- syslog-ng - lists.balabit.hu

Re: [syslog-ng]DNS caching
by Michael Renner 21 Mar '02

21 Mar '02

At 09:01 20.03.2002 +1000, you wrote: >On Tue, 19 Mar 2002 at 10:24am (+0100), Balazs Scheidler wrote: >[...] > > > > > can you check this patch, whether it fixes your problem ? > > > > diff -u -r1.37 cfgfile.c > > --- cfgfile.c 2001/09/03 16:42:23 1.37 > > +++ cfgfile.c 2002/03/19 09:23:55 > >[...] > >Thank you... it appears to be working as advertised now. When running with >NSCACHE_DEBUG enabled we get lots of messages like... > >.... which looks good. CPU usage for the syslog process has dropped from >~80% to ~40% (hazzah!) and the named process that was doing local caching >has dropped from ~10% to almost nill. Dear Bazsi, Thanks, also works flawless here, I get hardly any hits on my dnscache. Btw. the default option of dns_cache is "on", maybe you should document this or change it to "no", otherwise people who upgrade to newer versions (with the fixed dns_cache) may be confused by the "new" behaviour of syslog-ng. You also mention "syslog-ng blocks on DNS queries, so enabling DNS may lead to a Denial of Service attack." in your documentation. Does this mean that syslog messages which are received by the NIC, while syslog-ng performs a synchronous DNS lookup, are stored in the kernels receive buffer or are dropped? best regards, -- Michael Rennner Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

2 1

position dependencie of rules and "flags(final);"
by Volker Apelt 20 Mar '02

20 Mar '02

Hello, Are syslog rules position dependend? Is "flags(final);" position dependend? Is example #1 different from #2 in what it logs? Theory: # example 1 log { source; filter1; destination1; } log { source; filter1; filter2; destination2; flags(final); } # example 2 log { source; filter1; filter2; destination2; flags(final); } log { source; filter1; destination1; } Let's say, that filter2 matches only a sub set of the messages caught by filter1 and define: set1 := messages that matched by filter1 set2 := messages that matched by filter2 setLeftover := set1 without messages of set2 which means set1 == setLeftover + set2 In example #2 destination1 receives the messages of setLeftover and destination2 receives set2. But if rules+final are position dependend, then destination1 in example #1 will log _all_ messages of source1, _including_ those of filter2. So, destination1 receives the messages of set1 If they are not position dependend both destinations will receive the same message sets as in example #2. Is syslog-ng implemented in a way to Or as a practical example from my configuration: Will this configuration do what it is intended to? ## in pseudo code of what I am trying to do. if ( is it from "ssh" ) { if ( is loglevel equal or worse than "error" ){ send it to D_udp_network and D_tty_all } send it to D_ssh final ; # ie: dont send it any place else } ## I'll try to solve that with two different rules, one with a flag(final) and one without. I try to log all messages of ssh into one file and all messages of ssh above a certain log level (error or worse) shall be send to another destination (network + alert tty), too. All messages caught by the second rule must be logged to the first destination and No message from ssh shall be logged any place else, and I don't want to write a filter(f_no_ssh); into each and every log{} rule. # A message from ssh with loglevel emergency If syslog rules are postion dependend #### options { long_hostnames(off); sync(0); }; source S_local { unix-stream("/dev/log"); file("/proc/kmsg"); internal();}; ## destination D_udp_network{ udp( 192.168.51.2 port(514)); }; destination D_ssh { file("/var/log/ssh" perm(0640) owner(root) group(log)); }; ## filter l_normal_or_worse { level(normal..emerg); }; filter l_err_or_worse { level(err..emerg); }; ## filter f_ssh { program("ssh.*") or program("su"); }; ##### TWO RULES accepting messages from ssh ##### first without "final", second with "final" ## ## selected ssh messages of level error or worse ## send critical ssh messages to all tty's log { source(S_local); filter(f_ssh); filter(l_err_or_worse); destination( D_udp_network ); destination(D_tty_net); }; ## secure login / ssh / su ... ## shall store all messages (normal ... emerg) of ssh log { source(S_local); filter(f_ssh); filter(l_normal_or_worse); destination(D_ssh); flags(final); }; What kind of output on D_ssh and D_udp_network should I expect if there are these two messages? ## example messages #loglevel message [normal] datum host sshd[550]: some normal message of sshd [error] datum host sshd[550]: some error output of sshd Thank you, Volker Apelt -- Volker Apelt volker_apelt .@. yahoo.de (remove the dots, please) Dipl. Chem. +49 6172 31126

2 3

template option for tcp destination
by Nam 20 Mar '02

20 Mar '02

Does the template() option work for tcp destination? Help docs only list the option for file destination, but it also works with pipe. I would like to be able to apply formatting on the output for data inputing into a vendor product without having to use netcat (feeding from a piped destination). Nam __________________________________________________________ Get your FREE personalized e-mail at http://www.canada.com

2 1

DNS caching
by Matthew Melvin 20 Mar '02

20 Mar '02

Hello, I'm loath to ask a question right off the blocks but I wasn't able to find too much in the archives about this... I'm using syslog-ng 1.5.14 and am trying to get the 'dns_cache(yes);' option to work for me. When compiled with -DNSCACHE_DEBUG I get this message to start with... initialising nscache: 1007 entries, 3600/60 expiration. ... but no messages to suggest nscache_lookup() or any of the other cache functions are ever being called. Is there more to this option than meets the eye? Other recent discussions have talked about using djb's dnscache or nscd to do this instead and questioned the wisdom of using caching internal to syslog-ng. Should I not be using this feature? Does it, in fact, work at all? M. -- WebCentral Pty Ltd Australia's #1 Internet Web Hosting Company Level 1, 96 Lytton Road. Network Operations - Systems Engineer PO Box 4169, East Brisbane. phone: +61 7 3249 2500 Queensland, Australia. pgp key id: 0x900E515F

2 2

Re: big packets
by Balazs Scheidler 19 Mar '02

19 Mar '02

On Tue, Mar 05, 2002 at 05:15:11PM +0100, p(a)netoides.com wrote: > Hello syslog-ng developers. > > We are using your wonderful syslog-ng to receive > some big message chunks. We noticed that syslog-ng drops > bytes above 1Kb when using UDP. So, we changed to > TCP and, to our surprise, we found that syslog-ng > splits messages in chunks of 1Kb (approx). > > Is it possible to configure syslog-ng so that > each tcp message goes to only one line? > If this is not possible, what about modifing > syslog-ng to add this capability? > We can contribute development effort. after applying the following patch, you can change the maximum line length of syslog-ng by changing the MAX_LOG_LINE constant in syslog-ng.h (currently 2048 bytes) Index: sources.c =================================================================== RCS file: /var/cvs/syslog-ng/src/sources.c,v retrieving revision 1.30 diff -u -r1.30 sources.c --- sources.c 2002/02/28 13:05:37 1.30 +++ sources.c 2002/03/05 18:38:35 @@ -49,7 +49,7 @@ (vars (dgram simple UINT32) (pos simple UINT32) - (buffer array UINT8 MAX_LINE) + (buffer array UINT8 MAX_LOG_LINE) (next object log_handler))) */ @@ -81,11 +81,11 @@ size_t salen = sizeof(sabuf); if (!closure->dgram) { - n = A_READ(read, MAX_LINE - closure->pos, closure->buffer + closure->pos); + n = A_READ(read, MAX_LOG_LINE - closure->pos, closure->buffer + closure->pos); salen = 0; } else - n = A_RECV(read, MAX_LINE - closure->pos, closure->buffer + closure->pos, (abstract_addr *) &sabuf, &salen); + n = A_RECV(read, MAX_LOG_LINE - closure->pos, closure->buffer + closure->pos, (abstract_addr *) &sabuf, &salen); switch(n) { case 0: -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

6 10

Re: [syslog-ng]DNS caching
by Michael Renner 19 Mar '02

19 Mar '02

At 12:04 19.03.2002 +1000, you wrote: >Other recent discussions have talked about using djb's dnscache or nscd to >do this instead and questioned the wisdom of using caching internal to >syslog-ng. Should I not be using this feature? Does it, in fact, work at >all? It seems that this function is currently in development (or even deprecated, no changes were made from 1.5.14 to 1.5.15, it isn't documented at all, nobody even bothered to mention it when I asked a similiar question) and not working at the moment (hits to dnscache haven't decreased after activating it, i'm currently using 1.5.14 too). I for my part prefer dnscache over nscd because dnscache is much more transparent in its workings (no "weird" or "_very_ old cached" responses, very detailed logs). As for the internal dns cache, i don't think that it's that complicated at all, because the main part of dns caching, the resolver, is already implemented and working fine; adding a cache with fixed expiry times isn't that much additional work (at least it doesn't seem so to me, correct me if i'm wrong). The only problem I can think of are DNS records which have a TTL lower than the cache expiry time; the dns cache should ignore the ttl fields because here it gets way too complicated for a syslogger :). best regards, -- Renner Michael Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

1 0

Default template?
by Gert Menke 15 Mar '02

15 Mar '02

Hi! Is there a possibility to define a default template, so that I don't have to set my favorite template for every destination explicitly? Thanks in advance! Greetings Gert

1 0

load balanced syslog-ng
by Nicholas Berry 14 Mar '02

14 Mar '02

I'm running syslog-ng 1.5.13 (w/libol-0.3.1) under Solaris 8 and have two servers load balanced by two Foundry ServerIrons. This has been a rock solid solution for load balancing syslog reporting, but about once every few days both load balancers report a loss of port 514/udp. After checking syslog-ng for each syslog server, the daemon is still running and nothing was reported in syslog messages. Any ideas? Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com

1 0

no kernel facility
by Stephan Uhlmann 14 Mar '02

14 Mar '02

Hello. It seems that syslog-ng doesn't receive syslog messages of the "kern" facility. I have the following configuration (in reality a bit bigger but the other stuff is mostly configuration for receiving log messages from other hosts, it shouldn't affect this problem): --------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source src { unix-stream("/dev/log"); internal(); }; destination han_messages { file("/var/log/messages"); }; log { source(src); destination(han_messages); }; --------- I don't think that there are no kernel messages generated by the system. Also with normal syslog I get the following messages when killing/starting klogd: Mar 14 13:11:59 han kernel: klogd 1.3-3, log source = /proc/kmsg started. Mar 14 13:11:59 han kernel: Inspecting /boot/System.map-2.2.16-SMP Mar 14 13:11:59 han kernel: Loaded 9539 symbols from /boot/System.map-2.2.16-SMP. Mar 14 13:11:59 han kernel: Symbols match kernel version 2.2.16. Mar 14 13:11:59 han kernel: Loaded 290 symbols from 7 modules. Mar 14 13:12:03 han kernel: Kernel logging (proc) stopped. Mar 14 13:12:03 han kernel: Kernel log daemon terminating. With syslog-ng I don't get these messages. So I suspect that there is a problem with syslog-ng getting the messages from klogd. I updated to version 1.4.14 and the problem still exists. Any hint appreciated :-) Thank you, Stephan

4 6

Question
by Roscoe 13 Mar '02

13 Mar '02

Been playing with syslog-ng for a few days and have a question: I have set up a unix-stream src and only get messages (ususaly several hundred) on when syslog-ng starts up. Have set sync (0). Any suggestions?

1 0

Extra info padded when syslog-ng forwards syslog messages
by lukechung 12 Mar '02

12 Mar '02

Hi There, Is there a way for syslog-ng to forward syslog messages to another machine, without padding the additional information? (e.g. Feb 23 02:55:23 [203.208.161.105.28.128] 33: Feb 23 02:52:53.167 Singapo: %SYS-5-CONFIG_I: Configured from console by console) The [203.208.161.105.28.128] is the additional info padded. I have tried setting the option chain_hostnames=no, but to no effect. I would really appreciate it if you can shed some light on this matter. Thank you very much, Luke

1 0

RE: [syslog-ng]use_time_recvd(no) not working?
by Nicholas Berry 08 Mar '02

08 Mar '02

I have emailed a problem I've had a couple times, but I was playing around with the template() feature and found a little more preciously what the problem may be. With template() defined as template("$DATE $HOST $MSG\n"), this is the output I receive: Mar 8 16:32:29 smf-jumpstart AÂ Ã¡ AÂ Ã¡<149>Mar 8 16:32:29 sudo: [ID 850335 local2.notice] nberry : TTY=pts/1 ; PWD=/export/home/nberry ; USER=root ; COM MAND=/usr/ucb/whoami With template() defined as template("$MSG\n"), this is the output I receive: <149>Mar 8 16:40:15 sudo: [ID 850335 local2.notice] nberry : TTY=pts/1 ; PWD=/export/home/nberry ; USER=root ; COMMAND=/usr/ucb/whoami The examples were from a Solaris 8 host using its default syslog daemon, but I have similar issues on *all* other syslog reporting devices (routers, modem banks, etc.) One thing that seems to be consistent between all syslog reporting devices is <X>. Is this some sort of reference that syslogd uses? Can I filter this out? Or will it cause a problem? Also, in the first example " AÂ Ã¡ AÂ Ã¡" is another commonality between hosts. What is the default template() used? I've seen reference to use of "$DATE_RECVD" as an acceptable macro, but I don't see this listed in the documentation. Is there a document set with these new available macros? Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, March 08, 2002 12:37 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]use_time_recvd(no) not working? > a) do you have any tips on tracking down the problem with the broken > pam-timestamps? > b) is the use_time_recvd() option broken/non-existant in 1.5.14 ? it exists, but only affects macro expansion. the timestamp in the message itself is never touched unless you use template output files like this: destination d_file { file("/var/log/messages" template("$DATE_RECVD $HOST $MSG\n")); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

use_time_recvd(no) not working?
by Michael Renner 08 Mar '02

08 Mar '02

Hi! I've got a server (syslog-ng 1.5.14) with a innacurate system time (off by a minute) which logs to my master server (also syslog-ng 1.5.14). The option use_time_recvd(no) is in the masters config but the last changed time of the current logfile and the timestamps in the logfile are those of the senders server. Shouldn't the master syslog-ng strip all timestamp information from the logmessage and insert its own? I noticed this (obviously mis)behaviour because the PAM-stuff on the inaccurate server went mad and sends syslog entries with (nearly) correct time but the date is set to 2001-12-31; all other services log with correct timestamps. Here are some messages which cause the broken log-dates --- snip --- Mär 7 18:12:49 backup su: FAILED SU (to root) robe on /dev/pts/0 Mär 7 18:12:53 backup su: (to root) robe on /dev/pts/0 Mär 7 18:12:53 backup PAM-unix2[10112]: session started for user root, service su --- snap --- modify times of the two opened logfiles on the sending host (format is $HOST/$YEAR-$MONTH-$DAY): -rw------- 1 root root 3193 Mar 7 18:12 2001-12-31 -rw------- 1 root root 196130 Mar 7 19:17 2002-03-07 and here on the master server: -rw------- 1 root root 1814 Mar 7 18:13 2001-12-31 -rw------- 1 root root 39016 Mar 7 19:18 2002-03-07 a) do you have any tips on tracking down the problem with the broken pam-timestamps? b) is the use_time_recvd() option broken/non-existant in 1.5.14 ? mfg -- Renner Michael Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

2 2

logrotate and killall -HUP syslog-ng
by Jerome Peducasse 06 Mar '02

06 Mar '02

Hello, I am testing syslog-ng 1.4.14 and 1.5.15 on Redhat 6.2 with SOCK_DGRAM. In both version, each times I send SIGHUP to syslog-ng, syslog-ng lost kernel packet. I can execute "/etc/rc.d/init.d/syslog-ng restart" instead of "killall -HUP syslog-ng" in logrotate configuration file but this solution requires restart syslog-ng deamon for each logfile rotated :-( Thx. -- Jerome Peducasse

2 2

remote logging and logfile naming
by Christian Hammers 05 Mar '02

05 Mar '02

Hello I like to have the following logfile names: /var/log/remote/proxy.d.westend.com.2002-03-05.log or at least /var/log/remote/212.117.2.4.2002-03-05.log /var/log/remote/212.117.4.5.2002-03-05.log etc. Strangely, now I have a file /var/log/remote/proxy.2002-03-05.log which contains data from both, proxy.d.westend.com and proxy.westend.com. And, in addition, when trying to turn of hostname lookup, all syslog-ng exporters still have filenames with their short hostnames and all syslog (old) exporters have IPs as hostnames! /var/log/remote/proxy.2002-03-05 /var/log/remote/212.117.77.123.2002-03-05 (of course I restarted the server after each modification) On all three syslog-ng hosts (2xProxy and 1xCollector) I use syslog-ng-1.5.13. My collector config looks like this: options { long_hostnames(on); use_dns(no); use_fqdn(on); keep_hostname(on) chain_hostnames(on); use_time_recvd(yes); sync(0); mark(120); log_fifo_size(1000); }; source remote { udp(); tcp(); }; destination westend_remote_hosts_dir { file("/var/log/remote/$HOST.$YE..... Any ideas, how to archive "proxy.d.westend.com.2002-03-05.log"? The content of the files is uninteresting, although chained hostnames would be nice if I ever log over more than one host. bye, -christian- -- Christian Hammers WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 ch(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

5 8

which 1.5.x version works on solaris 8?
by Bernd Jucknischke 05 Mar '02

05 Mar '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all! I'd like to run a version of the development branch of syslog-ng on a solaris 8 machine (because of all the nice new features). I've tried 1.5.13, which doesn't compile and 1.5.15, which simply dies (without a single log line of output) with my config files (the same configs work with 1.4.14, though). Are there any known problems with 1.5.x on solaris 8? Can somebody point me to a working version? Are there incompatibilities in the configuration apart from the new features? TIA, Bernd -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8hIeSH+EzFoDhBKcRAi/LAJ9+VUp8WIKsL5cMx8VqA8XrQz5MMACdGU1e qvAv8fFj5gx1plHQch7nwqQ= =xYQv -----END PGP SIGNATURE-----

2 2

Log Stoppage
by Gorm Jensen 01 Mar '02

01 Mar '02

I run syslog 1.4.12 on Redhat 7.1, kernel 2.4.17. Occasionally, I find that my logserver has stopped logging some packets. This is after, or during, a log rotation. Processes 'CRON' and 'minilogd' are running. Killing minilogd and HUPping all processes restores normal operations. Any help would be appreciated.

2 2

Splitting routerlogs from servers
by Ken Paris 01 Mar '02

01 Mar '02

>On Thu, Feb 28, 2002 at 05:18:43PM +0100, Michael Renner wrote: > > Hiya! > > > > I've got a setup like this with many log hosts (~200, raising) and want to > > split the server logfiles from those of our routers. i've got a setup like > > this: > > [] > > > > This is a very ugly setup because i always have to add new servers to the > > f_server filter, otherwise it would get logged in the router/unknown dir > > > > Is there a better way to solve this with one ip address or should i add a > > secondary interface to the server and let the routers log to the second ip? Maybe I am missing something here, but why not source from a different facility for routers than local or servers. Facility can still be useful ;-/ if only to differ from a handful of source types, rather easily. Most syslog sources allow some method to set the syslog facility they speak to. Basically .... or am I over simplifying this? filter f_router { facility(local7); }; filter f_server { facility(local6); }; filter f_local { facility(local1); }; Good luck, Ken Paris

2 1

template() can't contain a newline...?
by Chan Wilson 28 Feb '02

28 Feb '02

Hey there. It appears that specifying a template in a file destination neither adds a trailing newline (which is OK, I s'pose), nor does it allow (in any way I can fanthom) any way of specifying such a newline. Obvious things like '\n' or '%n' fail to work, and shy of hacking either syslog-ng or libol source, I don't see any way of making it work...? TIA, --Chan

1 0

Splitting routerlogs from servers
by Michael Renner 28 Feb '02

28 Feb '02

Hiya! I've got a setup like this with many log hosts (~200, raising) and want to split the server logfiles from those of our routers. i've got a setup like this: --- options { sync (0); log_fifo_size (1000); use_fqdn (yes); chain_hostnames(no); stats (86400); }; source src { unix-stream("/dev/log"); internal(); }; source net { udp(ip(0.0.0.0) port(514)); }; source srck { pipe("/proc/kmsg"); }; destination messages { file("/var/log/local/$YEAR-$MONTH-$DAY" create_dirs(yes)); }; destination router { file("/var/log/router/$HOST/$YEAR-$MONTH-$DAY" create_dirs(yes)); }; destination server { file("/var/log/server/$HOST/$YEAR-$MONTH-$DAY" create_dirs(yes)); }; destination unknown { file("/var/log/unknown/$HOST/$YEAR-$MONTH-$DAY" create_dirs(yes)); }; filter f_router { facility(local1,local2,local3,local4,local5,local6,local7); }; filter f_server { host("server1|server2|serverx|..."); }; log { source(src); source(srck); destination(messages); flags(final); }; log { source(net); filter(f_server); destination(server); flags(final); }; log { source(net); filter(f_router); destination(router); }; log { source(net); destination(unknown); flags(fallback); }; --- This is a very ugly setup because i always have to add new servers to the f_server filter, otherwise it would get logged in the router/unknown dir Is there a better way to solve this with one ip address or should i add a secondary interface to the server and let the routers log to the second ip? mfg -- Renner Michael Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

3 3

Working example of forward logs
by sdouche.ml＠free.fr 28 Feb '02

28 Feb '02

Hi, I want forward all server syslog logs to a Linux supervision box. You have a complete example for this work ? Thanks -- Sébastien Douche <sdouche(a)free.fr>

2 1

problem with creating AF_INET socket at startup
by Frédéric LE BASTARD 28 Feb '02

28 Feb '02

Hi, I'm setting up a config with a frontal 'naked' linux RedHat 7.2 box / 2.4.18 (no X, no compiling tools, a basic firewall router) named celti000 I'd like to forward all the logs of celti000 on another linux box (RedHAt 7.2 / 2.4.18, with compiling tools). launching syslog-ng works on both machine, excpet on celti000, when I put this line in syslog-ng.conf : destination d_celti001 { udp("celti001" port (999)); }; if I have this line in my config file I get: error creating AF_INET socket (No such file or directory) any hints ? Thanks, Fred

2 2

Re: [syslog-ng]syslog-ng mysteriously exits
by Michael Earls 22 Feb '02

22 Feb '02

Syslog-ng running on debian / testing / Do we have an answer why syslog-ng just stops logging? and is there a fix? thanks michael

3 3

new macro feature request
by Nate Campi 21 Feb '02

21 Feb '02

I sort logs by hostname, but often the hostname field is wrong, containg a program name (from some solaris hosts) or a severity level (some network devices). Would it be possible to add a macro for the client IP/hostname? Instead of logging like this: destination hosts { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(logs) perm(0644) dir_perm(0755) create_dirs(yes)); }; I could log like this: destination hosts { file("/var/log/HOSTS/$gethostbyaddr/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" owner(root) group(logs) perm(0644) dir_perm(0755) create_dirs(yes)); }; This way, /var/log/HOSTS/unixbox gets the log that the host "unixbox" sent even if the message itself is formatted incorrectly. Man I wish I knew C and could supply patches. Maybe I'll finally apply myself to the K&R C book soon and see what I can churn out ;) -- Nate "Mac users swear by their Mac, PC users swear at their PC."

1 0

Re: [syslog-ng]syslog-ng mysteriously exits
by Michael Earls 21 Feb '02

21 Feb '02

ok, cool, the ver of my syslog-ng is 1.5.13. thanks bazsi >>> bazsi(a)balabit.hu 02/21/02 03:48 AM >>> On Wed, Feb 20, 2002 at 04:24:10PM -0500, Michael Earls wrote: > Syslog-ng running on debian / testing / > > Do we have an answer why syslog-ng just stops logging? and is there a fix? 1.5.13 & 1.5.14 seems to have a bug, that it keeps alive incoming connections as it should, but stops logging from such kept alive connection. I know about the bug, but didn't have time to fix it until now. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Not writing to new logfile after rotate and restart
by Livens Wim 21 Feb '02

21 Feb '02

I have a rather straightforward syslog-ng.conf. I write all messages from the local host to /var/adm/messages and things that come from the net to a separate (customer specific file) filtered on the source host. All works well except that I can't rotate the customer specific logfiles. I can rotate /var/adm/messages. doing: # mv /var/adm/messages /var/adm/messages.0 # kill -HUP `cat /etc/syslog-ng/syslog-ng.pid` and new log are written to /var/adm/messages BUT: # mv /data/customer-logs/491 /data/customer-logs/491.0 # kill -HUP `cat /etc/syslog-ng/syslog-ng.pid` and new messages are still written to data/customer-logs/491.0 I also tried stopping and starting syslog-ng and moving the file somewhere completly different. It still magically remembers the old file. Any idea ?? Relevant part of my config: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslogfile { file("/var/adm/messages"); }; log { source(local); destination(syslogfile); }; source net { udp(); }; filter filter491 { host("12.34.56.78");}; destination logfile491 { file("/data/customer-logs/log491" perm(0644)); }; log { source(net); filter(filter491); destination(logfile491); }; (I'm using syslog-ng-1.4.14 on SunOS 5.8 sparc) Thanks, -- Wim Livens. IP Security Engineer. C o l t B e l g i u m

6 8

Buffer size for message
by Gehring, Andrew x66132 19 Feb '02

19 Feb '02

The buffer size for messages in syslog is 1024. I assume it is the same in syslog-ng. Is there any reason that I can't make this larger... Very long story as to why... Thanks, Andrew

1 0

Solved: Not writing to new logfile after rotate and restart
by Livens Wim 18 Feb '02

18 Feb '02

> hmm.. are you HUP-ping the correct pid? you could possibly > truss syslog-ng > while sending the HUP to see whether it closes and reopens > its files. (it > should do so) The truss showed only /var/adm/messages was being reopened. I found that there were multiple syslog-ng's running. Killing them solved the problem. I falsely assumed the solaris init.d start script checked that. Thanks, -- Wim Livens.

1 0

RE: [syslog-ng]Not writing to new logfile after rotate and restar t
by Livens Wim 18 Feb '02

18 Feb '02

> On Mon, Feb 18, 2002 at 01:00:27PM +0100, Livens Wim wrote: > > > > I have a rather straightforward syslog-ng.conf. I write > all messages from > > the local host to /var/adm/messages and things that come > from the net to a > > separate (customer specific file) filtered on the source > host. All works > > well except that I can't rotate the customer specific > logfiles. I can > > rotate /var/adm/messages. > > > > doing: > > # mv /var/adm/messages /var/adm/messages.0 > > # kill -HUP `cat /etc/syslog-ng/syslog-ng.pid` > > > > and new log are written to /var/adm/messages > > > > BUT: > > # mv /data/customer-logs/491 /data/customer-logs/491.0 > > # kill -HUP `cat /etc/syslog-ng/syslog-ng.pid` > > > > and new messages are still written to data/customer-logs/491.0 > > > > I also tried stopping and starting syslog-ng and moving the > file somewhere > > completly different. > > It still magically remembers the old file. > > hmm.. are you HUP-ping the correct pid? you could possibly > truss syslog-ng > while sending the HUP to see whether it closes and reopens > its files. (it > should do so)

1 0

How do I send message to all ttys/ptys?
by Subodh Nijsure 18 Feb '02

18 Feb '02

Hello, Is there a way to send message to all tty/ptys of logged in users? Say I configure something on my system I want that message to be sent to all currently logged in users as well as to the console, which in my case is /dev/ttyS0 Via syslog-ng how do I redirect message to currently logged in ptys? /Subodh

3 2

RE: [syslog-ng]syslog-ng logging to mysql
by Abraham, Ajamu 18 Feb '02

18 Feb '02

Thanks for the link! However I got another novice question. I am having troubles getting sqlsyslogd running. I get this message when I try to make: ogbitch# make cc -O6 -Wall -pipe -I/usr/local/include -DCONF=\"/usr/local/etc/sqlsyslogd.conf\" -L/usr/local/lib/mysql -lmysqlclient sqlsyslogd.c -o sqlsyslogd /usr/local/lib/mysql/libmysqlclient.so: undefined reference to `strtoll' *** Error code 1 Stop in /usr/local/lab. I am running syslog-ng this on freeBSD. I checked to see if libmysqlclient.so is in the correct location and it is: logbitch# ls -la /usr/local/lib/mysql total 984 drwxr-xr-x 2 root wheel 512 Feb 16 20:48 . drwxr-xr-x 7 root wheel 1024 Feb 13 15:35 .. -r--r--r-- 1 root wheel 10542 Jan 23 14:47 libdbug.a -r--r--r-- 1 root wheel 34278 Jan 23 14:48 libheap.a -r--r--r-- 1 root wheel 15138 Jan 23 14:47 libmerge.a -r--r--r-- 1 root wheel 223014 Jan 23 14:47 libmyisam.a -r--r--r-- 1 root wheel 23010 Jan 23 14:48 libmyisammrg.a -rw-r--r-- 1 root wheel 187098 Jan 23 07:39 libmysqlclient.a lrwxr-xr-x 1 root wheel 20 Feb 13 15:35 libmysqlclient.so -> libmysqlclient.so.10 -rwxr-xr-x 1 root wheel 132453 Jan 23 07:39 libmysqlclient.so.10 -r--r--r-- 1 root wheel 35136 Jan 23 14:47 libmystrings.a -r--r--r-- 1 root wheel 193874 Jan 23 14:47 libmysys.a -r--r--r-- 1 root wheel 98296 Jan 23 14:47 libnisam.a I am wondering if you or anyone else can point me in the right direction. Thanks in advance. - Ajamu

1 0

Messages to console getting "chopped"
by Subodh Nijsure 18 Feb '02

18 Feb '02

Hello, I have setup one of the destination as /dev/ttyS0 and what I am observing is messages that are displayed on my serial console are "chopped", this serial console works fine for vi and all the other work I do, is this something error in configuration of syslog-ng, buffers? /Subodh

1 0

Re: [syslog-ng]Re: Having trouble with the options syntax for file permissions (fwd)
by Leonard Mills 15 Feb '02

15 Feb '02

On Fri, 15 Feb 2002 12:16:12 +0100 Balazs Scheidler <bazsi(a)balabit.hu> wrote: >as it seems your OS doesn't allow setting /dev/null to nonblocking mode and it >is fatal as of now: >what platform are you running syslog-ng? admin:{90} PM:uname -a BSD/OS admin.sjc.in.sel.sony.com 4.0.1 BSDI BSD/OS 4.0.1 Kernel #2: Mon Jan 14 03:20:12 UTC 2002 tra@admin.sjc.in.sel.sony.com:/usr/src/sys/compile/ADMIN i386 Len

1 0

log rotation not completing
by Len Conrad 15 Feb '02

15 Feb '02

FreeBSD 4.5R and syslog-ng 1.1.14. We have FreeBSD newsyslog rotate /var/log/maillog and /var/log/pop-before-smtp at 00:00. the rotation is working, we get the .0.gz files and new log files, but newsyslog-ng is apparently not receiving or reacting to the -HUP or whatever newsyslog sends after rotating the files, so logging to the new files stops at 00:00. We don't have this problem with FreeBSD syslogd. We run syslog-ng witht the standard .conf file delivered with the FreeBSD package and installed with pkg_add, with a couple of our lines added for filtering. eg, the pop-before-smtp log shows : Feb 15 00:00:00 buzzard newsyslog[2885]: logfile turned over Feb 15 03:13:45 ns1 POP3D (0000066C) logon success for nnn navymars.org from 66.26.185.182 no logging until we -HUP manually at 3:13. same situ with maillog. suggestions? Thanks Len http://MenAndMice.com/DNS-training http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways

4 5

Multiple Filters
by Gehring, Andrew x66132 15 Feb '02

15 Feb '02

Does a "and" and a "or" work together? i.e.: filter f_myfilter { level(crit) and match("NOT OK") or match("terminated"); }; Would I get messages that are crit and contain "NOT OK", as well as crit and contain "terminated" Also, what is the best source statement for AIX 4.3.3? I have unix_dgram("/dev/log") and internal() Thanks, Andrew

2 1

log files showing short name.
by Yan Lau 15 Feb '02

15 Feb '02

Hello, I am using syslog-ng 1.5.14. I am trying to get the log messages to display the full hostname instead of the short name. For instance, Feb 4 10:06:42 mailhost su: 'su toto' succeeded for ylau on /dev/pts/0 We have several servers with the name "mailhost" so I would like it to show mailhost.nyc1.globix.net so I can tell which one it is. Here are the options I have set: options { sync (0); time_reopen (10); log_fifo_size (1000); create_dirs (yes); chain_hostnames (no); use_dns (no); use_fqdn (yes); }; Where is it picking up the short name and how can I get it to show the full name? Sometimes the log shows IP addresses, that is OK. Thanks, Yan.

2 1

Having trouble with the options syntax for file permissions
by Leonard Mills 15 Feb '02

15 Feb '02

Running v.1.5.13 Couldn't find likely questions in the archives, going to the list. I have been getting several gigabytes per day in the logs of entries similar to (line broken for length considerations: Feb 13 00:28:04 admin monitor_mail(a)admin.sjc.in.sel.sony.com: [daemon.info] monitor_mail(a)admin.sjc.in.sel.sony.com[24759]: connect from hpntbox1.corpnet.sel.sony.com To try and prevent these, I tried changing the conf file by adding: # DESTINATION ... destination trash { file("/dev/null"); }; ... # FILTER ... filter f_trash { match("connect from hpntbox1.corpnet.sel.sony.com"); }; ... # first exact rule log { source(src); filter(f_trash); destination(trash); flags(final); }; That works. Of course, the daemon then goes ahead and puts the default mode (0600) on /dev/null, which is not a good thing. I haven't been able to decipher a proper syntax for the options in the destination line. My best hints seem to have been in section 2.5 of the reference manual, so I tried: destination trash { file("/dev/null" options{perm(0666);}; ); }; But this gives a syntax error. Also tried eliding the options as in destination trash { file("/dev/null" perm(0666);); } to no avail. Obviously I'm missing something simple, but can't see it. TIA for any hints, Len

3 2

Re: Having trouble with the options syntax for file permissions (fwd)
by Leonard Mills 15 Feb '02

15 Feb '02

laszlo.murvai-buzogany(a)gt-systems.hu wrote on Thu Feb 14 at 09:59:19 2002: >I have had the same problem before, here is the thing you need: >destination trash { file("/dev/null" perm(0666) ); }; >That's how it works for me. Thanks, but this won't work for me. It doesn't drop core, but the daemon dies without writing anything to the log file(s).

2 1

Sorting based on incoming hostname.
by Konstantin Riabitsev 15 Feb '02

15 Feb '02

Hi, folks: I am trying to achieve the following setup. Say, I have Solaris boxes and Linux boxes on my network, and I want them all to log to one loghost. However, I would like to separate the incoming logs by system type. I had this idea: Solaris boxes would log to log-sol.domain.com, while Linux boxes would log to log-lnx.domain.com, which are both CNAME's to loghost.domain.com. Would it be possible for syslog-ng to put all solaris logs in /var/log/solaris and linux logs into /var/log/linux, based entirely on which hostname they arrived at? Cheers, -- 0> Konstantin ("Icon") Riabitsev / ) Duke University Physics Sysadmin ~ www.phy.duke.edu/~icon/pubkey.asc

2 1

syslog-ng logging to mysql
by Abraham, Ajamu 15 Feb '02

15 Feb '02

I am rather new to syslog-ng but love the way it can parse through my logs. I just need to get it writing to a database, thereby making my logs searchable. Can someone send me some links or steps that I need to take to get this accomplished. Thanks in advance. - Ajamu

2 1

Re: [syslog-ng]Having trouble with the options syntax for file permissions (fwd)
by Leonard Mills 14 Feb '02

14 Feb '02

Michael Renner <m.renner(a)inode.at> At Thu, 14 Feb 2002 09:49:06 +0100 (08:49 >Hi Len! >destination trash { file("/dev/null" perm(0666)); }; >should work. I must be denser than I thought, because that dumps core on starting the daemon: (gdb) bt #0 0xc076c11 in kill () #1 0xc0c27c9 in abort () #2 0x8054842 in fatal () #3 0x8054227 in io_set_nonblocking () #4 0x8054275 in io_init_fd () #5 0x80543e2 in make_io_fd () #6 0x804e703 in do_init_dest_writer (c=0x809d708, cfg=0x805f508, persistent=0x0) at affile.c:220 #7 0x804f032 in affile_find_writer (self=0x809cf88, msg=0x80a7e8c) at affile.c:669 #8 0x804f18b in do_handle_affile_log (c=0x809cf88, msg=0x80a7e8c) at affile.c:736 #9 0x804b43d in do_handle_log (c=0x809bf08, msg=0x80a7e8c) at destinations.c:103 #10 0x804ab79 in do_distribute_log (c=0x80a7e48, msg=0x80a7e8c) at center.c:149 #11 0x804a79b in do_add_source_name (c=0x80bd708, logmsg=0x80a7e8c) at sources.c:238 #12 0x804f513 in do_handle_afunix_line (c=0x80a7ec8, msg=0x80a7e8c) at afunix.c:70 #13 0x804a3dc in do_handle_line (self=0x8090008, length=109, data=0x8090020 "<30>Feb 14 19:52:52 monitor_kern(a)admin.sjc.in.sel.sony.com[ 19699]: connect from hpntbox1.corpnet.sel.sony.com", addr=0x0, addrlen=0) at sources.c:67 #14 0x804a54a in do_read_line (h=0x809d0d0, read=0x8047858) at sources.c:122 #15 0x80534c3 in read_callback () #16 0x8053243 in io_iter () #17 0x8049c3e in main_loop (backend=0x805e008) at main.c:174 #18 0x804a345 in main (argc=3, argv=0x80479f8) at main.c:472 #19 0x8049994 in __start () Any other ideas? Len

1 0

Re: Having trouble with the options syntax for file permissions
by MURVAI-BUZOGANY Laszlo 14 Feb '02

14 Feb '02

Hi! > I haven't been able to decipher a proper syntax for the options in the > destination line. My best hints seem to have been in section 2.5 of the > reference manual, so I tried: > > destination trash { file("/dev/null" options{perm(0666);}; ); }; > > destination trash { file("/dev/null" perm(0666);); } > I have had the same problem before, here is the thing you need: destination trash { file("/dev/null" perm(0666) ); }; That's how it works for me. Laszlo

1 0

Re: Logrotate "remove_if_older" documentation
by klaas.vangend＠philips.com 14 Feb '02

14 Feb '02

> I read something about a "remove_if_older" Config variable in Baszis 1.5.14 > announce, but couldn't find any documentation for it. In which context do i > have to use this function (destination i guess..) and which options does it > accept/need? > Is there also a function which compresses the "rotated-away" logfiles, or > do i have to use the "find -mtime" hack? I added documentation in the patch I sent. Yes, remove_if_older requires one parameters, stating the number of seconds (it was days in my patch, but Balazs changed that to seconds to match all other syslog-ng parameters). If the file where the log line is to be written to is older than the number of seconds specified, the file will be removed prior to writing the log to file. Thus it is a parameter of the file() destination. I originally though about implementing some other features, like the ones you described, but because our product (which uses syslog-ng as logger) doesn't need those features, my boss didn't allow me to work on those. It shouldn't be too complex to add, by the way. You can take my patch as a basis for knowing where to change the source code. Groetjes, Klaas van Gend

3 3

Why can't I get NOT to work in a filter?
by Chad White 13 Feb '02

13 Feb '02

Hi all, I am trying to filter out some things from my log files using a filter with a NOT command and I can't get it to work. I am running Syslog-ng 1.4.14 on Solaris 8 (SPARC). What I am trying to do in this case is ensure that sudo doesn't get logged into my /var/adm/messages file. Here are the pertinent lines of my config file: options { dir_perm(0755); perm(0640); owner(root); group(wheel); chain_hostnames (no); keep_hostname(yes); }; source local { sun-streams("/dev/log" door ("/etc/.syslog_door") ); internal(); }; filter not_sudo { not facility(local2); }; filter notice_emerg { level(notice...emerg); }; destination messages { file("/var/adm/messages" create_dirs(yes)); }; log { source(local); filter(notice_emerg); filter(not_sudo); destination(message s); }; Now, it is my understanding that the filters are AND'd together so that log statement should basically say "log everything with a level between notice and emergency unless it is facility(local2)." However, I am still getting this is my log files: Dec 30 03:32:24 hqmon /usr/local/bin/sudo: [ID 850335 local2.notice] nobody : TTY=unknown ; PWD=/opt/bb18d ; USER=root ; COMMAND=/usr/sbin/vxdisk check rootdisk Also another filter that dumps everything from facility(local2) does dump all the sudo stuff into a file like I want.. Starting to feel like an idiot since I can't get this to work. Can someone give me some pointers to filtering out just a few cases based on facility or strings? thx, --Chad

1 0

Splitting UDP syslog traffic
by Eduardo Seud�nimo 13 Feb '02

13 Feb '02

I'm interested in doing a 'tee' to syslog traffic much in the same way that the tee command does to stdout. I currently have a syslog-ng server that gets a whole lot of traffic sent his way. Because of bandwidth contraints, I do not want to double the traffic flow by sending it to two servers. I would like to have a way to listen for the incoming syslog traffic and redirect each packet to a different IP address while preserving the original packet destined for my syslog box. For each packet that looks like this: source IP ----> syslog server IP I want two packets like this: source IP ----> syslog server IP source IP ----> syslog server2 IP This will allow me to send a stream to both servers while preserving the bandwidth to the remote sites. I need to preserve the source IP traffic because I'm using sysng to break it up into seperate paths/files based on source. Is this possible with NG? It looks like NG will bind to a local address when using the udp destination driver.

2 1

Re: A question on syslog-ng
by Balazs Scheidler 13 Feb '02

13 Feb '02

On Wed, Feb 13, 2002 at 01:12:49AM -0800, Subodh Nijsure wrote: > Is there any way in syslog-ng to stop logging of message once it has > been logged to "a destination". > > I am getting say ftpd messsages logged in ftpd.log file as well as my catch > all > entries I want to configure things such that they get logged only once. 1. use negative filters 2. in the 1.5.x tree you have the following flags on destinations you could use for this purpose: <entry>final</entry> <entry> This flag means that the processing of log statements ends here. Note that this doesn't necessarily mean that matching messages will be stored once, as they can be matching log statements processed prior the current one. </entry> </row> <row> <entry>fallback</entry> <entry> This flag makes a log statement 'fallback'. Being a fallback statement means that only messages not matching any 'non-fallback' log statements will be dispatched. </entry> </row> <row> <entry>catchall</entry> <entry> This flag means that the source of the message is ignored, only the filters are taken into account when matching messages. </entry> </row> -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Logrotate "remove_if_older" documentation
by Michael Renner 12 Feb '02

12 Feb '02

Hiya! I read something about a "remove_if_older" Config variable in Baszis 1.5.14 announce, but couldn't find any documentation for it. In which context do i have to use this function (destination i guess..) and which options does it accept/need? Is there also a function which compresses the "rotated-away" logfiles, or do i have to use the "find -mtime" hack? mfg/best eregards -- Renner Michael Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

1 0

RE: [syslog-ng]syslog-ng mysteriously exits
by John Coke 08 Feb '02

08 Feb '02

Are you referring to the SIGHUP bugs(s)? -----Original Message----- From: Ed Ravin [mailto:eravin@panix.com] Sent: Friday, February 08, 2002 12:40 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng mysteriously exits John Coke writes: > getpid() = 3616 > time(NULL) = 1013148201 > rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 > getpid() = 3616 > kill(3616, SIGABRT) = 0 > --- SIGABRT (Aborted) --- > > I have not been able to find a clear picture of what causes SIGABRT. This is self-inflicted - note that the process looks up its own process ID number (getpid()), diddles the signal mask (I'm guessing it's to enable SIGABRT), then kills itself. syslog-ng has probably detected something very wrong, and is trying to leave you a core dump so you can figure out what happened. So my next question is - where's the core dump? It should show up in the current directory of the daemon. Use "lsof" while the daemon is running to see what directory it is in, and check there. Or do a global find and hunt it down. Also, have you tried upgrading to the latest syslog-ng (1.5.14 or so)? Except for one small bug :-) it's worked pretty well for me. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 2

How to stop logging message
by Subodh Nijsure 08 Feb '02

08 Feb '02

Hello, Does syslog ng have functionality that would allow me to stop logging of message once a message is logged? i.e. say I have rule that says log all "ftp" messages to /var/log/ftpd.log I want logging of that message to stop and not get logged into my "catchall" destination. if anybody has syntax/config file sample for this please let me know. Thanks. /Subodh Nijsure

1 0

RE: [syslog-ng]syslog-ng mysteriously exits
by John Coke 08 Feb '02

08 Feb '02

Thanks to Ed for the help, here's the tail of the strace: socket(PF_UNIX, SOCK_STREAM, 0) = 7 connect(7, {sin_family=AF_UNIX, path=" /var/ru n/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) close(7) = 0 open("/etc/hosts", O_RDONLY) = 7 fcntl64(7, F_GETFD) = 0 fcntl64(7, F_SETFD, FD_CLOEXEC) = 0 fstat64(7, {st_mode=S_IFREG|0644, st_size=3633, ...}) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40017000 read(7, "# Do not remove the following li"..., 4096) = 3633 close(7) = 0 munmap(0x40017000, 4096) = 0 time(NULL) = 1013148201 getpid() = 3616 time(NULL) = 1013148201 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 getpid() = 3616 kill(3616, SIGABRT) = 0 --- SIGABRT (Aborted) --- I have not been able to find a clear picture of what causes SIGABRT. Has someone run across this before? Would the inclusion of my config be of any use? Thanks. -John -----Original Message----- From: Ed Ravin [mailto:eravin@panix.com] Sent: Wednesday, February 06, 2002 11:02 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng mysteriously exits John Coke writes: > Syslog-ng-1.4.14 on a redhat 7.2 server is mysteriously crashing/exiting and > I am having trouble tracing the problem. There is no core and when I run > the service in debug, it does not exit. It normally exits within 2 or three > hours. What can I do next to try and find the problem? Have you tried attaching to it with strace? That will slow it down, but it won't change any code paths like the -d option does. Do something like "strace -o outputfile -p <syslog-ng-process" and see what's in "outputfile" after syslog-ng exits (if it indeed does exit). If you don't have the disk space, you could kill the strace process every hour or so and restart it - the daemon being traced shouldn't notice anything. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1