- syslog-ng - lists.balabit.hu

Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 23 Apr '08

23 Apr '08

Hi folks! I posted this question previously, but I am still not clear on the process involved in putting a newer version of syslog-ng on my Fedora Core 4 machines. I need to upgrade, because my version (1.6.11) does not support hi-res timestamps. Can anyone provide some guidance as to how to go about this process? I got information previously to compile from source, but I am not 100% clear on the process. Any guidance from you fine folks would be terribly appreciated!!! Thanks, folks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

2 2

reliability question (unix-dgram vs unix-stream)
by Geller, Sandor (IT) 21 Apr '08

21 Apr '08

Hi, I'm discussing the differences between unix-stream and unix-dgram on linux with my colleagues. It looks like the kernel-side and glibc-side implementation aren't different in the aspect of reliability. So why is it stated both in the reference guide and in the faq that unix-stream is more reliable? Thanks, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.

2 1

syslog-ng OSE 2.1beta1 release
by Balazs Scheidler 18 Apr '08

18 Apr '08

Dear syslog-ng users, I'd like to announce the release of syslog-ng Open Source Edition 2.1beta1. This release contains a couple of bugfixes back and forward ported from other branches and two functionality changes, much requested previously on this list. The first is a change in the TCP connection logic to move the DNS lookup be be part of the TCP reconnection logic, effectively solving the problem of non-resolvable hostnames, which caused syslog-ng to fail during startup. The same change also causes the destination hostname to be resolved again for each new connection attempt. The second important change was to handle file write error much more gracefully: whenever a write error occurs, writing to the destination file is suspended for some time, this way handling disk-full conditions better. I'd like to release 2.1.0 real soon now. The complete list of user-visible changes is below: 2.1beta1 Fri, 18 Apr 2008 18:00:59 +0200 Bugfixes: * Fixed a possible SIGABRT crash if the hosts file passed to dns-cache-hosts() had multiple entries with the same IP address. * Fixed a bug that caused the persistent DNS cache (e.g. /etc/hosts) to be reloaded for all name resolution requests. * Fixed a possible crash during startup if "-g" was specified without using "-u". * Fixed handling more than 256 destinations by changing the reference counter type of LogMessages to a 16 bit value. * Fixed door initialization on Solaris, the door portion of sun-streams() sources did not work in previous releases. * Fixed a possible segmentation fault in handling file sources that are marked optional and the source file does not exist. * Fixed the LinkSys style timestamp parser to avoid recognizing hostnames starting with numbers as the year value of the timestamp. * Fixed the year recognition heuristics as the older used the previous year in some cases when the client's clock was too fast. Other changes: * Backported end-of-message search algorithm from PE, which results in increased performance and the removal of vague interpretation of messages that contain both NUL and NL characters. * Removed destination files from the set of polled fds, they are always writable anyway and cause performance degradation when a lot of destination files are managed. * Fixed some FreeBSD and AIX portability issues. * Added the BSDTAG macro, implementation by Jung Christian. * Changed the reconnection logic in the TCP destination driver to reattempt connections for any kind of network problems. Therefore an unknown DNS name will not prevent syslog-ng to start up with an initialization error. * Changed the file write error handling logic to suspend writing to a file destination on write errors, but retry it some time later. This time interval is controlled by time_reopen() just like with other drivers. -- Bazsi

1 1

Centralised logging of nginx
by Ed W 18 Apr '08

18 Apr '08

Does anyone have any thoughts on centralising logging of nginx? Anyone used syslog-ng as part of a system to ship the logs to a central location? Thanks Ed W

2 1

About $HOST macro
by Yu Watanabe 16 Apr '08

16 Apr '08

Hello, I have a question regarding to the $HOST macro in the syslog.conf. Which value does the syslog-ng uses for the hostname? It seems that there are circumstatnses that it converts the SOURCEIP using the /etc/hosts and sometimes it gets the hostname somewhere else. I would like to know how does the syslog-ng defines this value. Yu Watanabe

2 1

Parsing tab characters
by Norman Elton 15 Apr '08

15 Apr '08

We've configured a host to send syslogs to our central repository running syslog-ng 2.0.3. This particular host is sending tab-delimited entries. The normal syslogd daemon parses and saves the messages correctly. Syslog-NG seems to save them encoded as \011. Can syslog-ng be configured to save the decoded ASCII characters? Or can the messages be shoved through something like sed to be massaged before saving? Thanks! Norman Elton

3 3

Logging to dirs with $HOST gives me strange results
by Markus Strangl 15 Apr '08

15 Apr '08

Hi syslog-ng users, I'm running a central syslog-ng 2.0.6 server with a rather simple ruleset, just to collect copies of the syslogs from a bunch of machines. They are running Solaris 9 and 10, with the onboard syslog, forwarding with syslog.conf "*.alert @logso01". Syslog-NG's logging targets are set up like that: source net { udp(); }; destination messages { file("/logs/$HOST/messages"); }; log { source(net); filter(f_high); destination(messages); }; Options are set to use the /etc/hosts file, and all hosts are listed there. In theory, this should give me one directory for each hosts that's forwarding its log messages. However, in practice, I get quite a lot of useless directories as well, that don't match any real host. root@logso01:/logs>ls \"/ \011Corrupt/ \011PLOGI/ \011SONY_AIT/ \011got/ \011offline/ \011/ \011Error/ \011SCSI/ \011failed/ \011i/ \011transport/ (C) SC admso01-qfs archso03-mgm nrgdev nrgstg jumpso01-qfs testso01 nrgso01 US archso01-mgm archsrv-qfs nrgprod1-qfs epldev logso01 testso02-qfs All Use archso01-xfcu by nrgprod2-qfs for prodso01-mgm IBM Use, archso02-mgm cutapsrv nrgprod3-qfs gconfd stgaoma Licensed Version archso02-xfcu delso01-sn nrgso01-qfs ddpso01-qfs svnso01-mgm It looks like under some condition, syslog-ng doesn't use the source hostname for the $HOST config directrive, but the first word of the log message. Is this a (known?) bug, or is there any way to circumvent that behaviour? Please advise. Yours Markus

2 1

What packages need?
by hi ro 13 Apr '08

13 Apr '08

Hi, What packages does it need to compile syslog-ng? Is it the same package when to make RPM? (bison, flex, gcc-c++, pkgconfig, glib2-devel, libevtlog-devel) (It needs only libc to compile eventlog, doesn't it?) And if it's not necessary to connect database, does it need to install libdbi8? Thanks hiro _________________________________________________________________ 【MSNビデオ】超貴重！驚きの大物対談が実現。作家村上龍が話題のあの人に迫る http://video.msn.co.jp/rvr/default.htm

4 14

[Bug 3] New: udp flood
by bugzilla＠bugzilla.balabit.com 13 Apr '08

13 Apr '08

https://bugzilla.balabit.com/show_bug.cgi?id=3 Summary: udp flood Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: manoo(a)manoo.hu Type of the Report: bug Estimated Hours: 0.0 I installed syslog-ng 2.0.5 (because there was no .rpm for a RHEL3 server I made it with rpmbuild). In the config file I placed two destination lines for the same filter, first for place the log locally and an other to send it to a remote loghost (udp/514). I had a typo in the path of the local logfile (started with "/vavr" instead of "/var") and syslog-ng cannot create/write the specified file (I made no "create_dirs(yes)") when I started the logging (with logger - that was an apache logging system) the result was the following: it did not checked the writability of the file but could start itself (resart of syslog-ng was successfull) and started to sends this errormessage to the loghost with full speed: Dec 13 09:56:07 192.168.0.2 syslog-ng[19315]: Error opening file for writing; filename='/vavr/log/apache/apache.log', error='No such file or directory (2)' within 20 minutes it sends cca 700mb of clear text to the loghost. There is a leased line between the two hosts via internet and this flooded the communication channel. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 19] New: syslog-ng 2.0. x can not follow a change of IP at target syslog server
by bugzilla＠bugzilla.balabit.com 12 Apr '08

12 Apr '08

https://bugzilla.balabit.com/show_bug.cgi?id=19 Summary: syslog-ng 2.0.x can not follow a change of IP at target syslog server Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: enhancement Estimated Hours: 0.0 If the IP address of the destination for syslogging is changed, then all sending syslog-ng servers must be reloaded to figure out that the address has changed, even if the IP name has not changed. We recently moved one of our centralized syslog servers to a different building, resulting in a different network address. We took great pains (it was actually easy, but required planning) to maintain the IP name of the syslog server, but all of the sending hosts required a syslog-ng reload to resolve the IP name in the configuration file to the new IP address. The "reopen" logic should be changed to resolve the IP address of the hostname provided in the configuration file. Hopefully the reopen process should be relatively rare, and no significant load will be placed on the DNS servers during normal operation. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

5 6