- syslog-ng - lists.balabit.hu

cisco router logs..
by Anant Athavale 27 Dec '07

27 Dec '07

Dear List: I have configured my linux box to receive logs from cisco router over tcp. The log entries are coming, but instead of a newline character, * (star) is getting inserted into the log. So, log is becoming a single line output. Has anybody faced similar problem? How to resolve this? Regards, Anant Athavale.

2 1

unable to compile on AIX
by Anant Athavale 26 Dec '07

26 Dec '07

Dear List: I am unable to compile syslog-ng on AIX 5.3. I am using the following command to configure. configure EVTLOG_LIBS=-L/usr/local/lib EVTLOG_CFLAGS=-I/usr/local/include/eventlog --enable-static-linking --prefix=/usr/local/syslog-ng When I run make, I get the following error: ld SEVERE ERROR symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. Please suggest me, how to continue. Regards, Anant Athavale.

1 0

[Bug 11] New: Remove non-printable characters from log messages before writing them to disk
by bugzilla＠bugzilla.balabit.com 26 Dec '07

26 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=11 Summary: Remove non-printable characters from log messages before writing them to disk Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=354108 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: Among others, Perl's Sys::Syslog sends message buffers containing non-printable characters (mainly NUL characters - \000) to the local syslog daemon. sysklogd stops writing messages at the first NUL character and is therefore mainly unaffected by this. syslog-ng however, saves the complete buffer to the logfile. This behaviour might be of use to some (especially with non-ASCII character sets), but for most of us, it isn't too nice because it makes grep'ing harder (grep complains about binary file). It would therefore be nice if syslog-ng could at least strip trailing NUL characters from incoming log messages. It might be even nicer if an option was introduced to remove or replace non-printable characters from log messages. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 13] New: Drop older messages instead of new ones if needed
by bugzilla＠bugzilla.balabit.com 25 Dec '07

25 Dec '07

https://bugzilla.balabit.com/show_bug.cgi?id=13 Summary: Drop older messages instead of new ones if needed Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=192054 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I would like to suggest that for a destination that is a pipe (or perhaps any destination that is not a local file) that the oldest messages are deleted to make room for newer messages, rather than the other way around, as is currently being done. This suggestion could perhaps be a configuration option for every destination driver, eg, destination xconsole { pipe("/dev/xconsole" owner("root") lose(oldest)); file("/var/log/xcons.log" owner("root") lose(newest)); }; with the default being backwards compatible with the current policy, ie, lose(newest). -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

Eric Savidan/France/Equant is out of the office. : Run 2 syslog-ng by defferent configurations
by eric.savidan＠orange-ftgroup.com 25 Dec '07

25 Dec '07

I will be out of the office starting 24/12/2007 and will not return until 02/01/2008.

1 0

Cisco Syslog: Wireless Controller Messages
by Ivey, Chris 22 Dec '07

22 Dec '07

Hello everyone, and happy holidays! I came across a weird issue with syslog-ng, and messages coming from the Cisco Wireless Controller devices. When I use ngrep to do a capture from the wire, the alert looks like this: <130> Dec 21 19:20:24.474 iapp_socket_task.c:580 IAPP-3-MSGTAG015: iappSocketTask: iappRecvPkt returned error However, after running through syslog-ng and getting to my syslog file it appears like this (numbers different, message the same): Dec 21 16:01:27 .839 iapp_socket_task.c:580 IAPP-3-MSGTAG015: iappSocketTask: iappRecvPkt returned error So, it appears as though syslog-ng is pulling the milliseconds from the alert (the .839 in the second example) and moving it to the 4th token spot, instead of leaving it attached. Anyone seen this behavior, and more importantly, what do we need to do to fix it? I am on syslog-ng version 1.6.11. Thanks in advance!!! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

2 1

Re: [syslog-ng] Cisco Syslog: Wireless Controller Messages
by G.W. Haywood 22 Dec '07

22 Dec '07

Hi there, On Sat, 22 Dec 2007 Ivey, Chris wrote: > ... it appears as though syslog-ng is pulling the milliseconds from > the alert (the .839 in the second example) and moving it to the 4th > token spot, instead of leaving it attached. Anyone seen this > behavior, and more importantly, what do we need to do to fix it? I > am on syslog-ng version 1.6.11. I wouldn't normally have answered this since I can't comment on the behaviour of 1.6.11 but it is possible that you won't get much other response over the holiday period. Your syslog-ng is rather old - I'm using syslog-ng 2.0.6 - so I guess the first thing for you to do is to try that too. Compliments of the season to all! -- 73, Ged.

1 0

Solaris 10/SPARC patches for 2.0.6
by Albert Chin 21 Dec '07

21 Dec '07

Attached are two patches for syslog-ng-2.0.6 on Solaris 10/SPARC with the Sun C compiler: 1. tests/unit/test_msgparse.c requires __STRING but assumes it exists. 2. LOG_AUTHPRIV is not available on this platform. -- albert chin (china(a)thewrittenword.com)

1 0

lsof shows open files which should be closed
by Nagy Daniel 21 Dec '07

21 Dec '07

Hello, Scenario: this is a log server which receives logs from variuos hosts via TCP. We use time macros, which create a new log file in every hour for each remote host. The problem is, that 'lsof -c syslog-ng' shows, that the logfiles of the previous hours are still open, which exhausts the number of file descriptors after a while. kill -HUP syslog-ng corrects this as a workaround. System: RHEL4 Syslog-ng: 2.0.5 compiled from source Relevant config parts: options { flush_lines(16); flush_timeout(1000); time_reopen (10); log_fifo_size (1000); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats_freq(0); time_sleep(20); time_reap(10); }; source s_net { tcp(max-connections(512)); }; destination d_freemail_pop3{ file("/data/syslog/FP-$YEAR$MONTH$DAY-$HOUR0000-$HOST.log" template ("$YEAR.$MONTH.$DAY $HOUR:$MIN:$SEC $TZOFFSET $HOST $MSG\n") template_escape(no) group("bar") perm(0660)); }; For example 'lsof -c syslog-ng' at 12:20 shows these entries as open (it shows more, there are examples only): syslog-ng 8314 root 10w REG 253,0 1840830 3965325 /data/syslog/TM-20071219-110000-mx08a.log syslog-ng 8314 root 249w REG 253,0 5521445 3965131 /data/bar/data/target/mail/TM-20071219-100000-mx07a.log (deleted) The second is also interesting. After some minutes of an hour change, a script moves the log to an other directory. That's why the path of the second line is changed. But is it still open by syslog-ng? Thanks, Daniel

3 13

Lost messages
by Andrew Séguin 21 Dec '07

21 Dec '07

Hello, I'm sorry if I'm missing something obvious, admittedly I've only had the chance to quickly search through the manuals and mailing list and not read them as deep as I'd like to, yet. I'm working in a project where we were considering replacing syslog to take advantage of reliable transmission over tcp. Performance is a factor for us, so we wrote a short program that simply loops and logs a counter and time stamp (to avoid "last message repeated x messages"). We ran it with syslog (saving locally to a file, and then sending remotely to another station which is logging to file) and got some reference numbers for the hardware/OS (Solaris 10). We then started the same test with syslog-ng. Performance didn't get to be an issue: under the pressure of the performance test, only some 5-600,000 lines are logged although 1,000,000 were sent! We tried a few tweaks to the configuration file for buffering (see below), but it hasn't helped unfortunately. Is there a way to avoid this problem? Will we encounter this same problem on the remote host (considering the remote/logging host is planned to be accepting messages from two servers with a lot of traffic) Thanks for any tips/info! Andrew Seguin ps: here is the configuration file we have used... # # Syslog-ng example configuration file for Solaris # # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.solaris,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Solaris 2.5.1 and below uses the STREAMS driver, above extends it # with doors. For 2.5.1 remove the door() option from the source declaration. # options { sync (0); log_fifo_size (65535); gc_idle_threshold(30); gc_busy_threshold(3000); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/tmp/messages-ng" log_fifo_size(60000)); }; filter filter_local6 { facility(local6); }; log { source(local); filter(filter_local6); destination(all); };

2 3