- syslog-ng - lists.balabit.hu

upgraded to 2.0.3 and still time zone problems
by Guy Fleegman 30 Apr '07

30 Apr '07

Hello: I have several sources that are all reporting to a syslog-ng 2.0.3 server My source is source all_routers { udp(ip(0.0.0.0) port(514)); }; My problem is that I have one source that is isolated to a separate file I isolate the file with the following filter f_pd_snort { host(intsnort1); }; and have this destination destination d_pd_snort { file("/var/log/syslog-ng-logs/pd_snort.1" perm(0644) template(t_default)); }; then i use the following command log { source(all_routers); filter(f_pd_snort); destination(d_pd_snort); }; The problem is the format the data is arriving in. It send data in UTC time as follows Apr 30 14:04:35 2007 intsnort1 SFIMS: [119:13:1] Snort Alert [Classification: Unknown] [Priority: 3] Apr 30 14:04:35 2007 intsnort1 SFIMS: [119:4:1] Snort Alert [Classification: Unknown] [Priority: 3] Apr 30 14:04:35 2007 intsnort1 SFIMS: [122:3:0] Snort Alert [Classification: Unknown] [Priority: 3] This is UTC. It is the time that is being sent in the actual packet (I verified with wireshark) I want syslog-ng to modify the times going into this file (and this file only) to reflect EST time. Based upon the documentation The following algorithm is used. 1. The sender can specify the timezone of the messages. If the incoming message includes a timezone it is associated with the message. Otherwise, the local timezone is assumed. 2. The administrator specifies the *time_zone()* <#sourcecommonopts>parameter for the source driver that reads the message. This parameter overrides the original timezone of the message. Each source defaults to the value of the *recv_time_zone()* <#reference_options>global option. 3. The destination driver specifies the timezone via the *time_zone()* <#destcommonopts>parameter. Each destination driver might have an associated timezone value to which message timestamps are converted before they are sent to the final destination (file or network socket). Each destination defaults to the value of the *send_time_zone()* <#reference_options>global option. A message can be sent to multiple destination zones. 4. When macro expansions are used in the destination filenames, the local timezone is used So option #1 is not being done I can't use #2 because my source is defined for all devices I tried using #3..... with the line modified as destination d_pd_snort { file("/var/log/syslog-ng-logs/pd_snort.1" perm(0644) time_zone(-04:00) template(t_default)); }; However.. this does not seem to make any difference... Can you please tell me why option #3 is not working .... and also... why is it that in #1 it is not defauling to just adding the local timezone since the incoming message does not have a timezone specified. Please help and thank you :)

1 0

Re: syslog-ng Digest, Vol 24, Issue 32
by Fabian Pucciarelli 29 Apr '07

29 Apr '07

I have syslog ng writing to a mysql pipe and then a little script reading the pipe and writing to the db. I currently receive many messages like the following, I wonder if somenone can help me figure out what this message is saying..... thanks. | mailux | syslog | notice | notice | 2d | 2007-04-13 | 01:16:40 | syslog-ng | syslog-ng[30548]: Log statistics; dropped='pipe(/tmp/mysql.pipe)=0', processed='center(queued)=40295', processed='center(received)=13206', processed='destination(d_mysql)=40295', processed='source(net_tcp)=0', processed='source(src)=8962', processed='source(net_udp)=4244' | 46674 | On 4/29/07, syslog-ng-request(a)lists.balabit.hu < syslog-ng-request(a)lists.balabit.hu> wrote: > > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: turn off case sensitivity for match regex filter > (Balazs Scheidler) > 2. Re: turn off case sensitivity for match regex filter (stucky) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 28 Apr 2007 12:42:06 +0200 > From: Balazs Scheidler <bazsi(a)balabit.hu> > Subject: Re: [syslog-ng] turn off case sensitivity for match regex > filter > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <1177756926.14925.17.camel(a)bzorp.balabit> > Content-Type: text/plain > > On Sat, 2007-04-28 at 01:52 -0700, stucky wrote: > > Guys > > > > Playing around with ng 2 and I started looking at the match filter > > again. > > Simple question that I cannot find an answer to anywhere on the net. > > How do I turn off case sensitivity for the match target ? > > I'd like the following line to match "error' or 'ERROR' or 'Error' > > > > filter logparse { match("error"); }; > > > > but of course it only matches 'error' since by default regex is case > > sensitive. > > Basically I'm trying to emulate 'grep -i' > > I guess I could do this : > > > > filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo > > much simpler to turn off case sensitivity. > > Yes, you are right. But it's not currently possible. It should be > however, I'll try to add it in the nearfuture. > > > > > And while we're talking regex. Shouldn't the above line actually read > > like this : > > > > filter logparse { match(".+error.+"); }; ? > > > > meaning "anything followed by 'error' followed by anything" > > Both appear to work so I assume the first line is interpreted by > > syslog-ng like the second line correct ? > > syslog-ng interprets "match" the same as grep, e.g. it does not care > where the pattern is found. if you want to match the beginning or the > end of line, you need to use explicit ^ and $ characters. > > -- > Bazsi > > > > ------------------------------ > > Message: 2 > Date: Sat, 28 Apr 2007 12:44:04 -0700 > From: stucky <stucky101(a)gmail.com> > Subject: Re: [syslog-ng] turn off case sensitivity for match regex > filter > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <30997e260704281244g6f1225bfwc7da2b4e05fdfd9f(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Baszi > > Cool. I'm in the middle of building a new infrastructure and would like to > use this feature. I'm not a programmer but I assume adding this feature > shouldn't be very hard at all right ? > If you had a rough ETA that'd help me. > > thx > > On 4/28/07, Balazs Scheidler <bazsi(a)balabit.hu> wrote: > > > > On Sat, 2007-04-28 at 01:52 -0700, stucky wrote: > > > Guys > > > > > > Playing around with ng 2 and I started looking at the match filter > > > again. > > > Simple question that I cannot find an answer to anywhere on the net. > > > How do I turn off case sensitivity for the match target ? > > > I'd like the following line to match "error' or 'ERROR' or 'Error' > > > > > > filter logparse { match("error"); }; > > > > > > but of course it only matches 'error' since by default regex is case > > > sensitive. > > > Basically I'm trying to emulate 'grep -i' > > > I guess I could do this : > > > > > > filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo > > > much simpler to turn off case sensitivity. > > > > Yes, you are right. But it's not currently possible. It should be > > however, I'll try to add it in the nearfuture. > > > > > > > > And while we're talking regex. Shouldn't the above line actually read > > > like this : > > > > > > filter logparse { match(".+error.+"); }; ? > > > > > > meaning "anything followed by 'error' followed by anything" > > > Both appear to work so I assume the first line is interpreted by > > > syslog-ng like the second line correct ? > > > > syslog-ng interprets "match" the same as grep, e.g. it does not care > > where the pattern is found. if you want to match the beginning or the > > end of line, you need to use explicit ^ and $ characters. > > > > -- > > Bazsi > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > > > -- > stucky >

2 1

Trying to define my sources
by Guy Fleegman 27 Apr '07

27 Apr '07

Let me add to what i have changed.... My config now looks like this options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); ts_format (rfc3164); recv_time_zone(+05:00); }; template t_default { template("${DATE} ${YEAR} ${HOST} ${MSG}\n"); template_escape(no); }; source all_routers { udp(ip(0.0.0.0) port(514) time_zone(+05:00)); }; Even when I add the recv_time_zone and then time_zone options the log entries are still showing up in the file as UTC? Here is an example of how they are being logged Apr 27 20:46:59 2007 intsnort1 SFIMS: [119:17:1] Snort Alert [Classification: Unknown] [Priority: 3] {TCP} Why will the date not change? This is how the date look when i sniff iton wireshark.. so i know that is how it is being sent(as UTC) please advise and thanks.

1 0

Trying to define my sources
by Guy Fleegman 27 Apr '07

27 Apr '07

Hello: I am new to syslog-ng I have multiple network devices all sending me their syslog data to a single Linux server. I break the syslog data out to individual files based upon IP addresses. My problem is that I have a few devices that are sending out data in with no timezone information. The simply assume GMT. Is there any way to define my sources so that 1) I can have a default "bucket" source that cathces all syslog data send vi IP unless defined otherwise 2) I can define out individual IP's as "sources" 3) I can have one of the sources automatically apply a timezone i specify? Please advise and thanks, This is my source definition source all_routers { udp(ip(0.0.0.0) port(514)); };

1 0

Mailing list etiquette.
by G.W. Haywood 26 Apr '07

26 Apr '07

Hi there, On Thu, 26 Apr 2007 Shamim wrote: > Message: 1 > Date: Thu, 26 Apr 2007 06:22:00 +0100 (BST) > From: Shamim <shamim_99(a)yahoo.com> > Subject: [syslog-ng] Re: syslog-ng Digest, Vol 24, Issue 28 > To: syslog-ng(a)lists.balabit.hu > Message-ID: <663041.91562.qm(a)web32907.mail.mud.yahoo.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Ravi, > > Download pkgconfig-0.20-sol10-sparc-local.gz fron sunfreeware.com and install on your system. And copy eventlog.pc to path of pkg-config libray path. > > > > Thanks > Shamim > syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > [snip,snip,snip] Please read for example (especially section 2.4) http://www.freebsd.org/doc/en_US.ISO8859-1/articles/mailing-list-faq/etique… -- 73, Ged.

1 0

Re: syslog-ng Digest, Vol 24, Issue 28
by Shamim 26 Apr '07

26 Apr '07

Hi Ravi, Download pkgconfig-0.20-sol10-sparc-local.gz fron sunfreeware.com and install on your system. And copy eventlog.pc to path of pkg-config libray path. Thanks Shamim syslog-ng-request(a)lists.balabit.hu wrote: Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Syslog-ng 2.0.3 compile error (Ravi Papisetti -X (rpapiset - HCL at Cisco)) 2. Syslog-ng 2.0.3 make error (Ravi Papisetti -X (rpapiset - HCL at Cisco)) 3. Re: weird messages from syslog. ()\(@sS) ---------------------------------------------------------------------- Message: 1 Date: Wed, 25 Apr 2007 22:58:07 +0530 From: "Ravi Papisetti -X (rpapiset - HCL at Cisco)" Subject: [syslog-ng] Syslog-ng 2.0.3 compile error To: "Syslog-ng users' and developers' mailing list" Message-ID: <6499201801FBC6419ED8C910302F67AC02EC283B(a)xmb-blr-417.apac.cisco.com> Content-Type: text/plain; charset="us-ascii" Hi, I am trying to configure syslog-ng 2.0.3 on solaris 10 and below is the error checking for EVTLOG... Package eventlog was not found in the pkg-config search path. Perhaps you should add the directory containing `eventlog.pc' to the PKG_CONFIG_PATH environment variable No package 'eventlog' found configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? I have installed libnet-1.20 and libol-0.3.18, then ran ./configure from /syslog-ng-2.0.3. Am I missing something? Thanks, Ravi Kumar P. ------------------------------ Message: 2 Date: Thu, 26 Apr 2007 01:04:06 +0530 From: "Ravi Papisetti -X (rpapiset - HCL at Cisco)" Subject: [syslog-ng] Syslog-ng 2.0.3 make error To: "Syslog-ng users' and developers' mailing list" Message-ID: <6499201801FBC6419ED8C910302F67AC02EC284D(a)xmb-blr-417.apac.cisco.com> Content-Type: text/plain; charset="us-ascii" Hi, I see below error when I run make && make install make all-recursive make[1]: Entering directory `/usr/local/syslog-ng/syslog-ng-2.0.3' Making all in src make[2]: Entering directory `/usr/local/syslog-ng/syslog-ng-2.0.3/src' if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:30:20: libnet.h: No such file or directory In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:592: error: syntax error before ')' token /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:626: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/usr/local/syslog-ng/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/syslog-ng/syslog-ng-2.0.3' make: *** [all] Error 2 Some one could tell me the reason. Thanks, Ravi Kumar P. ------------------------------ Message: 3 Date: Thu, 26 Apr 2007 01:23:05 +0300 From: ")\\(@sS" Subject: Re: [syslog-ng] weird messages from syslog. To: "Syslog-ng users' and developers' mailing list" Message-ID: <770db8dc0704251523q280820d3jdfabc2af9f4f11b7(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" well thats definitely abit of a relief considering all the pc hardware parts are completely new. i don't mind doing a reinstallation of the OS... but here is smth new: i noticed that some of the messages talked abit about 'smbd' and 'printers'.. i decided to comment out 'load printers' from smb.conf and so far (half a day later) i haven't got the messages i ported before... i have some new ones though:) here is a dmesg dump: : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] _nv003589rm+0x26/0x2c [nvidia] [] _nv007223rm+0x23/0x28 [nvidia] [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] _nv002554rm+0xa8/0xb4 [nvidia] [] fcntl_setlk64+0x203/0x290 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] autoremove_wake_function+0x0/0x50 [] dput+0x8a/0x140 [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_alloc_refill+0xcc/0x1e0 [] fcntl_setlk64+0x203/0x290 [] invalidate_inode_buffers+0x1a/0xe0 [] schedule+0x465/0x7a0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] _nv003589rm+0x26/0x2c [nvidia] [] _nv007223rm+0x23/0x28 [nvidia] [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_alloc_refill+0xcc/0x1e0 [] fcntl_setlk64+0x203/0x290 [] invalidate_inode_buffers+0x1a/0xe0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] sock_sendmsg+0xbf/0x110 [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_alloc_refill+0xcc/0x1e0 [] fcntl_setlk64+0x203/0x290 [] invalidate_inode_buffers+0x1a/0xe0 [] hrtimer_run_queues+0x47/0xe0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] sock_sendmsg+0xbf/0x110 [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] change_clocksource+0x12b/0x170 [] update_wall_time+0x190/0x280 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] autoremove_wake_function+0x0/0x50 [] dput+0x8a/0x140 [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] devinet_ioctl+0x2db/0x570 [] inet_sock_destruct+0xbe/0x200 [] _spin_lock_bh+0x8/0x20 [] invalidate_inode_buffers+0x1a/0xe0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb [] rpc_unlink+0xc3/0xf0 ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] _nv003589rm+0x26/0x2c [nvidia] [] _nv007223rm+0x23/0x28 [nvidia] [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_alloc_refill+0xcc/0x1e0 [] fcntl_setlk64+0x203/0x290 [] update_wall_time+0x190/0x280 [] schedule+0x465/0x7a0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] _nv003589rm+0x26/0x2c [nvidia] [] _nv007223rm+0x23/0x28 [nvidia] [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_alloc_refill+0xcc/0x1e0 [] fcntl_setlk64+0x203/0x290 [] invalidate_inode_buffers+0x1a/0xe0 [] hrtimer_run_queues+0x47/0xe0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] autoremove_wake_function+0x0/0x50 [] dput+0x8a/0x140 [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_alloc_refill+0xcc/0x1e0 [] fcntl_setlk64+0x203/0x290 [] schedule+0x465/0x7a0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] sock_sendmsg+0xbf/0x110 [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] fcntl_setlk64+0x203/0x290 [] invalidate_inode_buffers+0x1a/0xe0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] sock_sendmsg+0xbf/0x110 [] autoremove_wake_function+0x0/0x50 [] dput+0x8a/0x140 [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_grow+0x102/0x170 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb [] rpc_unlink+0xc3/0xf0 ======================= root@Stargaze:~# im actually reading somewhere that sky2 network driver for Yukon2 PCI-E Marvell based controllers seems to have hw csum failures... the dump of those is not exactly the same... nass On 4/25/07, Balazs Scheidler wrote: > > On Wed, 2007-04-25 at 14:54 +0300, )\(@sS wrote: > > im sorry i understood nothing of your explanation... :) > > thats due to my lack of any knowledge on the matter.. > > i will get ksymoops but could you break down what you mean by back > > traces and what by 'bogus' > > Oopses basically happen for two reasons: software and hardware failure. > Hardware failures tend to cause mystic and nondeterministic behaviour, > crashing at random locations. On the consistent backtraces I meant that > several of the Oopses that you posted had the same backtrace (e.g. the > same crash location), which indicates that it's more likely a software > related problem. > > The listing I gave you, is the direct x86 dissassembly of the code found > at the crash location, this is reported as a sequence of bytes in the > Oops output, right after the "Code:" label. > > I said it was bogus as it made no sense. This is not valid code, so > either something corrupted the instruction pointer (by jumping to an > invalid function pointer), or something overwrote the stack. > > I checked the oopses again, don't go to LKML, your kernel is tainted > (e.g. it has a proprietary module loaded, they will not help you). > > -- > Bazsi > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

weird messages from syslog.
by )\(＠sS 26 Apr '07

26 Apr '07

hello everyone, i am really weirded out by some of the messages that appear on stdout from syslog and the kernel. i dunno where to turn in order to interpret the messages so i ask if you please take a look.. and perhaps direct me to someone. thank you in advance im setting up a pc that i want to use as server. its characteristics are m/b: Gigabyte - GA965P -DQ6. Northbridge: Intel P965 chipset; Southbridge: Intel ICH8R chipset; supports 6x Sata2 drives in; simple, AHCI, or raid 0,1,5,10,JBOD Gigabyte Sata controller; an additional controller (dunno what driver goes with it in linux kernel) supports 2 additional sata2 ports and raid 0,1 configurations. also: 1x WD 40GB raptor hard drive for the OS and 4x 320GB caviar hard drivers in RAID5 for data. ok i have setup the raid5 and i think it is working fine - it is not of much interest anyway.. i just note it in case you know of smth that is slipping me... also im running slackware 11. with a kernel that compile on my own from v. 2.6.20.7 the important and the reason im writing , is cause im trying to download some files from another pc through an sftp session.. im saving to the 40GB drive. thats /dev/sda1. the name of the pc is 'stargaze' .. now some history: last night twice in trying to copy a big tar.bz2 (100MB) from that pc to stargaze. and at some point it froze ( the pc that is). so i restarted and redid the sftp session.. the file arrived. then i also tried to download with mget ... about 200 photos of size 1MB each. the pc crashed again (btw not even reset button would restart the pc). reboot the pc.. (it took ages cause it would find that the file system is NOT clean and it would initiate 'journal transactions'. ok well that message was perhaps intented for sda1.. but its possible it was for /dev/md0.... anyhow today i tried again the same 2 sftp sessions.. trying to download the same files... it worked the couple of times i tried it... but here is the weird messages im getting... on stdout and /var/log/syslog BUG: unable to handle kernel paging request at virtual address 6dcecdd9 printing eip: c02eb417 *pde = 00000000 Oops: 0000 [#1] SMP Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss appletalk psnap llc ide_scsi generic nvidia(P) snd_hda_intel snd_hda_codec jmicron snd_pcm snd_timer snd snd_page_alloc CPU: 0 EIP: 0060:[<c02eb417>] Tainted: P VLI EFLAGS: 00210046 (2.6.20.7C2D6400,2x1GBRAM800,P965-ICH8R,Marv8056,1x40GB+3x320GBr5 #5) EIP is at radix_tree_lookup+0x37/0x60 eax: 00000000 ebx: 8b372010 ecx: 434ac05a edx: 6dcecdc9 esi: 00000000 edi: 00000000 ebp: f3ccd494 esp: f2f1bd7c ds: 007b es: 007b ss: 0068 Process smbd (pid: 3739, ti=f2f1a000 task=f4243550 task.ti=f2f1a000) Stack: 00000000 00000000 c01488c0 00000052 f3ccd4a4 00000000 00000001 00000000 f7b37cc0 f2f1bda0 f2f1bda0 f2f1be3c f3ccd494 00000000 f7b37cc0 c0148add 00000004 f2f1be3c 00000000 00000001 00000020 c0148d3b 00000004 f2f1be3c Call Trace: [<c01488c0>] __do_page_cache_readahead+0x90/0x160 [<c0148add>] blockable_page_cache_readahead+0x4d/0xd0 [<c0148d3b>] page_cache_readahead+0x10b/0x1c0 [<c01424e2>] do_generic_mapping_read+0x482/0x540 [<c0142824>] generic_file_aio_read+0x194/0x1f0 [<c01425a0>] file_read_actor+0x0/0xf0 [<c0162c7d>] do_sync_read+0xbd/0x110 [<c016bd7a>] open_namei+0xda/0x550 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0162d64>] vfs_read+0x94/0x170 [<c0163111>] sys_read+0x41/0x70 [<c0102eb8>] syscall_call+0x7/0xb ======================= Code: 3a f6 c2 01 75 3e 8b 1a 31 c0 39 34 9d f0 ed 75 c0 72 28 8d 04 5b 8d 4c 00 fa 8d 76 00 8d bc 27 00 00 00 00 89 f0 d3 e8 83 e0 3f <8b> 54 82 10 85 d2 74 1c 83 e9 06 4b 75 eb 89 d0 5b 5e c3 8d b6 EIP: [<c02eb417>] radix_tree_lookup+0x37/0x60 SS:ESP 0068:f2f1bd7c <1>BUG: unable to handle kernel paging request at virtual address 6dcecdd9 printing eip: c02eb417 *pde = 00000000 Oops: 0000 [#2] SMP Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss appletalk psnap llc ide_scsi generic nvidia(P) snd_hda_intel snd_hda_codec jmicron snd_pcm snd_timer snd snd_page_alloc CPU: 0 EIP: 0060:[<c02eb417>] Tainted: P VLI EFLAGS: 00210046 (2.6.20.7C2D6400,2x1GBRAM800,P965-ICH8R,Marv8056,1x40GB+3x320GBr5 #5) EIP is at radix_tree_lookup+0x37/0x60 eax: 00000000 ebx: 8b372010 ecx: 434ac05a edx: 6dcecdc9 esi: 00000000 edi: 00000000 ebp: f3ccd494 esp: f2f93d7c ds: 007b es: 007b ss: 0068 Process smbd (pid: 3769, ti=f2f92000 task=f2f33030 task.ti=f2f92000) Stack: 00000000 00000000 c01488c0 00000052 f3ccd4a4 00000000 00000001 00000000 f437b9c0 f2f93da0 f2f93da0 f2f93e3c f3ccd494 00000000 f437b9c0 c0148add 00000004 f2f93e3c 00000000 00000001 00000020 c0148d3b 00000004 f2f93e3c Call Trace: [<c01488c0>] __do_page_cache_readahead+0x90/0x160 [<c0148add>] blockable_page_cache_readahead+0x4d/0xd0 [<c0148d3b>] page_cache_readahead+0x10b/0x1c0 [<c01424e2>] do_generic_mapping_read+0x482/0x540 [<c0142824>] generic_file_aio_read+0x194/0x1f0 [<c01425a0>] file_read_actor+0x0/0xf0 [<c0162c7d>] do_sync_read+0xbd/0x110 [<c016bd7a>] open_namei+0xda/0x550 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0162d64>] vfs_read+0x94/0x170 [<c0163111>] sys_read+0x41/0x70 [<c0102eb8>] syscall_call+0x7/0xb ======================= Code: 3a f6 c2 01 75 3e 8b 1a 31 c0 39 34 9d f0 ed 75 c0 72 28 8d 04 5b 8d 4c 00 fa 8d 76 00 8d bc 27 00 00 00 00 89 f0 d3 e8 83 e0 3f <8b> 54 82 10 85 d2 74 1c 83 e9 06 4b 75 eb 89 d0 5b 5e c3 8d b6 EIP: [<c02eb417>] radix_tree_lookup+0x37/0x60 SS:ESP 0068:f2f93d7c <1>BUG: unable to handle kernel paging request at virtual address 6dcecdd9 printing eip: c02eb417 *pde = 00000000 Oops: 0000 [#3] SMP Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss appletalk psnap llc ide_scsi generic nvidia(P) snd_hda_intel snd_hda_codec jmicron snd_pcm snd_timer snd snd_page_alloc CPU: 0 EIP: 0060:[<c02eb417>] Tainted: P VLI EFLAGS: 00210046 (2.6.20.7C2D6400,2x1GBRAM800,P965-ICH8R,Marv8056,1x40GB+3x320GBr5 #5) EIP is at radix_tree_lookup+0x37/0x60 eax: 00000000 ebx: 8b372010 ecx: 434ac05a edx: 6dcecdc9 esi: 00000000 edi: 00000000 ebp: f3ccd494 esp: f2f4fd7c ds: 007b es: 007b ss: 0068 Process smbd (pid: 3801, ti=f2f4e000 task=f7087030 task.ti=f2f4e000) Stack: 00000000 00000000 c01488c0 00000052 f3ccd4a4 00000000 00000001 00000000 f437b3c0 f2f4fda0 f2f4fda0 f2f4fe3c f3ccd494 00000000 f437b3c0 c0148add 00000004 f2f4fe3c 00000000 00000001 00000020 c0148d3b 00000004 f2f4fe3c Call Trace: [<c01488c0>] __do_page_cache_readahead+0x90/0x160 [<c0148add>] blockable_page_cache_readahead+0x4d/0xd0 [<c0148d3b>] page_cache_readahead+0x10b/0x1c0 [<c01424e2>] do_generic_mapping_read+0x482/0x540 [<c0142824>] generic_file_aio_read+0x194/0x1f0 [<c01425a0>] file_read_actor+0x0/0xf0 [<c0162c7d>] do_sync_read+0xbd/0x110 [<c016bd7a>] open_namei+0xda/0x550 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0162d64>] vfs_read+0x94/0x170 [<c0163111>] sys_read+0x41/0x70 [<c0102eb8>] syscall_call+0x7/0xb ======================= Code: 3a f6 c2 01 75 3e 8b 1a 31 c0 39 34 9d f0 ed 75 c0 72 28 8d 04 5b 8d 4c 00 fa 8d 76 00 8d bc 27 00 00 00 00 89 f0 d3 e8 83 e0 3f <8b> 54 82 10 85 d2 74 1c 83 e9 06 4b 75 eb 89 d0 5b 5e c3 8d b6 EIP: [<c02eb417>] radix_tree_lookup+0x37/0x60 SS:ESP 0068:f2f4fd7c <3><unknown>: hw csum failure. [<c04d056d>] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [<c0511a05>] udp_recvmsg+0x135/0x280 [<c04cc195>] sock_common_recvmsg+0x45/0x70 [<c04c8038>] sock_recvmsg+0xd8/0x130 [<c04c7ebf>] sock_sendmsg+0xbf/0x110 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0173b2a>] dput+0x8a/0x140 [<c02ee77b>] copy_to_user+0x2b/0x40 [<c04c92e5>] sys_recvfrom+0xd5/0x160 [<c015fc3c>] cache_alloc_refill+0xcc/0x1e0 [<c01730e3>] fcntl_setlk64+0x203/0x290 [<c01278e0>] update_wall_time+0x190/0x280 [<c04c9b75>] sys_socketcall+0x1c5/0x250 [<c0102eb8>] syscall_call+0x7/0xb ======================= BUG: unable to handle kernel paging request at virtual address 6dcecdd9 printing eip: c02eb417 *pde = 00000000 Oops: 0000 [#4] SMP Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss appletalk psnap llc ide_scsi generic nvidia(P) snd_hda_intel snd_hda_codec jmicron snd_pcm snd_timer snd snd_page_alloc CPU: 0 EIP: 0060:[<c02eb417>] Tainted: P VLI EFLAGS: 00210046 (2.6.20.7C2D6400,2x1GBRAM800,P965-ICH8R,Marv8056,1x40GB+3x320GBr5 #5) EIP is at radix_tree_lookup+0x37/0x60 eax: 00000000 ebx: 8b372010 ecx: 434ac05a edx: 6dcecdc9 esi: 00000000 edi: 00000000 ebp: f3ccd494 esp: f2615d7c ds: 007b es: 007b ss: 0068 Process smbd (pid: 3856, ti=f2614000 task=f4243550 task.ti=f2614000) Stack: 00000000 00000000 c01488c0 00000052 f3ccd4a4 00000000 00000001 00000000 f7b36800 f2615da0 f2615da0 f2615e3c f3ccd494 00000000 f7b36800 c0148add 00000004 f2615e3c 00000000 00000001 00000020 c0148d3b 00000004 f2615e3c Call Trace: [<c01488c0>] __do_page_cache_readahead+0x90/0x160 [<c0148add>] blockable_page_cache_readahead+0x4d/0xd0 [<c0148d3b>] page_cache_readahead+0x10b/0x1c0 [<c01424e2>] do_generic_mapping_read+0x482/0x540 [<c0142824>] generic_file_aio_read+0x194/0x1f0 [<c01425a0>] file_read_actor+0x0/0xf0 [<c0162c7d>] do_sync_read+0xbd/0x110 [<c016bd7a>] open_namei+0xda/0x550 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0162d64>] vfs_read+0x94/0x170 [<c0163111>] sys_read+0x41/0x70 [<c0102eb8>] syscall_call+0x7/0xb ======================= Code: 3a f6 c2 01 75 3e 8b 1a 31 c0 39 34 9d f0 ed 75 c0 72 28 8d 04 5b 8d 4c 00 fa 8d 76 00 8d bc 27 00 00 00 00 89 f0 d3 e8 83 e0 3f <8b> 54 82 10 85 d2 74 1c 83 e9 06 4b 75 eb 89 d0 5b 5e c3 8d b6 EIP: [<c02eb417>] radix_tree_lookup+0x37/0x60 SS:ESP 0068:f2615d7c <1>BUG: unable to handle kernel paging request at virtual address 6dcecdd9 printing eip: c02eb417 *pde = 00000000 Oops: 0000 [#5] SMP Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss appletalk psnap llc ide_scsi generic nvidia(P) snd_hda_intel snd_hda_codec jmicron snd_pcm snd_timer snd snd_page_alloc CPU: 0 EIP: 0060:[<c02eb417>] Tainted: P VLI EFLAGS: 00210046 (2.6.20.7C2D6400,2x1GBRAM800,P965-ICH8R,Marv8056,1x40GB+3x320GBr5 #5) EIP is at radix_tree_lookup+0x37/0x60 eax: 00000000 ebx: 8b372010 ecx: 434ac05a edx: 6dcecdc9 esi: 00000000 edi: 00000000 ebp: f3ccd494 esp: f2629d7c ds: 007b es: 007b ss: 0068 Process smbd (pid: 3886, ti=f2628000 task=c2282550 task.ti=f2628000) Stack: 00000000 00000000 c01488c0 00000052 f3ccd4a4 00000000 00000001 00000000 f4a25380 f2629da0 f2629da0 f2629e3c f3ccd494 00000000 f4a25380 c0148add 00000004 f2629e3c 00000000 00000001 00000020 c0148d3b 00000004 f2629e3c Call Trace: [<c01488c0>] __do_page_cache_readahead+0x90/0x160 [<c0148add>] blockable_page_cache_readahead+0x4d/0xd0 [<c0148d3b>] page_cache_readahead+0x10b/0x1c0 [<c01424e2>] do_generic_mapping_read+0x482/0x540 [<c0142824>] generic_file_aio_read+0x194/0x1f0 [<c01425a0>] file_read_actor+0x0/0xf0 [<c0162c7d>] do_sync_read+0xbd/0x110 [<c016bd7a>] open_namei+0xda/0x550 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0162d64>] vfs_read+0x94/0x170 [<c0163111>] sys_read+0x41/0x70 [<c0102eb8>] syscall_call+0x7/0xb ======================= Code: 3a f6 c2 01 75 3e 8b 1a 31 c0 39 34 9d f0 ed 75 c0 72 28 8d 04 5b 8d 4c 00 fa 8d 76 00 8d bc 27 00 00 00 00 89 f0 d3 e8 83 e0 3f <8b> 54 82 10 85 d2 74 1c 83 e9 06 4b 75 eb 89 d0 5b 5e c3 8d b6 EIP: [<c02eb417>] radix_tree_lookup+0x37/0x60 SS:ESP 0068:f2629d7c <1>BUG: unable to handle kernel paging request at virtual address 6dcecdd9 printing eip: c02eb417 *pde = 00000000 Oops: 0000 [#6] SMP Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss appletalk psnap llc ide_scsi generic nvidia(P) snd_hda_intel snd_hda_codec jmicron snd_pcm snd_timer snd snd_page_alloc CPU: 0 EIP: 0060:[<c02eb417>] Tainted: P VLI EFLAGS: 00210046 (2.6.20.7C2D6400,2x1GBRAM800,P965-ICH8R,Marv8056,1x40GB+3x320GBr5 #5) EIP is at radix_tree_lookup+0x37/0x60 eax: 00000000 ebx: 8b372010 ecx: 434ac05a edx: 6dcecdc9 esi: 00000000 edi: 00000000 ebp: f3ccd494 esp: f2681d7c ds: 007b es: 007b ss: 0068 Process smbd (pid: 3916, ti=f2680000 task=f2657030 task.ti=f2680000) Stack: 00000000 00000000 c01488c0 00000052 f3ccd4a4 00000000 00000001 00000000 f7b36080 f2681da0 f2681da0 f2681e3c f3ccd494 00000000 f7b36080 c0148add 00000004 f2681e3c 00000000 00000001 00000020 c0148d3b 00000004 f2681e3c Call Trace: [<c01488c0>] __do_page_cache_readahead+0x90/0x160 [<c0148add>] blockable_page_cache_readahead+0x4d/0xd0 [<c0148d3b>] page_cache_readahead+0x10b/0x1c0 [<c01424e2>] do_generic_mapping_read+0x482/0x540 [<c0142824>] generic_file_aio_read+0x194/0x1f0 [<c01425a0>] file_read_actor+0x0/0xf0 [<c0162c7d>] do_sync_read+0xbd/0x110 [<c016bd7a>] open_namei+0xda/0x550 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0162d64>] vfs_read+0x94/0x170 [<c0163111>] sys_read+0x41/0x70 [<c0102eb8>] syscall_call+0x7/0xb ======================= Code: 3a f6 c2 01 75 3e 8b 1a 31 c0 39 34 9d f0 ed 75 c0 72 28 8d 04 5b 8d 4c 00 fa 8d 76 00 8d bc 27 00 00 00 00 89 f0 d3 e8 83 e0 3f <8b> 54 82 10 85 d2 74 1c 83 e9 06 4b 75 eb 89 d0 5b 5e c3 8d b6 EIP: [<c02eb417>] radix_tree_lookup+0x37/0x60 SS:ESP 0068:f2681d7c thank you very much for your time... what i am looking for is some directiong as to whom to ask about it... nass

3 5

syslog-ng 2 and bandwidth limiting
by jrhendri＠maine.rr.com 25 Apr '07

25 Apr '07

Hi, Is there a way to limit the bandwidth of an ng server? If so, does it work with UDP or only TCP? I have seen the log_fifo_size() option, but don't easily see how this would limit the amount of bandwidth used (seems like it is designed to provide a larger output buffer for slow links, but does not actually limit the bandwidth used by NG) I am also looking at the flow-control flag, but again it is not clear how to use it to limit the bandwidth. Ideally I would like something that would allow NG to be limited to a specific amount of bandwidth (packets/sec or kb/s, etc.) for each log path. This way if a service started generating an excessive amount of log data (e.g. if a daemon were put into debug mode) it would help prevent the log server from choking the network trying to send all the packets (it would be especially nice if you could configure how large an output buffer were available, so if you wanted to deal with *bursty* services, you could limit them to a small amount of bandwidth, but provide them with a larger output buffer so you would be less likely to drop messages. Thoughts? Thanks! Jim Hendrick

5 8

Re: syslog-ng Digest, Vol 23, Issue 20
by wayne yu 25 Apr '07

25 Apr '07

Please delete me from list server syslog-ng-request(a)lists.balabit.hu wrote: Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng filtering capabilities (Bruno Vieira) 2. Log rotate without log rotate. (Bruno Vieira) 3. Re: Log rotate without log rotate. (Alexander Clouter) 4. Re: Log rotate without log rotate. (Valdis.Kletnieks(a)vt.edu) 5. Re: Log rotate without log rotate. (Bruno Vieira) 6. Re: Where is the download link for 2.0 ? (Jose Pedro Oliveira) ---------------------------------------------------------------------- Message: 1 Date: Fri, 16 Mar 2007 14:51:26 +0000 From: "Bruno Vieira" Subject: Re: [syslog-ng] syslog-ng filtering capabilities To: "Syslog-ng users' and developers' mailing list" Message-ID: Content-Type: text/plain; charset="iso-8859-1" Hi there. Yes, syslog-ng has of those features that you want. Check the syslog-ng.conf expanded file. Here you can see those kind of things being used. Using templates it is possible for syslog-ng to create dirs and files based on templates. http://www.campin.net/syslog-ng/expanded-syslog-ng.conf Regards, Bruno. On 3/15/07, Ramesh Uppuluri wrote: > > I am new to syslog-ng product which has been working great so far. > My question is on filtering unwanted syslog messages during collection. > Can I accomplish this using syslog-ng? If so, can some one tell me its > possible to filter out messages from specific host or a wildcard > (subnet) etc. > > Thanks > Ramesh > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

Problems writing to a file if destination is not/var/log
by Luc Evers 23 Apr '07

23 Apr '07

Sandor, Thank you very much, the problem was indeed caused by AppArmor. Kind Regards, Luc.

1 0