- syslog-ng - lists.balabit.hu

udp 514 collision?
by Richard Morgan 25 Jan '08

25 Jan '08

Hi all- We're running syslog-ng in relay mode on a server which collects the udp syslogs from generic syslogd on a number of Linux and Solaris hosts in a single location. All the hosts around the collector are able to send logs to the collector, via 514/udp, and the logs are relayed on to our master server successfully. The problem comes on the relay host itself. We want to run syslog-ng as independently as possible and not have it replace the local syslogd. So, the local syslogd should send its logs via 514/udp to the syslog-ng instance. On RHEL4, it seems that the generic syslogd is showing as bound to 514/udp and any messages that the local syslogd would send on to syslog-ng are lost. Remember, this is all happening on the same host. Any syslog messages from other hosts arrive at the syslog-ng relay and are swiftly relayed on to the master server. # netstat -an | grep 514 tcp 0 0 149.174.133.19:514 0.0.0.0:* LISTEN tcp 0 0 149.174.133.19:9605 IP.FOR.SYSLOG-NG.MASTER:9514 ESTABLISHED (I think this piece is the problem:) udp 0 0 0.0.0.0:514 0.0.0.0:* udp 0 0 149.174.133.19:514 0.0.0.0:* syslog-ng Config bits: ------------------------------------------------------ source s_remote { tcp(localip(149.174.133.19) port(514)); udp(localip(149.174.133.19) port(514)); }; destination d_relay { tcp("IP.FOR.SYSLOG-NG.MASTER" port(9514)); }; log { source(s_remote); destination(d_relay); }; ------------------------------------------------------- Any ideas? Richard -------------------------------------------------------- Richard R. Morgan | richard at northerncrown.com --------------------------------------------------------

2 1

compilation problem
by Siwei Zhang 23 Jan '08

23 Jan '08

Hi there, I am trying to compile the syslog-ng-2.0.7 on CentOS 5 but failed with the following errors. Could someone help please? Thanks. Kevin SZ checking for LIBNET... which: no libnet-config in (/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin) no checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... yes checking whether to enable spoof source support... no checking whether to enable IPv6 support... yes checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... no configure: error: Cannot find GLib library version >= 2.2: is pkg-config in path? -bash-3.1$

4 4

HUP to syslog-ng does not close files
by Beirne Konarski 22 Jan '08

22 Jan '08

I'm upgrading from syslog-ng 2.0rc3 to 2.0.7. One thing that no longer works is when I send syslog-ng a hangup signal the currently open files aren't closed and reopened when the config file is reread. I verified this by running an lsof on syslog-ng and I see that it has files open that say "Deleted" next to the filename in the lsof output. If I send syslog-ng a hangup signal without deleting I files I do see a log entry that the config file is being reread. Because of all this I have had to change the restart line in the logrotate configuration from "syslog reload" to "syslog restart". Is this expected? Thanks, Beirne

2 1

Resolving host IPs on the central log server
by Steve Bernacki 21 Jan '08

21 Jan '08

My setup is pretty simple: I have a number of local syslog-ng "collectors" feeding into one central syslog-ng server. All systems are running syslog-ng 2.0.7. I'd like to optimize the collectors for speed and thus not attempt to resolve hostnames there, but rather pass the syslog message raw to the central log server who then performs the IP->DNS translation and writes the message to disk. I've experimented with the various dns_* options to no avail, as it seems like syslog-ng wants to either resolve the hostname at the collector, or not at all. Am I missing something simple here, or is this not possible with 2.0.7? Thanks for your help. Steve -- Steve Bernacki, Jr To date, the Pan-Massachusetts Challenge has raised 204 million dollars for cancer research. Get involved! http://www.pmc.org/

3 2

syslog-ng 2.0.7 major problem
by Balazs Scheidler 21 Jan '08

21 Jan '08

Hi, I've been biten by a non-trivial change in the 2.0.x branch again, so there's a quite severe problem in 2.0.7: - it does not close and reopen files when a SIGHUP is received. This causes problems for log rotation, especially if the files are compressed after rotation. The problematic patch is this: http://git.balabit/cgi-bin/gitweb.cgi?p=syslog-ng/syslog-ng--mainline--2.0.… I've pushed an experimental patch to fix the issue: http://git.balabit/cgi-bin/gitweb.cgi?p=syslog-ng/syslog-ng--mainline--2.0.… I'm goint to be much stricter to myself when deciding whether to include a patch to the 2.0.x branch in the nearfuture. Sorry for the problem. -- Bazsi

4 6

Re: [syslog-ng] Date and Host in Syslog Format Need Swapping
by infosec＠gmail.com 18 Jan '08

18 Jan '08

According to basic syslog message formatting rules the hostname in that message *is* indeed "2008", unfortunately. Either use bad_hostnames("2008") or set keep_hostnames() to no or false (or whatever the negative is) and use DNS to get the hostnames. To understand why "2008" is the hostname read the page called something like "about syslog" linked off the syslog-ng FAQ. -----Original Message----- From: <wiskbroom(a)hotmail.com> Subj: [syslog-ng] Date and Host in Syslog Format Need Swapping Date: Wed Jan 16, 2008 12:46 pm Size: 440 bytes To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Hello: I have an appliance that I've configured to send logs to syslog, but it is sending to a file named 2008.log instead of $FULLHOST.log None of the other logs that I am getting contain the year, but for some reason, this one is. Below is a sample of the log itself. Jan 16 15:31:06 2008 [192.168.100.1] Is it possible to ignore the YEAR and make output go to $FULLHOST.log ? Thank you, .vp --- attachment noname 1.txt ---

6 14

[Bug 16] New: program destination driver no longer sends TAG to STDIN in 2. 0.6
by bugzilla＠bugzilla.balabit.com 17 Jan '08

17 Jan '08

https://bugzilla.balabit.com/show_bug.cgi?id=16 Summary: program destination driver no longer sends TAG to STDIN in 2.0.6 Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: llarian(a)llarian.net Type of the Report: --- Estimated Hours: 0.0 After an upgrade from 1.6.11 to 2.0.6, it appears that the program destination driver no longer sends the priority/facility tag to stdout, despite the docs saying it transfers using the wire protocol of syslog. The following is the output of a perl script that does nothing but log stdin: Jan 15 15:46:57 192.168.105.10/206.208.46.253 10054: Jan 15 15:46:55.948 PST: %SYS-5-CONFIG_I: Configured from console by dylanv on vty0 (192.168.113.34) 1.6.11 prefixes this with the correct <45> output. Is this expected behavior and is there a way to get it to send the raw syslog packet to the program destination? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

Excessive Log Statistics
by Baxter, Scott 14 Jan '08

14 Jan '08

I apologize for this spam in advance as this may have been addressed in the past. How can I suppress the following frequent logging: syslog-ng[28465]: Log statistics; dropped='tcp(AF_INET(10.101.205.188:10514))=0', processed='center(queued)=179', processed='center(received)=44', processed='destination(d_auth)=0', processed='destination(d_cron)=42', processed='destination(d_mlal)=0', processed='destination(remote)=9', processed='destination(d_mlop)=0', processed='destination(d_mesg)=86', processed='destination(d_mlrt)=0', processed='destination(d_cons)=0', processed='destination(d_mail)=42', processed='source(s_sys)=44' Charles Schwab|T E C H N O L O G Y I N N O V A T I O N _____________________________________ Scott W Baxter Sr. Staff Phone: (602) 977-4565 UNIX Certification and Engineering Cell: 602-793-3909 Charles Schwab & Co., Inc. Phoenix Data Center 4750A E Francisco Dr. 01-435 Phoenix, Arizona 85044 scott.baxter(a)schwab.com Member:SIPC ________________________________________________ All email sent to this address will be received by the Charles Schwab & Co., Inc. corporate email system and is subject to archival and review by someone other than the recipient.

3 2

Re: [syslog-ng] Upgrade from 1.6.11 to 2.0.7: Gotchas?
by Ivey, Chris 14 Jan '08

14 Jan '08

Thanks, Bazsi! I was wondering if there is anything documented on the upgrade path, or if there is anything documented on the downgrade if the upgrade is not successful. I like to have documents to fall back on, when I try to do something for the first time. :o) Thanks!!! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Sunday, January 13, 2008 3:10 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Upgrade from 1.6.11 to 2.0.7: Gotchas? On Fri, 2008-01-11 at 08:03 -0600, Ivey, Chris wrote: > Folks, > I need to upgrade my syslog-ng from 1.6.11 to 2.0.7 since we > now are using devices with high resolution timestamps. As I inherited > these machines, and had not worked with syslog-ng prior to getting > them, I was wondering if anyone could let me know if there were any > gotchas for the upgrade. Can I upgrade in place? Do I need to make > backups of any files? Things of this nature. Thanks, all! > You can upgrade in place, the 2.0 version is upward compatible with 1.6.x, however as it is a complete rewrite, I'd suggest you to run the configuration file on a 2.0 first to see if it parses ok. Once the configuration file is processed by the new version then most probably it will work well. You can upgrade in place as if you encounter problems you can always go back to 1.6.x without pain. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog-ng roadmap for 2.1 & 2.2
by Balazs Scheidler 13 Jan '08

13 Jan '08

Hi, I have published some details about our plans on syslog-ng 2.1 and 2.2 on my blog, please read this port for more details: http://bazsi.blogspot.com/2008/01/syslog-ng-roadmap-21-22.html As described there I'm going to open two syslog-ng OSE branches at about the same time: syslog-ng OSE 2.1: * destined to get the PE features that we decided to be open-sourced: SQL destination * no real development process as most changes are already released in the Premium Edition * once released, 2.0 is becoming a strict maintenance branch, nothing but bugfixes syslog-ng OSE 2.2: * developed in parallel with the PE version * the new features that we planned in the PE and we decided to open-source right from the start will be released in this branch, these are: * support for the new IETF syslog protocol * sequence numbering of messages * message parsing/rewriting I hope to get syslog-ng 2.1 out of the door real soon now, the git repository is already opened: http://git.balabit.hu/?p=bazsi/syslog-ng-2.1.git;a=summary I'm going to put together a "beta" release of syslog-ng OSE 2.1 in the nearfuture. I'm expecting syslog-ng 2.2 to be opened in the coming weeks, our plans are to release syslog-ng PE 2.2 in Q1-Q2 2008. -- Bazsi

1 0