- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Encoding provlem when writing to postgres
by ml＠bortal.de 16 Oct '08

16 Oct '08

Hi Bazsi, > > where can i get syslog-ng 3.0? > > > > I cant find it on > > http://www.balabit.com/downloads/files/syslog-ng/sources/ > > I've just sent out an announcement that it's available as a git > repository. > > No formal releases have been made yet. I don't need a formal release announcment :) A snapshot or svn/cvs would be great. I just need that enconding support stuff :) Thanks, Mario

2 1

Re: [syslog-ng] Destination program behavior
by Gaetan Lord 16 Oct '08

16 Oct '08

>> My script is meant to run once and exit. Could it be the problem. > >Yes absolutely. You cannot exit after each log message, that is not permitted and explains why you are getting the SIGPIPE errors. You have to run in a loop, reading and processing >messages from stdin until you get an eof. See old postings to this list. Here's a pointer to one that gives an outline bash script that you can build upon. > >https://lists.balabit.hu/pipermail/syslog-ng/2008-March/011512.html Thank for the information. The script didn't work at first, at least under SuSE 10 with the native syslog-ng version 1.6.8 I compile and tried with version 2.0.9, and it work. :) I do have one more question for you. For now, I cannot replace the current syslog-ng V1.6.8. Can I run a second instance of syslog-ng, in this case version 2.0.9. The second one will have a different configuration file, and basically only run my destination program rule. Thanks again -- Helen Hayes - "Age is not important unless you're a cheese."

1 0

About Syslog-NG performance
by Yu Watanabe 15 Oct '08

15 Oct '08

Hello all, I am planning to build a syslog server using syslog-ng v 2.0.5. However, I am very concerned with the how much performace could syslog-ng can handle. Following is the system specification I am using. OS : RHEL 4 or RHEL 5 CPU : Xeon(R) E5205 (1.86GHz)×2 Memory : 4 GB I would like get an advice with the performace of the syslog-ng. Does any one has a testimonial with this? Yu Watanabe

2 2

Re: [syslog-ng] Encoding provlem when writing to postg res
by Paul Robert Marino 15 Oct '08

15 Oct '08

I've seen this with other web based apps. It usualy happens when tere is a control character in the text unfortunitly most text editors will simply ignore the character so it makes it hard to diagnose. If this is only happening with email related messages (which is not un-common) you may need to handle it at your mail server. Specificlty in the perl script that apears to be generating the message. Here is a regex I've used in the past in webforms where people would often copy and past fields from outlook that helped with the same error s/\P{IsPrint}//g this regex will strip out any characters that are not unicode printable. -----Original Message----- From: ml(a)bortal.de Subj: [syslog-ng] Encoding provlem when writing to postg res Date: Wed Oct 15, 2008 3:53 am Size: 1K To: syslog-ng(a)lists.balabit.hu Hello List, i get the following error when i try to write to postres: Error running SQL query; type='pgsql', host='XXX', port='', user='XXX', database='syslogng', error='ERROR: invalid byte sequence for encoding "UTF8": 0xe96461\x0aHINT: This error can also happen if the byte sequence does not match the encoding expected by the server, which is controlled by "client_encoding".\x0a', query='INSERT INTO msg_table (msg_rcv_time, msg_sent_time, hostname, msg_facility, msg_priority, msg_text) VALUES (\'2008-10-14T19:59:46+02:00\', \'2008-10-14T19:59:46+02:00\', \'foo\', \'mail\', \'warning\', \'mimedefang.pl[3497]: Message contains more than one Subject: header: Bulletin d\\\'\'info d\\\'\'Enseigner.TV et la fiche p\xffdagogique de l\\\'\'\xffmission du mois \xff 14 octobre 208 --> Bulletin d\\\'\'info d\\\'\'Enseigner.TV et la fiche p\xffdagogique de l\\\'\'\xffmission du mois \xff 14 octobre 208\')' How can i fix this? I am running postgresql-8.1 with Debian 4.0. Thanks, Mario ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 0

Encoding provlem when writing to postgres
by ml＠bortal.de 15 Oct '08

15 Oct '08

Hello List, i get the following error when i try to write to postres: Error running SQL query; type='pgsql', host='XXX', port='', user='XXX', database='syslogng', error='ERROR: invalid byte sequence for encoding "UTF8": 0xe96461\x0aHINT: This error can also happen if the byte sequence does not match the encoding expected by the server, which is controlled by "client_encoding".\x0a', query='INSERT INTO msg_table (msg_rcv_time, msg_sent_time, hostname, msg_facility, msg_priority, msg_text) VALUES (\'2008-10-14T19:59:46+02:00\', \'2008-10-14T19:59:46+02:00\', \'foo\', \'mail\', \'warning\', \'mimedefang.pl[3497]: Message contains more than one Subject: header: Bulletin d\\\'\'info d\\\'\'Enseigner.TV et la fiche p\xffdagogique de l\\\'\'\xffmission du mois \xff 14 octobre 208 --> Bulletin d\\\'\'info d\\\'\'Enseigner.TV et la fiche p\xffdagogique de l\\\'\'\xffmission du mois \xff 14 octobre 208\')' How can i fix this? I am running postgresql-8.1 with Debian 4.0. Thanks, Mario

2 1

syslog-ng 3.0 OSE and PE Release Date?
by Christian Lammers 14 Oct '08

14 Oct '08

Hello, I've compiled the 3.0 OSE successful and get it working. But also, it would be nice to test the Premium Edition in Version 3.0. I've read on the homepage, that it should be released in Q2 2008? I'm currently writing my bachelor thesis about "Audit proof logging", and in my opinion the syslog-ng 3.0 is the only professional tool to conform compliance requirements. Maybe, there is some Beta Version available? Thanks in advance, -- ------------------------------------------------------------------------ Christian Lammers Thinking Objects GmbH Tel. +49 71188770-301 Lilienthalstraße 2/1 Fax +49 711 88770-449 70825 Korntal/Stuttgart christian.lammers(a)to.com http://www.to.com Geschäftsführer: Markus Klingspor Sitz und Amtsgericht Stuttgart, HRB 19769 ------------------------------------------------------------------------

2 1

syslog-ng Agent, 3.0.3 release schedule (hatarido: 2008.10.22)
by Balazs Scheidler 14 Oct '08

14 Oct '08

hali, Rogtonzott megbeszelesunkon a kovetkezokben maradtunk: Memo: ----- * Zolinak szuksege van 1 napra egyedul, hogy az Agent olyan allapotba jusson, hogy a tobbi tesztelot is ra lehessen engedni (most nem kuld egyaltalan XP-n) * Szukseges funkcionalis tesztek: * 32/64 bit tesztek, telepitovel, kulonbozo kombinaciok, 2 nap * Vista funkcionalis teszt: 2nap * Hibajegybol most kb 20 van, amit tesztelni kell, feltetelezzuk, hogy a funkcionalis tesztekbol tovabbi 20 esik ki, igy 40 hibajegy tesztelesevel szamolunk, ami sacc/kb 6 embernap, ami viszont parhuzamosithato * Ghost meg csinalja az egy-ket nyitott hibajegyet, ha barmi a tesztelest blokkolo dolog van, akkor azt oldja meg inkabb * Abban maradtunk, hogy PZolin kivul MAndras es Lorant is syslog-ng agent-et fog tesztelni, Lorant alapvetoen holnaptol, MAndras matol * Szukseg van egy tesztkornyezetre, ld. todo TODO summary: ------------- * PZoli: ma elokesziti a tobbi tesztelest, a mindenkit blokkolo hibak kivasalasa * Ghost: ha van PZoli altal bejelentett blokkolo hiba, akkor az, ha nincs, akkor a meg nyitott hibajegyek * MAndras: * ma: tesztkornyezet osszerakasa, ami egy olyan Windows, ami: * minden audit esemeny bekapcsolva * IIS beallit, es fut, es logol * ISA beallit, es fut, es logol (ebben Scott/Ghost rendelkezhet infoval) * holnaptol: hibajegyteszt, esetleg szcenario teszt (PZoli megmondja) * Lorant: holnaptol hibajegyteszt, esetleg szcenraio teszt (PZoli megmondja) Abban maradtunk, hogy jovo het szerdara (okt. 22), az osszes uj funkcio letesztelve, hibajavitva lesz egy binarisunk, csak a release teszt lesz vissza. -- Bazsi

1 1

Benchmarking my syslog-ng infrastructure
by Francis Lacoste 14 Oct '08

14 Oct '08

Hello all, I am currently configuring my infrastructure to throw all logs to a dedicated syslog-ng server. I would like to benchmark it to know how many messages per seconds it can accept before it starts dropping. Is there any tools available ? Thanks. *Francis Lacoste*

2 1

FW: syslog-ng not working
by Ramprasad 13 Oct '08

13 Oct '08

Hi List, Do you have any suggestions for the below mentioned issue? Thanks & Regards, Ramprasad B ________________________________ From: Ramprasad Sent: Wednesday, October 08, 2008 12:43 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: syslog-ng not working Hi list, I have the following configuration in /etc/syslog-ng/syslog-ng.conf file on OpenSuSE 11.0 64 bit system. # cat /etc/syslog-ng/syslog-ng.conf options { long_hostnames(off); sync(0); perm(0640); stats(3600); }; source src { internal(); unix-stream("/dev/log"); unix-dgram("/dev/log"); }; destination d_filepath_10 { file("/tmp/syslog" fsync(yes)); }; filter f_filter_10 {level(debug .. emerg); }; log { source(src); filter(f_filter_10); destination(d_filepath_10); }; I don't see any log messaged being logged to /tmp/syslog file. Though, I restarted the syslog daemon, there is not effect. I went through some syslog-ng examples available on internet such as the one below, but still I don't see syslog-ng logging to the specified file - /tmp/syslog # cat /etc/syslog-ng/syslog-ng.conf options { keep_hostname(yes); long_hostnames(off); sync(1); log_fifo_size(1024); }; source src { unix-stream("/dev/log"); internal(); udp(); tcp(port(5140) keep-alive(yes)); }; destination syslog { file("/var/log/syslog"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/tmp/syslog"); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; log { source(src); filter(f_messages); destination(messages); }; Please help us on this. Thanks & Regards, Ramprasad B

1 0

Destination program behavior
by Gaetan Lord 13 Oct '08

13 Oct '08

Hi, I try to define a log parser. The idea is to monitor every lines for specific pattern and run action command. My config lines are destination syslog_parser { program("/usr/local/bin/test_syslog"); }; log { source(src); destination(syslog_parser); }; To test syslog-ng, I wrote a basic shell script, which only contain /bin/echo "This is a test" | /usr/bin/wall and exit This should issue a "wall" command on every lines written in the syslog I test it with the command "logger", and this do not work. I have the following syslog-ng error when I start it. Oct 10 13:04:00 minime1 syslog-ng[5470]: io.c: do_write: write() failed (errno 32), Broken pipe Oct 10 13:04:00 minime1 syslog-ng[5470]: pkt_buffer::do_flush(): Error flushing data I'm currently running version 1.6 from SLES10, syslog-ng-1.6.8-20.18 for IA64 I red the documentation provided by the package, and saw the following NOTE: the program is executed once at startup, and kept running until SIGHUP or exit. The reason is to prevent starting up a large number of programs for messages, which would imply an easy DoS. My script is meant to run once and exit. Could it be the problem. Is there any way to achieve what I want. I'm aware about the DoS, but in this case, there it's not a problem. Thank you -- Spike Milligan - "All I ask is the chance to prove that money can't make me happy."

2 1