- syslog-ng - lists.balabit.hu

what's the default template of file destination?
by Fu Ecy 13 Apr '12

13 Apr '12

Dear guys: I use syslog-ng to gather the error log of my system, but now I have a problem. The original log message is like this. *[2012-04-10 **18:51:30**] [BlenderProcessor.cpp:452:allocPhase1Request()] [WARN] :: BLENDER: queryparser doRewrite function error* I set the template like this. *file( "/home/admin/logs/blender.log.$S_YEAR-$S_MONTH-$S_DAY" create_dirs(yes) owner(admin) group(admin) perm(0755) template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC\t$FULLHOST\t$MESSAGE\n") );* Then I get the log like this. *2012-04-13 14:41:36 s061090.cm5 18:51:30] [BlenderProcessor.cpp:452:allocPhase1Request()] [WARN] :: BLENDER: queryparser doRewrite function error* The date of original log message has been truncated. If I don't use template, it will be ok. So I wonder what is the default template. Thank you very much :)

2 2

Syslog-ng apache filters
by Hugo Deprez 13 Apr '12

13 Apr '12

Dear community, I am currently trying to setup a central syslog-ng server. Almost everything is working, I just have some issue with filtering apache2 logs. On the remote host I use the following to send apache2 : source vhost_access { file("/var/log/apache2/vhost-access.log"); }; This is working the central syslog server get the messages. I setup a filter on the server to filter apache2 log such as : filter f_apache { match("hostname.mydomain.fr"); }; this works. The issue is that my apache2 logs match other filter, so I am logging messages 3 times : filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; and : filter f_user { facility(user) and not filter(f_debug); }; It seems that I have to play with default-priority() and default-facility() parameters. I would like to know how do you deal with this kind of situation ? Regards, Hugo

2 8

PROBLEM: Stats stop getting generating after nightly reload in logrotation script
by Paul Braxton 12 Apr '12

12 Apr '12

Version: syslog-ng-premium-edition-4.1.3-1.rhel5 Operating system: CentOS release 6.2 (Final) We are experiencing an issue where the statistics messages stop getting generated after the nightly reload done by logrotation. This happens pretty consistently after the logrotation runs, although sometimes upward of an hour later. This is the command in the log rotation script: /etc/init.d/syslog-ng reload 2>/dev/null We use the stats to track metrics and additional health monitoring. We are concerned that logs also may be dropped when these stats stop getting reported. A full restart of syslog-ng fixes the issue. Any info would be helpful, thanks!!! -Paul

2 1

paulbraxton3@hotmail.com
by Paul Braxton 12 Apr '12

12 Apr '12

paulbraxton3(a)hotmail.com

1 0

How to remove hosts from Syslog-ng plugin
by Wagner Pereira 07 Apr '12

07 Apr '12

Hello, all. I'm not sure if that's the right mailing list. If it is not, please let me know. I use the CactiEZ solution running Syslog 0.5.2 by Jimmy Conner The thing is: every host configured to log against my server (I asked a friend of mine to test it out), my server accept and include the new host in the list. I need to do two things: 1. To block new unauthorized hosts to log on it and 2. Remove hosts from the list I appreciate any help. Best wishes... Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo http://www.pop-sp.rnp.br Fixo. +55 11 3091-9799 Móvel. +55 11 9923-9554 fone@RNP. 011-1015-8902 ### At PoP-SP/RNP, every day is an IPv6 day ###

2 1

race condition in destination driver deinit?
by Michael Hocke 07 Apr '12

07 Apr '12

-----BEGIN PGP SIGNED MESSAGE----- Me again.... Hi guys, I've been running 3.3.3 on Solaris 10 x86 for quite a bit now. I've got two boxes, both running the same OS release and the same release of syslog-ng. One of them (box A) has a destination configured that doesn't really exist so I've been getting Mar 13 14:46:15 flowmon-sys syslog-ng[20118]: I/O error occurred while writing; fd='24', error='Connection refused (146)' which is perfectly fine and I just ignored it. The other Solaris box (box B) does not have this destination configured. It now happens that after a random number of HUP signals syslog-ng on box A crashes with a segmentation fault and the following backtrace: (gdb) bt #0 0xfef2a7a8 in log_dest_driver_release_queue_method (self=0x80d2958, q=0x83e58955, user_data=0x0) at driver.c:80 #1 0xfef2aa5c in log_dest_driver_deinit_method (s=0x80d2958) at driver.c:80 #2 0xfe914a14 in afsocket_dd_deinit (s=0x80d2958) at afsocket.c:109 #3 0xfef29cd6 in log_dest_group_deinit (s=0x8074198) at dgroup.c:59 #4 0xfef24a21 in log_center_deinit (self=0x8090cc0) at center.c:67 #5 0xfef25493 in cfg_deinit (cfg=0x80d2848) at cfg.c:90 #6 0xfef406b2 in main_loop_reload_config_apply () at mainloop.c:364 #7 0xfef40a42 in main_loop_io_worker_sync_call (func=<value optimized out>) at mainloop.c:364 #8 0x08047900 in ?? () I was able to reproduce this over and over again. Sometimes it happens after 11 HUPs, sometimes after 35, but it eventually does crash. Since the only difference between box A and box B is the one additional destination I suspect that this is the cause for this segfault. Maybe the HUP signal came at a time when syslog-ng was trying to send something to the non-existing destination? I'll try to collect some more data. If anybody could give me some direction on where exactly I should look into, I'll be happy to do that. - - Michael -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.0.3 (Build 1) Charset: us-ascii wsBVAwUBT1+ZRZbfnpCg64TVAQEiVgf7BmePJa6Va396QRyBLNPpOHzAvi9p3n07 uVvvYOcMHUFwixZoC0BXs+21EfSkMOmROQWupXBTcEbyBMOf0+HXDsuO7mfZDznU AZzLBzhgaDPf0stx55PqOssKTf28QLtxs1gUmJSb2DgmK9WjtMsovAlS83pQOa6O oQIaK3SBIUtrbijdx7vLvS0VUcqhDzJI9TJ7R+A0x3i9dAWKIvDb7wLW4CvB9k19 7bmmXFwpAClGZ6DS1CdIt4eHuDiuIoes2uXNhh5xReZpCh89FHzv8LxWxVnph3ms 6FctjAt4JMQTGnZRHN7QidYAGwjjabqtGjKWvXtRfoBCdUfLfC+wAA== =JjOa -----END PGP SIGNATURE-----

2 1

AUTO: James B Horwath/TheGuardian is out of the office. (returning 04/09/2012)
by James B Horwath 07 Apr '12

07 Apr '12

I am out of the office until 04/09/2012. I am out of the office until Monday April 9, 2012 with limited access to e-mail. If there are Nitro issues please contact Dante Rodino at 212-919-2819 or Sunil Gupta at 610-807-6710. Any other issues please contact Al Limone manager of IT Security Services & Governance. Thanks, Jim Note: This is an automated response to your message "syslog-ng Digest, Vol 84, Issue 10" sent on 4/6/2012 20:49:46. This is the only notification you will receive while this person is away. ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

Handling multiple timezones
by Chris Hiestand 07 Apr '12

07 Apr '12

After some googling and reading the admin guide, I think what I want to do is not possible. But I'd like confirmation. My syslog-ng server gets syslog messages from clients with two timezones: UTC and US/Pacific. But the UTC clients (ESXi servers) cannot specify the UTC timezone, so the collector incorrectly assumes the timestamps are local (US/Pacific). I'd really like to convert the UTC timezone to US/Pacific so my entire output is in US/Pacific. But the only place I can specify a source timezone is in the source section - however both client groups send syslogs to the same source so I cannot do that. So potential workarounds are: A. Set all the clients to output in the UTC timezone so that I can set UTC in the common source and then convert to US/Pacific as the default output timezone. B. Setup another IP address to collect syslogs, and set the different timezone on that source (and configure all of those timezones clients to syslog to a different IP). This means you need N IP addresses to collect N different timezones. Is it considered "Best Practice" to have all clients send syslogs in UTC timezone to avoid this complication? Any help is appreciated. Thanks, Chris

2 2

[PATCH] afsocket: Do not die if a destination is not resolvable at startup.
by Gergely Nagy 06 Apr '12

06 Apr '12

If a destination cannot be resolved at init time, do not panic, just bail out, but otherwise pretend we succeeded: after time_reopen, we'll retry anyway! And on that note, teach afsocket_dd_start_connect() to call afsocket_dd_apply_transport() if our fd is -1 (ie, not connected). Reported-by: Peter Palfrader <weasel(a)debian.org> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afsocket/afinet.c | 2 +- modules/afsocket/afsocket.c | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/modules/afsocket/afinet.c b/modules/afsocket/afinet.c index f83ff38..a7d3635 100644 --- a/modules/afsocket/afinet.c +++ b/modules/afsocket/afinet.c @@ -498,7 +498,7 @@ afinet_dd_apply_transport(AFSocketDestDriver *s) if ((self->bind_ip && !resolve_hostname(&self->super.bind_addr, self->bind_ip)) || !resolve_hostname(&self->super.dest_addr, self->super.hostname)) - return FALSE; + return TRUE; afinet_set_port(self->super.dest_addr, self->dest_port ? : default_dest_port, self->super.flags & AFSOCKET_DGRAM ? "udp" : "tcp"); diff --git a/modules/afsocket/afsocket.c b/modules/afsocket/afsocket.c index ae9c5c2..095f5a5 100644 --- a/modules/afsocket/afsocket.c +++ b/modules/afsocket/afsocket.c @@ -1103,6 +1103,11 @@ afsocket_dd_start_connect(AFSocketDestDriver *self) gchar buf1[MAX_SOCKADDR_STRING], buf2[MAX_SOCKADDR_STRING]; main_loop_assert_main_thread(); + + if (self->fd == -1) + if (!afsocket_dd_apply_transport(self)) + return FALSE; + if (!afsocket_open_socket(self->bind_addr, !!(self->flags & AFSOCKET_STREAM), &sock)) { return FALSE; @@ -1169,10 +1174,7 @@ afsocket_dd_init(LogPipe *s) /* these fields must be set up by apply_transport, so let's check if it indeed did */ g_assert(self->transport); - g_assert(self->bind_addr); - g_assert(self->dest_addr); g_assert(self->hostname); - g_assert(self->dest_name); if (cfg) { -- 1.7.9

2 3

[Bug 171] New: Unwanted IP adress Folder
by bugzilla＠bugzilla.balabit.com 04 Apr '12

04 Apr '12

https://bugzilla.balabit.com/show_bug.cgi?id=171 Summary: Unwanted IP adress Folder Product: syslog-ng Version: 3.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: julien.groselle(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 Hi, I work for a lange society, and we use syslog-ng for 5 years now. We have a centralized server with storage tank to keep logs securly. Concretely, we have 2 centralized servers syslog-ng in chrooted environement, and 50 clients servers. Since we use TLS transport in place of stunnel workaround, we have many issues : - First of all, many logs aren't writen in $HOST folder but in IPADDRESS folder. So, to be clear, this is an exemple : # ls drwxr-x--- 8 root adm 4,0K 1 mars 00:07 10.0.0.1 drwxr-x--- 53 root adm 4,0K 19 mars 00:35 host1 I assume that host1 have 10.0.0.1 IP address and # tree 192.168.100.79/2012-03/ 10.0.0.1/2012-03/ ├── 02-user-10.0.0.1.log.bz2 ├── 06-user-10.0.0.1.log.bz2 ├── 07-user-10.0.0.1.log.bz2 ├── 08-user-10.0.0.1.log.bz2 ├── 09-user-10.0.0.1.log.bz2 ├── 12-user-10.0.0.1.log.bz2 ├── 13-user-10.0.0.1.log.bz2 ├── 14-user-10.0.0.1.log.bz2 ├── 15-user-10.0.0.1.log.bz2 ├── 16-user-10.0.0.1.log.bz2 └── 19-user-10.0.0.1.log # tree host1/2012-03/ |grep 19- ├── 19-apache.access-host1.log ├── 19-apache.error-host1.log ├── 19-authpriv-host1.log ├── 19-auth-host1.log ├── 19-cron-host1.log ├── 19-daemon-host1.log ├── 19-kern-host1.log ├── 19-mail-host1.log ├── 19-nagios-host1.log ├── 19-puppetd-host1.log ├── 19-syslog-host1.log └── 19-user-host1.log (we have this problem with many servers) In facility "user" for host 10.0.0.1 in fact i have log for snmptrapd... But why ?? We have config for snmpd but not for snmptrapd... So i have tried to define a default facility => failed After i have tried many dns and hostnames options => failed As anyone here have a way to search for me ? If you need more details, i'm your's. Kind regards. -- JG -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6