter the events before they are piped into the database (I don't want the logs from the cron jobs to be logged). Does anybody can tell me how I can achieve this?? Thanks in advance martin, switzerland

2 1

How do I stop "STATS: dropped 0" messages?
by Subodh Nijsure 05 Jul '02

05 Jul '02

Hello, I think I have read the man pages, and I missed how do I stop syslog-ng from generating the "STATS: dropped 0" messages? Is there option in config file I can specify? /Subodh

3 2

pipe() under hpux-11 and timestamp
by Trapp, Michael 05 Jul '02

05 Jul '02

hi, i am running syslog-ng 1.5.18 on hpux 11.00 with the following options: use_time_recvd(yes); use_fqdn(yes); sync(0); use_dns(yes); dns_cache(yes); dns_cache_size(10000); dns_cache_expire(3600); dns_cache_expire_failed(300); keep_hostname(no); chain_hostnames(no); gc_idle_threshold(50); gc_busy_threshold(5000); log_fifo_size(2000); reading from udp() and pipe() as far as i can see the pipe("/dev/log") isn't working correct. with a simple fgets() i can see that the messages are '0' terminated strings, but syslog-ng reads the whole message obviously each message has 4096 bytes and print out several lines filled up with characters from the buffer behind the string termination. i have also configured use_time_recvd(yes) but there are a few messages which don't have the right timestamp or are not in the right order (just a few seconds). in adition the day field of this lines has a leading '0'. has anybody experienced these problems? are there further options to improve the performance, as i can see syslog-ng still miss some packets. thanx michael

2 2

starting syslog-ng
by bert 04 Jul '02

04 Jul '02

Hi, I want to start syslog-ng before the network is running but my configuration script contains (among other destinations) a network reference. Hence syslog-ng is exiting due to an error in the initialisation. Is there a way to deal with this, so syslog-ng is starting and resolve the connection at the time the network starts up. Thanks, Bert

2 1

Long messages truncated in 1.5.x branch on Solaris 8
by Andreas Schulze 03 Jul '02

03 Jul '02

Hello, we are observing a wondrous behavior on our central logservers. We have an local application, that logs to the destinations above. And all messages greater that approx. 975 Bytes are truncated. But the enigma is: If using the local Solaris 'logger' application, all messages greater than 509 Bytes are truncated. But they are truncated on different positions depends on the message size! (Say, if you log 600 Bytes, you get the first 509 and if you try to log 761, you get the first 26.) Hmm ?! We tried out the log_msg_size() feature, available since 1.5.1?. With no luck. Both logservers using Solaris 8, one running syslog-ng 1.5.7, the other 1.5.18. We are using file() and pipe() destinations capable of queueing via log_fifo_size() and capable of formating output via template(..$MSG..\n). Before writing to the destinations, we do a lot of filtering, too. We are using the excellent syslog-ng a long time, but now we stuck inactive. Has anybody a hint for us? Is this a bug in syslog-ng, in Solaris, in our mind? Thanks a lot for any note. -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | | sh# cat>$$.c<<EOT | main(l,a,n,d)char**a;{for(d=atoi(a[1])/10*80-atoi(a[2])/5-596;n="@NK\ | ACLCCGZAAQBEAADAFaISADJABBA^SNLGAQABDAXIMBAACTBATAHDBANZcEMMCCCCAAhE\ | IJFAEAAABAfHJETBdFLDAANEfDNBPHdBcBBBEA_AL H E L L O, W O R L D! " | [l++-3];)for(;n-->64;)putchar(!d+++33^l&1);} | EOT | gcc -o$$ $$.c;clear;./$$ 52 8;rm -f $$*

2 5

Re: [syslog-ng]host x.x.x.111 is the same as x.x.x.11 (filter error?)
by Lubos Vitek 03 Jul '02

03 Jul '02

Thank you very much for your kind reply! It really works as you wrote :-) (with ^...$ RE). Now I have one another question. How can I filter out this kind of log record: datum hostX process some text with "xxxxx" string I want to write it in file for hostX.log, so I wrote filter: filter f_hostX { host("hostX"); }; then I wrote filter for string "xxxxx": filter f_notxxxxx { not match("xxxxx"); }; and then I used it all in log statement: log {... filter f_hostX ; filter f_notxxxxx ; ... } I tried to log something on host hostX with string "xxxxx", and I received it in syslog-ng in file hostX.log. Why ? What am I doing wrong now ? Please sorry if I missunderstand something, but I tried it more times with other combinations of filter, but the "NOT" statement simply does not work ... Thank you in advance for your reply... Bye, Lubos. __________________________________________________ Do You Yahoo!? Sign up for SBC Yahoo! Dial - First Month Free http://sbc.yahoo.com

2 1

host x.x.x.111 is the same as x.x.x.11 (filter error?)
by Lubos Vitek 02 Jul '02

02 Jul '02

Hallo, I have found a bug (or a feature?) in the syslog-ng daemon. I used a filter: filter f_host11 { host("192.168.1.11"); }; filter f_host111 { host("192.168.1.111"); }; destination d_host11 {file("/var/log/other/11.log");}; destination d_host111 {file("/var/log/other/111.log");}; log{source(s_other);filter(f_host11);destination(d_host11);}; log{source(s_other);filter(f_host111);destination(d_host111);}; Then, when I try to log something on 192.168.1.111, I receive a log record in both files: 111.log and 11.log too ! What am I doing wrong ? bye, Lubos. __________________________________________________ Do You Yahoo!? Sign up for SBC Yahoo! Dial - First Month Free http://sbc.yahoo.com

3 2

Solaris 2.6 + syslog-ng 1.5.18
by Sangbutsarakum, Patai 28 Jun '02

28 Jun '02

Dear lists, =1= I've tried to install 1.5.18 but without luck. My environment is Solaris 2.6 SPARC, I've success in 1.4.15 but I need TEMPLATE feature so I moved. To log to MySQL. Please suggest. =2= In case of tremendous of messages to log to MySQL via pipe method. Is that pipe tolerate for big load? Thanks in advances Pat. == Messages at Compile time == # ./configure creating cache ./config.cache checking for a BSD compatible install... ./install-sh -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking whether build environment is sane... yes checking for gcc... gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for bison... bison -y checking how to run the C preprocessor... gcc -E checking for flex... flex checking for flex... (cached) flex checking for yywrap in -lfl... yes checking lex output file root... lex.yy checking whether yytext is a pointer... yes checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... yes checking for malloc.h... yes checking for unistd.h... yes checking for door.h... yes checking for stropts.h... yes checking for sys/strlog.h... yes checking for stdarg.h... yes checking for sys/klog.h... no checking for working const... yes checking whether time.h and sys/time.h may both be included... yes checking for modern utmp... yes checking for hosts_access in -lwrap... no checking whether to compile klogctl... no checking size of short... 2 checking size of int... 4 checking size of long... 4 checking for I_CONSLOG... yes checking for O_LARGEFILE... yes checking for working alloca.h... yes checking for alloca... yes checking for vprintf... yes checking for door_create in -ldoor... yes checking for select... yes checking for snprintf... yes checking for vsnprintf... yes checking for strerror... yes checking for inet_aton... no checking for strncpy... yes checking for getutent... yes checking for getopt_long... no checking for strcasecmp... yes checking for strptime... yes checking for pthread.h... yes checking for pthread_create in -lpthread... yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking whether to enable TCP wrapper support... no checking libol version >= 0.3.3... ok updating cache ./config.cache creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating utils/Makefile creating syslog-ng.spec creating src/config.h # make Making all in src cd /usr/local/src/syslog-ng-1.5.18 && /usr/local/src/syslog-ng-1.5.18/missing autoheader WARNING: `autoheader' is missing on your system. You should only need it if you modified `acconfig.h' or `configure.in'. You might want to install the `Autoconf' and `GNU m4' packages. Grab them from any GNU archive site. cd .. \ && CONFIG_FILES= CONFIG_HEADERS=src/config.h \ /bin/sh ./config.status creating src/config.h src/config.h is unchanged make all-recursive Making all in . gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c main.c main.c: In function `main': main.c:437: warning: passing arg 2 of `resolve_user_group' from incompatible pointer type main.c:437: warning: passing arg 3 of `resolve_user_group' from incompatible pointer type main.c:441: warning: passing arg 2 of `resolve_group' from incompatible pointer type gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c sources.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c center.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c filters.c filters.c: In function `make_filter_netmask': filters.c:314: warning: implicit declaration of function `inet_aton' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c destinations.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c log.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c cfgfile.c gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c cfg-grammar.c cfg-grammar.y: In function `yyerror': cfg-grammar.y:703: warning: implicit declaration of function `fprintf' cfg-grammar.y:703: `stderr' undeclared (first use in this function) cfg-grammar.y:703: (Each undeclared identifier is reported only once cfg-grammar.y:703: for each function it appears in.) *** Error code 1 make: Fatal error: Command failed for target `cfg-grammar.o' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /usr/local/src/syslog-ng-1.5.18/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive'

1 0

Syslog-NG security user permissions.
by Russo, Ben 27 Jun '02

27 Jun '02

With the recent brewhaha about SSH I can't help but wonder about other daemons running on my boxes that don't have privelage separation. Is it possible to give Syslog-ng a command line option (like named or ntpd)? So that after Syslog-ng binds to the network socket (with root privs) then it sets it's UID to something other than root? I realize that many of the options in syslog-ng might be more complex if this were done. I can think of many permissions and output file name and directory macros whose code would have to be modified if syslog-ng were to properly run as a regular user instead of ROOT and be able to properly handle error messages and such for permissions and directories and everything. However, it is inevitable with the facts that Syslog-NG is a network Daemon, that receives input and has macros based on that input to write to files, that a remote vulnerability in Syslog-NG will become known.... If Syslog-NG is running as a non-root UID then this is not a problem, (other than a big nuisance). -Ben.

2 1

Re: Thinking about linking
by Jay Goldberg 27 Jun '02

27 Jun '02

Hi Klaas Thanks very much for the reply and for thinking that this makes sense :) Symlinks are really portable - the symlink() and unlink() system calls are part of the Open Group's UNIX 98 definition (formerly X/Open and 'Spec 1170'), so any UNIX would be able to do this. Less sure about windows, BTW, although Cygwin and U/WIN definitely do support the calls. If I can find the time, I'll have a look at it myself, as I think it's really just a few lines of logic (plus error checking et al): add file options "symlink_cur" and "symlink_pre" at file close() time: if (symlink_cur is set) { unlink(symlink_cur) } if (symlink_pre is set) { symlink(real_file, symlink_pre) } at file open() time: if (symlink_cur is set) { symlink(real_file, symlink_cur) } ...that should about cover it. Never having touched lex & yacc, I've been hesitant to try to touch this code, but it shouldn't be that bad (famous last words :)) Kind regards Jay ===< Klaas van Gend wrote: >=== > From: klaas.vangend(a)philips.com > To: syslog-ng(a)lists.balabit.hu > Date: Wed, 26 Jun 2002 09:49:28 +0200 > Subject: [syslog-ng]Re: Thinking about linking > Reply-To: syslog-ng(a)lists.balabit.hu > > On 2002-06-26 06:25:05 AM syslog-ng-admin wrote: > > > > > Message: 4 > > Date: Tue, 25 Jun 2002 17:06:22 +0200 > > From: Jay Goldberg <jg(a)open.ch> > > To: syslog-ng(a)lists.balabit.hu > > Organization: Open Systems AG - http://www.open.ch > > Gecko/20020530 > > Subject: [syslog-ng]Thinking about linking > > Reply-To: syslog-ng(a)lists.balabit.hu > > > > Hi, syslog-ng'ers > > > > A quick question for all - I've been using syslog-ng, but instead of using > > the excellent built-in $YEAR $MONTH and $DAY macros for automatic logfile > > rotation, I've been using a different solution - > > > > I use the cronolog program (www.cronolog.org) as a destination for any files > > that I want to keep locally. It's not optimal, but it allows me to do one > > thing that keeps our complex management environment intact after the cutover > > from syslog to syslog-ng, and that's to maintain a symbolic link to the > > latest and previous logfiles in the place where folks/scripts would normally > > think to look for them. So for example: > > > > /reallybigdisk/logs/2002/06/messages.25 and > > /reallybigdisk/logs/2002/06/messages.24 > > > > would be today's and yesterdays 'messages' file. But with cronolog, I'm abl e > > to specify options so that /var/adm/messages is just a symlink to whatever f ile > > we're logging to now, and /var/adm/messages.0 is a symlink to whatever file > > we logged to last: > > > > host# ls -l /var/adm/messages* > > lrwxrwxrwx 1 root root 34 Jun 25 01:16 /var/adm/messages -> > > /reallybigdisk/logs/2002/06/messages.25 > > lrwxrwxrwx 1 root root 34 Jun 24 01:16 /var/adm/messages.0 -> > > /reallybigdisk/logs/2002/06/messages.24 > > > > I'm not sure if I missed this in the documentation for syslog-ng or perhaps > > I'm just insane for thinking that this is useful :) > > > > So I guess my questions after all this are: > > > > - did I miss this in the documentation? > > - am I insane for wanting such a feature? > > - would it be a lot of trouble to add this feature? > > > > ...I was thinking something along the lines of a 'maintain_symlink' option f or > > a file destination that takes the target of the symlink (e.g., > > /var/adm/messages) > > as an option. > > > As far as I know (and I've probably been the last person looking over that cod e), there is no such option currently available. > It wouldn't be too hard to write, if and only if creating symlinks is portable over all UNIX implementations. > Being a Linux&Windows programmer only, I don't know for sure. > Anyway, following the lines of my latest patch (the "remove_if_older" patch, s ubmitted Feb1 2002, included in 1.5.15), > it shouldn't be too difficult to implement. > > I currently don't have time for it, but I think your suggestion makes sense an d maybe I can persuade my boss to > give me some time to implement it. > > Groetjes, > > Klaas van Gend -- jay goldberg senior engineer open systems ag raeffelstrasse 29 ch-8045 zurich t: +41 1 455 74 00 f: +41 1 455 74 01 jg(a)open.ch http://www.open.ch

2 1

change directory/file permissions
by Stefan M. Brandl 26 Jun '02

26 Jun '02

Hi, I have the following line in syslog-ng.conf: destination router { file("/opt/syslog-ng/var/$YEAR/$MONTH/$YEAR$MONTH$DAY-$HOST" create_dirs(yes) perm(0644)); }; This creates automaticaly the directorys and changes the file-permissions to 644. But it only changes the permissions of the file, not of the directories. What can I do, that also the directories get 644? Regards Stefan

2 4

Re: Thinking about linking
by klaas.vangend＠philips.com 26 Jun '02

26 Jun '02

On 2002-06-26 06:25:05 AM syslog-ng-admin wrote: > > Message: 4 > Date: Tue, 25 Jun 2002 17:06:22 +0200 > From: Jay Goldberg <jg(a)open.ch> > To: syslog-ng(a)lists.balabit.hu > Organization: Open Systems AG - http://www.open.ch > Gecko/20020530 > Subject: [syslog-ng]Thinking about linking > Reply-To: syslog-ng(a)lists.balabit.hu > > Hi, syslog-ng'ers > > A quick question for all - I've been using syslog-ng, but instead of using > the excellent built-in $YEAR $MONTH and $DAY macros for automatic logfile > rotation, I've been using a different solution - > > I use the cronolog program (www.cronolog.org) as a destination for any files > that I want to keep locally. It's not optimal, but it allows me to do one > thing that keeps our complex management environment intact after the cutover > from syslog to syslog-ng, and that's to maintain a symbolic link to the > latest and previous logfiles in the place where folks/scripts would normally > think to look for them. So for example: > > /reallybigdisk/logs/2002/06/messages.25 and > /reallybigdisk/logs/2002/06/messages.24 > > would be today's and yesterdays 'messages' file. But with cronolog, I'm able > to specify options so that /var/adm/messages is just a symlink to whatever file > we're logging to now, and /var/adm/messages.0 is a symlink to whatever file > we logged to last: > > host# ls -l /var/adm/messages* > lrwxrwxrwx 1 root root 34 Jun 25 01:16 /var/adm/messages -> > /reallybigdisk/logs/2002/06/messages.25 > lrwxrwxrwx 1 root root 34 Jun 24 01:16 /var/adm/messages.0 -> > /reallybigdisk/logs/2002/06/messages.24 > > I'm not sure if I missed this in the documentation for syslog-ng or perhaps > I'm just insane for thinking that this is useful :) > > So I guess my questions after all this are: > > - did I miss this in the documentation? > - am I insane for wanting such a feature? > - would it be a lot of trouble to add this feature? > > ...I was thinking something along the lines of a 'maintain_symlink' option for > a file destination that takes the target of the symlink (e.g., > /var/adm/messages) > as an option. As far as I know (and I've probably been the last person looking over that code), there is no such option currently available. It wouldn't be too hard to write, if and only if creating symlinks is portable over all UNIX implementations. Being a Linux&Windows programmer only, I don't know for sure. Anyway, following the lines of my latest patch (the "remove_if_older" patch, submitted Feb1 2002, included in 1.5.15), it shouldn't be too difficult to implement. I currently don't have time for it, but I think your suggestion makes sense and maybe I can persuade my boss to give me some time to implement it. Groetjes, Klaas van Gend

1 0

Thinking about linking
by Jay Goldberg 25 Jun '02

25 Jun '02

Hi, syslog-ng'ers A quick question for all - I've been using syslog-ng, but instead of using the excellent built-in $YEAR $MONTH and $DAY macros for automatic logfile rotation, I've been using a different solution - I use the cronolog program (www.cronolog.org) as a destination for any files that I want to keep locally. It's not optimal, but it allows me to do one thing that keeps our complex management environment intact after the cutover from syslog to syslog-ng, and that's to maintain a symbolic link to the latest and previous logfiles in the place where folks/scripts would normally think to look for them. So for example: /reallybigdisk/logs/2002/06/messages.25 and /reallybigdisk/logs/2002/06/messages.24 would be today's and yesterdays 'messages' file. But with cronolog, I'm able to specify options so that /var/adm/messages is just a symlink to whatever file we're logging to now, and /var/adm/messages.0 is a symlink to whatever file we logged to last: host# ls -l /var/adm/messages* lrwxrwxrwx 1 root root 34 Jun 25 01:16 /var/adm/messages -> /reallybigdisk/logs/2002/06/messages.25 lrwxrwxrwx 1 root root 34 Jun 24 01:16 /var/adm/messages.0 -> /reallybigdisk/logs/2002/06/messages.24 I'm not sure if I missed this in the documentation for syslog-ng or perhaps I'm just insane for thinking that this is useful :) So I guess my questions after all this are: - did I miss this in the documentation? - am I insane for wanting such a feature? - would it be a lot of trouble to add this feature? ...I was thinking something along the lines of a 'maintain_symlink' option for a file destination that takes the target of the symlink (e.g., /var/adm/messages) as an option. I thought I'd ask first in case anyone's working on this already - it would save me from hacking at and most likely desecrating the code. I've had a look through, and it's a far tidier job than anything I've done in a long time. But then I haven't been a C programmer for the last 9 years :( Thanks! Jay -- jay goldberg senior engineer open systems ag raeffelstrasse 29 ch-8045 zurich t: +41 1 455 74 00 f: +41 1 455 74 01 jg(a)open.ch http://www.open.ch

1 0

syslog-ng on win
by Jas Amidzic 25 Jun '02

25 Jun '02

Syslog-ng is excellent tool, but to make it work for me I need to run it on at least one win200 box. Did anyone considered porting syslog-ng to the win environment? Thanks Jas ----------------------------------------------- ABS Web Site: www.abs.gov.au

3 2

RE: [syslog-ng]program() with template()..how or workaround?
by Michael Earls 24 Jun '02

24 Jun '02

You should look on http://www.campin.net/syslog-ng/faq.html there are some sites that list how to format syslog-ng to sql statements. michael -----Original Message----- From: thelittleprince(a)asteroid-b612.org Sent: Monday, June 24, 2002 2:40 PM To: <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng]program() with template()..how or workaround? i need to use template with program in order to send a specific format to a modified sqlsyslogd. I'm running the latest devel of syslog ng. can this be done? if not, is there some sort of workaround i can use with pipe to get the formatted data into sqlsyslogd? or maybe do something like.. program("/usr/local/bin/sqlsyslogd < echo $HOST $FACILITY"); i know that syntax wont work, but you get the gist. :) Thanx! Tony . ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. . Anthony J. Biacco Network Administrator/Engineer thelittleprince@asteroid b612.org http://www.asteroid b612.org "Strange, but it seems, there's a mutiny brewing inside of me" . ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. ._. . _______________________________________________ syslog ng maillist syslog ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog ng Frequently asked questions at http://www.campin.net/syslog ng/faq.html

1 0

program() with template()..how or workaround?
by The Little Prince 24 Jun '02

24 Jun '02

i need to use template with program in order to send a specific format to a modified sqlsyslogd. I'm running the latest devel of syslog-ng. can this be done? if not, is there some sort of workaround i can use with pipe to get the formatted data into sqlsyslogd? or maybe do something like.. program("/usr/local/bin/sqlsyslogd < echo $HOST $FACILITY"); i know that syntax wont work, but you get the gist. :) Thanx! --Tony .-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-. Anthony J. Biacco Network Administrator/Engineer thelittleprince(a)asteroid-b612.org http://www.asteroid-b612.org "Strange, but it seems, there's a mutiny brewing inside of me" .-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-._.-.

1 0

io.c:263: failed assertion `i == nfds'
by Doug Winter 24 Jun '02

24 Jun '02

Hi syslog-ng people, I've just installed syslog-ng 1.4.15, using libol 0.2.23 as directed in the INSTALL instructions. I am running it on a: SunOS 5.7 Generic_106541-11 sun4u sparc SUNW,Ultra-250 When I run syslog-ng with the attached configuration file, it runs for a short period (< 10 minutes) and exits. When it exits, I get this message in one of the output files: syslog:io.c:263: failed assertion `i == nfds' which file it appears in varies, which is presumably down to a file descriptor mixup. line 263 of io.c in libol is indeed: assert(i == nfds); When I run syslog-ng in debugging mode (with the -d -v switches), this problem does not occur (I have run for two days without the fault). I assume this is because in debugging mode fds 0,1 & 2 are kept open, whereas they are closed when syslog-ng becomes a daemon (note many assumptions :). I have tried to find reference to this problem on the web without success - the archives of this list aren't searchable as far as I can find, so apologies if this is a known and fixed problem. Many Thanks, Doug Winter -- 020 79610341 / 07879 423002 / dwinter(a)icpeurope.net 3 Waterhouse Square, Holborn Bars, 142 Holborn, London EC1N 2NX www.businesseurope.com www.icpeurope.net www.venturedome.com 1024D/1AB26B8C C88E DC6D A578 DEFB C493 A44D 0156 0479 1AB2 6B8C

1 0

Well, I use the last version of Syslog-ng (1.5.18). Well it looks as if syslog-ng was crashing itself and then all programsthat are usually logged via syslog-ng are unable to perform their ownactions (that's why ssh doesn't work anymore)... In some words, it looks like syslog-ng was becoming blocking for allapplications.On Fri, 2002-06-21 at 10:28, Balazs Scheidler wrote:> On Fri, Jun 21, 2002 at 10:23:24AM +0200, Yan DENET wrote:> > Hi all,> > > > Some quite strange things have happened in my ne
by Yan DENET 24 Jun '02

24 Jun '02

Well, I use the last version of Syslog-ng (1.5.18). Well it looks as if syslog-ng was crashing itself and then all programs that are usually logged via syslog-ng are unable to perform their own actions (that's why ssh doesn't work anymore)... In some words, it looks like syslog-ng was becoming blocking for all applications. On Fri, 2002-06-21 at 10:28, Balazs Scheidler wrote: > On Fri, Jun 21, 2002 at 10:23:24AM +0200, Yan DENET wrote: > > Hi all, > > > > Some quite strange things have happened in my network since i set up my > > syslog-ng as a log centralizer... > > Actually, when launched, my syslog-ng ends up to grab all resources of > > the machine on which it's installed. Then, no way to ssh to it... > > It's really strange cause normally, syslog-ng should use only very few > > resources... like syslog ! > > Whereas with syslog, everything goes well.. > > > > Don't know what's happening. Could somebody help me ? > > we can't help you unless you provide more information. which version are you > using, and what do you mean it ate up all resources? > > does it eat memory, or use all cpu cycles or? > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 --

2 1

CONGRATULATIONS: FINAL NOTICE!!!
by werken.bij.delotto＠HotPOP.com 23 Jun '02

23 Jun '02

WERKEN BIJ DE LOTTO, 41132, NL-1007 DB AMSTERDAM, THE NETHERLANDS. FROM: THE DESK OF THE DIRECTOR PROMOTIONS, INTERNATIONAL PROMOTIONS/PRIZE AWARD DEPARTMENT, REF: WBL/67-AO91657984 ATTENTION: AWARD NOTIFICATION; FINAL NOTICE We are pleased to inform you of the announcement today, 23RD JUNE 2002, of winners of the WERKEN BIJ DE LOTTO/ INTERNATIONAL PROGRAMS held on 1ST JUNE 2002. Your company, attached to ticket number 013-2316-2002-477, with serial number A025-09 drew the lucky numbers 37-13-34-85-56-42, and consequently won in category C. You have therefore been approved for a lump sum pay out of US$1,500,000.00 in cash credited to file REF NO. REF: WBL/67-AO91657984. This is from total prize money of US$22,500,000.00 shared among the fifteen international winners in the category C. All participants were selected through a computer ballot system drawn from 30,000 names from Australia, New Zealand, America, Asia, Europe and North America as part our International Promotions Program, which is conducted annually. CONGRATULATIONS! Your fund is now deposited with a Finance and Security House insured in your name. Due to the mix up of some numbers and names, we ask that you keep this award strictly from public notice until your claim has been processed and your money remitted to your account. This is part of our security protocol to avoid double claiming or unscrupulous acts by participants of this program. We hope with a part of you prize, you will participate in our end of year high stakes US$1.3 billion International lotto. To begin your claim, please contact your claims officer immediately: JANSEN DAVIS FOREIGN SERVICE MANAGER, EUROLITE BV, TEL: 31 205241592 FAX: 31 205241597 EMAIL: eurolitebv(a)poboxes.com For due processing and remittance of your prize money to a designated account of your choice. Remember, you must contact your claims officer not later than 29TH of JUNE 2002. After this date, all funds will be returned as unclaimed. NOTE: In order to avoid unnecessary delays and complications, please remember to quote your reference number in every one of your correspondences with your officer. Furthermore, should there be any change of your address, do inform your claims officer as soon as possible. Congratulations again from all our staff and thank you for being part of our promotions program. Sincerely, THE DIRECTOR PROMOTIONS, WERKEN BIJ DE LOTTO. www.werken-bij-delotto.net N.B. Any breach of confidentiality on the part of the winners will result to disqualification. Please do not reply this mail.

1 0

problems building 1.5.18 on solaris
by Bret Watson 23 Jun '02

23 Jun '02

Hi All, things don't seem to build on solaris 8 for 1.5.18.. here are the errors.. Making all in src make[1]: Entering directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' cd /home/bret/syslog-ng-beta/syslog-ng-1.5.18 && autoheader make all-recursive make[2]: Entering directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' Making all in . make[3]: Entering directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c main.c main.c: In function `main': main.c:437: warning: passing arg 2 of `resolve_user_group' from incompatible pointer type main.c:437: warning: passing arg 3 of `resolve_user_group' from incompatible pointer type main.c:441: warning: passing arg 2 of `resolve_group' from incompatible pointer type gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c sources.c gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c center.c center.c: In function `do_distribute_log': center.c:157: warning: deprecated use of label at end of compound statement gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c filters.c filters.c: In function `do_filter_call': filters.c:342: warning: implicit declaration of function `memcmp' gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c destinations.c gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c log.c gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c cfgfile.c gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c cfg-grammar.c cfg-grammar.y: In function `yyerror': cfg-grammar.y:703: warning: implicit declaration of function `fprintf' cfg-grammar.y:703: `stderr' undeclared (first use in this function) cfg-grammar.y:703: (Each undeclared identifier is reported only once cfg-grammar.y:703: for each function it appears in.) make[3]: *** [cfg-grammar.o] Error 1 make[3]: Leaving directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' make: *** [all-recursive] Error 1 Don't know if this is fixed in cvs?... Bret Technical Incursion Countermeasures www.ticm.com The Insider www.ticm.com/info/insider

1 0

syslog-ng and Redhat 7.3
by Kai Backhaus 22 Jun '02

22 Jun '02

Hello List, I tried to install/compile syslog-ng vers. 15.18 on to my RH 7.3 System. My System is using glibc vers. 2.5.5 While compiling a lot of errors occurred, so I could not run syslog-ng. Is syslog-ng vers. 15.18 not compatible with RH 7.3 and libc vers. 2.5.5? Does any body has any answer for that question? It is my intention to setup an win-nt40-eventlog-messages collecting linux server which keeps all NT-Eventlog from my network send by EventReporter. I just want to use the enhanced features of syslog-ng for that project. Thanx for helping in advance Kai

1 0

Syslog-ng makes my server crash.
by Yan DENET 21 Jun '02

21 Jun '02

Hi all, Some quite strange things have happened in my network since i set up my syslog-ng as a log centralizer... Actually, when launched, my syslog-ng ends up to grab all resources of the machine on which it's installed. Then, no way to ssh to it... It's really strange cause normally, syslog-ng should use only very few resources... like syslog ! Whereas with syslog, everything goes well.. Don't know what's happening. Could somebody help me ? -- Yan DENET

2 1