- syslog-ng - lists.balabit.hu

Cannot open file for writing (Permission denied)
by Ian Marlier 06 Aug '07

06 Aug '07

This is driving me up a wall, and I'm hoping that someone can give me some help... I'm trying to set up a server that's going to take syslog messages coming in on local5, and put them in a log file. I've defined a source that listens on all interfaces, on UDP port 514. That seems to be working fine -- netstat shows that syslog is listening on that port, and messages do come in on it. I've got a filter set up as filter f_comblog { facility(local5); }; I've got a destination set up this way: destination d_comblog { file("/space/comblog/local5" perm(0644)); }; And the the log statement is defined this way: log { source(netsrc); filter(f_comblog); destination(d_comblog); }; No complaints from syslog-ng about the syntax or anything else. The trouble that I'm having is that syslog-ng refuses to open the destination file for writing, giving me the message "Cannot open file /space/comblog/local5 for writing (Permission denied)" I get this message even with permissions relaxed all the way to 0777, on the file itself, on the directory in which the file is located, and even on the directory above that. I can create another file in the directory with identical permissions, and open it, write to it, etc with vi, so there isn't a problem with the partition being ro or anything like that. `lsof` indicates that no other process has the log file open for reading, writing, or anything else. Syslog-ng is running as root. The one thing that occurs to me is that there might be some problem with my mount tree. The directory /space has a partition mounted to it, and then /space/comblog has a different partition mounted on it. Is that something that would cause a problem for syslog-ng? I tried doing an strace, which was uninformative -- it just shows an "-1 EPERM" exit when syslog-ng tries to open the file. I'm going crazy with this one...anyone? Thanks! - Ian

2 2

syslog-ng-2.0.5 on HP-UX 11.11
by Uwe Martin 06 Aug '07

06 Aug '07

Hello, I try to compile the new version 2.0.5 on HP-UX 11.11. configure is running without erorrs. (./configure --enable-dynamic-linking) make stops with the following error : if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -DLIBNET_BIG_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -g -MT afinet.o -MD -MP -MF ".deps/afinet.Tpo" \ -c -o afinet.o `test -f 'afinet.c' || echo './'`afinet.c; \ then mv -f ".deps/afinet.Tpo" ".deps/afinet.Po"; \ else rm -f ".deps/afinet.Tpo"; exit 1; \ fi afinet.c: In function 'afinet_setup_socket': afinet.c:163: error: storage size of 'mreq' isn't known afinet.c:163: warning: unused variable 'mreq' *** Error exit code 1 How can I solve this problem ? kind regards Uwe Martin Festo AG & Co. KG Uwe Martin Abteilung IN-O Network-Operation Obere Kaiserstraße 303 D - 66386 St. Ingbert Tel: ++49 (0) 6894-591-6323 Fax: ++49 (0) 6894-591-6326 http://www.festo.com Der Inhalt dieses E-Mails ist ausschliesslich fuer den bezeichneten Adressaten bestimmt. Jede Form der Kenntnisnahme, Veroeffentlichung, Vervielfaeltigung oder Weitergabe des Inhalts dieses E-Mails durch unberechtigte Dritte ist unzulaessig. Wir bitten Sie, sich mit dem Absender des E-Mails in Verbindung zu setzen, falls Sie nicht der Adressat dieses E-Mails sind und das Material von Ihrem Computer zu loeschen. This e-mail and any attachments are confidential and intended solely for the addressee. The perusal, publication, copying or dissemination of the contents of this e-mail by unauthorised third parties is prohibited. If you are not the intended recipient of this e-mail, please delete it and immediately notify the sender. Rechtsform: Kommanditgesellschaft Sitz: Esslingen a.N. Registergericht Stuttgart HRA 211583 Umsatzsteuerident-Nummer: DE 145339206 Persoenlich haftende Gesellschafterin:Festo Aktiengesellschaft Sitz: Stuttgart Registergericht Stuttgart HRB 18535 Vorstand: Dr. Ekkehard Gericke, Lothar Kempf, Dipl.-Ing. Rudi Menrad Dr. Thomas Rubbe Dr. Eberhard Veit (Sprecher) Dr. Ulrich Walker Aufsichtsratsvorsitzender: Dr. Wilfried Stoll

7 14

Frances Wand/Poughkeepsie/IBM is out of the office.
by Frances Wand 06 Aug '07

06 Aug '07

I will be out of the office starting 08/06/2007 and will not return until 08/13/2007. Please call my cell phone listed in blue page for urgent issues. Thank you!

1 0

Syslog_ng-2.0.2-Post install reboot problems
by Shamim 02 Aug '07

02 Aug '07

Hi All, Please sugget me the possible cause of the below error message. ********************************************************************************************************** The following error message is seen during a post install reboot. This appears to be related to the installation of the Syslog_ng-2.0.2 . These messages will appear during system startups and additional messages will be generated as a result of the setroubleshootd daemon not being present. Subsequent removal the Syslog_ng-2.0.2 corrects this issue. Starting setroubleshootd: [ OK ] Starting NFS statd: [ OK ] Traceback (most recent call last): File "/usr/sbin/setroubleshootd", line 59, in ? from setroubleshoot.config import cfg File "/usr/lib/python2.4/site-packages/setroubleshoot/__init__.py", line 24, in ? log_init(sys.argv[0]) File "/usr/lib/python2.4/site-packages/setroubleshoot/log.py", line 127, in log_init syslog = logging.handlers.SysLogHandler(address='/dev/log') File "/usr/lib64/python2.4/logging/handlers.py", line 602, in __init__ self._connect_unixsocket(address) File "/usr/lib64/python2.4/logging/handlers.py", line 617, in _connect_unixsocket self.socket.connect(address) File "<string>", line 1, in connect socket.error: (13, 'Permission denied') Starting RPC idmapd: [ OK ] Starting system message bus: [ OK ] Starting Bluetooth services: [ OK ] ***************************************************************************************************** Thanks --------------------------------- Yahoo! Mail is the world's favourite email. Don't settle for less, sign up for your freeaccount today.

2 1

Syslog-ng appears to hang for local requests to log
by Russell Fulton 01 Aug '07

01 Aug '07

Hi Folks We operate a central syslog server for several thousand system on a linux box running syslog-ng 2.0rc3. For some time we have noticed that the machine hosting the service slowly locks up and we then have to reset the power to restart it. Recently we significantly increased the load on the box and now this is happening about once a week. Here are the symptoms we observer: 1. service to systems sending logs to the host are not affected. Logs continue to get written to disk 2. Cron jobs hang 3. login attempts hang 4. as do sudo attempts. 5. ssh sessions that were established before things turned to custard are not affected 6. top, sar etc. don't show anything unusual 7. ps shows hung cron jobs but nothing else unusual We are guessing that syslog-ng is causing any local process that tries to log to hang. In particular login, sudo and cron all cause login activity. If the system is left it eventually runs out of swap and processes. What we will do is to establish an ssh session to root so next time things come unstuck we can restart syslog-ng to see if that gets things going again. Any idea what is wrong or what we can do to diagnose the problem. Russell

3 3

$EVENT_SOURCE and $USERNAME are blank
by Gustavo Soares 01 Aug '07

01 Aug '07

Hi all! When I try to capture the EVENT_SOURCE or USERNAME variables within the template clause, these fields are logged blank in the log file. here is an excerpt of my configuration file.. destination local6 { file("/opt/logserver/log4j/$HOST/$YEAR/$MONTH/received.$DAY$MONTH$YEAR.log" template("$DATE User:$USERNAME $EVENT_SOURCE $MESSAGE\n") template_escape(yes) owner(watcher) group(other) create_dirs(yes)); }; anybody knows why this occurs? Cheers, Gustavo

2 2

[Fwd: [issue365] FreeBSD ports/111462 - syslog-ng2 default configuration file path]
by Brian A. Seklecki 31 Jul '07

31 Jul '07

FYI some 3 months later this patch has been merged back into Ports. http://www.freebsd.org/cgi/query-pr.cgi?pr=111462 ~BAS -------- Forwarded Message -------- > Reply-To: Network Operations issues/ smcafee(a)collaborativefusion.com, > wmoran(a)collaborativefusion.com > Subject: [issue365] FreeBSD ports/111462 - syslog-ng2 default > configuration file path > Date: Mon, 30 Jul 2007 14:36:07 -0000 > > Brian Seklecki <bseklecki(a)collaborativefusion.com> added the comment: > > Patch committed -- Please start ... > > --- > > Date: Sat, 28 Jul 2007 22:28:29 GMT > From: pav(a)FreeBSD.org > To: bseklecki(a)collaborativefusion.com, pav(a)FreeBSD.org, linimon(a)FreeBSD.org > Subject: Re: ports/111462: syslog-ng2 default configuration file path > > Synopsis: syslog-ng2 default configuration file path > > State-Changed-From-To: open->closed > State-Changed-By: pav > State-Changed-When: Sat Jul 28 22:20:11 UTC 2007 > State-Changed-Why: > Committed the maintainer's patch. > > http://www.freebsd.org/cgi/query-pr.cgi?pr=111462 > ____________________________________________________________

1 0

Fail to write facility local0
by Javier Terceiro 31 Jul '07

31 Jul '07

Hello, I have this config file: filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; destination df_local1 { file("/mnt/log/$R_YEAR-$R_MONTH-$R_DAY/$SOURCEIP/local.log" template("$FULLDATE <> $PROGRAM <> $MSGONLY\n") template_escape(no)); }; log { source(s_tcp); source(s_internal); source(s_udp); source(s_unix); filter(f_local0); filter(f_local1); destination(df_local1); }; When an event arrives at the system by facility local0 or local1, this one is registered in the file never. Can be some bug of syslog-ng or failure in config? some idea of so that this one failure happens? Best regards and thanks in advance. -- A greeting, Javier.

4 3

syslog-ng log rotation
by Root Administrator 27 Jul '07

27 Jul '07

Hi All PLz GIVE ME A CLUE !!! [Platform] Solaris 9 for sparc syslog-ng 2.0.4 [Plan] Syslog-ng writes logs to local file. Log rotation function is required to be implemented as in its configuration rather than using other UNIX standard logrotation. Rotation is planned to be executed in one minute interval. And, we gather five of this one minute rotated file and archive them in one file. This is the brief plan. Could anyone please give me a clue to do this !!! I appreciate the detailed clue !!!

2 1

Solaris-9 Syslog-ng
by Rory Savage 27 Jul '07

27 Jul '07

I just installed syslog-ng on a Solaris 9 (SPARC) server. It will not log anything to the console nor to /var/adm/messages. Does anyone have any idea of what I am doing wrong? No existing syslog processes are running, I killed them and stopped them from start on reboot. I can not reboot this server now, it is something that has to remain up and running. The service is running: # ps -ef|grep syslog-ng root 29422 29002 0 17:33:14 pts/3 0:00 grep syslog-ng root 29364 1 0 17:27:44 ? 0:00 /usr/local/sbin/ syslog-ng -f /etc/syslog-ng/syslog-ng.conf -p /etc/syslog-ng/sy My /var/run/syslog_door file exists: # ls -la /var/run/syslog_door Drw-r--r-- 1 root other 0 Jul 25 16:49 /var/run/ syslog_door The contents of my syslog-ng.conf file: # syslog-ng configuration file. # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20070727 rsavage(a)nuvox.net options { sync (1); time_reopen (10); log_msg_size(8192); log_fifo_size(2048); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats(3600); mark_freq(1); }; source s_sys { internal(); sun-streams ("/dev/log" door("/var/run/ syslog_door")); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/messages"); }; destination d_mail { file("/var/log/syslog"); }; destination d_auth { file("/var/log/authlog"); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { level(err) or (level(notice) and facility (auth, kern)); }; filter f_filter2 { level(err) or (facility(kern) and level(notice)) or (facility(daemon) and level(notice)) or (facility(mail) and level(crit)); }; filter f_filter3 { level(alert) or (facility(kern) and level(err)) or (facility(daemon) and level(err)); }; filter f_filter4 { level(alert); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(kern) and level(notice); }; filter f_filter7 { facility(mail) and level(debug); }; filter f_filter8 { facility(user) and level(err); }; filter f_filter9 { facility(user) and level(alert); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_mlop); }; log { source(s_sys); filter(f_filter4); destination(d_mlrt); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_auth); }; log { source(s_sys); filter(f_filter7); destination(d_mail); }; log { source(s_sys); filter(f_filter8); destination(d_cons); destination(d_mesg); }; log { source(s_sys); filter(f_filter9); destination(d_mlop); destination(d_mlrt); }; -- Rory Savage, Systems Administrator Nuvox Communications, Server Operations A Data, Voice, and Solutions Provider Email: rsavage(a)nuvox.net

2 2