- syslog-ng - lists.balabit.hu

logging facility in log file
by Jing CDL Sun 01 Jul '08

01 Jul '08

Hi, ALL I am using syslog-ng to do remote logging for facility of "local6" and priority of "warn", the log server is Linux system(SLES10 SP1), it works well with the message content, only one problem is the keyword of "local6" is not logged in the log file, please see the details below: on c890mgrs4(Linux) Jun 25 20:53:34 c890f12ec07 root: sunjing test 1 Jun 25 20:53:38 c890f12ec07 root: sunjing test 2 I did the same thing on AIX log server, while it could log the keyword of "local6" in log file: on c890mgrs3(AIX) Jun 25 20:53:34 c890f12ec07 local6:warn|warning c890f12ec07 root: sunjing test 1 Jun 25 20:53:38 c890f12ec07 local6:warn|warning c890f12ec07 root: sunjing test 2 So I am guessing that I did not enable this facility logging in syslog-ng, maybe syslog-ng has a certain configuration that could let the "facility" logged in message file, am I right? or could you point me to the correct method? I need this "facility" information to develop my applications. Thank you. Best Regards, ----------------------------- Sun Jing(孙靖) IBM China Software Development Laboratory Tel: (86-10) 82453625 E-mail: sjing(a)cn.ibm.com Address:5F Deshi Building No.9 Shangdi East Road Haidian District,Beijing City P.R.China 100085, P.R.China.

4 6

syslog-ng 2.1beta2 has been released
by devel＠balabit.hu 30 Jun '08

30 Jun '08

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 2.1beta2 SUMMARY : new stable release DATE : Jun 30, 2008 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (2.1beta2) has been released. For latest fixes in the 2.1.x branch you are recommended to upgrade to this version. CHANGES: 2.1beta2 Fri, 13 Jun 2008 14:37:08 +0200 Bugfixes: * Create /var/lib/syslog-ng directory from RPM packages. * Fixed a 100% CPU usage problem triggered by the pipe() destination. This is a regression in 2.1beta1 and does not affect earlier versions. * Removed test code that injected "Connection timed out" errors into local file writes. * Set the current directory to the root once syslog-ng daemonized itself. * Fixed the $PID macro to only extract information from the syslog message header and not from the message contents. Other changes: * Instead of using O_APPEND for file writes, add an lseek before writing which performs much better with the NFS client in BSD kernels. * Added support for suppressing duplicate messages. This feature was contributed by Chris Packham. * The default linking mode is changed to dynamic linking, as static linking is more difficult for users to cope with. Those who use NFS mounted /usr on machines where syslog-ng runs on will probably need to explicitly ask for the previous behaviour. BINARY DOWNLOAD: If you have a binary subscription, you can download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… OR, if you have a platform that is supported by apt-get, use the following apt sources to fetch the latest releases: Debian GNU/Linux ---------------- sarge: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-sarge/syslog-ng-2.1 syslog-ng etch: deb https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ debian-etch/syslog-ng-2.1 syslog-ng RedHat Enterprise Linux ----------------------- RHEL-4 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ rhel-4/syslog-ng-2.1 syslog-ng SUSE 10 ------- SUSE 10.0 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.0/syslog-ng-2.1 syslog-ng SUSE 10.1 rpm https://USERNAME:PASSWORD@apt.balabit.com/syslog-ng/open-source/ suse-10.1/syslog-ng-2.1 syslog-ng HTTP can also be used in the place of HTTPS If your version of apt-get does not support the HTTPS protocol. When using plain HTTP, the username and password will not be encrypted. SOURCE DOWNLOAD: The latest versions of syslog-ng in source format can be found at: http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/

1 0

syslog-ng suddenly stops logging
by Richard Vigeant 30 Jun '08

30 Jun '08

Hi, I have a configuration where several nodes send all log messages to a central server. The applications on remote nodes send their logs locally either via UDP or a unix socket. The syslog-ng running on remote nodes simply pick up all log messages from all sources, i.e. TCP, UDP, /proc/kmsg, /dev/log and internal, and transmit all messages to the central server uisng TCP. The remote node's config file follows. We've been having intermittent problems where the central server would suddenly stop logging messages from certain nodes. We noticed that very often restarting syslog-ng on the central server would fix the condition and logging would carry on. Howver I discovered a new rare case where restarting the central syslog-ng didn't work. I found out by doing a tcpdump that the remote syslog-ng was not sending the log messages. I have done an strace on the remote syslog-ng and it shows that nothing happens after a message has been "recvfrom()" or "read()". Then I have restarted syslog-ng and things went back to normal. In the 2nd strace we can see that there is a "write()" after the "read()". I'm using syslog-ng 2.0.9. ********************* Remote node's Config file: ********************* options { chain_hostnames(no); log_msg_size(8192); log_fifo_size(50000); log_iw_size(250); log_fetch_limit(25); flush_lines(10); flush_timeout(10); }; source local { pipe("/proc/kmsg"); unix-stream("/dev/log" max-connections(50)); internal(); }; source network { udp(localport(514)); tcp(localport(514)); }; destination spotxdeoam { tcp("spotxdeoam" destport(514)); }; destination local { tcp("localhost" destport(514)); }; # To change the local log path for modules, change the following statement. destination local_Modules { file("/opt/spotxde/software/var/SPOTxdeServer/logs/$HOST/$PROGRAM/ messages" create_dirs(yes) template("$FULLDATE, $HOST, $MSG\n") template_escape(no)); }; # To change the local log path for node, change the following statement. destination local_Nodes { file("/opt/spotxde/software/var/SPOTxdeServer/logs/$HOST/messages" create_dirs(yes) template("$FULLDATE, $HOST, $MSG\n") template_escape(no)); }; filter Modules { program("^OAM") or program("^TRX") or program("^VA1") or [root@c15 Rich]# more /opt/spotxde/software/etc/syslog_ng/syslog- ng_trx.conf options { chain_hostnames(no); log_msg_size(8192); log_fifo_size(50000); log_iw_size(250); log_fetch_limit(25); flush_lines(10); flush_timeout(10); }; source local { pipe("/proc/kmsg"); unix-stream("/dev/log" max-connections(50)); internal(); }; source network { udp(localport(514)); tcp(localport(514)); }; destination spotxdeoam { tcp("spotxdeoam" destport(514)); }; destination local { tcp("localhost" destport(514)); }; # To change the local log path for modules, change the following statement. destination local_Modules { file("/opt/spotxde/software/var/SPOTxdeServer/logs/$HOST/$PROGRAM/ messages" create_dirs(yes) template("$FULLDATE, $HOST, $MSG\n") template_escape(no)); }; # To change the local log path for node, change the following statement. destination local_Nodes { file("/opt/spotxde/software/var/SPOTxdeServer/logs/$HOST/messages" create_dirs(yes) template("$FULLDATE, $HOST, $MSG\n") template_escape(no)); }; filter Modules { program("^OAM") or program("^TRX") or program("^VA1") or program("^VA2") or program("^VA3") or program("^VA4") or program("^MM1") or program("^MM3") or program("^MM4") or program("^MM7") or program("^WAP") or program("^STI") or program("^HCA") or program("^RPT") or program("^PRF") or program("^SVW") or program("^MNG") or program("^CDR") or program("^EAIF") or program("^TEST") or program("^MMSC") or program("^SSMA") or program("^SMTP") or program("^ICAP") or program("^BIDA") or program("^SMPP") or program("^LTRX") or program("^MCDN") or program("^RMSS") or program("^EPGS"); }; log { source(local); source(network); filter(Modules); destination(spotxdeoam); # Remove the comment on the next statement to log locally on the TRX nodes the Modules related logs # destination(local_Modules); flags(final); }; log { source(local); source(network); destination(spotxdeoam); # Remove the comment on the next statement to log locally on the TRX nodes the Node relatedlogs # destination(local_Nodes); flags(fallback); }; ********************* ********************* Following is an strace of syslog-ng that doesn't work. There were 2 attemps in this one: one using UDP and on using Unix socket. ********************* [root@c15 Rich]# strace -p 8259 Process 8259 attached - interrupt to quit gettimeofday({1213891616, 539195}, NULL) = 0 gettimeofday({1213891616, 539246}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 22650) = 0 gettimeofday({1213891639, 190435}, NULL) = 0 time(NULL) = 1213891639 time(NULL) = 1213891639 gettimeofday({1213891639, 190507}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891669, 191715}, NULL) = 0 time(NULL) = 1213891669 time(NULL) = 1213891669 gettimeofday({1213891669, 191778}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 8, 30000) = 1 gettimeofday({1213891676, 326051}, NULL) = 0 recvfrom(3, "<30>Jun 19 12:07:56 RMSS: /syslo"..., 8192, 0, {sa_family=AF_INET, sin_port=htons(39166), sin_addr=inet_addr("127.0.0.1")}, [16]) = 100 gettimeofday({1213891676, 326294}, NULL) = 0 time(NULL) = 1213891676 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1252, ...}) = 0 time(NULL) = 1213891676 gettimeofday({1213891676, 326621}, NULL) = 0 recvfrom(3, 0x8131ef8, 8192, 0, 0xffffd560, 0xffffd55c) = -1 EAGAIN (Resource temporarily unavailable) gettimeofday({1213891676, 326794}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 22865) = 0 gettimeofday({1213891699, 193074}, NULL) = 0 time(NULL) = 1213891699 time(NULL) = 1213891699 gettimeofday({1213891699, 193277}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891729, 195368}, NULL) = 0 time(NULL) = 1213891729 time(NULL) = 1213891729 gettimeofday({1213891729, 195569}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891759, 196643}, NULL) = 0 time(NULL) = 1213891759 time(NULL) = 1213891759 gettimeofday({1213891759, 196842}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891789, 197931}, NULL) = 0 time(NULL) = 1213891789 time(NULL) = 1213891789 gettimeofday({1213891789, 198129}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891819, 199219}, NULL) = 0 time(NULL) = 1213891819 time(NULL) = 1213891819 gettimeofday({1213891819, 199421}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891849, 200510}, NULL) = 0 time(NULL) = 1213891849 time(NULL) = 1213891849 gettimeofday({1213891849, 200707}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=6, events=POLLIN, revents=POLLIN}, {fd=3, events=POLLIN}], 8, 30000) = 1 gettimeofday({1213891867, 753947}, NULL) = 0 accept(6, {sa_family=AF_FILE, path = "??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????"}, [2 ]) = 11 setsockopt(11, SOL_SOCKET, SO_KEEPALIVE, [0], 4) = 0 fcntl64(11, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(11, F_SETFL, O_RDWR|O_NONBLOCK) = 0 fcntl64(11, F_GETFD) = 0 fcntl64(11, F_SETFD, FD_CLOEXEC) = 0 brk(0) = 0x8ae1000 brk(0x8b02000) = 0x8b02000 gettimeofday({1213891867, 754658}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}, {fd=11, events=POLLIN, revents=POLLIN|POLLHUP}, {fd=6, events=POLLIN}], 9, 11446) = 1 gettimeofday({1213891867, 754830}, NULL) = 0 read(11, "<30>Jun 19 12:11:07 RMSS: /syslo"..., 8192) = 100 gettimeofday({1213891867, 755001}, NULL) = 0 time(NULL) = 1213891867 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1252, ...}) = 0 gettimeofday({1213891867, 755271}, NULL) = 0 read(11, "", 8192) = 0 close(11) = 0 gettimeofday({1213891867, 755520}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}], 8, 11445) = 0 gettimeofday({1213891879, 201791}, NULL) = 0 time(NULL) = 1213891879 time(NULL) = 1213891879 gettimeofday({1213891879, 201987}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891909, 203098}, NULL) = 0 time(NULL) = 1213891909 time(NULL) = 1213891909 gettimeofday({1213891909, 203299}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN|POLLOUT}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=10, events=POLLIN}, {fd=5, events=POLLIN}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}], 8, 30000) = 0 gettimeofday({1213891939, 205377}, NULL) = 0 time(NULL) = 1213891939 time(NULL) = 1213891939 gettimeofday({1213891939, 205580}, NULL) = 0 poll( ******************* And now the strace sequence when it works: We can see that after the read there is a write to transmit the message to the central log server. ******************* [root@c15 Rich]# strace -p 15310 Process 15310 attached - interrupt to quit gettimeofday({1213900598, 12321}, NULL) = 0 gettimeofday({1213900598, 12361}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN}, {fd=5, events=POLLIN}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=6, events=POLLIN}, {fd=3, events=POLLIN}], 7, 2069) = 0 gettimeofday({1213900600, 83036}, NULL) = 0 time(NULL) = 1213900600 time(NULL) = 1213900600 gettimeofday({1213900600, 83101}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN}, {fd=5, events=POLLIN}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=6, events=POLLIN, revents=POLLIN}, {fd=3, events=POLLIN}], 7, 30000) = 1 gettimeofday({1213900610, 338336}, NULL) = 0 accept(6, {sa_family=AF_FILE, path=@}, [2]) = 10 setsockopt(10, SOL_SOCKET, SO_KEEPALIVE, [0], 4) = 0 fcntl64(10, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(10, F_SETFL, O_RDWR|O_NONBLOCK) = 0 fcntl64(10, F_GETFD) = 0 fcntl64(10, F_SETFD, FD_CLOEXEC) = 0 gettimeofday({1213900610, 338937}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN}, {fd=5, events=POLLIN}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}, {fd=10, events=POLLIN, revents=POLLIN|POLLHUP}, {fd=6, events=POLLIN}], 8, 19745) = 1 gettimeofday({1213900610, 339123}, NULL) = 0 read(10, "<30>Jun 19 14:36:50 RMSS: /syslo"..., 8192) = 100 gettimeofday({1213900610, 339320}, NULL) = 0 time(NULL) = 1213900610 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1252, ...}) = 0 gettimeofday({1213900610, 339627}, NULL) = 0 read(10, "", 8192) = 0 close(10) = 0 gettimeofday({1213900610, 339888}, NULL) = 0 poll([{fd=7, events=POLLIN}, {fd=8, events=POLLIN}, {fd=5, events=POLLIN}, {fd=9, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}, {fd=6, events=POLLIN}], 7, 10) = 0 gettimeofday({1213900610, 351199}, NULL) = 0 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=1252, ...}) = 0 write(8, "<30>Jun 19 14:36:50 c15 RMSS: /s"..., 103) = 103 gettimeofday({1213900610, 351494}, NULL) = 0 poll( <unfinished ...> Process 15310 detached Richard Vigeant www.vantrix.com

2 5

Problem in source file driver
by 広瀬真作 30 Jun '08

30 Jun '08

Hello all, I use syslog-ng 2.0.9. I am troubled in how to use the source file driver. The trouble is that a log message is output in duplicate after syslog-ng restart. I made following syslog-ng.conf. ------------------------------------------------------------ options { long_hostnames(off); sync(0); stats(0); time_reopen(10); dir_perm(0755); perm(0644); }; source s_test1 { internal(); file("/tmp/test_app_log" follow_freq(1) flags(no-parse) keep_timestamp(no)); }; destination d_test1 { file("/var/log/test.log"); }; log { source(s_test1); destination(d_test1); }; ------------------------------------------------------------ Next I tested syslog-ng action with following operation. ------------------------------------------------------------ # echo "test message `date`" >> /tmp/test_app_log # cat /var/log/test.log Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:54 testserv2 test message Mon Jun 30 10:58:53 JST 2008 # /etc/init.d/syslog-ng restart Stopping syslog-ng: [ OK ] Starting syslog-ng: [ OK ] # cat /var/log/test.log Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:46 testserv2 syslog-ng[17216]: Configuration reload request received, reloading configuration; Jun 30 10:58:54 testserv2 test message Mon Jun 30 10:58:53 JST 2008 Jun 30 10:59:05 testserv2 syslog-ng[17216]: Termination requested via signal, terminating; Jun 30 10:59:05 testserv2 syslog-ng[17216]: syslog-ng shutting down; version='2.0.9' Jun 30 10:59:05 testserv2 syslog-ng[17292]: syslog-ng starting up; version='2.0.9' Jun 30 10:59:05 testserv2 test message Mon Jun 30 10:58:53 JST 2008 ------------------------------------------------------------ The message "testserv2 test message Mon Jun 30 10:58:53 JST 2008" was output in duplicate after syslog-ng retart. I hope the message is not output in duplicate after syslog-ng restart. Is my hope readily achievable? Please advise me.

2 2

clearing /var/log/syslog file - its becoming bigger
by janskey 28 Jun '08

28 Jun '08

Hi Guys, I installed syslog-ng and php-syslog-ng. As what I know, php-syslog-ng will get all logs files in /varlog/syslog file to mysql db. Is it possible to clear /var/log/syslog file because its getting bigger? Since all logs are been copied to the db, is it safe to clear syslog? Is this possible? Thanks! cheers, janskey

1 0

Syslog-ng and Switch Catalyst Cisco 3750
by Rodrigo Fernandes 27 Jun '08

27 Jun '08

Hello all, I´d like to know how to config my switch Catalyst 3750 to log messages into my syslog-ng server. My syslog-ng is working fine with other clients. This switch work with the facility local6, or local7 in syslog-ng. The switch is logging only this line in my syslog-ng: Jun 26 01:54:29 xx.xx.xx.xx 53: 000053: 1d09h: %SYS-5-CONFIG_I: Configured from console by vty0 (xxx.xxx.xxx.xxx). I need to receive more information about this switch. Somebody help me in this issue? Thanks a lot, Rodrigo

2 1

problem in remote logging
by Gemi 27 Jun '08

27 Jun '08

Hi, I am facing problem in remote logging though is working very fine locally. please advise me what to do and where I am missing something. the details I am giving below. I have one target linux system (set top box) and one host Linux Desktop Machine. the syslogd and logging working fine on both target as well as on PC(host) machine individually . I have scenario, I have to run program on target machine. And I have to collect the log on PC(host) console as well as in some file say /tmp/log. I have started $syslogd -r on both the machines. the syslog.conf file on the machines are like this. target >> syslong.conf local0.* @ip.address (PC-Host machine) PC(host) >> syslog.conf local0.err /dev/console local0.* /tmp/log in process list syslogd shows like "syslogd -r" I have already run many times $ kill -SIGHUP /var/run/syslog.pid on both machine. even though it is not working -Gemi _________________________________________________________________ Post free property ads on Yello Classifieds now! www.yello.in http://ss1.richmedia.in/recurl.asp?pid=219

2 1

Problem in remote logging
by Gemi 27 Jun '08

27 Jun '08

Hi, I am facing problem in remote logging though is working very fine locally. please advise me what to do and where I am missing something. the details I am giving below. I have one target linux system (set top box) and one host Linux Desktop Machine. the syslogd and logging working fine on both target as well as on PC(host) machine individually . I have scenario, I have to run program on target machine. And I have to collect the log on PC(host) console as well as in some file say /tmp/log. I have started $syslogd -r on both the machines. the syslog.conf file on the machines are like this. target >> syslong.conf local0.* @ip.address PC(host) >> syslog.conf local0.err /dev/console local0.* /tmp/log in process list syslogd shows like "syslogd -r" I have already run many times $ kill -SIGHUP /var/run/syslog.pid on both machine. even though it is not working -Gemi _________________________________________________________________ Tried the new MSN Messenger? It’s cool! Download now. http://messenger.msn.com/Download/Default.aspx?mkt=en-in

1 0

Logging timezone info in each message for V 1.6.8
by Manju Ramanathpura (mramanat) 27 Jun '08

27 Jun '08

Hello, Wondering if there is a way to print timezone with each message in the Version 1.6.8 ? Currently my message looks something like below Jan 21 12:22:12 <rest of the message> Instead I would like to see something like below Jan 21 12:22:12 PDT 2008 <rest of the message> or something in that line where I can see the timezone info. I have come across some timezone handling documents from - http://www.syslog.org/syslog-ng/v2/#timezone_handling But only for the Version 2.x and not for version 1.6.X I'd appreciate if you can share any tips for printing timezone ( or perhaps ISO format timestamp ) in each message for V 1.6.8 Thanks, -Manju

2 1

suitability of syslog-ng with long messages
by Joe Shaw 24 Jun '08

24 Jun '08

Hi, I am working on a project in which we will have many gigabytes of data logged per day. The log producers themselves were mostly developed in house and presently are simply logging to a file, but as we build out the system we'll obviously need some centralization. I've been thinking about using syslog-ng for this. While most of the messages are relatively small -- on the order of hundreds of bytes or a couple kilobytes -- there are some exceptional cases where we are generating messages that could be as large as two megabytes and need these to be kept in tact. We'll be using the tcp() destination driver. Are there any performance considerations, gotchas, etc. in setting log_msg_size(2097152)? Would that have a bad interaction memory usage-wise, for example, with log_fifo_size() if it were set to 1000? I am trying to get a feel if syslog-ng is the right tool for the problem here, or if something else would be more suitable. Thanks for any info you can provide, Joe

2 3