- syslog-ng - lists.balabit.hu

Problem when getting data from syslog-ng into a socket program
by Diluka Moratuwage 13 Aug '07

13 Aug '07

Hi, I have a little problem which I need to solve. I wrote a small program, which listens to the syslog-ng. I think I have encountered a problem with the timing I'm connecting and disconnecting to the syslog-ng. I almost always get the following msg with other msgs, <43>Aug 11 19:39:03 diluka-laptop syslog-ng[5084]: Connection broken; time_reopen='10' <43>Aug 11 19:39:13 diluka-laptop syslog-ng[5084]: EOF occurred while idle; fd='20' Please let me know whether following code snippet has anything irrelevent or unsuitable. while(1) { int len, read = 0; new_fd = accept(sockfd, (struct sockaddr *)&their_addr, &sin_size); while((len = recv (new_fd, buffer, BUFF_SIZE - 1, MSG_PEEK)) > 0) { read = recv(sockfd, buffer, BUFF_SIZE - 1, 0); buffer[read] = '\0'; printf(buffer); memset(buffer, '\0', BUFF_SIZE * sizeof(char)); break; } close(new_fd); new_fd = 0; } I highly appreciate if you can give some help for me to get the problem solved. Thanks, Diluka.

2 4

Binding error
by Diluka Moratuwage 13 Aug '07

13 Aug '07

Hi, When I'm trying to listen to a port, using syslog-ng the following error occurs. Can u pls help me to figure out the problem. > Starting system logging: syslog-ngError binding socket; addr='AF_INET(10.100.1.67:5000)', error='Cannot assign requested address (99)' Error initializing source driver; source='s_jabber_machine' start failed. < I highly appreciate if you can give me atleast a hint regarding this. Thanks, Diluka.

2 3

My server that listens to Syslog-ng
by Diluka Moratuwage 12 Aug '07

12 Aug '07

Hi, I wrote a program which listens to a port (5001), which the syslog-ng was configured to write to. Everything works fine, but sometimes I get msgs like, <43>Aug 11 19:39:03 diluka-laptop syslog-ng[5084]: Connection broken; time_reopen='10' <43>Aug 11 19:39:13 diluka-laptop syslog-ng[5084]: EOF occurred while idle; fd='20' Can anybody pls let me know what my mistake would be ??? Following is the code snippet shows how I read from the syslog-ng. I think there is a problem, in the way I read from the syslog-ng. Pls correct me, if I have missed any points. I really appreciate if you can provide me some help in getting through the problem. Thanks, Diluka.

1 1

Re: [syslog-ng] Routers don´t send syslog
by Maurice Manurung 11 Aug '07

11 Aug '07

Can you ping from other routers to the syslog-ng server and vice versa? Have you checked whether there is firewall or ACL in the router toward the syslog server? Warm Regards, Maurice Manurung http://www.flixya.com/referrer.php?ref=osmaniaindo ----- Original Message ---- From: Roberto Dud <roberto.dud(a)gmail.com> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Sent: Thursday, August 9, 2007 7:51:41 AM Subject: Re: [syslog-ng] Routers don´t send syslog Helo Mrs, Humm...maybe this is my problem. My syslog-ng server is behind a VLAN, the only Router with send syslog messages for the server is the same router with my syslog-ng is conected. Other routers, don´t send. I run tcpdump on the server and don´t get anyone messages, but in the routers everyhting is ok. Other equipments is ok, linux servers and switchs. Have any idea? Thanks, Dud. On 8/8/07, John Hala < john.hala(a)villanova.edu> wrote:I had a similar issue where my Management VLAN was blackholing the messages and it was never getting to the syslog server. I don't know your setup, but I had to blow away this Management VLAN. regards -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu ] On Behalf Of Werner Thal Sent: Wednesday, August 08, 2007 4:33 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Routers don´t send syslog Hallo Roberto, my Router-Config looks similar to yours, so I think this will be correct. So did you check if the router-messages reach your syslog-ng server? If not, just use a sniffer like ethereal/wireshark for that. regards Werner Am Mittwoch, 8. August 2007 05:08 schrieb Roberto Dud: > Mrs, > > I have a lot of Routers configured to send logs to syslog-ng, but isn´t > work. Only 1 router send ok, others 10 not ok. > > My configuration on routers is the same: > > service timestamps debug datetime msec localtime show-timezone > service timestamps log datetime msec localtime show-timezone > > logging <my ip> > logging buffered 10000 debugging > logging trap debugging > > I check with command : > > show logging > > And it´s ok, for me. > > Anyone have a problema with routers? > > Thanks, > > Dud. > -- ___________________________________________________________________________ A Linux-Server is like a tent: no windows, no gates and an apache inside... _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

Syslog-ng" daemon killing the "setroubleshoot" daemon on RHEL5_X86_64
by Shamim 10 Aug '07

10 Aug '07

Hi , When there was no daemon of "syslog-ng" was running ******************************************************************** [root@svllgg181 tmp]# ps -eaf |grep -i syslog-ng root 2631 2597 0 10:58 pts/0 00:00:00 grep -i syslog-ng [root@svllgg181 tmp]# ********************************************************************* in the absence of "syslog-ng" daemon I was easily able to restart the "setroubleshootd" daemon [root@svllgg181 tmp]# /etc/init.d/setroubleshoot restart Stopping setroubleshootd: [ OK ] Starting setroubleshootd: [ OK ] [root@svllgg181 tmp]# ******************************************************************************************* Now I started the "syslog-ng" daemon [root@svllgg181 tmp]# ps -eaf |grep -i syslog-ng root 2718 1 0 10:59 ? 00:00:00 syslog-ng root 2746 2597 0 11:00 pts/0 00:00:00 grep -i syslog-ng [root@svllgg181 tmp]# ***************************************************************************************** And I tried to start the "setroubleshoot", now it gives error. [root@svllgg181 tmp]# /etc/init.d/setroubleshoot restart Stopping setroubleshootd: [ OK ] Starting setroubleshootd: [ OK ] [root@svllgg181 tmp]# Traceback (most recent call last): File "/usr/sbin/setroubleshootd", line 59, in ? from setroubleshoot.config import cfg File "/usr/lib/python2.4/site-packages/setroubleshoot/__init__.py", line 24, in ? log_init(sys.argv[0]) File "/usr/lib/python2.4/site-packages/setroubleshoot/log.py", line 127, in log_init syslog = logging.handlers.SysLogHandler(address='/dev/log') File "/usr/lib64/python2.4/logging/handlers.py", line 602, in __init__ self._connect_unixsocket(address) File "/usr/lib64/python2.4/logging/handlers.py", line 617, in _connect_unixsocket self.socket.connect(address) File "<string>", line 1, in connect socket.error: (13, 'Permission denied') [root@svllgg181 tmp]# [root@svllgg181 tmp]# /etc/init.d/setroubleshoot restart Stopping setroubleshootd: [FAILED] Starting setroubleshootd: [ OK ] [root@svllgg181 tmp]# Traceback (most recent call last): File "/usr/sbin/setroubleshootd", line 59, in ? from setroubleshoot.config import cfg File "/usr/lib/python2.4/site-packages/setroubleshoot/__init__.py", line 24, in ? log_init(sys.argv[0]) File "/usr/lib/python2.4/site-packages/setroubleshoot/log.py", line 127, in log_init syslog = logging.handlers.SysLogHandler(address='/dev/log') File "/usr/lib64/python2.4/logging/handlers.py", line 602, in __init__ self._connect_unixsocket(address) File "/usr/lib64/python2.4/logging/handlers.py", line 617, in _connect_unixsocket self.socket.connect(address) File "<string>", line 1, in connect socket.error: (13, 'Permission denied') Note: "Syslog-ng" daemon killing the "setroubleshoot" daemon. Can anyone please suggest me the cause and any work around. I'm using syslog-ng-2.0.2 release. Thanks in advance Shamim, --------------------------------- Yahoo! Mail is the world's favourite email. Don't settle for less, sign up for your freeaccount today.

3 5

Syslog-ng appears to hang for local requests to log
by Paul Robert Marino 10 Aug '07

10 Aug '07

I just joined the list after seeing in the archive the syslog-ng causing other proccesses to freeze I've seen the same issue in syslog-ng-2.0.2. I also usualy see some error about exciding the maximum number of open files for root. if i happen to be loged in to the box as root I've been able to fix it by restarting syslog-ng. if ive been loged in as my normal useri can usualy run a sudo lsof but when i count the number of open files its onwhere near the number set in /etc/secutiy/limits.conf. i also ocasionaly see this in the logs right before it happens kernel: warning: many lost ticks. kernel: Your time source seems to be instable or some driver is hogging interupts kernel: rip default_idle+0x20/0x23

3 5

Compatability with Windows?
by Burns Andrew 09 Aug '07

09 Aug '07

Hi, I'm trying out Syslog-NG, and it's been working well with Linux, but I've been asked to start monitoring the eventlog of Windows 2000 Servers and Windows 2003 Servers. Is there a plugin or can Syslog-NG read those eventlog entries natively if they are sent to the Syslog-NG server? Any suggestions or tips are appreciated. Thanks, Andrew

6 5

Routers don´t send syslog
by Roberto Dud 09 Aug '07

09 Aug '07

Mrs, I have a lot of Routers configured to send logs to syslog-ng, but isn´t work. Only 1 router send ok, others 10 not ok. My configuration on routers is the same: service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone logging <my ip> logging buffered 10000 debugging logging trap debugging I check with command : show logging And it´s ok, for me. Anyone have a problema with routers? Thanks, Dud.

3 3

Problem with local*
by Javier Terceiro 08 Aug '07

08 Aug '07

Hello list, I am forming a system syslog and have a problem with facility's local*, I have two destinations, the first: filter f_local7_info { facility(local7) and level(info); }; destination df_local7_info { file("/var/log/$R_YEAR-$R_MONTH-$R_DAY/$SOURCEIP/$PROGRAM.error.log" template("$FULLDATE <> $PROGRAM <> $MSGONLY\n") template_escape(no)); }; log { source(s_udp); filter(f_local7_info); destination(df_local7_info); }; and the second: filter f_local6 { facility(local6); }; destination df_local6 { file("/var/log/$R_YEAR-$R_MONTH-$R_DAY/$SOURCEIP/router.log" template("$FULLDATE <> $PROGRAM <> $MSGONLY\n") template_escape(no)); }; log { source(s_udp); filter(f_local6); destination(df_local6); }; The problem is in which some messages with facility local6 are written in disc with facility local7, reason why does not respect its file. An example is the following one: Server:/var/log/10.0.0.51 # ls 239.error.log 241.error.log 244.error.log router.log Server:/var/log/10.0.0.51 # more 239.error.log 2007 Aug 8 03:30:59 <> 239 -- local6 -- <> *Apr 2 05:15:21: %LINK-3-UPDOWN: Interface Serial1/1:19, changed state to down The facility local6 is present in the menssage, but the name of file is $PROGRAM.error.log The version of syslog-ng that i use is 1.6.8. Some idea of so that this happens? -- Power by Debian. A greeting, Javier.

1 0

syslog-ng.conf help - syslog-ng writing everything to 'messages' in addition to $HOST.log
by Kevin Reiter 07 Aug '07

07 Aug '07

All, I'm fairly new to syslog-ng (been using syslogd for many years) and I have a question with the config file syntax. What I'm trying to do is log all remote hosts to /var/log/$HOST.log while keeping the logging host's logs seperate. What I'm seeing is all messages are being written to /var/log/$HOST.log, including the logging system, as well as to /var/log/messages. In a single day, /var/log/messages grows to over 11GB (I'm logging less than 100 devices - Windows servers, routers, and switches.) I haven't quite figured out which part of the config file is causing this to happen, since I'm still going through my growing pains with it. Can someone point me in the right direction with this? This is running on FreeBSD 6.2-RELEASE, and syslog-ng was installed via ports: root@logmeister [~]# pkg_info | grep syslog-ng syslog-ng-2.0.2 A powerful syslogd replacement In /etc/rc.conf I have the following defined: # We want syslog-ng, not the default syslogd: syslog_ng_enable="YES" syslogd_enable="NO" Here's my syslog-ng.conf file (note that I have the swatch portion at the end commented out. I'll figure that out once I get the important issues ironed out.) ------- Begin syslog-ng.conf ------- # /usr/local/etc/syslog-ng.conf # Modified for logmeister (running FreeBSD 6.2-RELEASE SMP) # # options # options { long_hostnames(on); sync(0); use_dns(yes);}; # # sources # source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); udp(); internal(); file("/dev/klog"); }; # # destinations # destination messages { file("/var/log/messages"); }; destination security { file("/var/log/security"); }; destination authlog { file("/var/log/auth.log"); }; destination maillog { file("/var/log/maillog"); }; destination lpd-errs { file("/var/log/lpd-errs"); }; destination xferlog { file("/var/log/xferlog"); }; destination cron { file("/var/log/cron"); }; destination debuglog { file("/var/log/debug.log"); }; destination consolelog { file("/var/log/console.log"); }; destination all { file("/var/log/all.log"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination slip { file("/var/log/slip.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination console { file("/dev/console"); }; destination allusers { usertty("*"); }; #destination loghost { udp("loghost" port(514)); }; # Log all remote hosts to their own file: destination remote { file("/var/log/$HOST.log" owner(root) group(wheel) perm(0644) dir_perm(0700) create_dirs(yes)); }; # # log facility filters # filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_not_authpriv { not facility(authpriv); }; filter f_console { facility(console); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # # log level filters # filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info..emerg); }; filter f_debug { level(debug..emerg); }; filter f_is_debug { level(debug); }; # # program filters # filter f_ppp { program("ppp"); }; filter f_slip { program("startslip"); }; # # *.err;kern.warning;auth.notice;mail.crit /dev/console # log { source(src); filter(f_err); destination(console); }; log { source(src); filter(f_kern); filter(f_warning); destination(console); }; log { source(src); filter(f_auth); filter(f_notice); destination(console); }; log { source(src); filter(f_mail); filter(f_crit); destination(console); }; # # *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages # log { source(src); filter(f_notice); filter(f_not_authpriv); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_mail); filter(f_crit); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # # security.* /var/log/security # log { source(src); filter(f_security); destination(security); }; # # auth.info;authpriv.info /var/log/auth.log log { source(src); filter(f_auth); filter(f_info); destination(authlog); }; log { source(src); filter(f_authpriv); filter(f_info); destination(authlog); }; # # mail.info /var/log/maillog # log { source(src); filter(f_mail); filter(f_info); destination(maillog); }; # # lpr.info /var/log/lpd-errs # log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); }; # # ftp.info /var/log/xferlog # log { source(src); filter(f_ftp); filter(f_info); destination(xferlog); }; # # cron.* /var/log/cron # log { source(src); filter(f_cron); destination(cron); }; # # *.=debug /var/log/debug.log # log { source(src); filter(f_is_debug); destination(debuglog); }; # # *.emerg * # log { source(src); filter(f_emerg); destination(allusers); }; # # uncomment this to log all writes to /dev/console to /var/log/console.log # console.info /var/log/console.log # #log { source(src); filter(f_console); filter(f_info); destination(consolelog); }; # # uncomment this to enable logging of all log messages to /var/log/all.log # touch /var/log/all.log and chmod it to mode 600 before it will work # *.* /var/log/all.log # #log { source(src); destination(all); }; # # uncomment this to enable logging to a remote loghost named loghost # *.* @loghost # #log { source(src); destination(loghost); }; # # uncomment these if you're running inn # news.crit /var/log/news/news.crit # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice # #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; # # !startslip # *.* /var/log/slip.log # log { source(src); filter(f_slip); destination(slip); }; # # !ppp # *.* /var/log/ppp.log # log { source(src); filter(f_ppp); destination(ppp); }; # Log remote hosts to {hostname}.log ####################### ### Local Machine ##### ####################### # *.err;kern.warning;auth.notice;mail.crit /dev/console log { source(src); filter(f_err); destination(console); }; log { source(src); filter(f_kern); filter(f_warning); destination(console); }; log { source(src); filter(f_auth); filter(f_notice); destination(console); }; log { source(src); filter(f_mail); filter(f_crit); destination(console); }; # *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages log { source(src); filter(f_notice); filter(f_not_authpriv); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_mail); filter(f_crit); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # security.* /var/log/security log { source(src); filter(f_security); destination(security); }; # auth.info;authpriv.info /var/log/auth.log log { source(src); filter(f_auth); filter(f_info); destination(authlog); }; log { source(src); filter(f_authpriv); filter(f_info); destination(authlog); }; # mail.info /var/log/maillog log { source(src); filter(f_mail); filter(f_info); destination(maillog); }; # cron.* /var/log/cron log { source(src); filter(f_cron); destination(cron); }; # *.=debug /var/log/debug.log log { source(src); filter(f_is_debug); destination(debuglog); }; # *.emerg * log { source(src); filter(f_emerg); destination(allusers); }; ####################### ### Remote Hosts ###### ####################### # *.err;kern.warning;auth.notice;mail.crit log { source(src); filter(f_err); destination(remote); }; log { source(src); filter(f_kern); filter(f_warning); destination(remote); }; log { source(src); filter(f_auth); filter(f_notice); destination(remote); }; log { source(src); filter(f_mail); filter(f_crit); destination(remote); }; # *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err log { source(src); filter(f_notice); filter(f_not_authpriv); destination(remote); }; log { source(src); filter(f_kern); filter(f_debug); destination(remote); }; log { source(src); filter(f_lpr); filter(f_info); destination(remote); }; log { source(src); filter(f_mail); filter(f_crit); destination(remote); }; log { source(src); filter(f_news); filter(f_err); destination(remote); }; # security.* log { source(src); filter(f_security); destination(remote); }; # auth.info;authpriv.info log { source(src); filter(f_auth); filter(f_info); destination(remote); }; log { source(src); filter(f_authpriv); filter(f_info); destination(remote); }; # mail.info log { source(src); filter(f_mail); filter(f_info); destination(remote); }; # cron.* log { source(src); filter(f_cron); destination(remote); }; # *.=debug log { source(src); filter(f_is_debug); destination(remote); }; # *.emerg log { source(src); filter(f_emerg); destination(remote); }; # local.* log { source(src); filter(f_local0); destination(remote); }; log { source(src); filter(f_local1); destination(remote); }; log { source(src); filter(f_local2); destination(remote); }; log { source(src); filter(f_local3); destination(remote); }; log { source(src); filter(f_local4); destination(remote); }; log { source(src); filter(f_local5); destination(remote); }; log { source(src); filter(f_local6); destination(remote); }; log { source(src); filter(f_local7); destination(remote); }; # send all logs to swatch for (near) real-time alerts #log { # source(src); # destination(swatch); #}; ------- End syslog-ng.conf ------- Many Thanks, Kevin Reiter Senior Security Engineer Financial Services, Inc. 21 Harristown Road Glen Rock, New Jersey 07452 (201)652-6000, ext. 588 PGP ID: 0xEE665233 This message may contain confidential or proprietary information and is intended solely for the individual(s) to whom it is addressed. If you are not a named addressee you should not disseminate, distribute or copy this e-mail or act upon the information contained herein. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.

2 3