- syslog-ng - lists.balabit.hu

Syslog-ng 3.0.2 statistics
by Aaron Robel 19 Jun '09

19 Jun '09

Hello, My apologies in advance, this is my first posting and I'm quite the rook' when it comes to Linux and Syslog-ng. I keep wondering why this is my project. I have a 4 server syslog deployment with 3 front end "relay" boxes and 1 backend archive box all within a virtualized SLES environment. Recently I noticed that the relay's together are averaging about 2500 messages per second (mps). The majority of the messages are coming from a single relay, about 2000 mps. Yet the archive box is only averaging about 400 mps. Since we are running 3.0.2 I decided to turn up the stats_level to (1). I don't see any drops to the about 150 file destinations that I've built. What does stamp, processed, stored, etc.. mean? I couldn't find any detailed documentation about the different statistics. Why am I getting such a large discrepency between "stamp" and "processed" in the log stats? Finally, since I'm sending the email does anyone see an issue with the way I've got the flow control set up in the global options? Here are my stats in question off my archive box: processed='src.udp(s_network#0)=22020892', stamp='src.udp(s_network#0)=1245249328' Here's the global's off the archive box: options { time_sleep(10); log_fetch_limit(250); log_fifo_size(2000); use_dns(no); keep_timestamp(yes); dns_cache(no); long_hostnames(off); flush_lines(2000); flush_timeout(200); perm(0644); stats_freq(1800); stats_level(1); time_reopen(10); create_dirs(yes); dir_perm(755); }; Thanks!

4 9

rate-limit
by Julien lecubin 19 Jun '09

19 Jun '09

hi list, what's the best way with syslog-ng to control the number of syslog mail notifications coming from a machine ? I'm currently using perl script to send notification but sometime it just floods my mail (some 600 mails in 5 minutes for a single event) I want to rate limit it to only 1 mail in 5 minute per host or message. /etc/syslog-ng/syslog-ng.conf : ----------------------------- [...] destination d_mail { program("perl /usr/local/bin/mail_log_mailsend.pl $MSG "); }; [...] filter f_notify_by_mail {level(emerg,alert,crit); }; [...] log { source(s_network); filter(f_notify_by_mail); destination(d_mail); }; mail_log_sendmail.pl -------------------- use MIME::Lite; while (<>) { # $_ contains the Log my $body = "Mail from Syslog-ng $_ "; my $msg = MIME::Lite->new ( From =>'syslog-ng(a)my_domain.fr', To =>'service.informatique(a)my_domain.fr', Subject =>'[SYSLOG-NG] Avertissement', Type =>'multipart/related'); $msg -> attach (Type => 'text/html', Data => qq {$body}); MIME::Lite->send('smtp','imap', Timeout=>60); $msg -> send or die "Impossible to send mail!"; } Is there's a notification_interval control (as i use in nagios) i can add in my syslog config file ? I didn't found anything in the man page (maybe i'm reading like a frog) Anyone have any clues / examples to show ? tks, julien Lecubin -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Julien LECUBIN Institut de Mecanique Celeste et de Calcul des Ephemerides CNRS UMR 8028 - Observatoire de Paris 77, avenue Denfert Rochereau 75014 PARIS tel : 01.40.51.22.80 fax : 01.46.33.28.34 julien.lecubin(a)imcce.fr | service.informatique(a)imcce.fr - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2 2

Handle multiple encoding from multiple sources
by David Perret 19 Jun '09

19 Jun '09

Hello, I'm trying to understand how syslog-ng handle charset encoding. I've seen that : - without the "encoding("charset")" keyword in the source it just writes to the output what it gets from the input. - with the "encoding("charset")" keyword in the source it converts what it gets from the output from "charset" to UTF-8. What is the best way to handle logs from different charset? Do I really have to create a different source per charset used ? Is there any way to say that I always want the input's charset to be converted to UTF-8 before writing my logs ? Thanks David

2 1

syslog-ng 3.0 seem to chop some of the long lines off
by Joe Hansen 19 Jun '09

19 Jun '09

We're seeing lines in /var/log/messages that are chopped off. They should look like this: v\:* { BEHAVIOR: url(#default#VML) } o\:* { BEHAVIOR: url(#default#VML) } w\:* { BEHAVIOR: url(#default#VML) } .shape { BEHAVIOR: url(#default#VML) } st1\:* { BEHAVIOR: url(#default#ieooui) } @font-face { font-family: MS Mincho; } @font-face { font-family: Tahoma; } @font-face { font-family: Calibri; } @font-face { font-family: Verdana; } @font-face { font-family: Consolas; } @font-face { font-family: MS Sans Serif; } @font-face { font-family: @MS Mincho; } @page Section1 {size: 595.3pt 841.9pt; margin: 72.0pt 90.0pt 72.0pt 90.0pt; } A:link { mso-style-priority: 99 } SPAN.MSOHYPERLINK { mso-style-priority: 99 } A:visited { mso-style-priority: 99 } SPAN.MSOHYPERLINKFOLLOWED { mso-style-priority: 99 } P.MSOPLAINTEXT { mso-style-priority: 99 } LI.MSOPLAINTEXT { mso-style-priority: 99 } DIV.MSOPLAINTEXT { mso-style-priority: 99 } P { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR0 { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR00 { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR000 { mso-style-priority: 99 } SPAN.PLAINTEXTCHAR0000 { mso-style-priority: 99 } P.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman" } LI.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman" } DIV.MsoNormal { FONT-SIZE: 12pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman" } A:link { COLOR: blue; TEXT-DECORATION: underline } SPAN.MsoHyperlink { COLOR: blue; TEXT-DECORATION: underline } A:visited { COLOR: purple; TEXT-DECORATION: underline } SPAN.MsoHyperlinkFollowed { COLOR: purple; TEXT-DECORATION: underline } P.MsoPlainText { FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: Consolas } LI.MsoPlainText { FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: Consolas } DIV.MsoPlainText { FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: Consolas } P { FONT-SIZE: 12pt; MARGIN-LEFT: 0cm; MARGIN-RIGHT: 0cm; FONT-FAMILY: "Times New Roman"; mso-margin-top-alt: auto; mso-margin-bottom-alt: auto } SPAN.plaintextchar { FONT-FAMILY: Consolas } SPAN.plaintextchar0 { FONT-FAMILY: Consolas } SPAN.plaintextchar00 { FONT-FAMILY: Consolas } SPAN.plaintextchar000 { FONT-FAMILY: Consolas } SPAN.plaintextchar0000 { FONT-FAMILY: Consolas } SPAN.EmailStyle24 { COLOR: windowtext; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle25 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle26 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: Tahoma; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle27 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle28 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle29 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle30 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle31 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle32 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle33 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle34 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle35 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle36 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle37 { COLOR: #1f497d; FONT-FAMILY: Calibri; mso-style-type: personal } SPAN.EmailStyle38 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle39 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle40 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: Tahoma; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle41 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle42 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: Tahoma; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle43 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle44 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle45 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle46 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle47 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle48 { FONT-WEIGHT: normal; COLOR: black; FONT-STYLE: normal; FONT-FAMILY: "Courier New"; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle49 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle50 { COLOR: #1f497d; FONT-FAMILY: Calibri; mso-style-type: personal } SPAN.EmailStyle51 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle52 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle53 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle54 { FONT-WEIGHT: normal; COLOR: #262626; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal } SPAN.EmailStyle55 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle56 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle57 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle58 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle59 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle60 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle61 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle62 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle63 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle64 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle65 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle66 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle67 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal } SPAN.EmailStyle68 { COLOR: navy; FONT-FAMILY: Arial; mso-style-type: personal-reply } DIV.Section1 { page: Section1 } OL { MARGIN-BOTTOM: 0cm } UL { MARGIN-BOTTOM: 0cm } Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info(a)callcentres.net"" <info(a)callcentres.net> ,to=To: ""Graeme Ross"" <gross(a)mobileemail.vodafone.com.au>,subject=Turn-key call centre for lease. Launceston, Tasmania","worker/CPSendWork.cpp:858" But they look like this: Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info(a)callcentres.net"" <info(a)callcentres.net> Anyone seen this? Thanks __________________________________________________________________ Yahoo! Canada Toolbar: Search from anywhere on the web, and bookmark your favourite sites. Download it now http://ca.toolbar.yahoo.com.

2 1

Re: [syslog-ng] syslog-ng 3.0 seem to chop some of the long lines off
by Joe Hansen 18 Jun '09

18 Jun '09

More info on this issue: We found that if the source message has "\n\r" this behavior happens. Does anyone know if this is by design or listed in the RFC anywhere? Thanks, Joe --- On Wed, 6/17/09, Joe Hansen <yrmf250(a)yahoo.com> wrote: From: Joe Hansen <yrmf250(a)yahoo.com> Subject: [syslog-ng] syslog-ng 3.0 seem to chop some of the long lines off To: syslog-ng(a)lists.balabit.hu Received: Wednesday, June 17, 2009, 7:10 PM We're seeing lines in /var/log/messages that are chopped off. They should look like this: #yiv1493839580 v\:* { } #yiv1493839580 o\:* { } #yiv1493839580 w\:* { } #yiv1493839580 .shape { } #yiv1493839580 st1\:* { } _filtered #yiv1493839580 { font-family:MS Mincho;} _filtered #yiv1493839580 { font-family:Tahoma;} _filtered #yiv1493839580 { font-family:Calibri;} _filtered #yiv1493839580 { font-family:Verdana;} _filtered #yiv1493839580 { font-family:Consolas;} _filtered #yiv1493839580 { font-family:MS Sans Serif;} _filtered #yiv1493839580 { font-family:Mincho;} _filtered #yiv1493839580 {margin:72.0pt 90.0pt 72.0pt 90.0pt;} #yiv1493839580 A:link { } #yiv1493839580 SPAN.MSOHYPERLINK { } #yiv1493839580 A:visited { } #yiv1493839580 SPAN.MSOHYPERLINKFOLLOWED { } #yiv1493839580 P.MSOPLAINTEXT { } #yiv1493839580 LI.MSOPLAINTEXT { } #yiv1493839580 DIV.MSOPLAINTEXT { } #yiv1493839580 P { } #yiv1493839580 SPAN.PLAINTEXTCHAR { } #yiv1493839580 SPAN.PLAINTEXTCHAR0 { } #yiv1493839580 SPAN.PLAINTEXTCHAR00 { } #yiv1493839580 SPAN.PLAINTEXTCHAR000 { } #yiv1493839580 SPAN.PLAINTEXTCHAR0000 { } #yiv1493839580 P.MsoNormal { FONT-SIZE:12pt;MARGIN:0cm 0cm 0pt;FONT-FAMILY:"Times New Roman";} #yiv1493839580 LI.MsoNormal { FONT-SIZE:12pt;MARGIN:0cm 0cm 0pt;FONT-FAMILY:"Times New Roman";} #yiv1493839580 DIV.MsoNormal { FONT-SIZE:12pt;MARGIN:0cm 0cm 0pt;FONT-FAMILY:"Times New Roman";} #yiv1493839580 A:link { COLOR:blue;TEXT-DECORATION:underline;} #yiv1493839580 SPAN.MsoHyperlink { COLOR:blue;TEXT-DECORATION:underline;} #yiv1493839580 A:visited { COLOR:purple;TEXT-DECORATION:underline;} #yiv1493839580 SPAN.MsoHyperlinkFollowed { COLOR:purple;TEXT-DECORATION:underline;} #yiv1493839580 P.MsoPlainText { FONT-SIZE:10.5pt;MARGIN:0cm 0cm 0pt;FONT-FAMILY:Consolas;} #yiv1493839580 LI.MsoPlainText { FONT-SIZE:10.5pt;MARGIN:0cm 0cm 0pt;FONT-FAMILY:Consolas;} #yiv1493839580 DIV.MsoPlainText { FONT-SIZE:10.5pt;MARGIN:0cm 0cm 0pt;FONT-FAMILY:Consolas;} #yiv1493839580 P { FONT-SIZE:12pt;MARGIN-LEFT:0cm;MARGIN-RIGHT:0cm;FONT-FAMILY:"Times New Roman";} #yiv1493839580 SPAN.plaintextchar { FONT-FAMILY:Consolas;} #yiv1493839580 SPAN.plaintextchar0 { FONT-FAMILY:Consolas;} #yiv1493839580 SPAN.plaintextchar00 { FONT-FAMILY:Consolas;} #yiv1493839580 SPAN.plaintextchar000 { FONT-FAMILY:Consolas;} #yiv1493839580 SPAN.plaintextchar0000 { FONT-FAMILY:Consolas;} #yiv1493839580 SPAN.EmailStyle24 { COLOR:windowtext;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle25 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle26 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:Tahoma;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle27 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle28 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle29 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle30 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle31 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle32 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle33 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle34 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle35 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle36 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle37 { COLOR:#1f497d;FONT-FAMILY:Calibri;} #yiv1493839580 SPAN.EmailStyle38 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle39 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle40 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:Tahoma;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle41 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle42 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:Tahoma;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle43 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle44 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle45 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle46 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle47 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle48 { FONT-WEIGHT:normal;COLOR:black;FONT-STYLE:normal;FONT-FAMILY:"Courier New";TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle49 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle50 { COLOR:#1f497d;FONT-FAMILY:Calibri;} #yiv1493839580 SPAN.EmailStyle51 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle52 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle53 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle54 { FONT-WEIGHT:normal;COLOR:#262626;FONT-STYLE:normal;FONT-FAMILY:Verdana;TEXT-DECORATION:none;} #yiv1493839580 SPAN.EmailStyle55 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle56 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle57 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle58 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle59 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle60 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle61 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle62 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle63 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle64 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle65 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle66 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle67 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 SPAN.EmailStyle68 { COLOR:navy;FONT-FAMILY:Arial;} #yiv1493839580 DIV.Section1 { } #yiv1493839580 OL { MARGIN-BOTTOM:0cm;} #yiv1493839580 UL { MARGIN-BOTTOM:0cm;} Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info(a)callcentres.net"" <info(a)callcentres.net> ,to=To: ""Graeme Ross"" <gross(a)mobileemail.vodafone.com.au>,subject=Turn-key call centre for lease. Launceston, Tasmania","worker/CPSendWork.cpp:858" But they look like this: Jun 17 00:34:36 bxe1001 WORKER[18808]: DEBUG,email header info,3893336992,1941292826,CPSendWork::ProcessConverterSuccessMessage,"man_id=551797512,srp_id=GBISXAPC00S07,from=From: ""info(a)callcentres.net"" <info(a)callcentres.net> Anyone seen this? Thanks The new Internet Explorer® 8 - Faster, safer, easier. Optimized for Yahoo! Get it Now for Free! -----Inline Attachment Follows----- ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html __________________________________________________________________ The new Internet Explorer® 8 - Faster, safer, easier. Optimized for Yahoo! Get it Now for Free! at http://downloads.yahoo.com/ca/internetexplorer/

1 0

syslog-ng OSE 2.1.4 released
by Balazs Scheidler 16 Jun '09

16 Jun '09

Hi, I've released syslog-ng OSE 2.1.4 with the following changes: 2.1.4 Tue, 17 Mar 2009 13:35:00 +0100 Bugfixes: * Fixed a possible DoS condition triggered by a destination port unreachable ICMP packet received from a UDP destination. syslog-ng started eating all available memory and CPU until it crashed if this happened. * Fixed the rate at which files regular were read using the file() source. * Report connection breaks as a write error instead of reporting POLLERR as the write error path reports more sensible information in the logs. The release is available at: https://www.balabit.com/network-security/syslog-ng/opensource-logging-syste… -- Bazsi

4 5

Stripping the original hostname /ip from the syslog message
by Shashank Vinchurkar 12 Jun '09

12 Jun '09

Hi, We have a setup where multiple syslog-ng servers send logs to a central syslog-ng server. Finally this central syslog-ng server sends the consolidated logs to an outside server. The outside server can be any server accepting standard syslog messages. The first group of servers are running in the internal network and don't have any hostname associated with them. Also the ip address is internal and does not make sense to outside world. My requirement is that the outside server should only see the ip address of the syslog-ng server which consolidates the messages from these syslog-ng servers. But I always see the ip address of the syslog-ng server which originated the message. Is there anyway to get rid of this? I tried playing with the keep_hostname, long_hostname, chain_hostname and bad_hostname options but I still see the ip address of the originating server. Thanks in advance for the help. -Shashank

3 5

Backslash before quote
by Pennington, Philip 11 Jun '09

11 Jun '09

Syslog-ng version 2. Can anyone please explain the purpose of the backslash being added before each quote in syslog output ? Is there any way to disable this feature ? Is this flags(noparse) ? Is there any other way to do it (other than stripping it out on an output process)? Regards Philip =============================================================================== Please access the attached hyperlink for an important electronic communications disclaimer: http://www.credit-suisse.com/legal/en/disclaimer_email_ib.html ===============================================================================

3 4

I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\'
by Clayton Dukes 08 Jun '09

08 Jun '09

Hi Folks, I am the owner of php-syslog-ng... While working on one of my servers, I notice the following error getting repeated (a lot): syslog-ng[23692]: I/O error occurred while writing; fd=\'6\', error=\'Connection refused (111)\' I've done multiple searches but haven't been able to nail down why this error is constantly getting logged into my pipe. I've found google results where Baszi asked the user to try using strace and/or lsof, but I can't gleen anything useful from it (maybe I'm just too dumb :-)) Any help would be greatly appreciated :-) Here's my syslog-ng config: options { long_hostnames(off); # doesn't actually help on Solaris, log(3) truncates at 1024 chars log_msg_size(8192); # buffer just a little for performance sync(1); # memory is cheap, buffer messages unable to write (like to loghost) log_fifo_size(16384); # Hosts we don't want syslog from #bad_hostname("^(ctld.|cmd|tmd|last)$"); bad_hostname("^11.16.254.134$"); # The time to wait before a dead connection is reestablished (seconds) time_reopen(10); #Use DNS so that our good names are used, not hostnames use_dns(yes); dns_cache(yes); #Use the whole DNS name use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); #Read permission for everyone perm(0644); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; destination d_syslogdb { pipe("/var/log/mysql.pipe", template ("'$HOST''$FACILITY''$PRIORITY''$LEVEL''$TAG''$YEAR-$MONTH-$DAY''$HOUR:$MIN:$SEC''$PROGRAM''$MSG'\n") template_escape(yes) ); }; log { source(s_all); destination(d_syslogdb); }; -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

4 12

Syslog-3.0.2 build failure on OS X
by Mark Duling 08 Jun '09

08 Jun '09

Hello, Syslog-ng 2.1.4 compiles fine on OS X, but 3.0.2 does not. Below is the error I get. Any idea what the problem might be? Thanks. Mark syslog-ng Open Source Edition 3.0.2 configured Compiler options: compiler : /usr/bin/gcc-4.0 compiler options : -O2 -Wall -I/opt/local/include -I/opt/local/include/glib-2.0 -I/opt/local/lib/glib-2.0/include -I/opt/local/include -I/opt/local/include/eventlog -I/opt/local/include -DHAVE_SOCKADDR_SA_LEN -DLIBNET_BSDISH_OS -DLIBNET_BSD_BYTE_SWAP -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -L/opt/local/lib prefix : /opt/local linking mode : dynamic Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : yes tcp-wrapper support : yes SSL support : yes SQL support : no Linux capability support : no PCRE support : no Env wrapper support : no ---> Building syslog-ng ........ rm -f libsyslog-ng.a ar cru libsyslog-ng.a misc.o utils.o messages.o syslog-names.o cfg.o filter.o logmsg.o logstamp.o logpipe.o logsource.o driver.o sgroup.o dgroup.o center.o templates.o logreader.o logwriter.o affile.o afstreams.o afuser.o afprog.o afsocket.o afunix.o afinet.o afinter.o children.o stats.o gsockaddr.o gsocket.o logtransport.o logproto.o memtrace.o dnscache.o serialize.o apphook.o radix.o logpatterns.o cfg-lex.o cfg-grammar.o timeutils.o alarms.o logparser.o logprocess.o logmpx.o logrewrite.o logmatcher.o gprocess.o globals.o control.o compat.o logqueue.o afsql.o tlscontext.o tlstransport.o ranlib: file: libsyslog-ng.a(afstreams.o) has no symbols ranlib: file: libsyslog-ng.a(compat.o) has no symbols ranlib: file: libsyslog-ng.a(afsql.o) has no symbols ranlib libsyslog-ng.a ranlib: file: libsyslog-ng.a(afstreams.o) has no symbols ranlib: file: libsyslog-ng.a(compat.o) has no symbols ranlib: file: libsyslog-ng.a(afsql.o) has no symbols if /usr/bin/gcc-4.0 -DHAVE_CONFIG_H -I. -I. -I.. -I/opt/local/include -I/opt/local/include/glib-2.0 -I/opt/local/lib/glib-2.0/include -I/opt/local/include -I/opt/local/include/eventlog -I/opt/local/include -DHAVE_SOCKADDR_SA_LEN -DLIBNET_BSDISH_OS -DLIBNET_BSD_BYTE_SWAP -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -Wall -MT main.o -MD -MP -MF ".deps/main.Tpo" -c -o main.o main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; else rm -f ".deps/main.Tpo"; exit 1; fi /usr/bin/gcc-4.0 -O2 -Wall -L/opt/local/lib -o syslog-ng main.o libsyslog-ng.a -lfl -L/opt/local/lib -lglib-2.0 -lintl -liconv -L/opt/local/lib -levtlog -L/opt/local/lib -lssl -lcrypto -lz -lz -lnet -lwrap -lresolv Undefined symbols: "_configuration", referenced from: _configuration$non_lazy_ptr in libsyslog-ng.a(stats.o) _configuration$non_lazy_ptr in libsyslog-ng.a(cfg.o) _configuration$non_lazy_ptr in libsyslog-ng.a(templates.o) _configuration$non_lazy_ptr in libsyslog-ng.a(cfg-lex.o) _configuration$non_lazy_ptr in libsyslog-ng.a(cfg-grammar.o) _configuration$non_lazy_ptr in libsyslog-ng.a(affile.o) _configuration$non_lazy_ptr in libsyslog-ng.a(logmatcher.o) _configuration$non_lazy_ptr in libsyslog-ng.a(logreader.o) ld: symbol(s) not found collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2

2 1