- syslog-ng - lists.balabit.hu

Installing Syslog-NG 3.7 on CentOS 7
by Ivan Adji - Krstev 12 May '16

12 May '16

I have the following errors when i try to install Syslog-NG 3.7 on CentOS 7 I have problem when i try to install Syslog-NG 3.7 on CentOS 7. The following errors i get: --> Finished Dependency Resolution Error: Package: syslog-ng-3.7.3-1.el6.x86_64 (czanik-syslog-ng37epel6) Requires: libevtlog.so.0()(64bit) Error: Package: syslog-ng-3.7.3-1.el6.x86_64 (czanik-syslog-ng37epel6) Requires: libpcre.so.0()(64bit) You could try using --skip-broken to work around the problem You could try running: rpm -Va --nofiles --nodigest Any hints on this ? Kind regards Ivan

3 6

Syslog-ng 3.8
by Ivan Adji - Krstev 12 May '16

12 May '16

Hi all, I have open a issue about the error i got when i update the Syslog-NG to 3.8 for "syslog-ng Address already in use (98)". I'm still working on the issue, but i would like to know if this newest version 3.8 is stabled as im building new environment and im asking myself do i use this 3.8 version or 3.7 ? Thanks Ivan

5 13

[GSOC]WebSocket for syslog-ng - Configuration file design to get feedbacks.
by Yilin Li 05 May '16

05 May '16

Hi, Very excited and thanks to the community that my proposal is accepted by syslog-ng in GSOC 2016. Here is my proposal: https://github.com/balabit/syslog-ng/wiki/GSoC-2016-Proposal:-WebSocket-for… I have some spare time recently. So I plan to begin my work early This document describes what the configuration file will look like for the project that I will accomplish. WebSocket for syslog-ng (Yilin Li) - Configure ... <https://docs.google.com/document/d/1FVc4EySiTu9RHdlsPd-NGQ9JzvV0WInQrM2VBA4…> . I post it to the community to get feed backs. I will reiterate the design on the community feedback. I hope it will be what our users exactly want at last. Any comments will be greatly apprecitated :) And there is a question for my mentors Laszlo Meszaros and Viktor Juhasz, will it be OK that I go faster than my schedule ? -- Best wishes, Yilin Li Institute of Software Chinese Academy of Sciences

1 0

Insider 2016-05: BMW; GSoC; Hadoop; grouping-by; SIEM; Java; Rust;
by Czanik, Péter 05 May '16

05 May '16

Dear syslog-ng users, This is the 49th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng in the BMW i3 ----------------------- The BMW i3 electric car uses many open source software under the hood. BMW respects the GPL and made the source code of software used available upon request. You can find syslog-ng among them: https://github.com/edent/BMW-OpenSource Google Summer of Code (GSoC) ---------------------------- The syslog-ng project will participate in GSoC this year again, this time with five students. We are looking for Feature Owners who could represent syslog-ng users in the process. Topics range from websockets through CLI to Java-based Kafka source. Read more about the topics and learn how to contact the team at https://lists.balabit.hu/pipermail/syslog-ng/2016-April/022862.html syslog-ng is Hortonworks Data Platform certified ------------------------------------------------ Both syslog-ng OSE and PE provide a Hadoop destination and are now Hortonworks Data Platform certified. You can read more about why use syslog-ng in a Hadoop environment at https://czanik.blogs.balabit.com/2016/02/filling-your-data-lake-with-log-me… or on the Hortonworks website at http://hortonworks.com/partner/balabit/ The grouping-by() parser ------------------------ Until recently, you could only correlate and aggregate information from multiple messages with the PatternDB parser. The new grouping-by() parser in the upcoming syslog-ng version 3.8 can correlate and aggregate information independently from PatternDB, using data from any of the available parsers (CSV, key=value, PatternDB, JSON): https://czanik.blogs.balabit.com/2016/04/the-grouping_by-parser-in-syslog-n… Optimize your SIEM ------------------ Join us on Wednesday, May 18, 2016, at 2:00 PM EST to hear about the benefits of front-ending your SIEM with syslog-ng. Benefits include: increased performance, higher quality data, and cost-effective scalability. Register for the live webinar at https://pages2.balabit.com/optimize-siem/ Troubleshooting Java support ---------------------------- Java based destination drivers were introduced to syslog-ng last year. The syslog-ng application uses libjvm.so to embed a Java Virtual Machine inside syslog-ng. Learn which Java to use and how to make sure, that it is found by syslog-ng: https://czanik.blogs.balabit.com/2016/03/troubleshooting-java-support-in-sy… Cybersecurity Excellence award for SSB -------------------------------------- Balabit has been named the winner of the 2016 Cybersecurity Excellence Award for Forensics for syslog-ng Store Box (SSB). Based on syslog-ng – one of the most widely adopted log management software packages – SSB is a highly reliable and high-performance log management appliance which collects, classifies, organizes, and securely stores log messages for any enterprise who operates a log management infrastructure. http://www.marketwired.com/press-release/balabits-syslog-ng-store-box-earns… Packaging Rust parsers ---------------------- Up until now, if you wanted to try the new Rust-based parsing in syslog-ng, you also had to build syslog-ng yourself from source code. Not anymore, if you use one of the RPM-based Linux distributions: https://czanik.blogs.balabit.com/2016/04/syslog-ng-3-8-preview-parsers-in-r… Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com . To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

race condition causes copytruncate log rotation problems
by Jim Segrave 04 May '16

04 May '16

On a set of very busy Usenet servers, we are seeing problems with using syslog-ng together with copytruncate in logrotation. I am not sure why, but syslog-ng opens log files without having O_APPEND set, and appends log mesages with separate syscalls - an lseek to SEEK_END, followed by a write. On a busy server- perhaps 300 logs/sec each about 120 bytes long, we sometimes find that logrotate, which is configured to do a copy-truncate, actually produces a sparse file which begins with blocks of zeroes up to the pre-rotate log file size, followed by logs written after the copytruncate completes. Looking at the Linux /proc/PID/fdinfo information, I see that the logfiles are not opened in append mode, although they are opened O_WR. I haven't begun looking through the source to see if syslog-ng ever tries to overwrite data it's already logged by seeking backwards in the file - I must confess I can't think of any reason to do so. The only other reason for not having O_APPEND set would be to avoid problems for people using NFS to collect logs centrally by having different servers all writing to one NFS file. As I see it, the sequence leading to this problem is: syslog-ng logrotate copytruncate function ------------- ------------------------------------------- ,,, begin copytruncate, reach EOF on the copy lseek(fd, SEEK_END) <------------------------------------------------------------- the end of the file before logrotate ftruncates() it ftruncate(fd, 0) write(fd, log_msg, log_msg_size) <----------------------------------------- the write takes place at the old EOF, so the kernel considers the file to have empty blocks from 0 to that point If there is a reason that some users need the logfile opened without O_APPEND mode, then making that choice a configuration option would be helpful. For those using O_APPEND, the lseek() calls are harmless and won't add any more resource usage than is already present, but file truncation will prevent a zero filled pad being prefixed to the file.

3 2

Re: [syslog-ng] syslog-ng 3.7.3 with Java enable Can't find class when startup
by Ho, Ming 04 May '16

04 May '16

Hi, I use the following conf file to start syslog-ng 3.7.3 complied with Java supported version and got the following error: # syslog-ng -f /opt/syslog-ng/syslog-ng.conf [2016-05-03T23:13:54.191256] Can't find class; class_name='org/syslog_ng/SyslogNgClassLoader' ** ERROR:modules/java/native/java_machine.c:126:java_machine_get_class_loader: assertion failed: (self->loader) syslog-ng.conf: @version: 3.7 @include "scl.conf" @module mod-java source s_syslog { syslog(); }; destination d_elastic { java( class_path("/usr/lib64/syslog-ng/java-modules/*.jar:/usr/share/elasticsearch/lib/*.jar") class_name("org.syslog_ng.elasticsearch.ElasticSearchDestination") option("index", "syslog-ng_${YEAR}.${MONTH}.${DAY}") option("type", "test") option("client-mode", "transport") option("server", "sl73ovnapd018") option("port", "9200") option("flush-limit", "10") ); }; log { source(s_syslog); destination(d_elastic); flags(flow-control); }; I found previous post from last year with the exact same error: https://github.com/balabit/syslog-ng/issues/620 According to the post the problem was make install fail to copy "syslog-ng-core.jar" and/or "syslog-ng-common.jar" to target directory. Including these two files in the directory referenced by the class_path should solve the problem. I have these two files included in my class_path already but still got the same error: -rw-r--r-- 1 root root 11411 May 2 06:50 /usr/lib64/syslog-ng/java-modules/syslog-ng-core.jar -rw-r--r-- 1 root root 12536 May 2 06:51 /usr/lib64/syslog-ng/java-modules/syslog-ng-common.jar Any help is highly appreciated. Ming Ho

1 0

Compile time error
by Vithulan MV 03 May '16

03 May '16

Hi all, I added required dependencies and tried to build syslog-ng from the source, there was an error saying, ${syslog-ng_HOME}/modules/afmongodb/mongo-c-driver/src/mongoc/mongoc-scram.c: In function '_mongoc_scram_sha1': storage size of 'digest_ctx' isn't known (EVP_MD_CTX digest_ctx) I confirmed OpenSSL [1] headers are included in the file.Can you please point out whats wrong? [1] https://github.com/mongodb/mongo-c-driver/blob/7415d3468de0c500fd6e630f7b52… Thanks. Regards, Vithulan

4 6

filtering vs. keeping all logs
by Czanik, Péter 29 Apr '16

29 Apr '16

Hi, One of the major strengths of syslog-ng is message filtering, which facilitates message routing and discarding useless log messages. OTOH I often read, that we have now all the technologies and storage to keep all logs. What do you think? Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

5 7

Re: [syslog-ng] [GSoC] Project: Kafka source
by Vithulan MV 27 Apr '16

27 Apr '16

Hi all, First of all, I'd like to thank you Syslog-ng community and my mentor Viktor Juhasz for accepting my proposal to implement Kafka source in Java!. Some of you may already know me but for others, I'll introduce myself again. I'm Vithulan, 3rd year undergraduate at University of Moratuwa, Sri lanka. My areas of interests are, Data analytics, Machine Learning, Networking and Security. As a first step into this GSoC program I already started following the documentation [1], and going through the code base of syslog-ng (I'm curious what IDE you all are using?). What are the other areas that you want me to know to polish my knowledge before we get into the coding period? I guess, this is going to be very interesting 4 months with good new experiences :) Thank you! [1] https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… Best regards, Vithulan. On 23 April 2016 at 08:42, Vithulan MV <vithulanmv.12(a)cse.mrt.ac.lk> wrote: > Hi Viktor, > > I am very excited and happy after seeing my morning mail from Google > summer of code! Thank you very much for accepting my proposal! :) > How shall we proceed into this project? and any tips before going deep > into the project? :) > > Thank you. > > Best regards, > Vithulan. > > On 26 March 2016 at 10:52, Vithulan MV <vithulanmv.12(a)cse.mrt.ac.lk> > wrote: > >> Hi Viktor, >> >> I have submitted my proposal in GSoC page and Syslog-ng wiki page aswell. >> >> Thanks. >> Best regards, >> Vithulan >> On Mar 10, 2016 8:42 PM, "Vithulan MV" <vithulanmv.12(a)cse.mrt.ac.lk> >> wrote: >> >>> Hi Viktor, >>> >>> Thanks for the link :) I'll check that. >>> >>> Regards, >>> Vithulan. >>> >>> On 10 March 2016 at 20:22, Juhász, Viktor <viktor.juhasz(a)balabit.com> >>> wrote: >>> >>>> Hi, >>>> >>>> Sorry I missed the link :) >>>> https://syslog-ng.org/gsoc-2016/ >>>> >>>> BR, >>>> Viktor >>>> >>>> On Thu, Mar 10, 2016 at 3:46 PM, Vithulan MV < >>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>> >>>>> Hi Viktor, >>>>> >>>>> Do you mean creating proposals for GSOC 2016 page [1] ? If not please >>>>> kindly share the page link with me? >>>>> >>>>> [1] >>>>> https://github.com/balabit/syslog-ng/wiki/Creating-a-proposal-for-GSoC-2016 >>>>> >>>>> Thanks. >>>>> Regards, >>>>> Vithulan. >>>>> >>>>> On 10 March 2016 at 19:40, Juhász, Viktor <viktor.juhasz(a)balabit.com> >>>>> wrote: >>>>> >>>>>> Hi Vithulan, >>>>>> >>>>>> We've finished our GSoC process description. Please read it >>>>>> carefully, and fill our Student Application Form. >>>>>> >>>>>> BR, >>>>>> Viktor >>>>>> >>>>>> On Thu, Mar 10, 2016 at 3:06 PM, Vithulan MV < >>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>> >>>>>>> HI Viktor, >>>>>>> >>>>>>> Thanks for the overview and giving the overall idea. I'm working on >>>>>>> this and report you back on the progress. >>>>>>> >>>>>>> Thanks. >>>>>>> Regards, >>>>>>> Vithulan. >>>>>>> >>>>>>> On 8 March 2016 at 18:05, Juhász, Viktor <viktor.juhasz(a)balabit.com> >>>>>>> wrote: >>>>>>> >>>>>>>> Hi Vithulan, >>>>>>>> >>>>>>>> Yes, this should be plugin (you can find the plugins in the modules >>>>>>>> directory in syslog-ng source). >>>>>>>> >>>>>>>> Just a very briefly overview: >>>>>>>> >>>>>>>> syslog-ng read messages from the sources, process them with >>>>>>>> filters, rewrite rules, parsers, etc, and finally send messages to the >>>>>>>> destinations. >>>>>>>> We have a Kafka destination, it is implemented in java. The kafka >>>>>>>> source also should be implemented in java, but we our java source base is >>>>>>>> under construction, so till I can't give you an exact API, it is comming in >>>>>>>> the next 2-3 weeks. >>>>>>>> >>>>>>>> The ovarall idea is the following. >>>>>>>> - We should implement a Kafka consumer which uses the high level >>>>>>>> kafka group consuming API ( >>>>>>>> https://cwiki.apache.org/confluence/display/KAFKA/Consumer+Group+Example >>>>>>>> ) >>>>>>>> - We have to process data read from the Kafka (create LogMessage >>>>>>>> from this. LogMessage is an internal struct in syslog-ng representing the >>>>>>>> in the software) >>>>>>>> - After reload or restart syslog-ng have to be able to continue >>>>>>>> reading messages from the last read message. >>>>>>>> - If there are more syslog-ng's reading the same Kafka input >>>>>>>> (these syslog-ng's have the same group name) avoid message loosing or >>>>>>>> message duplication as much as possible >>>>>>>> >>>>>>>> Regards, >>>>>>>> Viktor >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Mon, Mar 7, 2016 at 6:43 PM, Vithulan MV < >>>>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>>>> >>>>>>>>> Hi Viktor, >>>>>>>>> >>>>>>>>> Oh I see! I've sent a mail to the mail list. Can you kindly give >>>>>>>>> me an overall idea of project Kafka source please? (Architecture of >>>>>>>>> syslog-ng/ current APIs) Is this is going to be an extension of syslog-ng? >>>>>>>>> >>>>>>>>> Thank you. >>>>>>>>> >>>>>>>>> Regards, >>>>>>>>> Vithulan. >>>>>>>>> Hi Vithulan, >>>>>>>>> >>>>>>>>> I've never faced with this problem, during compiling syslog-ng. >>>>>>>>> I suggest, that ask about your problem in the mail list of >>>>>>>>> syslog-ng ;) >>>>>>>>> >>>>>>>>> Best Regards, >>>>>>>>> Viktor >>>>>>>>> >>>>>>>>> >>>>>>>>> On Mon, Mar 7, 2016 at 12:46 PM, Vithulan MV < >>>>>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>>>>> >>>>>>>>>> Hi, >>>>>>>>>> >>>>>>>>>> I've been going through the git book that you referred. It was >>>>>>>>>> helpful. Can you please explain a bit about the project structure and >>>>>>>>>> deliverables of Kafka-source project? >>>>>>>>>> >>>>>>>>>> I added required dependencies and tried to build syslog-ng from >>>>>>>>>> the source, there was an error saying, >>>>>>>>>> *${syslog-ng_HOME}/modules/afmongodb/mongo-c-driver/src/mongoc/mongoc-scram.c: >>>>>>>>>> In function '_mongoc_scram_sha1':* *storage size of 'digest_ctx' >>>>>>>>>> isn't known** (EVP_MD_CTX digest_ctx)* >>>>>>>>>> I confirmed OpenSSL [1] headers are included in the file.Can you >>>>>>>>>> please point out whats wrong? >>>>>>>>>> >>>>>>>>>> In the meantime I'm going through the syslog-ng documentation >>>>>>>>>> [2]. Can you give me directives on what I can be doing while preparing my >>>>>>>>>> proposals? >>>>>>>>>> >>>>>>>>>> [1] >>>>>>>>>> https://github.com/mongodb/mongo-c-driver/blob/7415d3468de0c500fd6e630f7b52… >>>>>>>>>> [2] >>>>>>>>>> https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… >>>>>>>>>> >>>>>>>>>> Thank you. >>>>>>>>>> Regards, >>>>>>>>>> Vithulan. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On 4 March 2016 at 18:56, Vithulan MV < >>>>>>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>>>>>> >>>>>>>>>>> Hi, >>>>>>>>>>> >>>>>>>>>>> Thanks for the reference, I will go through it and report you >>>>>>>>>>> back on the progress. >>>>>>>>>>> >>>>>>>>>>> Thanks, >>>>>>>>>>> Regards, >>>>>>>>>>> Vithulan. >>>>>>>>>>> >>>>>>>>>>> On 4 March 2016 at 18:45, Juhász, Viktor < >>>>>>>>>>> viktor.juhasz(a)balabit.com> wrote: >>>>>>>>>>> >>>>>>>>>>>> Hello, >>>>>>>>>>>> >>>>>>>>>>>> Sorry for the long response time. We are working on a wiki >>>>>>>>>>>> page, this page will describe all the required information. Till please >>>>>>>>>>>> read our documentation (getting started) >>>>>>>>>>>> https://www.gitbook.com/book/syslog-ng/getting-started/details >>>>>>>>>>>> >>>>>>>>>>>> Best Regards, >>>>>>>>>>>> Viktor Juhasz >>>>>>>>>>>> >>>>>>>>>>>> On Fri, Mar 4, 2016 at 2:09 PM, Vithulan MV < >>>>>>>>>>>> vithulanmv.12(a)cse.mrt.ac.lk> wrote: >>>>>>>>>>>> >>>>>>>>>>>>> Hello, >>>>>>>>>>>>> >>>>>>>>>>>>> I sent the following mail to the syslog-ng mailing list, but >>>>>>>>>>>>> didn't get any responses. So I thought it didn't reach to you. I'm highly >>>>>>>>>>>>> motivated on contributing for syslog-ng in GSoC 2016. I also have prior >>>>>>>>>>>>> experience in syslog-ng domain so I feel like this project is going to be >>>>>>>>>>>>> very interesting. Please kindly guide me on how I should start? >>>>>>>>>>>>> >>>>>>>>>>>>> Thank you. >>>>>>>>>>>>> >>>>>>>>>>>>> Regards, >>>>>>>>>>>>> Vithulan. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> ---------- Forwarded message ---------- >>>>>>>>>>>>> From: Vithulan MV <vithulanmv.12(a)cse.mrt.ac.lk> >>>>>>>>>>>>> Date: 3 March 2016 at 15:33 >>>>>>>>>>>>> Subject: [GSoC] Project: Kafka source >>>>>>>>>>>>> To: syslog-ng(a)lists.balabit.hu >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> Hi all, >>>>>>>>>>>>> >>>>>>>>>>>>> I'm currently a 3rd year undergraduate at University of >>>>>>>>>>>>> Moratuwa, Sri lanka. I have attached my Linkedin profile with this mail >>>>>>>>>>>>> [1]. I'd like to contribute to a GSoC 2016 project with the open source >>>>>>>>>>>>> community of syslog-ng. >>>>>>>>>>>>> >>>>>>>>>>>>> I have contributed in log analyzing project LogAnalyzer [2] >>>>>>>>>>>>> and also worked with logstash, kafka. Therefore, I think I can contribute >>>>>>>>>>>>> syslog-ng project kafka source as I'm much interested in that. >>>>>>>>>>>>> >>>>>>>>>>>>> Please kindly make any suggestions on how I should proceed on >>>>>>>>>>>>> this? >>>>>>>>>>>>> >>>>>>>>>>>>> [1] https://lk.linkedin.com/in/vithulamv >>>>>>>>>>>>> [2] https://github.com/VIthulan/product-la >>>>>>>>>>>>> >>>>>>>>>>>>> Thank you. >>>>>>>>>>>>> Regards, >>>>>>>>>>>>> Vithulan >>>>>>>>>>>>> >>>>>>>>>>>>> -- >>>>>>>>>>>>> Vithulan MV. >>>>>>>>>>>>> >>>>>>>>>>>>> Undergraduate, >>>>>>>>>>>>> Department of Computer Science & Engineering, >>>>>>>>>>>>> University of Moratuwa, >>>>>>>>>>>>> Sri lanka. >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> -- >>>>>>>>>>>>> Vithulan MV. >>>>>>>>>>>>> >>>>>>>>>>>>> Undergraduate, >>>>>>>>>>>>> Department of Computer Science & Engineering, >>>>>>>>>>>>> University of Moratuwa, >>>>>>>>>>>>> Sri lanka. >>>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> -- >>>>>>>>>>> Vithulan MV. >>>>>>>>>>> >>>>>>>>>>> Undergraduate, >>>>>>>>>>> Department of Computer Science & Engineering, >>>>>>>>>>> University of Moratuwa, >>>>>>>>>>> Sri lanka. >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> -- >>>>>>>>>> Vithulan MV. >>>>>>>>>> >>>>>>>>>> Undergraduate, >>>>>>>>>> Department of Computer Science & Engineering, >>>>>>>>>> University of Moratuwa, >>>>>>>>>> Sri lanka. >>>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>> >>>>>>> >>>>>>> -- >>>>>>> Vithulan MV. >>>>>>> >>>>>>> Undergraduate, >>>>>>> Department of Computer Science & Engineering, >>>>>>> University of Moratuwa, >>>>>>> Sri lanka. >>>>>>> >>>>>> >>>>>> >>>>> >>>>> >>>>> -- >>>>> Vithulan MV. >>>>> >>>>> Undergraduate, >>>>> Department of Computer Science & Engineering, >>>>> University of Moratuwa, >>>>> Sri lanka. >>>>> >>>> >>>> >>> >>> >>> -- >>> Vithulan MV. >>> >>> Undergraduate, >>> Department of Computer Science & Engineering, >>> University of Moratuwa, >>> Sri lanka. >>> >> > > > -- > Vithulan MV. > > Undergraduate, > Department of Computer Science & Engineering, > University of Moratuwa, > Sri lanka. > -- Vithulan MV. Undergraduate, Department of Computer Science & Engineering, University of Moratuwa, Sri lanka.

2 1

Re: [syslog-ng] Switching the syslog-ng central server - client messages go missing
by jrhendri 27 Apr '16

27 Apr '16

Can you test manually using logger? That way you can see if it behaves differently with different combinations of facility and priority. Also capture those with tcpdump or whatever. I seem to recall that Solaris uses different mappings than other operating systems. You might look at the sending and receiving system header files. I forget the exact name or location but something like /usr/include/sys/syslog.h I think... Good luck Jim Sent from my Verizon, Samsung Galaxy smartphone -------- Original message --------From: "Cottington-Bray, Ian" <ian.cottington-bray(a)mclaren.com> Date: 4/27/16 7:06 AM (GMT-05:00) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Switching the syslog-ng central server - client messages go missing Thanks for the feedback – had to wait for a period to test again. Comments below Ian Cottington-Bray | Senior Infrastructure Engineer – Linux/Unix | McLaren Technology Group Limited McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK T: +44 (0) 1483 261 900 D: +44 (0) 1483 262 357 E: ian.cottington-bray(a)mclaren.com W: www.mclaren.com From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Scheidler, Balázs Sent: 21 April 2016 10:33 To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Subject: Re: [syslog-ng] Switching the syslog-ng central server - client messages go missing hmm... couple of things come to mind, not all syslog-ng related: 1) are those messages actually arriving on the host (check with tcpdump) Sometimes – I see network packets being sent some of the time (by the client) but not always 2) is the local firewall letting them through? There is no firewall on this network 3) is syslog-ng bound to a specific ip/port or it is bound to 0.0.0.0? (check that with netstat) Specific IP/port (514) – several IPs in fact 4) you should be able to use telnet/netcat on the client host to check if the port on the solaris11 box is open The port is open 5) if all else fails, check the syslog-ng config, but that shouldn't be a problem It looks OK to me .. It almost looks like the client systems don’t send all the time – which is VERY strange and I’m struggling to understand why. The client systems seem to send a few messages immediately after syslog-ng starts on the central server and then stop sending … If I shutdown the new server and bring up the old one the messages start appearing in the logs as I would expect. Any suggestions ? Bazsi -- Bazsi On Wed, Apr 20, 2016 at 4:51 PM, Cottington-Bray, Ian <ian.cottington-bray(a)mclaren.com> wrote: Hi I have a Solaris 10 server running version 3.0 of syslog-ng. I have built a new server running Solaris 11 with version 3.6 of syslog-ng installed. I have tested the new server by pointing another client at it and messages appear in the configured files as expected. I then shut down the Solaris 10 server – change the Solaris 11 server IP configuration to match the details for the Solaris 10 server – restart syslog-ng on the Solaris 11 server. Things seem to be working ok – except for the (Solaris and Linux) clients using syslog-ng (and referencing the central syslog-ng server by IP) their messages do not arrive at the expected files. Any suggestions ? Ian Ian Cottington-Bray | Senior Infrastructure Engineer – Linux/Unix | McLaren Technology Group Limited McLaren Technology Centre, Chertsey Road, Woking, Surrey GU21 4YH, UK T: +44 (0) 1483 261 900 D: +44 (0) 1483 262 357 E: ian.cottington-bray(a)mclaren.com W: www.mclaren.com The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715 ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715

1 0