- syslog-ng - lists.balabit.hu

[Bug 227] New: Feature request – Linux /dev/kmsg support
by bugzilla＠bugzilla.balabit.com 12 Apr '13

12 Apr '13

https://bugzilla.balabit.com/show_bug.cgi?id=227 Summary: Feature request – Linux /dev/kmsg support Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: grawity(a)gmail.com Type of the Report: enhancement Estimated Hours: 0.0 Starting with Linux 3.5 (commits [1], [2]), there is a new kmsg interface "/dev/kmsg", which allows multiple readers, is able to export some structured data (such as device name and subsystem), avoids some other problems /proc/kmsg had, such as the ones described in syslog-ng's FAQ [3]. Are there any plans to support this in syslog-ng? The format is explained in Documentation/ABI/testing/dev-kmsg.txt [4]. [1]: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… [2]: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… [3]: http://www.balabit.com/wiki/syslog-ng-faq-kmsg-klogd [4]: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/plain/Docum… -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

syslog-ng v3.3.4 on Ubuntu 12.04.2 LTS x_64 has a memory leak
by Clayton Dukes 11 Apr '13

11 Apr '13

Hi Guys, We have some folks doing an audit and they found that syslog-ng is leaking memory. This server is processing a steady 8000 events/second, 24 hours a day. syslog-ng is currently using 20GB of memory. Here is their comment: ===================== I've been watching syslog-ng memory usage and this looks like leaking to me (5MB growth every minute): root@logzilla:/etc/syslog-ng# while sleep 60; do ps auxw | grep /usr/sbin/syslog-ng | grep -v grep; done root 14004 26.4 20.6 20831384 20462180 ? Ssl Apr08 1024:00 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20467152 ? Ssl Apr08 1024:17 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20472132 ? Ssl Apr08 1024:33 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20477136 ? Ssl Apr08 1024:49 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20481932 ? Ssl Apr08 1025:06 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20486956 ? Ssl Apr08 1025:22 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.6 20831384 20491700 ? Rsl Apr08 1025:39 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20496688 ? Ssl Apr08 1025:55 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20501576 ? Ssl Apr08 1026:11 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20506788 ? Ssl Apr08 1026:28 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20512480 ? Ssl Apr08 1026:44 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20518272 ? Ssl Apr08 1026:59 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20522940 ? Ssl Apr08 1027:16 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20528268 ? Ssl Apr08 1027:32 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20533184 ? Ssl Apr08 1027:49 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20538016 ? Ssl Apr08 1028:05 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20543132 ? Ssl Apr08 1028:22 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20548200 ? Ssl Apr08 1028:37 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20553124 ? Rsl Apr08 1028:54 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20557940 ? Ssl Apr08 1029:10 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20563312 ? Ssl Apr08 1029:26 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20568080 ? Ssl Apr08 1029:43 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20573176 ? Ssl Apr08 1029:59 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20578104 ? Rsl Apr08 1030:16 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20583076 ? Ssl Apr08 1030:32 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.7 20831384 20588856 ? Ssl Apr08 1030:48 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20831384 20594296 ? Ssl Apr08 1031:03 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20831384 20599116 ? Ssl Apr08 1031:20 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20831384 20604028 ? Ssl Apr08 1031:36 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20608844 ? Ssl Apr08 1031:52 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20613796 ? Ssl Apr08 1032:08 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20618956 ? Ssl Apr08 1032:25 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20624292 ? Ssl Apr08 1032:41 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20629372 ? Ssl Apr08 1032:57 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20634284 ? Ssl Apr08 1033:13 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20639608 ? Ssl Apr08 1033:29 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20644384 ? Rsl Apr08 1033:45 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20896920 20649440 ? Rsl Apr08 1034:02 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20962456 20654116 ? Ssl Apr08 1034:18 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20962456 20659368 ? Rsl Apr08 1034:34 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20962456 20665300 ? Ssl Apr08 1034:50 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 20962456 20671644 ? Ssl Apr08 1035:05 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 21027992 20676440 ? Rsl Apr08 1035:22 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 21027992 20681116 ? Ssl Apr08 1035:38 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.8 21027992 20686220 ? Ssl Apr08 1035:54 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20691032 ? Ssl Apr08 1036:11 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20696044 ? Ssl Apr08 1036:27 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20700944 ? Rsl Apr08 1036:43 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20705760 ? Ssl Apr08 1037:00 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20710540 ? Rsl Apr08 1037:18 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20715696 ? Ssl Apr08 1037:34 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20720316 ? Ssl Apr08 1037:51 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21027992 20725632 ? Ssl Apr08 1038:07 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20730196 ? Ssl Apr08 1038:24 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20735636 ? Ssl Apr08 1038:39 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20741476 ? Ssl Apr08 1038:56 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20749860 ? Ssl Apr08 1039:10 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20755808 ? Ssl Apr08 1039:24 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20761004 ? Ssl Apr08 1039:40 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20766152 ? Ssl Apr08 1039:57 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20771220 ? Ssl Apr08 1040:14 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20776268 ? Ssl Apr08 1040:30 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20781116 ? Ssl Apr08 1040:47 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 20.9 21028120 20786176 ? Ssl Apr08 1041:03 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 21.0 21159192 20791412 ? Ssl Apr08 1041:19 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 21.0 21159192 20796124 ? Ssl Apr08 1041:36 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 21.0 21159192 20801112 ? Ssl Apr08 1041:53 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid root 14004 26.4 21.0 21159192 20805952 ? Rsl Apr08 1042:10 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid ______________________________________________________________ Clayton Dukes ______________________________________________________________

3 5

[PATCH (3.4)] cfg_lexer: Drop quotes when expanding a backtick, and already quoted
by Gergely Nagy 09 Apr '13

09 Apr '13

In case we're expanding a backtick while we're already in a quoted string, and the backtick starts with a '"', drop the extra quotes. This allows blocks like: block source s_logfile (filename("messages")) { file("/var/log/`filename`"); }; source s_example { s_logfile(filename("logfile.log")); }; To work properly, and result in file("/var/log/logfile.log"); Reported-by: Eric Berggren <eric_berggren(a)apple.com> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/cfg-lexer.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/lib/cfg-lexer.c b/lib/cfg-lexer.c index fbce432..b1c7c93 100644 --- a/lib/cfg-lexer.c +++ b/lib/cfg-lexer.c @@ -156,12 +156,18 @@ gchar * cfg_lexer_subst_args(CfgArgs *globals, CfgArgs *defs, CfgArgs *args, gchar *cptr, gsize *length) { gboolean backtick = FALSE; + gboolean in_string = FALSE; gchar *p, *ref_start = cptr; GString *result = g_string_sized_new(32); p = cptr; while (*p) { + if (!backtick && (*p) == '"') + { + in_string = !in_string; + } + if (!backtick && (*p) == '`') { /* start of reference */ @@ -195,7 +201,12 @@ cfg_lexer_subst_args(CfgArgs *globals, CfgArgs *defs, CfgArgs *args, gchar *cptr arg = NULL; *p = '`'; - g_string_append(result, arg ? arg : ""); + if (in_string && arg && arg[0] == '"') + { + g_string_append_len(result, &arg[1], strlen(arg) - 2); + } + else + g_string_append(result, arg ? arg : ""); } } else if (!backtick) -- 1.7.10.4

1 0

[PATCH 0/3]: Support systemd notifications
by Gergely Nagy 09 Apr '13

09 Apr '13

The patchset coming after this implements support for Type=notify units, and support for the STATUS notifications in systemd. This means that syslog-ng becomes able to signal systemd upon startup when it finished starting up, and thanks to the STATUS notifications, an administrator will be able to check syslog-ng's status with systemctl. If a reload fails for example, that will be shown there. -- |8]

1 3

Re: [syslog-ng] syslog-ng Digest, Vol 96, Issue 6
by Yarick Tsagoyko 09 Apr '13

09 Apr '13

Dear Ramon, the config looks ok, What is the issue you are having ? --Yarick. On Mon, Apr 8, 2013 at 3:25 PM, <syslog-ng-request(a)lists.balabit.hu> wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: Syslog-ng 3.1.4 on OpenBSD 5.2 (Ramon F McDougall) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 8 Apr 2013 15:25:25 -0400 > From: Ramon F McDougall <cyberjet(a)live.com> > Subject: Re: [syslog-ng] Syslog-ng 3.1.4 on OpenBSD 5.2 > To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> > Message-ID: <BAY148-W654AE36D7E7FB13020FC85B7C50(a)phx.gbl> > Content-Type: text/plain; charset="windows-1252" > > Greetings > to All, > > > > I > need your help, I recently installed Syslog-ng on an OpenBSD 5.2 and > decided to > try syslog-ng to work under this environment. I?m not 100% sure(trying to > learn about all these things) that it?s > working the way it?s supposed to. I followed an example detailed in this > link: > http://kimiushida.com/bitsandpieces/articles/openbsd_syslog-ng/index.html > > It?s my hope that someone with much more expertise than I share > some of their knowledge so that I can get this working. I have configured > the > firewall to send to my syslog server v3.1.4. Does anyone have this working > on > OpenBSD and can share their config files? > > > > $ cd syslog-ng > > syslog-ng.conf > syslog-ng.conf.original > > $ more syslog-ng.conf > > # syslog-ng configuration file for OpenBSD. > > # This should provide the same behavior as OpenBSD's > syslog.conf(5). > > # 2010-07-18 steven(a)openbsd.org > > > > @version: 3.0 > > > > options { > > use_dns(no); > > > create_dirs(no); > > > keep_hostname(yes); > > }; > > > > source s_local { > > unix-dgram > ("/dev/log"); > > unix-dgram > ("/var/empty/dev/log"); > > internal(); > > }; > > #source s_local_all { > > # unix-dgram > ("/dev/log"); > > # unix-dgram > ("/var/empty/dev/log"); > > # unix-dgram > ("/var/www/dev/log"); > > # internal(); > > #}; > > #source s_net { > > # > udp(port(514)); > > #}; > > > > destination d_console > { file("/dev/console"); > }; > > destination d_messages > { file("/var/log/messages" owner(root) group(wheel) > perm(0644)); }; > > destination d_authlog > { file("/var/log/authlog" owner(root) group(wheel) > perm(0640)); }; > > destination d_secure > { file("/var/log/secure" owner(root) group(wheel) > perm(0600)); }; > > destination d_cronlog > { file("/var/cron/log" owner(root) group(wheel) > perm(0600)); }; > > destination d_daemon > { file("/var/log/daemon" owner(root) group(wheel) > perm(0640)); }; > > destination d_xferlog > { file("/var/log/xferlog" owner(root) group(wheel) > perm(0640)); }; > > destination d_lpderrs > { file("/var/log/lpd-errs" owner(root) group(wheel) > perm(0640)); }; > > destination d_maillog > { file("/var/log/maillog" owner(root) group(wheel) > perm(0600)); }; > > destination d_uucplog > { file("/var/log/uucp" owner(uucp) group(dialer) > perm(0660)); }; > > destination d_sudolog > { file("/var/log/sudo"); > }; > > destination d_chatlog > { file("/var/log/chat"); > }; > > destination d_ttyall > { usertty("*"); > }; > > destination d_ttyroot > { usertty("root"); > }; > > destination d_loghost > { udp("loghost" port(514)); > }; > > > > destination d_network_hosts { file > ("/var/log/bcm/$HOST.log"); }; > > > > filter f_notice { > > level(notice > .. emerg) > > and > not(facility(auth,authpriv,cron,ftp,kern,lpr,mail,user)); > > }; > > filter f_kerndebug { > > level(debug .. > emerg) and facility(kern); > > }; > > filter f_msginfo { > > level(info .. > emerg) and facility(syslog,user); > > }; > > filter f_authinfo { > > level(info .. > emerg) and facility(auth); > > }; > > filter f_authprivdebug { > > level(debug .. > emerg) and facility(authpriv); > > }; > > filter f_croninfo { > > level(info .. > emerg) and facility(cron); > > }; > > filter f_daemoninfo { > > level(info .. > emerg) and facility(daemon); > > }; > > filter f_ftpinfo { > > level(info .. > emerg) and facility(ftp); > > }; > > filter f_lprdebug { > > level(debug .. > emerg) and facility(lpr); > > }; > > filter f_mailinfo { > > level(info .. > emerg) and facility(mail); > > }; > > filter f_uucpinfo { > > level(info .. > emerg) and facility(uucp); > > }; > > filter f_emerg { > > level(emerg); > > }; > > filter f_to_console { > > not > (facility(authpriv)) and > > ((level(notice > .. emerg) and facility(auth)) > > or > (level(debug .. emerg) and facility(kern)) > > or (level(crit > .. emerg) and facility(mail)) > > or level(err > .. emerg)); > > }; > > filter f_to_root { > > (level(debug > .. emerg) and facility(auth)) > > or (level(notice .. emerg)); > > }; > > filter f_to_loghost { > > (level(notice > .. emerg) and > > not > (facility(auth,authpriv,cron,ftp,kern,lpr,mail,user))) > > or (level(info > .. emerg) and facility(auth,daemon,syslog,user)) > > or > (level(debug .. emerg) and facility(authpriv,kern)); > > }; > > filter f_prog_sudo { > > > program("sudo"); > > }; > > filter f_prog_chat { > > > program("chat"); > > }; > > > > log { source(s_local); filter(f_notice); destination(d_messages);}; > > log { source(s_local); filter(f_kerndebug); destination(d_messages);}; > > log { source(s_local); filter(f_msginfo); destination(d_messages);}; > > log { source(s_local); filter(f_authinfo); destination(d_authlog); }; > > log { source(s_local); filter(f_authprivdebug); > destination(d_secure); }; > > log { source(s_local); filter(f_croninfo); destination(d_cronlog); }; > > log { source(s_local); filter(f_daemoninfo); destination(d_daemon); }; > > log { source(s_local); filter(f_ftpinfo); destination(d_xferlog); }; > > log { source(s_local); filter(f_lprdebug); destination(d_lpderrs); }; > > log { source(s_local); filter(f_mailinfo); destination(d_maillog); }; > > #log { source(s_local); filter(f_uucpinfo); destination(d_uucplog); }; > > > > # Uncomment this line to send "important" messages > to the system > > # console: be aware that this could create lots of output. > > #log { source(s_local); filter(f_to_console); destination(d_console); }; > > > > # Uncomment this to have all messages of notice level and > higher > > # as well as all authentication messages sent to root. > > #log { source(s_local); filter(f_to_root); destination(d_ttyroot); }; > > > > # Everyone gets emergency messages. > > log { source(s_local); filter(f_emerg); destination(d_ttyall); }; > > > > # Uncomment to log to a central host named > "loghost". > > #log { source(s_local); filter(f_to_loghost); destination(d_loghost); }; > > > > # Uncomment to log messages from sudo(8) and chat(8) to > their own > > # respective log files. > Matches are done based on the program name. > > # Program-specific logs: > > #log { source(s_local); filter(f_prog_sudo); destination(d_sudolog); }; > > #log { source(s_local); filter(f_prog_chat); destination(d_chatlog); }; > > > > # Uncomment to log messages from the network. > > # Note: it is recommended to specify a different destination > here. > > #log { source(s_net); destination(d_messages); }; > > $ syslog-ng-ctl > > Syntax: syslog-ng-ctl <command> [options] > > Possible commands are: > > stats Dump syslog-ng statistics > > verbose Enable/query verbose messages > > debug Enable/query debug messages > > trace Enable/query trace messages > > > > # syslog-ng-ctl stats > > SourceName;SourceId;SourceInstance;State;Type;Number > > center;;received;a;processed;0 > > destination;d_lpderrs;;a;processed;0 > > destination;d_messages;;a;processed;6 > > src.internal;s_local#2;;a;processed;5 > > src.internal;s_local#2;;a;stamp;1365446582 > > destination;d_daemon;;a;processed;0 > > destination;d_secure;;a;processed;0 > > center;;queued;a;processed;0 > > global;payload_reallocs;;a;processed;0 > > global;sdata_updates;;a;processed;0 > > destination;d_xferlog;;a;processed;0 > > destination;d_authlog;;a;processed;2 > > destination;d_cronlog;;a;processed;0 > > destination;d_maillog;;a;processed;0 > > global;msg_clones;;a;processed;0 > > source;s_local;;a;processed;7 > > destination;d_ttyall;;a;processed;0 > > # syslog-ng-ctl verbose --set=on > > # syslog-ng-ctl stats > > SourceName;SourceId;SourceInstance;State;Type;Number > > center;;received;a;processed;0 > > destination;d_lpderrs;;a;processed;0 > > destination;d_messages;;a;processed;9 > > src.internal;s_local#2;;a;processed;8 > > src.internal;s_local#2;;a;stamp;1365446909 > > destination;d_daemon;;a;processed;0 > > destination;d_secure;;a;processed;0 > > center;;queued;a;processed;0 > > global;payload_reallocs;;a;processed;0 > > global;sdata_updates;;a;processed;0 > > destination;d_xferlog;;a;processed;0 > > destination;d_authlog;;a;processed;2 > > destination;d_cronlog;;a;processed;0 > > destination;d_maillog;;a;processed;0 > > global;msg_clones;;a;processed;0 > > source;s_local;;a;processed;10 > > destination;d_ttyall;;a;processed;0 > > # > Please let me know what more information you need to be able to help. > Regards and Thank you,?Ramon > > > >

1 0

Re: [syslog-ng] Syslog-ng 3.1.4 on OpenBSD 5.2
by Ramon F McDougall 08 Apr '13

08 Apr '13

Greetings to All, I need your help, I recently installed Syslog-ng on an OpenBSD 5.2 and decided to try syslog-ng to work under this environment. I’m not 100% sure(trying to learn about all these things) that it’s working the way it’s supposed to. I followed an example detailed in this link: http://kimiushida.com/bitsandpieces/articles/openbsd_syslog-ng/index.html It’s my hope that someone with much more expertise than I share some of their knowledge so that I can get this working. I have configured the firewall to send to my syslog server v3.1.4. Does anyone have this working on OpenBSD and can share their config files? $ cd syslog-ng syslog-ng.conf syslog-ng.conf.original $ more syslog-ng.conf # syslog-ng configuration file for OpenBSD. # This should provide the same behavior as OpenBSD's syslog.conf(5). # 2010-07-18 steven(a)openbsd.org @version: 3.0 options { use_dns(no); create_dirs(no); keep_hostname(yes); }; source s_local { unix-dgram ("/dev/log"); unix-dgram ("/var/empty/dev/log"); internal(); }; #source s_local_all { # unix-dgram ("/dev/log"); # unix-dgram ("/var/empty/dev/log"); # unix-dgram ("/var/www/dev/log"); # internal(); #}; #source s_net { # udp(port(514)); #}; destination d_console { file("/dev/console"); }; destination d_messages { file("/var/log/messages" owner(root) group(wheel) perm(0644)); }; destination d_authlog { file("/var/log/authlog" owner(root) group(wheel) perm(0640)); }; destination d_secure { file("/var/log/secure" owner(root) group(wheel) perm(0600)); }; destination d_cronlog { file("/var/cron/log" owner(root) group(wheel) perm(0600)); }; destination d_daemon { file("/var/log/daemon" owner(root) group(wheel) perm(0640)); }; destination d_xferlog { file("/var/log/xferlog" owner(root) group(wheel) perm(0640)); }; destination d_lpderrs { file("/var/log/lpd-errs" owner(root) group(wheel) perm(0640)); }; destination d_maillog { file("/var/log/maillog" owner(root) group(wheel) perm(0600)); }; destination d_uucplog { file("/var/log/uucp" owner(uucp) group(dialer) perm(0660)); }; destination d_sudolog { file("/var/log/sudo"); }; destination d_chatlog { file("/var/log/chat"); }; destination d_ttyall { usertty("*"); }; destination d_ttyroot { usertty("root"); }; destination d_loghost { udp("loghost" port(514)); }; destination d_network_hosts { file ("/var/log/bcm/$HOST.log"); }; filter f_notice { level(notice .. emerg) and not(facility(auth,authpriv,cron,ftp,kern,lpr,mail,user)); }; filter f_kerndebug { level(debug .. emerg) and facility(kern); }; filter f_msginfo { level(info .. emerg) and facility(syslog,user); }; filter f_authinfo { level(info .. emerg) and facility(auth); }; filter f_authprivdebug { level(debug .. emerg) and facility(authpriv); }; filter f_croninfo { level(info .. emerg) and facility(cron); }; filter f_daemoninfo { level(info .. emerg) and facility(daemon); }; filter f_ftpinfo { level(info .. emerg) and facility(ftp); }; filter f_lprdebug { level(debug .. emerg) and facility(lpr); }; filter f_mailinfo { level(info .. emerg) and facility(mail); }; filter f_uucpinfo { level(info .. emerg) and facility(uucp); }; filter f_emerg { level(emerg); }; filter f_to_console { not (facility(authpriv)) and ((level(notice .. emerg) and facility(auth)) or (level(debug .. emerg) and facility(kern)) or (level(crit .. emerg) and facility(mail)) or level(err .. emerg)); }; filter f_to_root { (level(debug .. emerg) and facility(auth)) or (level(notice .. emerg)); }; filter f_to_loghost { (level(notice .. emerg) and not (facility(auth,authpriv,cron,ftp,kern,lpr,mail,user))) or (level(info .. emerg) and facility(auth,daemon,syslog,user)) or (level(debug .. emerg) and facility(authpriv,kern)); }; filter f_prog_sudo { program("sudo"); }; filter f_prog_chat { program("chat"); }; log { source(s_local); filter(f_notice); destination(d_messages);}; log { source(s_local); filter(f_kerndebug); destination(d_messages);}; log { source(s_local); filter(f_msginfo); destination(d_messages);}; log { source(s_local); filter(f_authinfo); destination(d_authlog); }; log { source(s_local); filter(f_authprivdebug); destination(d_secure); }; log { source(s_local); filter(f_croninfo); destination(d_cronlog); }; log { source(s_local); filter(f_daemoninfo); destination(d_daemon); }; log { source(s_local); filter(f_ftpinfo); destination(d_xferlog); }; log { source(s_local); filter(f_lprdebug); destination(d_lpderrs); }; log { source(s_local); filter(f_mailinfo); destination(d_maillog); }; #log { source(s_local); filter(f_uucpinfo); destination(d_uucplog); }; # Uncomment this line to send "important" messages to the system # console: be aware that this could create lots of output. #log { source(s_local); filter(f_to_console); destination(d_console); }; # Uncomment this to have all messages of notice level and higher # as well as all authentication messages sent to root. #log { source(s_local); filter(f_to_root); destination(d_ttyroot); }; # Everyone gets emergency messages. log { source(s_local); filter(f_emerg); destination(d_ttyall); }; # Uncomment to log to a central host named "loghost". #log { source(s_local); filter(f_to_loghost); destination(d_loghost); }; # Uncomment to log messages from sudo(8) and chat(8) to their own # respective log files. Matches are done based on the program name. # Program-specific logs: #log { source(s_local); filter(f_prog_sudo); destination(d_sudolog); }; #log { source(s_local); filter(f_prog_chat); destination(d_chatlog); }; # Uncomment to log messages from the network. # Note: it is recommended to specify a different destination here. #log { source(s_net); destination(d_messages); }; $ syslog-ng-ctl Syntax: syslog-ng-ctl <command> [options] Possible commands are: stats Dump syslog-ng statistics verbose Enable/query verbose messages debug Enable/query debug messages trace Enable/query trace messages # syslog-ng-ctl stats SourceName;SourceId;SourceInstance;State;Type;Number center;;received;a;processed;0 destination;d_lpderrs;;a;processed;0 destination;d_messages;;a;processed;6 src.internal;s_local#2;;a;processed;5 src.internal;s_local#2;;a;stamp;1365446582 destination;d_daemon;;a;processed;0 destination;d_secure;;a;processed;0 center;;queued;a;processed;0 global;payload_reallocs;;a;processed;0 global;sdata_updates;;a;processed;0 destination;d_xferlog;;a;processed;0 destination;d_authlog;;a;processed;2 destination;d_cronlog;;a;processed;0 destination;d_maillog;;a;processed;0 global;msg_clones;;a;processed;0 source;s_local;;a;processed;7 destination;d_ttyall;;a;processed;0 # syslog-ng-ctl verbose --set=on # syslog-ng-ctl stats SourceName;SourceId;SourceInstance;State;Type;Number center;;received;a;processed;0 destination;d_lpderrs;;a;processed;0 destination;d_messages;;a;processed;9 src.internal;s_local#2;;a;processed;8 src.internal;s_local#2;;a;stamp;1365446909 destination;d_daemon;;a;processed;0 destination;d_secure;;a;processed;0 center;;queued;a;processed;0 global;payload_reallocs;;a;processed;0 global;sdata_updates;;a;processed;0 destination;d_xferlog;;a;processed;0 destination;d_authlog;;a;processed;2 destination;d_cronlog;;a;processed;0 destination;d_maillog;;a;processed;0 global;msg_clones;;a;processed;0 source;s_local;;a;processed;10 destination;d_ttyall;;a;processed;0 # Please let me know what more information you need to be able to help. Regards and Thank you,…Ramon

1 0

Getting milliseconds in logs
by Abhijeet Rastogi 05 Apr '13

05 Apr '13

Hi, I want to get a complete ISO8601 timestamp format in syslog-ng. Something like: 2013-04-04T18:44:34.694692+00:00 When I enable, ts_format("iso"), I'm not able to get milliseconds precision and what I get is something like 2013-04-05T02:57:07+00:00 For some reason, I really need milliseconds resolution. How can I achieve that in syslogn-ng? -- Regards, Abhijeet Rastogi (shadyabhi) http://blog.abhijeetr.com

3 4

how to archive logs efficiently
by Daniel Neubacher 05 Apr '13

05 Apr '13

Hey there, my syslog-ng has gotten quite big with 50k logs per second and the server seems to hit the io limit at night. While a few month ago I could run a gzip with ionice over all old logs the server doesn't like it anymore and quite a lot of logs are storing while the compression lasts. I'm using the ose so I've got no logstore. And for a second I've thought about writing the logs a compressed fuse fs but... fuse :P So how are you guys doing it? -- Daniel Neubacher, Network Administrator daniel.neubacher(a)xing.com<mailto:daniel.neubacher@xing.com> XING AG Gaensemarkt 43, 20354 Hamburg, Germany Tel. +49 40 419131-28, Fax +49 40 419131-11 Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 98807 Exec. Board (Vorstand): Dr. Stefan Groß-Selbeck (Vorsitzender), Dr. Thomas Vollmoeller, Ingo Chu, Dr. Helmut Becker, Jens Pape Chairman of the Supervisory Board (Aufsichtsratsvorsitzender): Dr. Neil Sunderland This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden and may be unlawful.

5 7

reloading (HUP) syslog-ng -> mutilation of messages in mongodb
by Lucas, Sascha 04 Apr '13

04 Apr '13

Hi, after reloading syslog-ng 3.4.1 (SIGHUP) I have random issues with mutilation of messages to a mongodb destination. Sometimes the value of the MESSAGE key is just truncated. An other time i.e. LEGACY_MSGHDR, MESSAGE, PROGRAM are empty and the HOST value is mutilated. And sometimes syslog-ng stops inserting into mongodb. Any hints on this? TIA, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 3

syslog-ng-ctl stats -> EOF on control channel
by Lucas, Sascha 03 Apr '13

03 Apr '13

Hi, I regularly run "syslog-ng-ctl stats" for monitoring purpose. My log-analyses shows that following messages is logged to priority err: EOF on control channel, closing connection; I would expect this with priority info. Or is there an error calling the above command? My syslog-ng version is 3.4.1. Thanks, Sascha. Vorsitzender des Aufsichtsrates: Ralf Hiltenkamp Geschäftsführung: Michael Krüger (Sprecher), Stephan Drescher Sitz der Gesellschaft: Halle/Saale Registergericht: Amtsgericht Stendal | Handelsregister-Nr. HRB 208414 UST-ID-Nr. DE 158253683 Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Empfänger sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail oder des Inhalts dieser Mail sind nicht gestattet. Diese Kommunikation per E-Mail ist nicht gegen den Zugriff durch Dritte geschützt. Die GISA GmbH haftet ausdrücklich nicht für den Inhalt und die Vollständigkeit von E-Mails und den gegebenenfalls daraus entstehenden Schaden. Sollte trotz der bestehenden Viren-Schutzprogramme durch diese E-Mail ein Virus in Ihr System gelangen, so haftet die GISA GmbH - soweit gesetzlich zulässig - nicht für die hieraus entstehenden Schäden.

2 1