- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Assistance compiling 1.6.12
by tim.brown＠juno.com 04 Jul '07

04 Jul '07

agreed, unfortunately the latest I've been able to locate for Solaris 9 on sparc is 2.1.3. I would greatly appreciate any pointers to where I might locate a version later that 2.2. -- Carson Gaspar <carson(a)taltos.org> wrote: tim.brown(a)juno.com wrote: > That would be ideal if I could locate a version of glib >= 2.2 for > Solaris 9 on sparc, based on the following: > > checking for GLIB... Requested 'glib-2.0 >= 2.2' but version of GLib is > 2.0.7 > no > configure: error: Cannot find GLib library version >= 2.2: is > pkg-config in path? Download, compile, install. It's not that hard ;-) -- Carson _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _____________________________________________________________ Click for free info on online degrees and make $150K/ year http://track.juno.com/s/lc?u=http://tagline.untd.us/fc/Ioyw6iigA5BTZcRbYLnF…

2 1

One destination stopped logging?
by Hari Sekhon 03 Jul '07

03 Jul '07

Hi, I've got syslog-ng on my mail server and today I noticed while trying to debug something else that there was nothing in the maillog. I thought this was very odd as there should be lots of stuff, so I checked syslog-ng was running. It was but I decided to restart it and then the maillog started to fill up again. Now it's been several days since it's written anything to the mail log, but it has continued writing to the /var/log/messages destination during that time. Here is my config: options { chain_hostnames(off); sync(0); stats(43200); log_fifo_size(30000); }; source src { unix-stream("/dev/log" max-connections(1000)); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; destination d_net { tcp("ip_to_logserver" port(logserver_port) ); }; destination maillog { file("/var/log/maillog"); }; destination mailerr { file("/var/log/mail.err"); }; filter f_mail { facility(mail); }; filter f_mailerr { facility(mail) and level(err); }; filter f_notmailjunk { not (program("postfix/*") and not level(err)); }; log { source(src); filter(f_mail); destination(maillog); }; log { source(src); filter(f_mailerr); destination(mailerr); }; log { source(src); filter(f_notmailjunk); destination(messages); destination(d_net); }; Possible idea: My logserver was flooded as I was doing something else on it and it's likely that logs didn't get through (I know, I know - I wanted a separate machine for this of course but my boss holds the money...). Is it possible that the logger filled up locally backlogged messages for the logserver and this caused logs to be lost for the other destination maillog as syslog-ng was full or something? Does this sound like it or not at all? I am using syslog-ng 1.6.11 by the way. Thanks Hari -- Hari Sekhon

3 5

Constant disconnects
by Tim Boyer 03 Jul '07

03 Jul '07

I'm running 2.0.0, and have eight remote servers logging to a central server. Seven of those servers are running fine; the eighth keeps getting log messages like this: Jun 26 10:41:33 kyushu.denmantire.com syslog-ng[6829]: syslog-ng starting up; version='2.0.0' Jun 26 10:41:33 kyushu.denmantire.com syslog-ng: syslog-ng startup succeeded Jun 26 10:41:33 kyushu.denmantire.com syslog-ng[6829]: EOF occurred while idle;fd='5' Jun 26 10:41:33 kyushu.denmantire.com syslog-ng[6829]: Connection broken; time_reopen='60' My first assumption was a firewall problem, but tcpdump says that data's getting there: 10:42:49.013423 IP kyushu-vpn-cli.denmantire.com.37759 > buran.denmantire.com.5142: S 1168830611:1168830611(0) win 5840 <mss 1460,sackOK,timestamp 316509070 0,nop,wscale 2> 10:42:49.014768 IP buran.denmantire.com.5142 > kyushu-vpn-cli.denmantire.com.37759: S 845996771:845996771(0) ack 1168830612 win 5792 <mss 1460,sackOK,timestamp 39334539 316509070,nop,wscale 7> Any ideas what could be causing the connection to drop - but only on this server? Thanks much, -- Tim Boyer Director IT and Engineering Projects Denman Tire Corporation (330) 675-4249

5 11

Log messages looping back infinitely
by Christopher Cowart 02 Jul '07

02 Jul '07

Hello, I've had a recent problem where my dhcpd logs appear to be arriving and rearriving until /var fills up. My log traffic looks like this (all over udp/syslog and IPSec): ------------+ all logs +----------+ dhcpd logs +------------+ dhcp servers|---------->|log server|------------>|other server|----| ------------+ +----------+ +------------+ | ^ | | all logs except dhcpd | -------------------------------------| This configuration has been in effect and working as expected for about 11 months now. Approximately 2 weeks ago, I was reviewing my morning cronspam and discovered that /var had filled up on my log server. The dhcpd log was the obvious culprit, expanded to fill my entire log partition. I'm attaching sample entries so you can take a look if you are so inclined; I apologize for sanitizing out the data in the messages, but they're both protected data and not important to the discussion at hand. There should be *no* dhcpd log messages originating on the log server. When logging is working properly, the host field in the entries properly reflect their dhcp servers of origin. When logging becomes fubar'd, I see a lot of messages with localhost in that field, all with increasing amounts of whitespace in them. syslog-ng spins the CPU to 100% and proceeds to fill up /var with these "feedback" entries. This has happened 3 times in the past 2 weeks. It always begins at midnight. I checked my crons -- I have an hourly execution of logrotate. It is configured to rotate most of my logs (dhcpd included) once a day, which happens at midnight. It politely runs `pkill -HUP syslog-ng' after truncating the log files; this works successfully for all the other logfiles on the log server and has been working fine for dhcpd for the previous 11 months as well. The other likely candidate for trouble is the "other server" from the diagram above that logs back to the log server. I'm relatively certain that this (alone) is not the cause of the problem. I was painstakingly careful to not generate any feedback loops in its configuration. The incoming udp messages have a dedicated source, which is written to a dedicated destination. I'm having trouble piecing two and two together here. I don't think either of these things are causing the problem, but they're the only obvious culprits. Neither of them, if misconfigured, would explain why the duplicates all appear to come from the localhost. Why would the udp source on the logserver be receiving the messages it sends, but only recently and only immediately after midnight? I haven't had the chance to do a tcpdump yet to see the actual network traffic; twice now I've gotten there after /var was already full and tonight when I did finally catch it in the act, I was too concerned about stopping it to troubleshoot it. Stopping and starting syslog-ng returns my logging into a normal state of affairs. $ uname -a | FreeBSD pitfall.rescomp.berkeley.edu 6.1-RELEASE-p3 FreeBSD | 6.1-RELEASE-p3 #0: Mon Aug 21 15:42:31 PDT 2006 | root@new-pitfall.rescomp.berkeley.edu:/usr/obj/usr/src/sys/RCBSD_1 | i386 $ syslog-ng -V | syslog-ng 2.0.0 First time-stamp in fubar'd logfile: Jun 29 00:00:07 First localhost entry: Jun 29 00:02:19 (Line #256) Last time-stamp in fubar'd logfile: Jun 29 00:08:46 Number of "good" entries: 1266 Number of localhost entries: 1123083 Total number of entries: 1124349 If anyone has tips for continuing my troubleshooting process, please let me know. I'd be tempted to upgrade to 2.0.2 (it's in ports), but given the changelogs didn't mention anything about random feedback loops, I didn't figure it would help much. Thanks in advance for your time, -- Chris Cowart Lead Systems Administrator Network Infrastructure, RSSP-IT UC Berkeley

2 1

Static compilation
by Nicolas de Marqué - Fromentin 02 Jul '07

02 Jul '07

Hello, I have problems with compilation of syslog-ng on a solaris 5.8 : After Syslog-ng Configuration : ./configure --prefix=/tmp/local --disable-spoof-source --enable-static-linking => i have this error : checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib => but i have the correct file : ls -la /tmp/local/lib/libglib-2.0.a -rw-r--r-- 1 outils dinb 2096104 Jun 28 15:51 /tmp/local/lib/libglib-2.0.a Have you an idea about this problem? Nicolas

3 2

error compiling syslog-ng-2.0.2 and syslog-ng-2.0.4+20070626
by Serge Torop 02 Jul '07

02 Jul '07

Hello, then I compiling the syslog-ng-2.0.2 on RedHat Enterpise Linux 4 (kernel 2.6.9-42.ELsmp) I see the message: .. [skip].. rm -f libsyslog-ng.a ar cru libsyslog-ng.a misc.o utils.o messages.o syslog-names.o cfg.o cfg-lex.o cfg-grammar.o macros.o filter.o logmsg.o logpipe.o logsource.o driver.o sgroup.o dgroup.o center.o templates.o logreader.o logwriter.o affile.o afstreams.o afuser.o afprog.o af socket.o afunix.o afinet.o afinter.o children.o stats.o gsockaddr.o fdwrite.o fdread.o memtrace.o dnscache.o ranlib libsyslog-ng.a if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo './'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -Wl,-Bdynamic libsyslog-ng.a(misc.o)(.text+0x3a9): In function `resolve_hostname': /home/tsp/syslog-ng-2.0.2/src/misc.c:185: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:110: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x2b2): In function `log_msg_ref': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:497: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x34e): In function `log_msg_unref': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:511: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xe02): In function `log_msg_ack_block_end': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:631: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref': /home/tsp/syslog-ng-2.0.2/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref': /home/tsp/syslog-ng-2.0.2/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free': /home/tsp/syslog-ng-2.0.2/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new': /home/tsp/syslog-ng-2.0.2/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x2a6): In function `log_template_ref': /home/tsp/syslog-ng-2.0.2/src/templates.c:169: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x30e):/home/tsp/syslog-ng-2.0.2/src/templates.c:180: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error code 1 make[2]: Leaving directory `/home/tsp/syslog-ng-2.0.2/src' make[1]: *** [all-recursive] Error code 1 make[1]: Leaving directory `/home/tsp/syslog-ng-2.0.2' make: *** [all] Error code 2 the same error with syslog-ng-2.0.4+20070626. Is this possible to fix or solve this problem? Thanks for advance. -- Serge P. Torop St.Petersburg, Russia

3 6

AF_INET client dropped connection
by Pol Moal 28 Jun '07

28 Jun '07

Hi, when I restart syslog-ng on a client, the loghost prints these lines: Jun 28 12:28:38 loghost syslog-ng[7068]: AF_INET client dropped connection from w.x.y.z, port 38171 Jun 28 12:28:39 loghost syslog-ng[7068]: AF_INET client connected from w.x.y.z, port 38040 Do I lose some information from the client? If yes, what can I do? thanks ps: sorry for the first post -- Pol Moal - Comité Réseau des Universités |--> http://www.cru.fr

1 0

Assistance compiling 1.6.12
by tim.brown＠juno.com 26 Jun '07

26 Jun '07

Hello, I apologize in advance for my lack of experience and knowledge in this area but I keep encountering the following when I attempt to "make" the 1.6.12 distribution on Solaris 9: Making install in src Making install in . gcc -g -O2 -Wall -I/opt/syslog-ng-1.6.12/libol-0.3.18/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o getopt.o getopt1.o -lpthread -lrt -lnsl -lsocket -ldoor -lresolv -Wl,-Bstatic /opt/syslog-ng-1.6.12/libol-0.3.18/src/.libs/libol.a -lsocket -lnsl -lxnet -lfl -lsocket -lnsl -lnet -Wl,-Bdynamic ld: fatal: library -lxnet: not found ld: fatal: File processing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /opt/syslog-ng-1.6.12/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Current working directory /opt/syslog-ng-1.6.12/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' I've scanned the net for references to "-lxnet" on Solaris and could only determine that is a library routine particular to Linux. I could not find how to provide this on a Solaris platform. Any assistance would be greatly appreciated. Tim _____________________________________________________________ Click here to find a massage therapy school near you. http://track.juno.com/s/lc?u=http://tagline.untd.us/fc/Ioyw6iieZBaNpvMSHkV5…

3 4

RE: syslog-ng 2.0.4 How can syslog-ng achieve this performance???
by Root Administrator 25 Jun '07

25 Jun '07

Geller, Sandor Balazs Scheidler Thanks 4 ur advise. Please pardon me for my short information. The scenario is this, ----- There is a network device which sends logs to syslog server over network at a pace of approx 4000 logs/sec. Syslog server has its own mission to handle them. In case, syslog server must write logs to local disk, the server in fact drops some logs in the local file. Consequently, I turned to think of tuning some tweak in syslog-ng parameter or kernel parameter. I have tuned kernel parameter by setting "udp_recv_hiwat" to its maximum value, and udp_max_buf to the value of 300 times of the default value. And, I have come up with this idea. 1. Increase "sync" parameter to buffer some logs and write logs , not at the pace of every second. I tried to increase sync as well as log_fifo_size. First, I set sync as 3000 , log_fifo_size as 10000. However, it was not liked, with the message " The value of flush_lines must be less than fifo_size; fifo_size='1000',flush_lines='3000' ". Syslog-ng is configured as follows; sync (3000); time_reopen (10); time_sleep(0); log_fifo_size (10000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); source s_test { udp(ip(0.0.0.0) port(514)); }; destination d_local4 { file("/var/log/local4"); }; filter f_local4_al { facility(local4) and level(info) and match("xxxxxx") and filter(test); }; filter test { match("10600[1267]") or match("10601[0-8]") or match ("10602[0124567]") or match("106100") or match("20900[345]") or match("500004"); }; log { source(s_test); filter(f_local4_al); destination(d_local4); }; Any advice about how sync works , and how log_fifo_size works will greatly help. Is there any other way than editing the logwriter.c file and re-compile it? Is there difference between setting sync and log_fifo_size in global option section and individual destination section in terms of its effect? 2. "fsync" parameter would be thouhgt as second chance to overcome this problem. However, no userful information cound not be found on web. I set fsync in destination section, but it was rejected when reloading the process. Any advice about how fsync works will greatly help. In addition, how can I get STATS information of syslog-ng? I have added "stats_freq (60);" in global option section, but I could not get any information in /var/adm/messages. Where does syslog-ng output the stats information? Thanks! Regards George ------------------------------ > > Message: 3 > Date: Wed, 20 Jun 2007 11:12:40 +0900 > From: "Root Administrator" <root.regist(a)gmail.com> > Subject: [syslog-ng] syslog-ng 2.0.4 How can syslog-ng achieve this > performance??? > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <8ee7d730706191912l357ecabfgb137b7297c1bfbf0(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi All, > > NEED HELP!!!!! > > [Environment] > SunOS 5.9 Generic_122300-07 sun4u sparc SUNW > syslog-ng 2.0.4 > disk : single disk (no RAID) > syslog-ng conf (global option part) > sync (3000); > time_reopen (10); > time_sleep(0); > log_fifo_size (10000); > long_hostnames (off); > use_dns (no); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > > [NEED] > I want syslog-ng to write logs to local disk at pace of about 4000 > lines per second without any lines losing. > However, lines were in fact lost in the local file. > I am trying to know the syslog-ng max performable point. > > [Consideration] > "log_fifo_size" in global option is set as 10000. > I tried to set sync() parameter, for instance 3000, in global option > section. > This did not succeed with this messages when reloading the process, > " The value of flush_lines must be less than fifo_size; fifo_size='1000', > flush_lines='3000' ". > The administration guide says "sync" is alias for "flush_lines". > > In addition, resource usage at 4000lines/s load was as below, > > result of vmstat > kthr memory page disk faults cpu > r b w swap free re mf pi po fr de sr s3 sd sd -- in sy cs us sy > id > 0 0 0 3954792 3895288 155 8 353 0 0 0 12 0 2 0 0 669 4368 857 4 3 > 93 > 0 0 0 3955248 3926424 3 8 0 0 0 0 0 0 2 0 0 4112 27017 5889 21 > 15 > 64 > 0 0 0 3955248 3925664 0 0 0 0 0 0 0 0 3 0 0 4120 27251 5653 16 > 19 > 64 > 0 0 0 3955248 3924528 0 0 0 0 0 0 0 0 1 0 0 4129 27251 5914 15 > 18 > 67 > 0 0 0 3955248 3923400 0 0 0 0 0 0 0 0 1 0 0 4113 27236 6052 17 > 15 > 68 > 0 0 0 3955176 3922568 0 0 0 0 0 0 0 0 32 0 0 4156 26028 5405 19 > 13 > 68 > 0 0 0 3955176 3921808 0 0 0 0 0 0 0 0 1 0 0 4161 27316 5757 16 > 18 > 66 > 0 0 0 3955176 3921056 0 0 0 0 0 0 0 0 1 0 0 4120 27254 6136 14 > 18 > 68 > 0 0 0 3955176 3920296 0 0 0 0 0 0 0 0 1 0 0 4110 27244 5648 18 > 17 > 65 > 0 0 0 3955176 3919544 0 0 0 0 0 0 0 0 1 0 0 4115 27253 6042 17 > 19 > 64 > 0 0 0 3955176 3918784 0 0 0 0 0 0 0 0 1 0 0 4108 27238 6469 18 > 16 > 65 > 0 0 0 3955176 3918032 0 0 0 0 0 0 0 0 1 0 0 4107 27235 6106 16 > 18 > 66 > 0 0 0 3955176 3917272 0 0 0 0 0 0 0 0 1 0 0 4139 27264 5850 17 > 18 > 65 > 0 0 0 3955176 3916520 0 0 0 0 0 0 0 0 1 0 0 4107 27259 5867 19 > 14 > 67 > > result of iostat > extended device statistics > r/s w/s kr/s kw/s wait actv wsvc_t asvc_t %w %b device > 0.0 1.0 0.0 775.9 0.0 0.0 0.0 27.3 0 3 c1t0d0s3 > 1.0 2.0 8.0 744.1 0.0 0.0 0.0 11.4 0 3 c1t0d0s3 > 0.0 2.0 0.0 864.0 0.0 0.0 0.0 15.7 0 3 c1t0d0s3 > 0.0 4.0 0.0 856.0 0.0 0.1 0.0 17.3 0 3 c1t0d0s3 > 0.0 1.0 0.0 456.0 0.0 0.0 0.0 19.5 0 2 c1t0d0s3 > 0.0 1.0 0.0 856.1 0.0 0.0 0.0 28.1 0 3 c1t0d0s3 > 0.0 1.0 0.0 855.9 0.0 0.0 0.0 24.4 0 2 c1t0d0s3 > 0.0 1.0 0.0 856.1 0.0 0.0 0.0 27.3 0 3 c1t0d0s3 > 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 c1t0d0s3 > 0.0 1.0 0.0 856.0 0.0 0.0 0.0 19.0 0 2 c1t0d0s3 > 0.0 1.0 0.0 856.0 0.0 0.0 0.0 26.9 0 3 c1t0d0s3 > 0.0 1.0 0.0 832.1 0.0 0.0 0.0 24.8 0 2 c1t0d0s3 > 0.0 1.0 0.0 735.9 0.0 0.0 0.0 26.4 0 3 c1t0d0s3 > 0.0 1.0 0.0 856.1 0.0 0.0 0.0 28.7 0 3 c1t0d0s3 > 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 c1t0d0s3 > > [Question] > Question 1. > Does the "fifo_size" in above message mean "log_fifo_size" in global > option ? > Is the value "fifo_size='1000'" max value ? > Is it possible to set "log_fifo_size" far more than 1000 ? > Is it possible to set "sync" far more than 1000 ? > If possible, then how do I do it ? > > Question 2. > To achieve the NEED, I am considering the parameters below, > sync() > log_fifo_size() > . > Are there any other parameters I MUST consider for syslog-ng > configuration? > > Regards > > George >

2 1

Cisco Loadbalancer and Syslog-ng
by Ajay Chenampara 21 Jun '07

21 Jun '07

Hi everyone, Our syslog-ng server is logging all our cisco css (arrowpoint) syslogs into a file called "5". For all the other network devices, it is getting correctly logged under the host IP. Has anyone experienced this behavior ? Is there a workaround? -ajay --------------------------------- Be a better Globetrotter. Get better travel answers from someone who knows. Yahoo! Answers - Check it out.

2 1