- syslog-ng - lists.balabit.hu

Monitoring syslog-ng logserver
by Paul Muther 19 Nov '11

19 Nov '11

Greetings all, I have a question about monitoring syslog-ng itself. In the event that the log server stops listening or stops processing for messages for whatever reason is there a way to alert on hosts that messages are being queued/buffered? In a situation recently the log server syslog-ng process was running but not accepting log messages from remote hosts for some reason. As a result they all pilled up at the sources until the clients rolled over. It would be helpful to have an alert that it is happening but I can't find anything on monitoring the buffers. Thanks much, PM

2 1

patterndb
by Gianluca Tranelli 18 Nov '11

18 Nov '11

Good morning everybody, the time is very good here in Rome, but I don't want to talk abbout the weather but about patterndb that is driving me crazy. After reading all the administration guide v3.3, I found an example of using patterndb to log the duration of an ssh Linux and to log a new formatted message. I just copied the XML, ran update-patterndb but nothing happen. Do i miss something? Can someone post a complete working example on ssh? Patterndb is driving me crazy. Thank you in advance.

2 3

Query regarding syslog-ng
by Ankit Mahawar 18 Nov '11

18 Nov '11

Hi , In c++ we have a function syslog for logging data into the log file . Similar function can be used in syslog-ng for logging or there is a separate function I am totally new to syslog-ng. Thanks =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

2 3

Simple config question
by Miguel Alvarez 18 Nov '11

18 Nov '11

Hi, After being less than impressed with the stability of rsyslog, I just discovered syslog-ng and it looks really impressive but a bit overwhelming! I have a simple configuration with my existing rsyslog set up where it's performing normal system syslog responsibilities but also tagging other log files and then forwarding them to a centralized log server. The examples I've seen for syslog-ng are making my head swim so I was hoping someone would be able to point me in the right direction on how to do the same with syslog-ng. Thank you

5 12

syslog-ng fails to drop file handles and reopen on HUP signal
by Dave Rawks 17 Nov '11

17 Nov '11

Since 3.3.2 I've been seeing this weird behavior where syslog-ng fails to reload cleanly on a HUP. This has been particularly hard to troubleshoot since it appears as though when the reload fails it is causing both sshd and login to block; which I suspect is because /dev/log has disappeared. Luckily I do have nagios nrpe setup to allow me to remotely restart syslog-ng which alleviates the inability to login, but also makes it very hard to collect any troubleshooting information. Anyone else seeing any failures like this? I also sometimes see a a kernel error like one of the following on reload: Nov 17 10:30:02 app-bogus kernel: [ 3788.489852] syslog-ng[28520]: segfault at 7fd054022350 ip 00007fd054022350 sp 00007fffc93404e8 error 15 OR Nov 17 10:32:35 app-bogus kernel: [ 3941.605005] syslog-ng[29805] general protection ip:7fd05f0bcc4e sp:7fd05ac71240 error:0 in libsyslog-ng-3.3.2.so[7fd05f092000+7b000] I was really excited about the features this version of syslog-ng has brought with it, but I'm finding it WAY to unstable to use in production. Is there any information I could provide to help resolve these possibly related issues? -Dave

2 1

R: Re: R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

Sorry, but I need more help. I need to install syslog-ng in server mode and I'm not able to find the installer script. Thanks. >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 17/11/2011 12.10 >A: "andrea.meconi(a)libero.it"<andrea.meconi(a)libero.it> >Cc: "Syslog-ng users' and developers' mailing list"<syslog-ng(a)lists.balabit. hu> >Ogg: Re: [syslog-ng] R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >> How can I install the new service now? > >I would suggest reading our excellent administrator's guide, available >at: > http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3- guides/syslog-ng-ose-v3.3-guide-admin-en.html/bk01-toc.html > >-- >|8] > >

2 1

R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

How can I install the new service now? Thanks. >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 16/11/2011 22.32 >A: <syslog-ng(a)lists.balabit.hu> >Ogg: Re: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >> ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version >> ./syslog-ng: error while loading shared libraries: libsyslog-ng-3.3.2.so: >> cannot open shared object file: No such file or directory >> ameconi@ubuntu:/usr/local/sbin$ > >You also need to add /usr/local/lib to your library load path. The >easiest way is to add that dir to /etc/ld.so.conf. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

2 1

R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

Sorry! With this addendum into ld.so.conf ameconi@ubuntu:/etc$ more ld.so.conf include /etc/local/sbin include /etc/ld.so.conf.d/*.conf ameconi@ubuntu:/etc$ I can obtain the version information ameconi@ubuntu:/usr/local/sbin$ sudo syslog-ng --version syslog-ng 3.3.2 Installer-Version: 3.3.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose-- mainline--3.3#master#555a5cead6723132e6aa89f52365bb40582c8ecc Compile-Date: Nov 15 2011 17:55:58 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser, syslogformat Available-Modules: dbparser,syslogformat,basicfuncs,afsocket-notls,afuser, afmongodb,csvparser,afsocket,afprog,affile,confgen,convertfuncs,dummy Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: off ameconi@ubuntu:/usr/local/sbin$ >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 16/11/2011 22.32 >A: <syslog-ng(a)lists.balabit.hu> >Ogg: Re: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >> ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version >> ./syslog-ng: error while loading shared libraries: libsyslog-ng-3.3.2.so: >> cannot open shared object file: No such file or directory >> ameconi@ubuntu:/usr/local/sbin$ > >You also need to add /usr/local/lib to your library load path. The >easiest way is to add that dir to /etc/ld.so.conf. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0

R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

Goodmorning. This is my ld.so.conf ameconi@ubuntu:/etc$ more ld.so.conf include /etc/ld.so.conf.d/*.conf ameconi@ubuntu:/etc$ I need to ad another include. If so, This does not solve. >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 16/11/2011 22.32 >A: <syslog-ng(a)lists.balabit.hu> >Ogg: Re: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >> ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version >> ./syslog-ng: error while loading shared libraries: libsyslog-ng-3.3.2.so: >> cannot open shared object file: No such file or directory >> ameconi@ubuntu:/usr/local/sbin$ > >You also need to add /usr/local/lib to your library load path. The >easiest way is to add that dir to /etc/ld.so.conf. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0

R: RE: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

ameconi@ubuntu:~$ sudo ldconfig [sudo] password for ameconi: ameconi@ubuntu:~$ cd /usr/local/sbin ameconi@ubuntu:/usr/local/sbin$ ldd syslog-ng linux-gate.so.1 => (0xb7762000) libsyslog-ng-3.3.2.so => /usr/local/lib/libsyslog-ng-3.3.2.so (0xb76ec000) libnsl.so.1 => /lib/tls/i686/cmov/libnsl.so.1 (0xb76d4000) libgmodule-2.0.so.0 => /usr/lib/libgmodule-2.0.so.0 (0xb76cf000) libgthread-2.0.so.0 => /usr/lib/libgthread-2.0.so.0 (0xb76ca000) librt.so.1 => /lib/tls/i686/cmov/librt.so.1 (0xb76c1000) libglib-2.0.so.0 => /usr/lib/libglib-2.0.so.0 (0xb7610000) libevtlog.so.0 => /usr/local/lib/libevtlog.so.0 (0xb760c000) libdl.so.2 => /lib/tls/i686/cmov/libdl.so.2 (0xb7608000) libpthread.so.0 => /lib/tls/i686/cmov/libpthread.so.0 (0xb75ef000) libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb74a0000) /lib/ld-linux.so.2 (0xb7763000) libpcre.so.3 => /usr/lib/libpcre.so.3 (0xb7479000) ameconi@ubuntu:/usr/local/sbin$ >----Messaggio originale---- >Da: james.lay(a)wincofoods.com >Data: 16/11/2011 21.06 >A: <andrea.meconi(a)libero.it>, <syslog-ng(a)lists.balabit.hu> >Ogg: RE: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > > > >> -----Original Message----- >> From: syslog-ng-bounces(a)lists.balabit.hu >[mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of >> andrea.meconi(a)libero.it >> Sent: Wednesday, November 16, 2011 12:04 PM >> To: syslog-ng(a)lists.balabit.hu >> Subject: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on >Ubuntu. >> >> ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version >> ./syslog-ng: error while loading shared libraries: >libsyslog-ng-3.3.2.so: >> cannot open shared object file: No such file or directory >> ameconi@ubuntu:/usr/local/sbin$ > >That looks promising :) > >Ok...do this: > >"sudo ldconfig" > >And while you're in that /usr/local/sbin directory, what's the output >of: > >"ldd syslog-ng" > >James >

1 0