- syslog-ng - lists.balabit.hu

Silence syslog-ng upon connection reopening?
by Wolfram Schlich 24 Nov '06

24 Nov '06

Hi, is it possible to silence syslog-ng running on a log client when it reopens a TCP connection to the syslog-ng log server? For example, when you restart syslog-ng on the server due to some configuration change or whatever other reason, syslog-ng on the log client logs this to syslog.err: syslog-ng[13214]: io.c: do_write: write() failed, EOF detected syslog-ng[13214]: pkt_buffer::do_flush(): Error flushing data syslog-ng[13214]: Connection broken to AF_INET(log-server:514), reopening in 10 seconds Can I make syslog-ng NOT log those messages until, let's say, the reopening failed at least N times? The reason is I am using tenshi to monitor the remote logs on the log server in order to alert me about messages with the severities err, crit and emerg. I can, however, add special trash patterns to my tenshi config to disregard the above messages, but I don't feel comfortable about it (for example, when there was a real problem, like a network outage for, let's say, more than 60 seconds). Switching to UDP does not look like a brilliant alternative either ;) Best regards -- Wolfram Schlich

2 4

syslg-ng hangs on damnsmalllinux boot
by Heiko Blume 23 Nov '06

23 Nov '06

Hello, i try to run syslog-ng 2.0.0 compiled with eventlog-0.25 and glib-2.12.4 on damnsmalllinux 3.0.1 (knoppix variant based on linux 2.4.26). It is started in a script like this which is called from bootlocal.sh sudo /opt/syslog-ng/sbin/syslog-ng \ --cfgfile=/opt/syslog-ng/etc/syslog-ng.conf \ --chroot=/data/var/log \ --user=65534 \ --group=65534 unfortunately it will hang causing mischief, like programs blocking on it, so the boot script does not complete and no login is possible at all. it can only be killed with "-9". The "messages" and "syslog" logfiles look like this, so the chroot etc has worked correctly, the config is valid etc etc: Nov 22 00:19:22 s_all@box syslog-ng[682]: syslog-ng starting up; version='2.0.0' Nov 22 00:19:22 s_all@box kernel: Linux version 2.4.26 (root@Knoppix) (gcc versi on 2.95.4 20011002 (Debian prerelease)) #1 SMP Sa Apr 17 19:33:42 CEST 2004 [blaaaaaaaaaaaaah] Nov 22 00:19:22 s_all@box kernel: Linux agpgart interface v0.99 (c) Jeff Hartmann But hereafter nothing happens anymore :-((( If it is started manually later on it seems to work. I tried starting it with --debug, but that didn't say anything at all, although i ran configure with --enable-debug (is that relevant?) I applied the patch from http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg265412.html to prevent blocking on tty's but that didn't help. In the config file i then set use_dns(no) and commented out the usertty() destination, so it is only logging to files. no external programs, pipes etc are used. the only source used is this: source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-dgram("/dev/log"); unix-dgram("/data/tftpboot/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the next line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) udp(); tcp(); }; any help would be appreciated!!! regards, -- Heiko(a)Blume.AG

2 8

comm method with clients
by Constantine Kousoulos 23 Nov '06

23 Nov '06

Hello, From what i read in the reference manual, there is a fixed number of available source drivers (internal, file, tcp, etc) in syslog-ng. I would like to develope a new kind of driver (communication method) to collect messages from clients. Is syslog-ng customizable enough to accomplish something like that relatively easy? :) I am a newbie in this mailing list so please forgive me if my question sounds too naive. Thanks, Constantine

2 1

Syslog-ng load testing
by Vaibhav Goel 22 Nov '06

22 Nov '06

Hi all I am planning to do some capacity and load testing our syslog-ng servers over TCP. Towards that end, I will be writing a script to send packets to a syslog-ng host. Has anyone done anything similar? I was just thinking of writing a simple script that will open multiple sockets to the server and send a message (based upon our current calculated average message size). Any other suggestions are appreciated. Thanks,

4 15

Need help with having Syslog-ng import a log file into syslog-ng
by Steven Meacham 21 Nov '06

21 Nov '06

Need help with having Syslog-ng import a log file into Syslog-ng. I have a proxy server that will not syslog but will log to a file than can ftp of the server. I am wondering how I can take the ftped file and send it to the Syslog-ng so It can be sysloged to our database server for review? Any help would be great? Thanks.

4 4

syslog-ng and chroot'ed bind
by Patrick Topping 21 Nov '06

21 Nov '06

All, I have just installed bind in a chtoot'ed environment. What I am not able to get set up properly is the logging through syslog-ng. Does anyone have a "HOW TO" on this or a web site that I could be directed to in order to get this going....??? Thanks in advance. -Patrick

2 1

Any non-commercial Windows tcp clients?
by Alejandro Sierra 18 Nov '06

18 Nov '06

Hi, i'm interested in the same. The solution i've thought by now is using NTSyslog and Kiwi Together. NTSyslog sends messages gotten from the EventViewer in UDP to localhost where are recived by Kiwi who has the ability to send over TCP in the SSH Tunnel (I use plink) . By this moment i have a problem. Kiwi uses '\r' as separator for TCP messages and Syslog-ng uses '\n', so when syslog-ng recives 5 messages in one TCP message from a Kiwi, he only gets the syslog header from the 1st message, and sees all the rest as part of the first one. Cya. I accept critics(very welcolme). PD: Sorry for my english.

1 0

Syslog-ng 2.0 contrib/redhat conf file problem
by King, John (Greg) (LMIT-HOU) 17 Nov '06

17 Nov '06

I have copied the syslog.conf file from syslog-ng-2.0.0/contrib/rhel-packaging to /etc/syslog-ng.conf When I try running syslog-ng I get the following error "/usr/local/sbin/syslog-ng -f /etc/syslog-ng.conf syntax error at 17" Line 17 is file("/proc/kmsg" log_prefix "kernel:"); Which is in this script block # source s_local { unix-dgram("/dev/log"); file("/proc/kmsg" log_prefix "kernel:"); }; Did something change in version 2.0 that was not updated in the example? Or should I use the contrib app syslog2ng? I would like to create a config that will allow me to disable klogd and syslogd on RHES4. Then set syslog-ng up to listen for tcp syslog packets from remote systems and then separate those logs like this destination d_separatedbyhosts { file("/var/log/syslog-ng/$HOST/messages" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes)); }; Any help would be great, Thanks - Greg

1 0

timestamp in log files
by Gustavo Mendes de Carvalho 13 Nov '06

13 Nov '06

He All, Does anybody knows any idea to include a date in unix timestamp format into a log file, together with a message ? Something like Nov 11 05:15:34 *1163214934 *s_sys(a)10.9.8.7 sshd[13037]: Accepted publickey for ROOT from 10.0.0.2 port 1355 ssh2 Regards -- Gustavo Mendes de Carvalho gmcarvalho(a)gmail.com

2 5

syslog-ng droping events
by Arya, Manish Kumar 10 Nov '06

10 Nov '06

Hi, I have 3 syslog listeners (solaris 10 ) collecting log events from about 20,000 devices and fwding them on a central syslog box (solaris 10, 16 gb RAM and 3TB SAN storage) . the central syslog box stores them in oracle db and on filesystem. I notice that events from many devices are being droped on central syslog box. I thought it might be because of udp protocol, but even after enabling tcp its droping events. I can see that events come on listeners boxes (I created temp file logs there) please tell me what could be missing. Regards, -Manish ____________________________________________________________________________________ Want to start your own business? Learn how on Yahoo! Small Business. http://smallbusiness.yahoo.com/r-index

4 4