- syslog-ng - lists.balabit.hu

Multi-core use in threaded mode
by Martin Holste 01 May '12

01 May '12

I'm seeing that on a very busy syslog-ng 3.3.4 box, CPU never rises above 103% and log loss occurs. Does threaded mode not allow separate threads to utilize multiple cores? I need to scale above a single CPU.

6 8

[PATCH (3.4) 0/3] afsql code cleanups
by Gergely Nagy 01 May '12

01 May '12

The patches following this mail are my attempts at cleaning up the afsql driver here and there, mostly afsql_dd_insert_db(), in preparation for moving towards LogThreadedDestDriver (which will be posted separately a bit later). The migration is possible without these patches, but these are worth applying even without the LogThreadedDestDriver patches, as these present no real architectural change, just a little refactoring. I think the code could be cleaned up further, but for the time being, I only did what I thought necessary to prepare for migration to LogThreadedDestDriver.

2 5

[PATCH (3.4)] afsmtp: Add SCS_SMTP to lib/stats.h
by Gergely Nagy 01 May '12

01 May '12

Add SCS_SMTP to lib/stats.h, so we get proper smtp stats too. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/stats.h | 1 + modules/afsmtp/afsmtp.c | 4 ---- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/lib/stats.h b/lib/stats.h index 99936da..9174408 100644 --- a/lib/stats.h +++ b/lib/stats.h @@ -70,6 +70,7 @@ enum SCS_SEVERITY = 24, SCS_FACILITY = 25, SCS_SENDER = 26, + SCS_SMTP = 27, SCS_MAX, SCS_SOURCE_MASK = 0xff }; diff --git a/modules/afsmtp/afsmtp.c b/modules/afsmtp/afsmtp.c index bd8adfe..841100d 100644 --- a/modules/afsmtp/afsmtp.c +++ b/modules/afsmtp/afsmtp.c @@ -33,10 +33,6 @@ #include <libesmtp.h> -#ifndef SCS_SMTP -#define SCS_SMTP 0 -#endif - typedef struct { gchar *name; -- 1.7.10

2 1

syslog-ng 3.3.5 and openssl
by Alexander Komyagin 01 May '12

01 May '12

Hi! I noticed that when I'm compiling syslog-ng 3.3.5 with openssl enabled (at least in my environment), libsyslog-ng-crypto.so somehow is not linked with libssl (checked with ldd), thus resulting with unresolved symbols error on syslog-ng startup for afsocket module. Attached patch fixes the issue. --- syslog-ng-3.3.5.orig/lib/Makefile.am 2012-03-31 22:23:43.000000000 +0400 +++ syslog-ng-3.3.5/lib/Makefile.am 2012-04-26 17:32:58.000000000 +0400 @@ -12,7 +12,7 @@ libsyslog_ng_la_LDFLAGS = -no-undefined -release @VERSION@ module_LTLIBRARIES = libsyslog-ng-crypto.la -libsyslog_ng_crypto_la_LIBADD = @CORE_DEPS_LIBS@ libsyslog-ng.la +libsyslog_ng_crypto_la_LIBADD = @CORE_DEPS_LIBS@ @OPENSSL_LIBS@ libsyslog-ng.la libsyslog_ng_crypto_la_LDFLAGS = -no-undefined -avoid-version # this is intentionally formatted so conflicts are less likely to arise. one name in every line. -- Best wishes, Alexander Komyagin

2 1

[PATCH] lib/gprocess.c: Ignore SIGHUP inside the supervisor.
by Gergely Nagy 01 May '12

01 May '12

Reloading syslog-ng's config is often done via a killall -HUP syslog-ng command, which also sends a signal to the supervisor. However, the supervisor did not handle said signal, thus it exited as is the default for it. To work around this issue, lets ignore SIGHUP inside the supervisor. Reported-by: Patrick Hemmer Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/gprocess.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/lib/gprocess.c b/lib/gprocess.c index aaefbab..9246d88 100644 --- a/lib/gprocess.c +++ b/lib/gprocess.c @@ -1110,7 +1110,9 @@ g_process_perform_supervise(void) g_process_message("Initialization failed but the daemon did not exit, even when forced to, trying to recover; pid='%d'", pid); continue; } - + + sigignore(SIGHUP); + if (process_opts.check_fn && (process_opts.check_period >= 0)) { gint i = 1; -- 1.7.9.1

2 1

3.4 on opensuse factory
by Peter Czanik 01 May '12

01 May '12

Hello, When trying to run syslog-ng 3.4 on openSUSE factory, the supervisor process starts, but it's child segfaults continuously. I tried to revert the big nvtable patch, which solved my problem previously, but it did not help. Here are two backtraces, practically the same: With the nvtable patch: (gdb) bt #0 0x00007f3e447516c6 in __memcpy_ssse3_back () from /lib64/libc.so.6 #1 0x00007f3e44f1a3ff in nv_table_add_value () from /lib64/libsyslog-ng-3.4.0alpha1.so #2 0x00007f3e44f0858f in log_msg_set_value () from /lib64/libsyslog-ng-3.4.0alpha1.so #3 0x00007f3e44f015db in log_src_driver_queue_method () from /lib64/libsyslog-ng-3.4.0alpha1.so #4 0x00007f3e44f12bfe in log_source_queue () from /lib64/libsyslog-ng-3.4.0alpha1.so #5 0x00007f3e44efa008 in afinter_source_post () from /lib64/libsyslog-ng-3.4.0alpha1.so #6 0x00007f3e44f338d4 in iv_event_run_pending_events () from /lib64/libsyslog-ng-3.4.0alpha1.so #7 0x00007f3e44f33c49 in iv_event_raw_got_event () from /lib64/libsyslog-ng-3.4.0alpha1.so #8 0x00007f3e44f3534a in iv_main () from /lib64/libsyslog-ng-3.4.0alpha1.so #9 0x00007f3e44f18532 in main_loop_run () from /lib64/libsyslog-ng-3.4.0alpha1.so #10 0x00000000004016e1 in main () With the nvtable patch (https://github.com/bazsi/syslog-ng-3.4/commit/1c3a37764d98d5a37f2cd3c79f7f4…) reverted: (gdb) bt #0 0x00007f6fdb8b86c6 in __memcpy_ssse3_back () from /lib64/libc.so.6 #1 0x00007f6fdc0818bf in nv_table_add_value () from /lib64/libsyslog-ng-3.4.0alpha1.so #2 0x00007f6fdc06f620 in log_msg_set_value () from /lib64/libsyslog-ng-3.4.0alpha1.so #3 0x00007f6fdc0685cb in log_src_driver_queue_method () from /lib64/libsyslog-ng-3.4.0alpha1.so #4 0x00007f6fdc079dbe in log_source_queue () from /lib64/libsyslog-ng-3.4.0alpha1.so #5 0x00007f6fdc060ff8 in afinter_source_post () from /lib64/libsyslog-ng-3.4.0alpha1.so #6 0x00007f6fdc09afc4 in iv_event_run_pending_events () from /lib64/libsyslog-ng-3.4.0alpha1.so #7 0x00007f6fdc09b339 in iv_event_raw_got_event () from /lib64/libsyslog-ng-3.4.0alpha1.so #8 0x00007f6fdc09ca3a in iv_main () from /lib64/libsyslog-ng-3.4.0alpha1.so #9 0x00007f6fdc07f942 in main_loop_run () from /lib64/libsyslog-ng-3.4.0alpha1.so #10 0x00000000004016e1 in main () Is it something in syslog-ng, or I should rather report it at openSUSE? Bye, -- Peter Czanik (CzP)<czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

3 3

[PATCH] contrib/systemd: Alias the service to syslog.service
by Gergely Nagy 01 May '12

01 May '12

In order to be considered a syslog service, we need to Alias ourselves to syslog.service. Doing this will make systemd consider syslog-ng a valid syslogd service, without the alias, one has to do something similar manually. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- contrib/systemd/syslog-ng.service | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/contrib/systemd/syslog-ng.service b/contrib/systemd/syslog-ng.service index 85c91e5..f9b9fe2 100644 --- a/contrib/systemd/syslog-ng.service +++ b/contrib/systemd/syslog-ng.service @@ -10,3 +10,4 @@ StandardOutput=null [Install] WantedBy=multi-user.target +Alias=syslog.service -- 1.7.9.1

2 1

File permission in syslog-ng
by Ankit Mahawar 01 May '12

01 May '12

Hi All, If the file permission is not specified in syslog-ng.conf file then it uses the file permission as default which is 600 . I noticed it and want to confirm this behavior of syslog-ng . Also if we define the permission as perm(644) in options tag of syslog-ng.conf then does that permission is set for all the files ? Please provide your inputs as I am understanding this utility. Thanks Ankit =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

2 1

Antw: [PATCH] afinter: Make the parent class LogSrcDriver, instead of LogDriver.
by Peter Eisenlohr 01 May '12

01 May '12

Hi, since the large NVTable patch has been re-applied (1c3a37764d), this patch should be committed soon, as syslog-ng currently still crashes when a mark is logged. Peter Dipl.-Inf. Peter Eisenlohr Geschäftsbereich Logistik INFORM GmbH, Pascalstr. 23, 52076 Aachen, Germany Telefon: (+49) 2408 9456-6000 E-Mail: peter.eisenlohr(a)inform-software.com, Web: http://www.inform-software.com INFORM Institut fur Operations Research und Management GmbH Registered AmtsG Aachen HRB1144 Gfhr. Adrian Weiler >>> Gergely Nagy 06.04.12 11.36 Uhr >>> The parent of AFInterSourceDriver should be LogSrcDriver, because that's the struct we pass down to it anyway, and other parts of the code will cast it back to LogSrcDriver, too. But if its parent is LogDriver, as it was, we were corrupting the later parts of the original LogSrcDriver, with values from AFInterSourceDriver. Many thanks to Peter Eisenlohr for initial debugging, and for pinpointing mark messages as the triggers. Reported-by: Peter Czanik Signed-off-by: Gergely Nagy --- lib/afinter.c | 10 +++++----- lib/afinter.h | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/lib/afinter.c b/lib/afinter.c index 23b1c82..b9d0ddf 100644 --- a/lib/afinter.c +++ b/lib/afinter.c @@ -304,7 +304,7 @@ afinter_source_new(AFInterSourceDriver *owner, LogSourceOptions *options) AFInterSource *self = g_new0(AFInterSource, 1); log_source_init_instance(&self->super); - log_source_set_options(&self->super, options, 0, SCS_INTERNAL, owner->super.id, NULL, FALSE); + log_source_set_options(&self->super.super, options, 0, SCS_INTERNAL, owner->super.super.id, NULL, FALSE); afinter_source_init_watches(self); self->super.super.init = afinter_source_init; self->super.super.deinit = afinter_source_deinit; @@ -328,7 +328,7 @@ afinter_sd_init(LogPipe *s) return FALSE; } - log_source_options_init(&self->source_options, cfg, self->super.group); + log_source_options_init(&self->source_options, cfg, self->super.super.group); self->source = afinter_source_new(self, &self->source_options); log_pipe_append(&self->source->super, s); log_pipe_init(&self->source->super, cfg); @@ -370,9 +370,9 @@ afinter_sd_new(void) AFInterSourceDriver *self = g_new0(AFInterSourceDriver, 1); log_src_driver_init_instance((LogSrcDriver *)&self->super); - self->super.super.init = afinter_sd_init; - self->super.super.deinit = afinter_sd_deinit; - self->super.super.free_fn = afinter_sd_free; + self->super.super.super.init = afinter_sd_init; + self->super.super.super.deinit = afinter_sd_deinit; + self->super.super.super.free_fn = afinter_sd_free; log_source_options_defaults(&self->source_options); return (LogDriver *)&self->super.super; } diff --git a/lib/afinter.h b/lib/afinter.h index 108475f..1cd9d78 100644 --- a/lib/afinter.h +++ b/lib/afinter.h @@ -33,7 +33,7 @@ */ typedef struct _AFInterSourceDriver { - LogDriver super; + LogSrcDriver super; LogSource *source; LogSourceOptions source_options; } AFInterSourceDriver; -- 1.7.9.1 ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

[PATCH (3.4)] configure.in: Add --disable-smtp support.
by Gergely Nagy 01 May '12

01 May '12

Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/configure.in b/configure.in index f21e130..2d56bbd 100644 --- a/configure.in +++ b/configure.in @@ -178,6 +178,10 @@ AC_ARG_ENABLE(json, [ --disable-json Disable JSON support (default: auto)], [case "${enableval}" in yes) with_json="auto";; *) with_json="${enableval}";; esac],with_json="auto") +AC_ARG_ENABLE(smtp, + [ --disable-smtp Disable SMTP support (default: auto)], + ,,enable_smtp="auto") + AC_ARG_WITH(libesmtp, AC_HELP_STRING([--with-libesmtp=DIR], [use libesmtp library from (prefix) directory DIR]),,) -- 1.7.9.1

2 1