- syslog-ng - lists.balabit.hu

Re: [syslog-ng] syslog-ng Digest, Vol 97, Issue 4
by Yarick Tsagoyko 05 May '13

05 May '13

Dear R, cool issue. I have not seen this exact error on my compiles, here are some pointers: 1. Post your config.log 2. View the location of the referenced file(s) In file included from /usr/include/net/ethernet.h:27, from /usr/include/libnet.h:98, from afinet-dest.c:43 3. Rerun the configure, make clean, make. Sometimes rerunning the configure and running make cleac helps. Please post the findings. On May 5, 2013 6:00 AM, <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. problems compiling OSE 3.4.1 on redhat enterprise 6.4 > (Russell Fulton) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 5 May 2013 13:28:04 +1200 > From: Russell Fulton <r.fulton(a)auckland.ac.nz> > Subject: [syslog-ng] problems compiling OSE 3.4.1 on redhat enterprise > 6.4 > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <D1B88BF5-CE66-485B-93FF-ECE892F2F950(a)auckland.ac.nz> > Content-Type: text/plain; charset=us-ascii > > make[4]: Entering directory > `/home/rful011/syslog-ng-3.4.1/modules/afsocket' > /bin/sh ../../libtool --tag=CC --mode=compile gcc -std=gnu99 > -DHAVE_CONFIG_H -I. -I../.. -I../../lib -I../../lib -pthread > -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include > -I/usr/local/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE > -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -I../../lib/ivykis/src/include > -I../../lib/ivykis/src/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE > -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -pthread -MT > libafsocket_notls_la-afinet-dest.lo -MD -MP -MF > .deps/libafsocket_notls_la-afinet-dest.Tpo -c -o > libafsocket_notls_la-afinet-dest.lo `test -f 'afinet-dest.c' || echo > './'`afinet-dest.c > libtool: compile: gcc -std=gnu99 -DHAVE_CONFIG_H -I. -I../.. -I../../lib > -I../../lib -pthread -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include > -I/usr/local/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD > -DHAVE_NET_ETHERNET_H -I../../lib/ivykis/src/include > -I../../lib/ivykis/src/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE > -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -pthread -MT > libafsocket_notls_la-afinet-dest.lo -MD -MP -MF > .deps/libafsocket_notls_la-afinet-dest.Tpo -c afinet-dest.c -fPIC -DPIC -o > .libs/libafsocket_notls_la-afinet-dest.o > In file included from /usr/include/net/ethernet.h:27, > from /usr/include/libnet.h:98, > from afinet-dest.c:43: > > > when I first encountered this error I went and did some googling and > followed some vague leads to install a bunch of -devel packages (most of > which were already installed ) but it did not make any difference. > > Googling the message brings up a bunch of hits for both redhat and debian > families and a range of packages. There did not seem to be any common > cause. > > Russell > > > > ------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > End of syslog-ng Digest, Vol 97, Issue 4 > **************************************** >

1 0

Prevent message loss while using tcp output
by Abhijeet Rastogi 03 May '13

03 May '13

Hi all, I've source defined as: source s_sys { file ("/proc/kmsg" program_override("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; And one of the destination as: destination d_logstash { tcp( "127.0.0.1" port(515) template(t_both_timestamps) flush_lines(10)); }; Problem is when my consumer is down, I can see messages being dropped in "syslog-ng-ctl stats". How can I avoid this at the expense of memory (like a queueing mechanism or something)? -- Regards, Abhijeet Rastogi (shadyabhi) http://blog.abhijeetr.com

2 1

syslog-ng 3.3.6 Hangs on Solaris 8 sparc
by Rakesh Rajasekharan 02 May '13

02 May '13

Hi All, I have compiled the syslog-ng version 3.3.6 on a Solaris Sparc machine . The compilation went through fine but when I try to run syslog-ng .. though the daemon gets running somehow the unix prompt is not returned.. and it hangs... For ex:- # ps -ef|grep -i syslog root 14073 11758 0 07:11:37 pts/4 0:00 vi syslog-ng.d root 14097 13526 0 07:15:48 pts/1 0:00 grep -i syslog Now if I start the daemon using the below options... # /opt/soe/local/syslog-ng-3.3.6/sbin/syslog-ng -f /opt/soe/local/syslog_ng/etc/syslog-ng/syslog-ng.conf -p /var/run/syslog-ng.pid I never get back the prompt.. but if on another window I check.. the daemon has started.. ps -ef|grep -i syslog root 14099 11758 0 07:16:17 pts/4 0:00 grep -i syslog root 14098 13526 23 07:16:04 pts/1 0:13 /opt/soe/local/syslog-ng-3.3.6/sbin/syslog-ng -f /opt/soe/local/syslog_ng/etc/s though I guess... i should expect one more child to this... can someone please help me address this issue please... Thanks, Rkaesh.

3 10

[Bug 233] New: openssl CAfile configuration option
by bugzilla＠bugzilla.balabit.com 30 Apr '13

30 Apr '13

https://bugzilla.balabit.com/show_bug.cgi?id=233 Summary: openssl CAfile configuration option Product: syslog-ng Version: unspecified Platform: All OS/Version: All Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: james(a)chatid.com Type of the Report: enhancement Estimated Hours: 0.0 Today I was trying to set up syslog-ng on some servers and encountered trouble configuring the server to send intermediary certificates. >From what I can see[1], the ca_dir option is the only way to get intermediary certs attached. I can only assume that this maps down to a call to the `SSL_CTX_load_verify_locations` function in the openssl library[2] with a `NULL` CAfile argument and `ca_path` as the third argument Can a configuration option that maps to CAfile be added to syslog-ng? [1] http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-guid… [2] https://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 229] New: json parser does not maintain all json object data
by bugzilla＠bugzilla.balabit.com 30 Apr '13

30 Apr '13

https://bugzilla.balabit.com/show_bug.cgi?id=229 Summary: json parser does not maintain all json object data Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 Then the json parser is used parser p_json { json-parser(); }; log { source(mysource); parser(p_json); ... } tag-value pairs are not maintained if they are ones that are normally populated by syslog-ng. Even with a source that has flags(no-parse) man macros are populated by syslog-ng C_* S_* R_* YEAR_DAY YEAR WEEKDAY_NAME WEEK_DAY_ABBREV WEEK_DAY WEEKDAY WEEK USEC UNIXTIME TZOFFSET TZ TAGS SYSUPTIME STAMP SEC MSEC MONTH_WEEK MONTH_NAME MONTH_ABBREV MONTH MIN LOGHOST ISODATE HOUR12 HOUR FULLDATE DAY DATE AMPM the json parser should populate the macros after the initial population allowing the json data to overwrite/control all of the macros. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

Re: [syslog-ng] supervisor not restarting a failed daemon process
by Balazs Scheidler 29 Apr '13

29 Apr '13

Strange, indeed. The supervisor gives up if the restarted daemon exits for some reason. Eg. If there's an initialization error it gives up. Any indication in the logs? Evan Rempel <erempel(a)uvic.ca> wrote: >We are sing the log line > >supervise/syslog-ng[27221]: Daemon exited due to a deadlock/signal/failure, restarting; exitcode='11' > > >and it looks like it should restart, but instead of restarting, >the supervisor terminates and then no syslog-ng process is running. > >Is this a bug in the supervisor? >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

2 1

Can not get DBParse match macro result (syslog-ng 3.13 debian squeeze)
by 不坏阿峰 27 Apr '13

27 Apr '13

when use pdbtool do match test, it is success. but from syslog-ng can not return result of macro i can not get macro result. for example, ${.esxi.month} no value, same as ${.esxi.host_ip} ${.esxi.time} test log output ,just like this. === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , do the pdbtool test, it's ok. wish someone can give me some solution and help. i have search some mail list but i can not get the right solution. thanks a lot. root@debian:~# pdbtool match -D -c -p /etc/syslog-ng/patterndb/esxi_pattern.xml -P ESXI -M "Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev "mpx.vmhba0:C0:T0:L0" on path "vmhba0:C0:T0:L0" Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE" Pattern matching part: @STRING:.esxi.month=Apr@ @STRING:.esxi.date=26@ @STRING:.esxi.time=15:17:31@@IPv4:.esxi.host_ip=192.168.88.71@@ESTRING:.esxi.program= vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@@ANYSTRING:.esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@ Matching part: Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE Values: MESSAGE=Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE PROGRAM=ESXI .classifier.class=esxi .classifier.rule_id=182437592347598 .esxi.month=Apr .esxi.date=26 .esxi.time=15:17:31 .esxi.host_ip=192.168.88.71 .esxi.program= vmkernel .esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE root@debian:~# my configuration like as below ######## esxi_pattern.xml ############ <?xml version="1.0" encoding="utf-8"?> <patterndb version='3' pub_date='2009-04-17'> <ruleset name='esxi' id='123456678'> <pattern>ESXI</pattern> <rules> <rule provider='Fone Bro' id='182437592347598' class='esxi'> <patterns> <pattern>@STRING:.esxi.month:@ @STRING:.esxi.date:@ @STRING:.esxi.time::@@IPv4:.esxi.host_ip:@ @ESTRING:.esxi.program::@ @ANYSTRING:.esxi.message@</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> ######## syslog-ng.conf ######## #####Parser##### parser pattern_db { db_parser( file("/etc/syslog-ng/patterndb/esxi_pattern.xml")); }; #Check pattern matching destination udp_esxi_output { file("/var/log/pattern_output" template("=== $PROGRAM,${.esxi_month} ${.esxi.date} ${.esxi.time} HOST IP ${.esxi.host_ip},${.esxi.message}\n") template_escape(no)); }; #####Log##### log { source(s_network); parser(pattern_db); destination(udp_esxi_output); };

2 1

syslog-ng performance config calculator on Android
by Zoltán Pallagi 26 Apr '13

26 Apr '13

Hi guys, You know I like syslog-ng but also my hobby is Android programming. Because I wanted to practice (and develop my Android knowledge), I've just written a little interesting Android application related to syslog-ng performance tuning. It can calculate the tuning related settings like log_iw_size(), log_fetch_limit(), log_fifo_size() and so on, based on the given source specific parameters. Furthermore it can generate an example configuration that can be saved or sent via email. So it was absolutely just my hobby project related to Android, but after I showed it to a few people interested in syslog, I received positive feedbacks. After I decided to share it with everybody taking into consideration that I already have an Android developer account. I hope it will be useful, at least you can play with the numbers and results, but of course this is not a serious program just as I said my hobby project. You can download it from Android Market (and you can find more details here): https://play.google.com/store/apps/details?id=pzolee.android.syslogngconfig… Of course it's free and no ads. Have fun!

2 1

Re: [syslog-ng] syslog-ng Digest, Vol 96, Issue 23
by Davide D'Amico 26 Apr '13

26 Apr '13

> ------------------------------ > > Message: 3 > Date: Fri, 26 Apr 2013 11:29:39 +0200 > From: Balazs Scheidler <bazsi77(a)gmail.com> > Subject: Re: [syslog-ng] Configuration for a centralized syslog-ng > server > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu>, eh(a)gmail.com > Message-ID: > < > CAKcfE+bvXksZFdz77SkN8VCrmH15wwbTvUk8xJeWFLEwHpay7w(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > How do you know messages are dropped? Using freq_stats :) Anyway, I found the issue that wasn't related to syslog-ng. I had the syslog zfs partition on 92% so, after removing a lot of old files, everything went fine. -- d.

2 1

Configuration for a centralized syslog-ng server
by Davide D'Amico 26 Apr '13

26 Apr '13

Hi, I'm using syslog-ng OSE 3.3.8 on a FreeBSD 9.1 amd64 box on a centralized server (DELL R610, 32GB ram, ZFS with compressed filesystem) and 150 servers with syslog-ng that logs locally and send remotely their logs stream to the centralized syslog-ng. Sometime I see packets dropped, so I think I'm missing something on its configuration. That's what I'm using: - generic server: @version: 3.3 options { perm(0644); dir_perm(0750); create_dirs(yes); group (logs); dir_group (logs); log_fifo_size(10000); use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); stats_freq(3600); }; source s_local { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; destination d_local { file("/var/log/syslog-ng/$YEAR/$MONTH/$DAY/$FACILITY.log"); }; destination d_remote { tcp("10.0.0.9" port(514)); }; log { source(s_local); destination(d_local); destination(d_remote); }; - centralized log server: @version: 3.3 options { perm(0644); dir_perm(0755); create_dirs(yes); group (logs); dir_group (logs); use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); stats_freq(120); log_fifo_size(10000); frac_digits(3); }; source s_local { unix-dgram("/var/run/log" max_connections(20)); unix-dgram("/var/run/logpriv" perm(0600) max_connections(20)); internal(); file("/dev/klog"); }; filter f_localhost { netmask( "127.0.0.1" ); }; filter f_network6 { netmask( "172.16.6.0/255.255.255.0" ); }; destination d_local { file("/tank/syslog/custom/localhost/$YEAR/$MONTH/$DAY/$FACILITY.log"); }; source s_network { udp(ip("10.0.0.9") so_rcvbuf(16777216)); tcp(ip("10.0.0.9") port(514) log_fetch_limit(100) max_connections(200) log_iw_size(20000) so_rcvbuf(16777216)); }; filter f_www_host { host("www1.domain.lan") or host("www2.domain.lan") or host("www3.domain.lan"); }; [...] filter f_www_fac { facility(local6); }; [...] destination d_www { file("/tank/syslog-ng/custom/www/$YEAR/$MONTH/$DAY/$FACILITY.log"); }; [...] log { source(s_network); filter(f_www_host); filter(f_www_fac); destination(d_www); }; Thanks, -- d.

2 1