- syslog-ng - lists.balabit.hu

syslog-ng does not resume log when disk is full at first, and then disk space available
by Andrej Lobovski 21 Feb '08

21 Feb '08

Hi. I have a problem, with syslog-ng 2.0.0-1etch1 on debian 4. It is like this: - syslog-ng fills /var/log/syslog with messages - then /var partition becomes full and I get "No space left on device (28)" error written in /var/log/syslog (tail -f on this file), which is expected - then I make some disk space available on /var partition, BUT syslog-ng does not resume writing in /var/log/syslog at all Am I missing any options in /etc/syslog-ng/syslog-ng.conf ? Thank you very much Andrej Podgorsek _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

5 15

bugzilla down
by Balazs Scheidler 20 Feb '08

20 Feb '08

hi, I've just been told that bugzilla.balabit.com is currently down. I hope it can be fixed tomorrow. For the time being, just send bugreports to this list. Sorry for the outage. -- Bazsi

1 0

Syslog-ng sometime dies at 04:02
by Peter Michael Calum 20 Feb '08

20 Feb '08

Hi I have installed syslog-ng on RHEL 5 as an RPM (syslog-ng-2.0.8-1.fc8.i386.rpm). It runs fine except for this problem : Every night at 04:02 som script runs and make a reload of the configuration. This comes out with some errors in the messages file, but the real problem is, that syslog-ng sometime stops running at this time. I'm running syslog-ng together with php-syslog-ng Hope anyone can help rgds, Peter Calum Denmark Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(stream,AF_UNIX(/dev/log))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_connections(dgram,AF_INET(0.0.0.0:514))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))' Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Configuration reload request received, reloading configuration; Feb 19 04:02:04 s_sys@khk9dsg5 syslog-ng[21702]: Internal error, duplicate configuration elements refer to the same persistent config; name='afsocket_sd_listen_fd(stream,AF_UNIX(/dev/log))' My configuration file : options { sync (0); chain_hostnames(on); stats(43200); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; source s_everything { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_everything); destination(d_mysql); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; # vim:set ai ts=4 sw=4 sts=4 et:

5 19

Problem on RHEL4
by Abid Ghufran 17 Feb '08

17 Feb '08

Hello, While trying to compile syslog-ng from I am getting the following error. I have seen that many others have had the same problem but I could not find any solution. I am installing on RHEL4 and have used all the latest requisities for syslog-ng as follows: bison-2.3eventlog-0.2.5flex-2.5.34glib-2.14.6libnetpkg-config-0.20syslog-ng-2.0.8tcp_wrappers_7.6I would appreciate if someone could help me with this problem. Thanks and regards, Abid Ghufran. =============================================== make all-recursivemake[1]: Entering directory `/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8'Making all in srcmake[2]: Entering directory `/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src'gcc -g -O2 -Wall -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamiclibsyslog-ng.a(misc.o)(.text+0x3a9): In function `resolve_hostname':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/misc.c:191: undefined reference to `g_assert_warning'libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logmsg.c:110: undefined reference to `g_assert_warning'libsyslog-ng.a(logmsg.o)(.text+0x2b6): In function `log_msg_ref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logmsg.c:575: undefined reference to `g_assert_warning'libsyslog-ng.a(logmsg.o)(.text+0x342): In function `log_msg_unref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logmsg.c:589: undefined reference to `g_assert_warning'libsyslog-ng.a(logmsg.o)(.text+0x1132): In function `log_msg_ack_block_end':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logmsg.c:726: undefined reference to `g_return_if_fail_warning'libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logpipe.c:38: undefined reference to `g_assert_warning'libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/logpipe.c:47: undefined reference to `g_assert_warning'libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/center.c:90: undefined reference to `g_assert_warning'libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/center.c:132: undefined reference to `g_assert_warning'libsyslog-ng.a(templates.o)(.text+0x2de): In function `log_template_ref':/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/templates.c:191: undefined reference to `g_assert_warning'libsyslog-ng.a(templates.o)(.text+0x396):/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src/templates.c:202: more undefined references to `g_assert_warning' followcollect2: ld returned 1 exit statusmake[2]: *** [syslog-ng] Error 1make[2]: Leaving directory `/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8/src'make[1]: *** [all-recursive] Error 1make[1]: Leaving directory `/home/abidg/projects/syslog/syslog/syslog-ng-2.0.8'make: *** [all] Error 2 _________________________________________________________________ Free games, great prizes - get gaming at Gamesbox. http://www.searchgamesbox.com

2 1

Reference counter width of log messages and group/user handling
by Roger J. Meier 14 Feb '08

14 Feb '08

Hi all, These patches fix two segmentation fault and abort signal problems which we encountered in our use case of syslog-ng 2.0.8. Patch 1: "syslog-ng-2.0.8-refcounter.diff". If specifying more than about 256 "destination" directives inside one log directive, then the reference counter of a log message wraps. The reference counter width of LogMessage is expanded from 8 bit to unsigned int (32 bit). Reason: The reference counter wraps after 256 increments, which causes an abort() call when decrementing the reference counter below 0 at a later time. The additional 3 bytes per message in memory seem to be affordable. Patch 2: "syslog-ng-2.0.8-group.diff". Handling of "-g" and "-u" options is not mutual exclusive: If group is specified on the command line, but not the user, then the user is a NULL pointer. Calling initgroups() with a null pointer segfaults in our case. And once again, many thanks to Bazsi for the syslog-ng software. -- Roger -- --------------------------------------------------------------- addr://Kasinostrasse 30, CH-5001 Aarau fon://++41 62 823 9355 http://www.terreactive.com fax://++41 62 823 9356 --------------------------------------------------------------- Wir sichern Ihren Erfolg. terreActive AG --------------------------------------------------------------- --- syslog-ng-2.0.8-orig/src/logmsg.h 2008-01-26 16:15:14 +0100 +++ syslog-ng-2.0.8/src/logmsg.h 2008-02-08 13:58:48 +0100 @@ -77,7 +77,7 @@ typedef struct _LogMessage { - guint8 ref_cnt; + guint ref_cnt; guint8 flags; guint8 pri; guint8 num_re_matches; --- syslog-ng-2.0.8-orig/src/main.c 2007-12-27 11:55:59 +0100 +++ syslog-ng-2.0.8/src/main.c 2008-02-08 18:31:49 +0100 @@ -287,7 +287,8 @@ if (uid || gid || run_as_user) { setgid(gid); - initgroups(run_as_user, gid); + if (run_as_user) + initgroups(run_as_user, gid); setuid(uid); } return 1;

2 2

Re: [syslog-ng] Problems with short messages
by Guy Fleegman 13 Feb '08

13 Feb '08

I see what you are saying... I don't think the length of a packet either 1024 or 69 bytes in length is causing the problem. The problem is that the second frame (the 69 byte one) is not going to the appropriate file. It is going to the default "catch all" file instead of the one it should be. If you look at the actual packet code... I believe the applications part of the header is missing on the 69 byte packet. Would this cause syslog-ng to dump the packet into the default catch all file as opposed to the one specified by IP? Please advise and thanks, Chris -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Monday, February 11, 2008 4:04 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Problems with short messages On Sun, 2008-02-10 at 08:03 -0500, Guy Fleegman wrote: > The first packet is only 1066 bytes long... and the second one is 69. > I thought that the default log msg size was 8192...so i was not > thinking that adjusting that in either direction would make a > difference.... should it? If it's over your desired length, then you don't need to adjust that. The problem is that if you're using the UDP transport, messages terminated by the datagram borders, e.g. each message is a separate frame. Syslog-ng will happily process UDP frames over 1024 bytes (even thought the RFC says that's the limit), so change the sender to send it out with a single frame. -- Bazsi

3 2

usertty
by Anurag Agarwal 12 Feb '08

12 Feb '08

Hello everybuddy, I am using syslog-ng and used usertty in destination. I am using a user 'test' as destination. But other users can also see the message on their console e.g root and other users. Please help as this is creating a problem and NG not working as desired. OS: Solaris 10 Anurag aggarwal GSM: +91-9811511699 mailto:anurag.agarwal@telsima.com Skype: anuraganuj Yahoo IM: anuraganuj

1 0

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. : EricSavidan/France/Equant is out of the office. : EricSavidan/France/Equant isout of the office. : Re:anybody usingflags(fallback) ?
by eric.savidan＠orange-ftgroup.com 11 Feb '08

11 Feb '08

I will be out of the office starting 11/02/2008 and will not return until 18/02/2008. Pour tout problème sur bongrain et valrhona, veuillez contacter M. Abdelmounim Baroudi (02 23 28 64 96) Pour tout autre problème SB Alliance, veuillez contacter M. Hervé Samson (01 44 45 12 91) Pour tout autre problème urgent, veuillez contacter Mme Gwenola Wyckens (02 23 28 33 15)

1 0

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. : EricSavidan/France/Equant is out of the office. : Re:anybody usingflags(fallback) ?
by eric.savidan＠orange-ftgroup.com 11 Feb '08

11 Feb '08

I will be out of the office starting 11/02/2008 and will not return until 18/02/2008. Pour tout problème sur bongrain et valrhona, veuillez contacter M. Abdelmounim Baroudi (02 23 28 64 96) Pour tout autre problème SB Alliance, veuillez contacter M. Hervé Samson (01 44 45 12 91) Pour tout autre problème urgent, veuillez contacter Mme Gwenola Wyckens (02 23 28 33 15)

1 0

Eric Savidan/France/Equant is out of the office. : Eric Savidan/France/Equant is out of the office. : Re:anybody using flags(fallback) ?
by eric.savidan＠orange-ftgroup.com 11 Feb '08

11 Feb '08

I will be out of the office starting 11/02/2008 and will not return until 18/02/2008. Pour tout problème sur bongrain et valrhona, veuillez contacter M. Abdelmounim Baroudi (02 23 28 64 96) Pour tout autre problème SB Alliance, veuillez contacter M. Hervé Samson (01 44 45 12 91) Pour tout autre problème urgent, veuillez contacter Mme Gwenola Wyckens (02 23 28 33 15)

1 0