- syslog-ng - lists.balabit.hu

Check connection to server
by Josu Lazkano 01 Aug '11

01 Aug '11

Hello again. I had my syslog server configured and running. All servers has public IP but they are on the same LAN. Now I want to get all logs from a remote server. I configured the remote server same as LAN servers but there is no logs from WAN. How could I check if it is sending data to my syslog server? Maybe I must configure filters to do that? Thanks and best regards.

2 1

Inability to filter/log hostnames
by Norman Elton 01 Aug '11

01 Aug '11

I'm running syslog-ng 3.2.4 from RedHat's RPM. Unfortunately, I can't seem to log the hostname as specified in the incoming UDP packet. We don't do DNS resolution; rather, just want to log what the sending host is passing along. No relays in the mix, but we have keep_hostname() enabled. My global options: flush_lines(10); flush_timeout(750); time_reopen (10); log_fifo_size (1000); keep_hostname (yes); When I log $HOSTNAME or $HOST, I just get the sender's IP address. Similarly, filters based on these macros don't work properly. This all seemed to work on prior versions of syslog-ng (2.something). Any ideas? Thanks! Norman

2 1

3.3.0beta1 leaking memeory (Re: syslog-ng 3.3.0beta & ESX crashes)
by Hendrik Visage 01 Aug '11

01 Aug '11

Hi there, I've mailed Gergely the Valgrind output to analyze 3.3.0beta1 memory leak(s), so if anybody else are interested in it, please contact me for them. I've since compiled 3.2.4+noescape patch (since only 3.3.0+ have the default option for SQL insert I need/use for the autoincrementing ID field in systemevents), and using the same config file (other than @version 3.2 and the noescape('default') for my postgresql insertions) and the system is stable with no descernable memory growth compared to syslog-ng 3.3.0beta1's explosion in memory size. Hendrik On Mon, Jul 18, 2011 at 3:02 PM, Gergely Nagy <algernon(a)balabit.hu> wrote: > Hendrik Visage <hvjunk(a)gmail.com> writes: > >> Hi Gergely, >> >> Looks like I have a syslog-ng 3.3beta1 (fetched from GITHEAD) that is >> having a serious memory leak (and I'm not yet pushing all our logs to >> it ;( >> >> Any advice in how to help you track this problem? > > Hrm. Well, valgrind would be best, but that slows things down to almost > a grounding halt. (But in case you want to try that: > G_SLICE=always-malloc valgrind --leak-check=full -v --show-reachable-yes > --log-file=valgrind.log syslog-ng -F would be the command to run ;) > > Other than that, a config could be useful, so I can try and reproduce > the problem (or at least identify possible areas where the leak might be > coming from, and go from there), and see if I can fix it. > > -- > |8] > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

3 6

AUTO: David Barry is out of the office through 8/9/2011 (returning 08/09/2011)
by dbarry＠princesscruises.com 30 Jul '11

30 Jul '11

I am out of the office until 08/09/2011. I will respond to your message when I return. For general security issues, you may contact Russell Swift or Christy Belknap. Or, you may contact my manager, Paul Johnson. Note: This is an automated response to your message "syslog-ng Digest, Vol 75, Issue 38" sent on 7/30/2011 3:00:01. This is the only notification you will receive while this person is away.

1 0

AUTO: James B Horwath/TheGuardian is out of the office. (returning 08/06/2011)
by James B Horwath 30 Jul '11

30 Jul '11

I am out of the office until 08/06/2011. I am out of the office until Monday,August 8, 2011 with limited access to e-mail. If there are Nitro issues please contact Dante Rodino at 212-919-2819 or Sunil Gupta at 610-807-6710. Any other issues please contact Christopher Clarke manager of Security Operations Thanks, Jim Note: This is an automated response to your message "syslog-ng Digest, Vol 75, Issue 38" sent on 7/30/11 6:00:01. This is the only notification you will receive while this person is away. ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

1 0

Rapid filling of /var/log/syslog-ng.log with "--MARK--" messages?
by mike＠lague.org 25 Jul '11

25 Jul '11

On a system running syslog-ng 3.0.5, we observed the following: * * * Jul 21 11:53:37.724586 sys89 -- MARK -- Jul 21 11:53:37.724623 sys89 -- MARK -- Jul 21 11:53:37.724660 sys89 -- MARK -- Jul 21 11:53:37.724696 sys89 -- MARK -- Jul 21 11:53:37.724733 sys89 -- MARK -- Jul 21 11:53:37.724770 sys89 -- MARK -- Jul 21 11:53:37.724807 sys89 -- MARK -- Jul 21 11:53:37.724843 sys89 -- MARK -- Jul 21 11:53:37.724880 sys89 -- MARK ? The log was written to at this frequency, with these "MARK" messages, until the partition filled up. It appears that the first of these messages was logged very close in time to when the system date was set back by a couple of minutes. However, I was unable to reproduce this result on a different system (by setting the date back in time.) However, is it possible that this problem is the same as: SYSLOG-NG] [BUG 110] NEW: ADVANCING THE SYSTEM DATE AND TIME BEYOND 2038 CAUSES FLOOD OF MESSAGES (i.e., https://lists.balabit.hu/pipermail/syslog-ng/2011-January/015754.html) It appears that this is fixed in 3.2.3; it is fixed in other versions? In versions where this is not fixed, is it possible to avoid this problem by turning off the "mark" feature, i.e., by putting mark_freq(0); in the options clause of the configuration? Thank you, --Mike Lague

1 0

Re: [syslog-ng] log file size limit
by Hendrik Visage 25 Jul '11

25 Jul '11

Better to make use of monthly, weekly, daily, hourly type logs in syslog-ng, and the to use cront to clean up as needed ;) On Mon, Jul 25, 2011 at 5:50 PM, William Tambellini <William.Tambellini(a)galaxysemi.com> wrote: > Dear Syslog-ng team, > > We are currently evaluating syslog-ng in order to satisfy some requests > from our customers regarding logs from our software. > > One of their requests is to limit log file size using some kind of rotation > algo : if size > 6Mo then rotate to another file. > > We have found some options in file destination like fifo buffer control but > nothing about files rotation. > > Is there anything for that kind of feature ? > > Regards > > WT. > > > > ---------------------- > > William Tambellini > > Lead Technical Organizer > > www.galaxysemi.com > > > > “Sometimes I think the surest sign that intelligent life exists elsewhere in > the universe is that none of it has tried to contact us.” > > Bill Waterson (Calvin & Hobbes) > > > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > >

1 0

Re: [syslog-ng] log file size limit
by Patrick H. 25 Jul '11

25 Jul '11

Syslog-ng doesnt perform file rotation. This would the the job of something like 'logrotate <https://fedorahosted.org/logrotate/>'. Sent: Mon Jul 25 2011 09:50:42 GMT-0600 (MST) From: William Tambellini <William.Tambellini(a)galaxysemi.com> To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] log file size limit > > Dear Syslog-ng team, > > We are currently evaluating syslog-ng in order to satisfy some > requests from our customers regarding logs from our software. > > One of their requests is to limit log file size using some kind of > rotation algo : if size > 6Mo then rotate to another file. > > We have found some options in file destination like fifo buffer > control but nothing about files rotation. > > Is there anything for that kind of feature ? > > Regards > > WT. > > ---------------------- > > William Tambellini > > Lead Technical Organizer > > www.galaxysemi.com > > "Sometimes I think the surest sign that intelligent life exists > elsewhere in the universe is that none of it has tried to contact us." > > Bill Waterson (Calvin & Hobbes) > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

1 0

log file size limit
by William Tambellini 25 Jul '11

25 Jul '11

Dear Syslog-ng team, We are currently evaluating syslog-ng in order to satisfy some requests from our customers regarding logs from our software. One of their requests is to limit log file size using some kind of rotation algo : if size > 6Mo then rotate to another file. We have found some options in file destination like fifo buffer control but nothing about files rotation. Is there anything for that kind of feature ? Regards WT. ---------------------- William Tambellini Lead Technical Organizer www.galaxysemi.com "Sometimes I think the surest sign that intelligent life exists elsewhere in the universe is that none of it has tried to contact us." Bill Waterson (Calvin & Hobbes)

1 0

can syslog-ng extract part of the hostname and make directory on the fly?
by fedora fedora 22 Jul '11

22 Jul '11

I have few hundreds of hosts, and say hosta has dns name groupa-hosta hostb has dns name groupbhostb hostc has dns name groupc.hostc ..etc..etc (note the first 6 characters defines the group) When a log comes in, can syslog-ng extracts the first 6 character from dns name, and drop the log file to the corresponding group? (So log from hostb will go under /log/groupb/groupahostb ) I cannot predefine the groups though, since i don't know how many groups will be there, the only thing i know is the first 6 character of the hostname will be the group name thanks

3 2