- syslog-ng - lists.balabit.hu

syslog-ng and log4j
by Sigurður Bjarnason 10 Mar '08

10 Mar '08

Hi All My first time on this list so be gentle J I have questions about syslog-ng and log4j. I am using syslog-ng as central server with syslog-ng on clients forwarding logs to the central server and I have notice that logs from java ( log4j ) are being dropped under heavy load, so I did some investigating and found out that log4j only send on UDP rather then TCP like all other logs . Is it possible to get log4j to send logs over TCP by sending logs from java to socket or otherwise, I would guess that log4j is not capable of sending logs to TCP since I have tried to take the udp section out of the syslog-ng config and then no logs are received from java L Can please someone tell me what my options are here, I really need to get logs from java over to the central server without this drop since these are the most critical logs on my system . Regards Siggi

2 3

Leap Year
by hi ro 06 Mar '08

06 Mar '08

Hi, Do you have any problem about Leap Year? Thanks hiro _________________________________________________________________ Hotmailユーザの半数近くが使用しています。Windows Liveメッセンジャー。 http://messenger.live.jp/

3 2

Parallel Use of syslog-ng with syslogd (Linux RH ES4)
by Diffenderfer, Randy 04 Mar '08

04 Mar '08

Folks, I haven't yet done the research here by RTFS'ing, so I apologize in advance for uninformed posting... :-) I'm looking at syslog-ng as a syslogd replacement in our shop. I'd like to determine in advance if there is a reasonable way to run these in parallel. In particular, are there supplied hooks to routines equivalent to syslog(3) in the C library? I understand that I can shut down syslogd and bring up syslog-ng listening to /dev/log, and things will be transparent to production code. I envision an environment where I have the RH syslogd listening to /dev/log, and syslog-ng listening to /dev/log-ng. Using perl and C routines, can I integrate my production code with minimal alterations to selectively use the new facility? Thanks for any advice, rnd

2 1

Re: [syslog-ng] Syslog-ng 2.0.x on Fedora Core 4
by Ivey, Chris 03 Mar '08

03 Mar '08

Sandor/ScottO, Thanks for the information that it works properly on old releases. If I could trouble you guys for *how* you made it work, that would be great. I did some testing using my personal Linux machine (FC5), and I could not get the application to install (could not find all the needed preliminaries). If you want to PM me for this, that would be fine, since I am sure the rest of the list does not need to be exposed to my lack of knowledge. (( For what it's worth - I inherited these machines, had nothing to do with the original setup/configuration, and now find myself as the owner/admin of an application I don't know much about. )) Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage On Mon, Mar 3, 2008 at 4:42 AM, Geller, Sandor (IT) <Sandor.Geller(a)morganstanley.com <mailto:Sandor.Geller@morganstanley.com> > wrote: Hi, > Folks, > I need to upgrade syslog-ng running on my 2 servers, > which are running Fedora Core 4. Is it possible to put 2.0.x > onto a machine running FC4? I was looking around this morning > for this information, and can't find anything that says "yay" > or "nay". Thanks! It should just work (TM). I'm using syslog-ng 2.0 on very old OS releases, all you might need is to install its requirements: eventlog, libnet, glib and optionally tcp-wrappers. Regards, Sandor -------------------------------------------------------- Agreed, fwiw, I have it working just fine on FC3.

2 1

Syslog-ng 2.0.x on Fedora Core 4
by Ivey, Chris 03 Mar '08

03 Mar '08

Folks, I need to upgrade syslog-ng running on my 2 servers, which are running Fedora Core 4. Is it possible to put 2.0.x onto a machine running FC4? I was looking around this morning for this information, and can't find anything that says "yay" or "nay". Thanks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

3 2

Problem with installation
by vempati Ramprasad 29 Feb '08

29 Feb '08

Hi frnds, When Iam trying to do a make on syslog-ng,Iam getting the following error.Could you let me know,how do I resolve this problem.Iam in desperate need for this. My configuration is : Redhat Linux : 3.2.2-5 Kernel : 2.4.31 eventlog-0.2.7.tar.gz syslog-ng-2.0.8.tar.gz. gcc version : 3.2.2 When I do "make" in syslog-ng directory....(After ./configure step) Iam getting the following error. "In file included from /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:61: parse error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:591: parse error before ')' token /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:624: parse error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/root/rams/syslog-ng-2.0.8/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/rams/syslog-ng-2.0.8' make: *** [all] Error 2 [root@ramprasad syslog-ng-2.0.8]#" Please help me. -ramprasad. Rgds, Ramprasad Vempati

2 1

Syslog-ng 2.0.x on FC4?
by Ivey, Chris 25 Feb '08

25 Feb '08

Folks, I need to upgrade my syslog-ng running on my 2 servers, which are running Fedora Core 4. Is it possible to put 2.0.x onto a machine running FC4? I was looking around this morning for this information, and can't find anything that says "yay" or "nay". Thanks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

1 0

syslog partialy ignores the firewall filter...
by eial＠cs.bgu.ac.il 25 Feb '08

25 Feb '08

I've setup an firewall and I want to log the rejects to a separate log file, I've done that but I've not been able to drop the messages from dmesg, here is my conf file # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo,v 1.7 2007/08/02 04:52:18 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux # contributed by Michael Sterrett options { chain_hostnames(off); sync(0); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; source src { unix-stream("/dev/log" max-connections(256)); internal(); file("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; #firewall filter f_firewall { match("Rejected: "); }; filter f_no_firewall { not match("Rejected: "); }; destination firewall { file("/var/log/iptables.log" owner("root") group("adm") perm(0640)); }; log { source(src); filter(f_firewall); destination(firewall); flags(final); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; # ...if you intend to use /dev/console for programs like xconsole # you can comment out the destination line above that references /dev/tty12 # and uncomment the line below. #destination console_all { file("/dev/console"); }; log { source(src); filter(f_no_firewall); destination(messages); }; log { source(src); destination(console_all); }; how can I fix it? thanks

3 3

time_sleep() and inadvertent admission control
by John Morrissey 22 Feb '08

22 Feb '08

About a year ago, I noticed heavy CPU consumption during certain workloads (many processes sending a small number of log messages per process, such as a busy Postfix machine) due to io_iter spinning very rapidly on poll(). We kludged around it by adding the time_sleep() directive, to add an artificial delay at the end of the io_iter loop and prevent the loop from rolling over too quickly: http://marc.info/?l=syslog-ng&m=114009552929622&w=2 We started using time_sleep(30) across all of our machines, since that delay value didn't seem to cause any problems for our workloads and we wanted to keep the configuration uniform. We noticed recently that time_sleep() exhibits some inadvertent admission control behavior. When poll() indicates that the listener socket has activity (new connections), syslog-ng seems to accept() only once on it, allowing one new connection per poll(). As a result, it only allows: 1000 / time_sleep() connections per second. Accordingly, with time_sleep(30), only 33 connections would be allowed every second. This became problematic when we added a logger into our qmail-pop3d chain. Normally, qmail-pop3d is invoked thusly: qmail-popup $HOSTNAME auth_pop qmail-pop3d ./Maildir/ qmail-popup starts, pops its args, and then exec()s what's left over. By default, qmail's POP3 daemon doesn't log user information, so we added a very simple syslogging script to this exec chain, like so: qmail-popup $HOSTNAME auth_pop qmail-loguser qmail-pop3d ./Maildir/ [jwm@periscope:pts/0 ~> cat qmail-loguser #!/bin/sh logger -t $(basename $0) -- "${HOME##*/} from $TCPREMOTEIP on $TCPLOCALIP" exec "$@" This was disastrous under load, since the admission control behavior caused by time_sleep() made logger(1) block, quickly causing the machine to run out of memory. I realize time_sleep() is a kludge, but more advanced dynamic tuning to replace it seems like it would be error-prone and difficult to troubleshoot when things go wrong. I would also argue that time_sleep() is meant to prevent spinning on poll() and its effect was not intended for *new connections*, since new connections did not cause the original problem of excessive CPU consumption. time_sleep() unnecessarily throttles new connections, which in workloads like qmail's are critical to scalability. For example, syslog-ng still consumes only ~2% of a dual 2.8GHz Xeon machine's CPUs even with this rapid-connection qmail workload. Instead, would it make sense for syslog-ng to accept() on the listener FD (it would need to be marked as non-blocking; I haven't looked into the ramifications if it isn't already) until there are no more new connections waiting, perhaps with a hard ceiling if starvation of other FDs is a worry? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

4 7

Why syslog-ng'config permission change ?
by hi ro 22 Feb '08

22 Feb '08

Hi, I installed syslog-ng. At that time, syslog-ng.conf's permission was 644. I let A user (not root) to update syslog-ng.conf, so I changed permission to 666. But I reboot the Server, then syslog-ng.conf's permission returned 644. Why ? Thanks hiro _________________________________________________________________ 出会いがない、と嘆いているあなたにぴったりの恋人探し！まずは無料検索！ http://match.jp.msn.com/channel/index.aspx?avo=1&trackingid=1034447

4 4