- syslog-ng - lists.balabit.hu

Some issues with syntax checking
by Guillaume Rousse 22 Nov '09

22 Nov '09

Hello list. Unresolved object errors seems not to be catched by 'syslog-ng --syntax-only', whereas they are fatal errors. For instance, with this configuration file: @version:3.0 log { source(s_foo); destination(d_foo); }; [root@oberkampf guillaume]# syslog-ng --syntax-only [root@oberkampf guillaume]# syslog-ng Error in configuration, unresolved source reference; source='s_foo' Moreover, the error message is sometimes a bit misleading. with this configuration file: @version:3.0 source s_foo { unix-stream ("/dev/log" max-connections(100)); }; log { source(s_foo); destination(d_foo); }; [root@oberkampf guillaume]# syslog-ng --syntax-only [root@oberkampf guillaume]# syslog-ng Error in configuration, unresolved destination reference; filter='d_foo' What is missing is a destination, not a filter. -- BOFH excuse #327: The POP server is out of Coke

2 1

log action or discard ?
by Jan Schaumann 18 Nov '09

18 Nov '09

Hello, I have a syslog server that receives syslog messages and will forward a selection of them to a central host via TLS. It will log all other messages to a local file. The current configuration looks something like this: destination forward { syslog(<options here>); }; destination all { file("/var/log/all"); }; filter forward { match("mumble"); }; log { all-my-sources filter(forward); destination(forward); flags(final); }; log { all-my-sources destination(all); }; Now if my remote server to which I'm forwarding messages to goes down or stops accepting connections for any reason, _all_ my logging will come to a grinding halt. That is, nothing gets appended to /var/log/all. What I want is for my forwarding to be a "try this or discard" kind of scenario. That is, if I can't forward the messages, just drop them, but continue to log all other messages unphased. Is that possible? If so, how? Thanks in advance, -Jan

1 0

Re: [syslog-ng] syslog-ng on solaris locks up after a while
by Balazs Scheidler 18 Nov '09

18 Nov '09

Thanks. It indeeed seems to be the same as Author: Balazs Scheidler <bazsi(a)balabit.hu> 2009-08-30 11:41:24 Committer: Balazs Scheidler <bazsi(a)balabit.hu> 2009-08-30 11:41:24 Parent: 1ad4da07d5305ba0140ac385d661ab6de25fc5f3 ([patterndb] estring parser length calculation must include ending quote) Child: c2e8aa58763a89cab58d05fb7a2b2a18021413b4 ([logmsg] added support for ASA timestamps) Branches: master, remotes/balabit/master, remotes/origin/master Follows: v3.0.4 Precedes: [afinter] don't block on the internal_msg_queue even in the threaded case (fixes: pub#48) A hang was reported in bugzilla ticket #48 which seems to have been caused by MARK messages interfering with local messages: * if the MARK is due in the same poll iteration as a local message * the MARK timeout is checked and the internal source is marked as having input available * then the local message comes in pushing the mark timeout further ahead in time * then the internal() dispatch callback checks the mark timeout again, but at this time it is already in the future -> * the dispatch callback falls back to fetching the internal message from internal_msg_queue, assuming it was that which caused the dispatch callback to be scheduled * this blocks indefinitely. The solution is very simple: use g_async_queue_try_pop() instead of g_async_queue_pop(), the dispatch code already takes care about a NULL message value. Thanks for the helpful reporters to hunt down the issue. Reported-By: Arkadiusz Miśkiewicz, Elan Ruusamäe A recent snapshot (and the git tree) should contain the fix. On Thu, 2009-11-12 at 11:10 -0500, Manassypov, Igor wrote: > Here is the information: > > (gdb) info thread > 2 process 153634 0xfed4b000 in _door_return () from /lib/libc.so.1 > * 1 process 88098 0xfed46df0 in __lwp_park () from /lib/libc.so.1 > (gdb) thread 1 > [Switching to thread 1 (process 88098 )]#0 0xfed46df0 in __lwp_park () from /lib/libc.so.1 > (gdb) bt > #0 0xfed46df0 in __lwp_park () from /lib/libc.so.1 > #1 0xfed40c44 in cond_sleep_queue () from /lib/libc.so.1 > #2 0xfed40e08 in cond_wait_queue () from /lib/libc.so.1 > #3 0xfed41350 in cond_wait () from /lib/libc.so.1 > #4 0xfed4138c in pthread_cond_wait () from /lib/libc.so.1 > #5 0xff119d80 in g_async_queue_pop_intern_unlocked (queue=0x757e0, try=0, end_time=0x75618) at gasyncqueue.c:359 > #6 0xff119e80 in g_async_queue_pop (queue=0x757e0) at gasyncqueue.c:398 > #7 0x0003e984 in afinter_source_dispatch (source=0x8d260, callback=0x3e9dc <afinter_source_dispatch_msg>, user_data=0x8d1e0) > at afinter.c:112 > #8 0xff143564 in g_main_context_dispatch (context=0x8d158) at gmain.c:2144 > #9 0xff1459a4 in g_main_context_iterate (context=0x8d158, block=1, dispatch=1, self=0x76030) at gmain.c:2778 > #10 0xff146050 in g_main_context_iteration (context=0x8d158, may_block=1) at gmain.c:2841 > #11 0x0001bc20 in main_loop_run (cfg=0xffbffbc8) at main.c:149 > #12 0x0001c260 in main (argc=1, argv=0xffbffd44) at main.c:394 > (gdb) thread 2 > [Switching to thread 2 (process 153634 )]#0 0xfed4b000 in _door_return () from /lib/libc.so.1 > (gdb) bt > #0 0xfed4b000 in _door_return () from /lib/libc.so.1 > #1 0xff370bdc in door_return () from /lib/libdoor.so.1 > #2 0xff370c38 in door_create_func () from /lib/libdoor.so.1 > #3 0xfed46d54 in _lwp_start () from /lib/libc.so.1 > #4 0xfed46d54 in _lwp_start () from /lib/libc.so.1 > Backtrace stopped: previous frame identical to this frame (corrupt stack?) > (gdb) > > > > > ----------------------------------------------------------------------------------- > Igor R. Manassypov, M.Eng., P.Eng., CCIE 23032, CCVP > Network Architect, CI Investments > 416.795.3147 > > -----Original Message----- > From: Balazs Scheidler [mailto:bazsi@balabit.hu] > Sent: Thursday, November 12, 2009 11:02 AM > To: imanassypov(a)rogers.com > Cc: Syslog-ng users' and developers' mailing list; Pallagi Zoltán; Network > Subject: Re: [syslog-ng] syslog-ng on solaris locks up after a while > > Hi, > > not really, are there multiple threads in the same core file? > > e.g. what is the response for "info threads"? > > It would be nice to have the backtrace for all threads, like this: > > (gdb) thread 1 > (gdb) bt > (gdb) thread 2 > (gdb) bt > > and so on, for each threadid that "info thread" lists. > > > On Fri, 2009-11-06 at 11:41 -0800, Igor Manassypov wrote: > > Would this one make more sense? > > > > > > > > bash-3.00# ps -eaf | grep syslog > > root 22562 22561 0 Nov 04 ? > > 0:30 /usr/local/sbin/syslog-ng > > root 22561 1 0 Nov 04 ? > > 0:00 /usr/local/sbin/syslog-ng > > > > bash-3.00# truss -f -p 22562 > > 22562/2: door_return(0x00000000, 0, 0x00000000, 0) > > (sleeping...) > > 22562/1: lwp_park(0x00000000, 0) (sleeping....) > > 22562/1: Received signal #11, SIGSEGV, in lwp_park() > > [default] > > 22562/1: siginfo: SIGSEGV pid=12717 uid=0 > > 22562/1: lwp_park(0x00000000, 0) Err#4 > > EINTR > > > > Core was generated by `/usr/local/sbin/syslog-ng'. > > Program terminated with signal 11, Segmentation fault. > > [New process 88098 ] > > [New process 153634 ] > > #0 0xfed46df0 in __lwp_park () from /lib/libc.so.1 #0 0xfed46df0 in > > __lwp_park () from /lib/libc.so.1 > > > > bash-3.00# gdb syslog-ng core > > > > Core was generated by `/usr/local/sbin/syslog-ng'. > > Program terminated with signal 11, Segmentation fault. > > [New process 88098 ] > > [New process 153634 ] > > #0 0xfed46df0 in __lwp_park () from /lib/libc.so.1 > > (gdb) > > > > --- On Tue, 11/3/09, Balazs Scheidler <bazsi(a)balabit.hu> wrote: > > > > From: Balazs Scheidler <bazsi@balabit..hu> > > Subject: Re: [syslog-ng] syslog-ng on solaris locks up after a > > while > > To: imanassypov(a)rogers.com, "Syslog-ng users' and developers' > > mailing list" <syslog-ng(a)lists.balabit.hu> > > Cc: "Pallagi Zoltán" <pzolee(a)balabit.hu>, network(a)ci.com > > Date: Tuesday, November 3, 2009, 2:11 PM > > > > Hi, > > > > The problem is that you killed the supervisor process, which > > restarts > > syslog-ng in case it crashes.. However the hang is not in this > > part, but > > in its child. > > > > So by looking at the ps output, I'd say that in this situation > > you > > should have trussed 13621 and not its parent. > > > > On Tue, 2009-11-03 at 08:54 -0800, Igor Manassypov wrote: > > > Hi Zoltan, > > > > > > > > > Here are the traces: > > > > > > bash-3.00# ps -eaf | grep syslog > > > root 12694 12616 0 11:37:07 pts/1 0:00 grep > > syslog > > > root 13012 1 0 Oct 21 ? 0:00 syslog-ng > > -v > > > root 13013 13012 0 Oct 21 ? 0:41 syslog-ng > > -v > > > root 13620 1 0 Oct 08 ? > > > 0:00 /usr/local/sbin/syslog-ng > > > root 13621 13620 0 Oct 08 ? > > > 6:16 /usr/local/sbin/syslog-ng > > > bash-3.00# truss -f -p "13620" > > > 13620: waitid(P_PID, 13621, 0xFFBFF468, WEXITED|WTRAPPED) > > > (sleeping...) > > > > > > 13620: Received signal #11, SIGSEGV, in waitid() > > [default] > > > 13620: siginfo: SIGSEGV pid=12717 uid=0 > > > 13620: waitid(P_PID, 13621, 0xFFBFF468, WEXITED|WTRAPPED) > > Err#4 EINTR > > > > > > Core was generated by `/usr/local/sbin/syslog-ng'. > > > Program terminated with signal 11, Segmentation fault. > > > [New process 79156 ] > > > #0 0xfed4ad80 in _waitid () from /lib/libc.so.1 > > > (gdb) bt full > > > #0 0xfed4ad80 in _waitid () from /lib/libc.so.1 > > > No symbol table info available. > > > #1 0xfecee038 in _waitpid () from /lib/libc.so.1 > > > No symbol table info available. > > > #2 0xfed3a70c in waitpid () from /lib/libc.so.1 > > > No symbol table info available. > > > #3 0x0003017c in g_process_start () at gprocess.c:1042 > > > rc = 0 > > > deadlock = 0 > > > pid = 13621 > > > __PRETTY_FUNCTION__ = "g_process_start" > > > #4 0x0001c214 in main (argc=1, argv=0xffbffd14) at > > main.c:371 > > > cfg = (GlobalConfig *) 0x10034 > > > rc = 310272 > > > ctx = (GOptionContext *) 0x76030 > > > error = (GError *) 0x0 > > > > > > Please let me know if I can provide you with more > > information, > > > > > > Thanks! > > > > > > --- On Tue, 11/3/09, Pallagi Zoltán <pzolee(a)balabit.hu> > > wrote: > > > > > > From: Pallagi Zoltán <pzolee(a)balabit.hu> > > > Subject: Re: [syslog-ng] syslog-ng on solaris locks > > up after a > > > while > > > To: imanassypov(a)rogers.com, "Syslog-ng users' and > > developers' > > > mailing list" <syslog-ng(a)lists.balabit.hu> > > > Received: Tuesday, November 3, 2009, 11:10 AM > > > > > > Hi Igor, > > > > > > Can you show me truss output or backtrace of the > > stuck > > > syslog-ng?: > > > truss: > > > > > > truss -f -p "syslog-ng pid" > > > > > > backtrace: > > > > > > kill -11 "syslog-ng pid" (syslog-ng will drop a core > > file) > > > gdb syslog-ng core > > > bt full > > > > > > Igor Manassypov írta: > > > > Hello, > > > > > > > > > > > > I am having an issue with a solaris installation > > of the > > > > syslog-ng. It is configured such that all the logs > > are > > > > stored different per-ip folders. This is my > > centralized > > > > logging device, so it is fairly heavily loaded > > with > > > > receiving logs from a few dozen hosts. The > > syslog-ng process > > > > locks up every two to three weeks, with no > > messages logging > > > > to any of the files. The only way of getting it > > back is kill > > > > -9 the process and restart it. > > > > > > > > Is there any known issue of same sorts and is > > there any > > > > other way around it other than recycling the > > daemon every > > > > night? > > > > > > > > > > > > here is the version info: > > > > > > > > bash-3.00# syslog-ng --version > > > > syslog-ng 3.0.4 > > > > Revision: ssh > > > > > > +git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#1b5d618e301ad94aa20e692ffba16469dece8d10 > > > > Compile-Date: Aug 11 2009 10:44:17 > > > > Enable-Threads: on > > > > Enable-Debug: off > > > > Enable-GProf: off > > > > Enable-Memtrace: off > > > > Enable-Sun-STREAMS: on > > > > Enable-Sun-Door: on > > > > Enable-IPv6: off > > > > Enable-Spoof-Source: on > > > > Enable-TCP-Wrapper: off > > > > Enable-SSL: on > > > > Enable-SQL: on > > > > Enable-Linux-Caps: off > > > > Enable-Pcre: on > > > > > > > > bash-3.00# uname -a > > > > SunOS prelude 5.10 Generic_137137-09 sun4v sparc > > SUNW,T5240 > > > > Thanks! > > > > > > > > -igor > > > > > > > > Igor Manassypov., M.Eng, P.Eng, CCIE 23032, CCVP > > Network > > > > Architect > > > > > > > > > > ____________________________________________________________ > > > > > > > > > > ______________________________________________________________________________ > > > > Member info: > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > > > > > > > > > > > > > > > > ______________________________________________________________________________ > > > Member info: > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > > -- > > Bazsi > > > > > > > -- > Bazsi > > ################################################################################### > This communication is confidential and may be > privileged. If you received it in error, please destroy > without copying and advise the sender. > > By submitting personal information to CI Investments, > you agree to the collection, use and disclosure of > such personal information for the purposes described > in our Privacy Policy available at www.ci.com. > > > Cette communication est confidentielle et pourrait être > privilégiée. Si vous la recevez par erreur, veuillez > l'éliminer sans en faire une copie et aviser l'expéditeur. > > Lorsque vous soumettez des renseignements > personnels à Placements CI, vous nous permettez de > conserver, utiliser et divulguer ces renseignements > personnels aux fins décrites dans nos Principes > directeurs en matière de protection des renseignements personnels > qui sont disponibles au www.ci.com. > > ################################################################ > -- Bazsi

1 0

udp6 source declaration causes syslog+tls to fail
by Jan Schaumann 17 Nov '09

17 Nov '09

Hello, I'm seeing what appears to be an odd interaction between the declaration of an udp6 source and trying to forward messages via tls to another host. I have the following configuration: # UDP will use the regular port 514 as per /etc/services. source s_udp { udp(log_fetch_limit(400000000)); # UDP6 definition requires an explicit port statement. # See upstream bug # https://bugzilla.balabit.com/show_bug.cgi?id=58 # udp6( # port(514) # log_fetch_limit(400000000) # ); }; destination d_amslog { syslog("<hostname>" port(6514) suppress(30) transport("tls") tls( ca_dir("<dir>") cert_file("<cert>") key_file("<key>") trusted_keys("<fp>") ) ); }; log { source(s_udp); destination(d_amslog); flags(final); }; Now this works just fine with the "udp6" part commented out as above. However, if I uncomment the udp6 part, I get the following error: ERROR:gsockaddr.h:86:g_sockaddr_inet_get_sa: assertion failed: (g_sockaddr_inet_check(s)) failed! Note that if I remove the destination from the log directive (ie comment out the line "destination(d_amslog);", I still get the same error. If I comment out the entire syslog directive and replace it with a file destination, there is no problem (even though the udp6 source definition is there). It seems as if -- and I'm guessing here -- the udp6 declaration causes syslog-ng to try to treat the subsequent "syslog" directive to be an IPv6 type connection, which fails since the host does not (currently) have IPv6 configured. Ie, I believe syslog-ng assumes that just by the existence of an IPv6 source all connections will be IPv6 (which, if correct, seems like a bug to me). The version of syslog-ng here is: syslog-ng 3.0.3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#08c9bf9d98e4e021756adc12c42605840140ba8b Compile-Date: Sep 12 2009 02:43:20 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on Any suggestion on how to fix this would be appreciated. Thanks in advance, -Jan

1 1

Dear syslog-ng@lists.balabit.hu SALE 80% OFF on Pfizer
by Pfizer Inc 17 Nov '09

17 Nov '09

1 0

Logging only certain logs to a remote syslog server
by Paras Fadte 16 Nov '09

16 Nov '09

Hi, Is it possible to log only a particular logs to a remote syslog server ? For example logging only mysql/postgres logs to a remote host . syslog-ng version used is syslog-ng 1.6.8 Thank you. -Paras

4 6

Re: [syslog-ng] syslog-ng Digest, Vol 55, Issue 18
by Adam Chou 13 Nov '09

13 Nov '09

> > > On Friday 13 of November 2009, Adam Chou wrote: > > > > Just in case you're wondering why I'm trying to build from source, the > > current packages are built for amd64 and I'm running x86_64 on an > > Intel. > > https://lists.balabit.hu/pipermail/syslog-ng/2009-November/013551.html > > HTH > > thanks, that was informative. That link seems to be only the client version, however. Is there a server binary that is also compiled to work with yum's x86_64?

2 1

Can't build syslog-ng RPM
by Adam Chou 13 Nov '09

13 Nov '09

I'm trying to build the syslog-ng RPM and I'm having an issue with the libnet-devel package. I've tried searching for it and I can't find a devel package from Fedora, CentOS, or RHEL. I found the libnet-devel page but the project appears to have forked now so I'm no longer sure if its still good to use. Just in case you're wondering why I'm trying to build from source, the current packages are built for amd64 and I'm running x86_64 on an Intel. Any help with how I can get libnet-devel installed would be much appreciated. Thanks.

3 2

stats_freq ignored in config version 3.0?
by Peter Volkov 12 Nov '09

12 Nov '09

Hi, I've just upgraded syslog-ng up to 3.0.4 and configuration files up to version 3.0. Now I have the following config: ======================================================== @version:3.0 options { stats_freq(4320); }; source src { unix-stream("/dev/log" max-connections(256)); internal(); }; destination messages { file("/var/log/messages"); }; log { source(src); destination(messages); }; ======================================================== The problem I experience is that -- MARK -- is printed every 20 minutes no matter what I put into /etc/syslog-ng/syslog-ng.conf stats_freq option argument: Nov 12 17:56:32 stage4 syslog-ng[25815]: syslog-ng starting up; version='3.0.4' Nov 12 18:16:32 stage4 -- MARK -- Nov 12 18:36:32 stage4 -- MARK -- Does anybody else experience this? What could cause this? I've managed to reproduce this problem on two linux systems with kernel 2.6.27 and 2.6.31. How to debug this kind of problem? Thanks in advance for any hint. -- Peter.

2 2

Re: [syslog-ng] flags(final)
by Michael J. Bauer 12 Nov '09

12 Nov '09

flags(final) is now working with my rewritten match() statements. I wonder if it was a combination of the older version I was initially running and the odd structure of the log entry I was trying to use, but I really am disinclined to try to chase it down. However, in rewriting things, I did discover something else. In cutting and pasting, I had accidentally done this in my config: destination d_dhcpd { file("/var/log/dhcpd" flush_lines(10) flush_timeout(1000)); }; destination d_dhcpd { file("/var/log/named" flush_lines(10) flush_timeout(1000)); }; filter f_dhcpd { match("dhcpd" value(PROGRAM)); }; filter f_named { match("named" value(PROGRAM)); }; log { source(s_sys); filter(f_dhcpd); destination(d_dhcpd); flags(final); }; log { source(s_sys); filter(f_named); destination(d_named); flags(final); }; log { source(s_sys); destination(d_default); flags(fallback); }; Note the log statement containing the non-existent destination(d_named). When I ran "/etc/init.d/syslog-ng reload", it didn't crash, nor did it throw any error where I could see it. What it did do was start logging multiple copies of each line going to destination(d_default), apparently one more line each time I did a reload. I didn't notice what was going on until it was at 8 copies of each line, and it took me until 17 copies of each line to finally give up and run "/etc/init.d/syslog-ng stop; /etc/init.d/syslog-ng start". Once I did that, I got an error and corrected the problem. This is probably an obscure bug, but it may be worth looking at. It was certainly entertaining after the fact. MJB Michael J. Bauer wrote: > I think I am misunderstanding what flags(final) is supposed to do. I'm > running syslog-ng 2.1.4 on RHEL 5.4 (Tikanga). > > I have a fairly simple syslog-ng configuration, which I've attached > below. I'm trying to pick off individual groups of log entries and put > them in their own individual files. I want to ensure that each gets > logged exactly once, so I'm using flags(final). I also have a catch-all > at the end in case I've missed something, but the ultimate goal is to > have that file present, but empty. > > However, with this configuration, the log entries that appear in > d_network_address_translation (/var/log/network-address-translation) > also appear in d_default (/var/log/default) despite the presence of > flags(final) on an earlier log() line. Should it work this way? If so, > what can I do to get the desired behavior? > > Thanks, > MJB > > options { > sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (off); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > }; > > source s_sys { > file ("/proc/kmsg" log_prefix("kernel: ")); > unix-stream ("/dev/log"); > internal(); > udp(ip(0.0.0.0) port(514)); > }; > > destination d_network_address_translation { > file("/var/log/network-address-translation"); }; > destination d_default { file("/var/log/default"); }; > > filter f_network_address_translation { host("router-service-interface") and > priority(info) and > facility(local2) and > match("FWNAT"); }; > > log { source(s_sys); > filter(f_network_address_translation); > destination(d_network_address_translation); > flags(final); }; > log { source(s_sys); > destination(d_default); }; > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > >

2 2