- syslog-ng - lists.balabit.hu

STATS: high amount of dropped messages
by Jeffrey Chandler 10 Apr '08

10 Apr '08

Hello, I am using syslog-ng 1.6.12 on Solaris 10 (sparc). I am seeing a large amount of dropped message every time Apr 9 20:14:18 syslog syslog-ng[16754]: STATS: dropped 1068470 Apr 9 20:24:18 syslog syslog-ng[16754]: STATS: dropped 1031716 Apr 9 20:34:18 syslog syslog-ng[16754]: STATS: dropped 997105 Apr 9 20:44:18 syslog syslog-ng[16754]: STATS: dropped 943151 Apr 9 20:54:18 syslog syslog-ng[16754]: STATS: dropped 1016377 Apr 9 21:04:18 syslog syslog-ng[16754]: STATS: dropped 992911 In previous posts, I have seen that this does not relate to log entries written to disk, but rather to a different destination, ie a pipe. In the case of our environment, we pipe all of the data which comes into syslog-ng to a pipe which is then forwarded to ArcSight through an agent running on the system. With the number of entries showing up as "dropped," would you recommend a different method to achieve this same task? Is this also a 1 to 1 correlation of messages that are not sent to the pipe? Thanks, Jeff

2 1

Redhat Enterprise 3 compile of 2.0.9
by Sigurður Bjarnason 10 Apr '08

10 Apr '08

Hi All, I am trying to compile syslog-ng 2.0.9 for Redhat ES3, it is not going too good it complains about not have-ing glib 2.x ,now my problem is that I cannot complile this for glib v2 and I need to stick with the orginal glib of Redhat ES3. Can it be done that is compile Syslog-ng for RedhatEs with the old glib or I am forced to upgrade to glib version 2.x . Regards Siggi

2 2

Bug: Numeric digits stripped from source hostname and time mangled.
by Christopher Cashell 09 Apr '08

09 Apr '08

[Apologies if this has been reported before, but I couldn't find any mention of it. Also, my apologies if this shows up twice. I sent it yesterday, but after 24 hours, it hasn't hit the list yet, so I'm resending.] It appears that Syslog-NG 2.0.x (tested with 2.0.9) will mangle originating source hostname when it begins numerically hostnames, and this also causes errors with date/time handling. Verified with Syslog-NG 2.0.9 on Red Hat Enterprise Linux 3 To duplicate and display the bug (destination(d_log_expanded) and template added to more easily display what's going on): [root@logbox syslog-ng]# cat syslog-ng.conf options { sync(0); chain_hostnames(yes); }; source s_net { tcp(); }; destination d_log { file("/tmp/test.log") ; }; destination d_log_expanded { file("/tmp/test-long.log" template("Date: $DATE, Sender Unixtime: $S_UNIXTIME, Receiver Unixtime: $R_UNIXTIME, Host: $FULLHOST Message: $MSGONLY\n") template_escape(no)) ; }; log { source(s_net); destination(d_log); }; log { source(s_net); destination(d_log_expanded); }; [root@logbox tmp]# cat /tmp/problem-log <0d>Mar 31 04:41:57 1234-xxxx/192.168.1.1 TestLog: This is a test log that includes the relevant bits of the original log, before Syslog-NG mangles them: "Mar 31 04:41:57 1234-xxxx/192.168.1.1 TestLog: This is a test log. . ." [root@logbox tmp]# cat < /tmp/problem-log | nc localhost 514 [root@logbox tmp]# tail -1 *.log ==> test.log <== Dec 31 17:59:59 -xxxx/192.168.1.1/localhost TestLog: This is a test log that includes the relevant bits of the original log, before Syslog-NG mangles them: "Mar 31 04:41:57 1234-xxxx/192.168.1.1 TestLog: This is a test log. . ." ==> test-long.log <== Date: Dec 31 17:59:59, Sender Unixtime: -1, Receiver Unixtime: 1207676046, Host: -xxxx/192.168.1.1/localhost Message: This is a test log that includes the relevant bits of the original log, before Syslog-NG mangles them: "Mar 31 04:41:57 1234-xxxx/192.168.1.1 TestLog: This is a test log. . ." You can see from the above that the '1234' is being stripped from the originating hostname '1234-xxxx', and the sender timestamp is then being mangled to -1. It appears to only pull the first 4 numbers from the source hostname (assuming there are more numbers, such as '123456-xxxx'), and it only happens when the hostname starts numerically. If you add a non-numeric character to the beginning part of the hostname, it is handled correctly (such as 'z1234-xxxx' or '12z34-xxxx'). -- Christopher Cashell ____________________________________ Christopher Cashell Systems & Network Security Engineer phone: 402.361.3065 fax: 402.361.3165 e-mail: christophercashell(a)solutionary.com Solutionary, Inc. www.Solutionary.com Making Security Manageable _____________________________________ Confidentiality Notice The content of this communication, along with any attachments, is covered by federal and state law governing electronic communications and may contain confidential and legally privileged information. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, use or copying of the information contained herein is strictly prohibited. If you have received this communication in error, please immediately contact us by telephone at (402) 361-3000 or e-mail security(a)solutionary.com. Thank you. Copyright 2000-2007, Solutionary, Inc. All rights reserved. ActiveGuard, eV3, Solutionary and the Solutionary logo are registered marks of Solutionary, Inc. SecurCompass is a service mark of Solutionary, Inc.

3 4

io.c: bind_inet_socket() bind failed Address already inuse
by Lucky Y 09 Apr '08

09 Apr '08

> >We use syslog-ng 1.6.12 in RHEL4. > >As part of our system testing we restart syslog-ng 150 times in a loop > >along with other services in the server. > > > >syslog-ng fails to come up 3/4 times with the error : > >"io.c: bind_inet_socket() bind failed 192.168.128.1:601 >> Address already in use". >How do you restart syslog-ng? It takes some time to close sources/ >destinations and there is a chance that the new syslog-ng instance >tries to bind to the same address the not-yet-stopped instance >still uses. Does syslog-ng use SO_REUSEADDR option ?

3 3

syslog-ng logging with wrong year
by Jean-Sebastien Pilon 09 Apr '08

09 Apr '08

Hello, We have a log collector receiving logs from several nodes and it is logging in the wrong $YEAR directory every 1st of the month for some host for about 2 minutes... We have 75 nodes sending logs, and we have a directory created under /var/log/hosts/2007/*/01/hostname for about 3-4 host. As you can see below, the folder 01 (January 1st) was created at 23:59 on December 31st... Same thing for Feb. 1st to now... /var/log/hosts/2007/01# ls -l total 4 drwxr-xr-x 2 root root 4096 2007-12-31 23:59 01 Here are my destination and log rules destination d_local { file("/var/log/hosts/$YEAR/$MONTH/$DAY/$HOST"); }; log { source(s_tcp); source(s_udp); source(s_local); destination(d_local); }; Any one has any idea why this is happening? NOTICE: This email contains privileged and confidential information and is intended only for the individual to whom it is addressed. If you are not the named addressee, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this transmission by mistake and delete this communication from your system. E-mail transmission cannot be guaranteed to be secured or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. AVIS: Le pr�sent courriel contient des renseignements de nature privil�gi�e et confidentielle et n�est destin� qu'� la personne � qui il est adress�. Si vous n��tes pas le destinataire pr�vu, vous �tes par les pr�sentes avis�s que toute diffusion, distribution ou reproduction de cette communication est strictement interdite.� Si vous avez re�u ce courriel par erreur, veuillez en aviser imm�diatement l�exp�diteur et le supprimer de votre syst�me. Notez que la transmission de courriel ne peut en aucun cas �tre consid�r� comme inviolable ou exempt d�erreur puisque les informations qu�il contient pourraient �tre intercept�s, corrompues, perdues, d�truites, arriv�es en retard ou incompl�tes ou contenir un virus. �

4 8

Re: [syslog-ng] syslog-ng logging with wrong year
by G.W. Haywood 09 Apr '08

09 Apr '08

Hi there, On Wed, 9 Apr 2008 Balazs Scheidler wrote: > ...the timestamp of the message does not contain a year, there's a > heuristic in syslog-ng to determine that. > ... > I'm reluctant to change this in 2.0 (the current algorithm has been > in place for about a decade now), however I can commit a patch to 2.1. > What do others think? If you do, please make it optional, disabled by default. It could be enabled by a command-line switch or by the configuration file options. -- 73, Ged.

2 1

Re: [syslog-ng] TAG-Macro
by JUNG, Christian 07 Apr '08

07 Apr '08

Here's a new version of the BSDTAG macro patch which doesn't use a lookup-table for the facility anymore.

2 1

Re: [syslog-ng] TAG-Macro
by JUNG, Christian 07 Apr '08

07 Apr '08

> -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of > Balazs Scheidler > Sent: Tuesday, March 18, 2008 12:46 PM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] TAG-Macro > > Something like BSDTAG? > Attached is a patch to the 2.0.9 source tree of syslog-ng which implements the "BSDTAG" macro. bye Chris

2 2

changing the location of the disk buffer for log_disk_fifo_size()
by Lucky Y 07 Apr '08

07 Apr '08

Hi, Is there anyway to change the location of the disk buffer for log_disk_fifo_size() ? It buffers the messages in /var/lib/syslog-ng/ by default in Linux, but in our system this directory will not exist. Regards, Lucky

2 2

About Syslog-ng Macro
by Yu Watanabe 07 Apr '08

07 Apr '08

TO : Syslog-NG Developers Hello , I have a question regarding to the syslog-ng macros that is useful in the syslog.conf. I am using syslog-ng in the follwoing development. 1. Linux **** 2.6.9-42.EL #1 Sat Aug 12 09:17:58 CDT 2006 i686 i686 i386 GNU/Linux 2. CentOS release 4.4 (Final) 3. LANG=ja_JP.eucJP However, whenever I try to ouput the multibye code(EUC) through the macro such as $MSG the message do not show properly. I am defining the following template and destination function in the config file. template t_temp { template("$S_YEAR-$S_MONTH-$S_DAY $S_HOUR:$S_MIN:$S_SEC $SOURCEIP $MSG\n"); }; destination d_log { program("/tmp/stdin2phpsyslogng.pl > /tmp/stdin2phpsyslogng.log 2>&1" template(t_temp)); }; But in the log file which is created through the file driver the japanese code shows properly. I am defining the following definition destination host_splitter { file( "/tmp/$HOST.log" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; I am looking in the source code but I am having trouble with the investigation. If its possible, I would like to know why this is happening. Is there any way to modify the macro problem? Thank you! Yu Watanabe

3 5