- syslog-ng - lists.balabit.hu

syslog-ng 100% cpu utilization issue
by Jain, Vaibhav (GE Healthcare) 28 Oct '11

28 Oct '11

Hi, I am getting 100% CPU utilization problem on all the syslog-ng client machines. All the clients are pointing to one syslog-ng server. I don't know why this is happening can you please help me on this. PS:I am using syslog-ng 3.0.1 (open source, 64bit). Thanks, Vaibhav

4 6

[Bug 141] New: Crash while reloading config
by bugzilla＠bugzilla.balabit.com 27 Oct '11

27 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=141 Summary: Crash while reloading config Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: eric(a)sevenscale.com Type of the Report: --- Estimated Hours: 0.0 We have experienced multiple instances of crashes on reloading a config with 3.3.1. Here is the backtrace: (gdb) where #0 afsocket_sd_remove_and_kill_connection (self=0x0, connection=0x1d64010) at afsocket.c:343 #1 0x00007f3b91790560 in afsocket_sd_kill_connection_list (list=<value optimized out>) at afsocket.c:367 #2 0x00007f3b9225a4f2 in persist_config_entry_free (self=0x1eb9180) at cfg.c:66 #3 0x0000003b62a2dd3e in ?? () from /lib64/libglib-2.0.so.0 #4 0x0000003b62a2e1ad in g_hash_table_remove_all () from /lib64/libglib-2.0.so.0 #5 0x0000003b62a2e245 in g_hash_table_destroy () from /lib64/libglib-2.0.so.0 #6 0x00007f3b9225a78c in persist_config_free (self=0x35de9e0) at cfg.c:83 #7 0x00007f3b922730d4 in main_loop_reload_config_apply () at mainloop.c:491 #8 0x00007f3b9228f81b in iv_signal_event (_this=0x7f3b924bbee0) at iv_signal.c:80 #9 0x00007f3b9228f3a9 in iv_event_raw_got_event (_this=0x7f3b924bbf08) at iv_event_raw.c:82 #10 0x00007f3b9228cdf6 in iv_run_active_list () at iv_main.c:219 #11 iv_main () at iv_main.c:269 #12 0x00007f3b92272c3e in main_loop_run () at mainloop.c:722 #13 0x00000000004015b1 in main () (gdb) p *connection $5 = {super = {ref_cnt = {counter = 2}, flags = 0, cfg = 0x0, pipe_next = 0x1a2e5b0, queue_data = 0x0, queue = 0, init = 0x7f3b917901b0 <afsocket_sc_init>, deinit = 0x7f3b91790470 <afsocket_sc_deinit>, free_fn = 0x7f3b9178fc60 <afsocket_sc_free>, notify = 0x7f3b91790570 <afsocket_sc_notify>}, owner = 0x0, reader = 0x1d64430, sock = 386, peer_addr = 0x0} (gdb) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

Latest version of syslog-ng open source 64 bit
by Jain, Vaibhav (GE Healthcare) 27 Oct '11

27 Oct '11

Hi All, I want to download the latest version of syslog-ng (client and server) open source 64 bit. Can you please share with me? Thanks Vaibhav

2 1

Request: GitHub mirror of git bazsi/syslog-ng-3.2.git and bazsi/syslog-ng-3.3.git
by Eric Lindvall 26 Oct '11

26 Oct '11

Hello, GitHub has the ability to setup an automated mirror of a remote git repository to allow for users of GitHub to interact with the code more easily. I would really appreciate having such a mirror setup for syslog-ng to make development easier to track in how I work day-to-day. To get the mirror setup, a free Organization needs to be created for "syslog-ng", and then someone needs to send an email to support(a)github.comasking to setup the mirrors. If this is something that interests anyone, I would be more than willing to help out in getting the process completed. Thanks, Eric

2 2

Cannot install syslog-ng 3.2.4 under cygwin with Oracle support
by Hery Fanomezantsoa 26 Oct '11

26 Oct '11

Hi all, Prior to installing syslog-ng on cygwin, i installed libdbi and libdbi-drivers with oracle instant client on windows. After that, i installed eventlog Finally i tried to install syslog-ng and it failed. Here is my configure: ./configure EVTLOG_CFLAGS="-I/usr/local/eventlog/include/eventlog" \ > EVTLOG_LIBS="-L/usr/local/eventlog/lib -levtlog" \ > GLIB_CFLAGS="-I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include" \ > GLIB_LIBS="-L/usr/lib -lglib-2.0 -lintl" \ > LIBDBI_CFLAGS="-I/usr/local/libdbi/include/dbi-0.8" \ > LIBDBI_LIBS="-L/usr/local/libdbi/lib" \ > --enable-sql I've got this warning: *** Warning: This system can not link to static lib archive /usr/local/eventlog/lib/libevtlog.la. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: linker path does not have real file for library -lrt. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have *** because I did check the linker path looking for a file starting *** with librt and none of the candidates passed a file format test *** using a file magic. Last file checked: /lib/librt.a *** Warning: linker path does not have real file for library -lresolv. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have *** because I did check the linker path looking for a file starting *** with libresolv and none of the candidates passed a file format test *** using a file magic. Last file checked: /lib/libresolv.a *** Warning: linker path does not have real file for library -ldl. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have *** because I did check the linker path looking for a file starting *** with libdl and none of the candidates passed a file format test *** using a file magic. Last file checked: /lib/libdl.a *** The inter-library dependencies that have been dropped here will be *** automatically added whenever a program is linked with this library *** or is declared to -dlopen it. *** Since this library must not contain undefined symbols, *** because either the platform does not support them or *** it was explicitly requested with -no-undefined, *** libtool will only create a static version of it. And this error ../../lib/.libs/libsyslog-ng.a(plugin.o): In function `plugin_load_module': /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:154: undefined reference to `_g_module_symbol' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:172: undefined reference to `_g_module_build_path' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:206: undefined reference to `_g_module_open' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:217: undefined reference to `_g_module_make_resident' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:219: undefined reference to `_g_module_symbol' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:221: undefined reference to `_g_module_error' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:210: undefined reference to `_g_module_error' /cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/lib/plugin.c:146: undefined reference to `_g_module_open' collect2: ld returned 1 exit status make[5]: *** [pdbtool.exe] Error 1 make[5]: Leaving directory `/cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/cygdrive/q/STAGE2011/Soft/syslog-ng-3.2.4' make: *** [all] Error 2 What do I miss? Thanks in advance.

2 3

Using RS and GS field seperator
by Omer Faruk SEN 25 Oct '11

25 Oct '11

Hi, Is there an option I can use non-printable chars as field seperators on template() I want to use RS and GS at the and. 035 29 1D GS (group separator) 135 93 5D ] 036 30 1E RS (record separator) 136 94 5E ^ Regards.

2 1

[Bug 140] New: syslog-ng ignores filter boolean logic
by bugzilla＠bugzilla.balabit.com 24 Oct '11

24 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=140 Summary: syslog-ng ignores filter boolean logic Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: lisaev(a)umail.iu.edu Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=42) --> (https://bugzilla.balabit.com/attachment.cgi?id=42) syslog-ng 3.3.1 config file I am running syslog-ng 3.3.1 (arch linux), and noticed that my iptables logs go into every possible logfile, i.e. /var/log/{messages,kernel,iptables}.log. For example: cur_work$ tail -n1 /var/log/kernel.log Oct 23 12:43:18 linhost kernel: [ 5372.600518] firewall: IN=wlan0 OUT= MAC=00:26:c6:d7:27:6a:00:17:0f:70:b1:00:08:00 SRC=74.125.65.108 DST=96.125.23.251 LEN=40 TOS=0x00 PREC=0x00 TTL=43 ID=28546 PROTO=TCP SPT=993 DPT=52331 WINDOW=0 RES=0x00 RST URGP=0 This is despite the fact that syslog-ng.conf contains filter f_iptables { match("IN=" value("MESSAGE")) and match("OUT=" value("MESSAGE")); }; filter f_kernel { facility(kern) and not filter(f_iptables); }; I also tried modifying f_iptables as filter f_iptables { match("firewall" value("MESSAGE")); }; but still get firewall logs everywhere :( I add the full syslog-ng.conf as an attachment. Thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

[Bug 129] New: Add ability to synchronously flush logs on demand
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=129 Summary: Add ability to synchronously flush logs on demand Product: syslog-ng Version: 1.6.x Platform: All OS/Version: FreeBSD Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: fermulator(a)sympatico.ca Type of the Report: enhancement Estimated Hours: 0.0 As per the below e-mail thread with Bazsi, I was trying to figure out why syslog-ng doesn't write logs immediately. As I discovered syslog-ng by default has the concept of “flush_timeout” and “flush_lines”, where flush_timeout is how frequently we'll write logs (default 10s), and flush_lines is the maximum number of lines we'll hold in the buffer before writing (default 10,000). Currently, there is no way to synchronously force syslog-ng to "write logs now". This ticket is an enhancement to syslog-ng to add the ability, in a synchronous way, ask syslog-ng to flush the buffer now, writing all logs in the queue/buffer immediately/ASAP, and block until the operation is completed. Version Information: * syslog-ng 1.6.8 * FreeBSD 6.1 ----------- From: bazsi(a)balabit.hu To: fermulator(a)sympatico.ca Subject: Re: Flush (write logs now) for syslog-ng? Date: Fri, 22 Jul 2011 06:31:36 +0200 hi, we do have a bugzilla at bugzilla.balabit.com, however it's primarily used for bug reports. you can file enhancement requests though. ----- Original message ----- > Thanks for the reply. > > I tried SIGHUP, and as you mentioned, it's not synchronous. syslog-ng > does write the logs, but only after a few seconds (presumably this is > less than the timeout though at least). > > Do you have any "ticket system", that has the "enhancement" to do this > synchronously that I could reference? > > ~Matt > > > -------- Original Message -------- > From: Balazs Scheidler <bazsi(a)balabit.hu> > Sent: Thu 21 Jul 2011 02:31:24 PM EST > To: Fermulator Fermulator <fermulator(a)sympatico.ca> > Cc: > Subject: Re: Flush (write logs now) for syslog-ng? > > > hi, > > > > sending a SIGHUP should flush all buffers. this is not synchronous > > though, so you have to sleep some time to let syslog-ng do the thing. > > > > we have plans to add both on-demand synchronous reloads and config > > file flushes. > > > > ----- Original message ----- > > > > > > > > > > > > Hi Bazsi, > > > > > > > > > > > > I hope you don’t mind, I was trying to search for this in > > > the syslog-ng mail archives, but couldn’t find my answer, and found > > > your e-mail in the process. > > > > > > > > > > > > > > > As I understand it, syslog-ng has “flush_timeout” and “flush_lines” > > > parameters which determine how often we write out the buffer/queue of > > > log messages, and what the maximum number of lines is that we’ll > > > buffer, respectively. > > > > > > > > > > > > > > > > > > I’m trying to figure out: How can I tell syslog-ng to “write > > > logs now” on demand? (i.e. I > > > have a script that upon failure, scrapes some log files … but > > > instead of waiting for the flush_timeout, I’d rather “poke” > > > syslog-ng to “write all logs now” (i.e. temporarily set the > > > flush_timeout to 0, or temporarily set the flush_lines to 0) > > > > > > > > > > > > Is it possible? > > > > > > > > > > > > Thanks so much > > > > > > > > > ~Fermulator > > > (Matt Callaghan) > > > > > -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 115] New: libsyslog-ng.so is not linked with glib/cap but uses glib/ cap symbols
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=115 Summary: libsyslog-ng.so is not linked with glib/cap but uses glib/cap symbols Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 [arekm@carme-pld ~/rpm/BUILD/syslog-ng-3.2.2/lib]$ ldd .libs/libsyslog-ng.so linux-vdso.so.1 => (0x00007fff46f80000) libc.so.6 => /lib64/libc.so.6 (0x00007fb64c4b8000) /lib64/ld-linux-x86-64.so.2 (0x0000003fba800000) but libsyslog-ng.so uses many glib and cap symbols: libtool: link: x86_64-pld-linux-gcc -std=gnu99 -I../../../lib -I../../../lib -I../../../modules/dbparser -I.. -Wno-pointer-sign -O2 -fno-strict-aliasing -fwrapv -march=x86-64 -gdwarf-3 -g2 -Wall .libs/test_patterndbS.o -Wl,--as-needed -Wl,--no-copy-dt-needed-entries -Wl,-z -Wl,relro -Wl,-z -Wl,combreloc -o .libs/test_patterndb test_patterndb.o ../.libs/patternize.o -Wl,-Bstatic -Wl,--whole-archive -Wl,--export-dynamic -pthread -Wl,--no-whole-archive -Wl,-Bdynamic ../../syslogformat/.libs/libsyslogformat.so ../../../lib/.libs/libsyslog-ng.so ../.libs/libsyslog-ng-patterndb.so /home/users/arekm/rpm/BUILD/syslog-ng-3.2.2/lib/.libs/libsyslog-ng.so -lssl -lcrypto -lresolv /usr/lib64/libgmodule-2.0.so /usr/lib64/libgthread-2.0.so -lpthread /usr/lib64/libglib-2.0.so /usr/lib64/libevtlog.so /usr/lib64/libpcre.so -lcap -ldl -lrt -pthread -Wl,-rpath -Wl,/lib64/syslog-ng ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_set_proc' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_from_text' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_build_path' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_free' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_make_resident' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_thread_init' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_symbol' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_open' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `g_module_error' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_set_flag' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_to_text' ../../../lib/.libs/libsyslog-ng.so: undefined reference to `cap_get_proc' That's in mixed linking, CORE_DEPS_LIBS is then empty. CORE_DEPS_LIBS should contain static linking to glib and dynamic to cap then. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

2 5

[Bug 114] New: configure strips -ldl -lrt for static linking but doesn' t add back with dynamic linking
by bugzilla＠bugzilla.balabit.com 23 Oct '11

23 Oct '11

https://bugzilla.balabit.com/show_bug.cgi?id=114 Summary: configure strips -ldl -lrt for static linking but doesn't add back with dynamic linking Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 configure.in when detecting glib strips -ldl and -lrt to prevent static linking with these libraries. # strip out -ldl & -lrt as it cannot be linked statically GLIB_LIBS=`echo $GLIB_LIBS | tr ' ' '\n' | egrep -v "^(-ldld?)|(-lrt)$" | tr '\n' ' '` This is fine. Unfortunately it doesn't add -ldl and -lrt back with dynamic linking and that causes newer glib detection to fail: configure:14223: checking for g_hash_table_new configure:14223: x86_64-pld-linux-gcc -std=gnu99 -o conftest -O2 -fno-strict-aliasing -fwrapv -march=x86-64 -gdwarf-3 -g2 -Wall -D_FORTIFY_SOURCE=2 -Wl,--as-needed -Wl,--no-copy-dt-needed-entries -Wl,-z,relro -Wl,-z,combreloc conftest.c -Wl,-Bstatic -Wl,--export-dynamic -pthread -lgmodule-2.0 -lgthread-2.0 -lglib-2.0 -Wl,-Bdynamic >&5 /usr/lib64/gcc/x86_64-pld-linux/4.5.2/../../../../lib64/libglib-2.0.a(gmain.o): In function `g_get_monotonic_time': (.text+0x2e12): undefined reference to `clock_gettime' collect2: ld returned 1 exit status -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3