- syslog-ng - lists.balabit.hu

1.6.11 stops logging on Garbage Collect (Solaris 9)
by Kim Cary 11 Oct '06

11 Oct '06

Our installation of syslog-ng writes to 3 pipes and a dozen files from 2 IP sources. About 2-3 times a week it will stop logging in 1-12 files. The last record in these files will almost always coincide with a Garbage Collect record in /var/log/syslog (which always continues to collect records). Solaris syslog is NOT running. Solaris logadm sends HUP to syslog-ng on any rotate. We tried TCP logging from some systems for a while, but its all UDP now. Important to note, it may not be all files that stop receiving records, or even all the files from a single source. We need reliable logs. How do we begin to debug this issue?

2 1

logging by hostname
by Istvan Szukacs 11 Oct '06

11 Oct '06

Hi! I would like to log several computer which are behind nat. The problem is i cannot find the right metod to log by the hostname not by the ip reverse name from where the packets come. But i got this: Oct 1 02:34:27 external ip/external ip Is there a possibility to devide the logs by the original hostname? thx

4 3

Re : [syslog-ng] Syslog and syslog-ng on HP-UX
by olivier "madmax"rolland 11 Oct '06

11 Oct '06

I have to run syslog and syslog-ng because syslog-ng have not been probated in my compagny yet. I want to log the same message in syslog and in syslog-ng but i conclude that's not possible for the two daemons to read the same pipe. Syslog-ng extract only messages that syslogd don-t want to. Thanks for your help and if you have an idea for a solution contact me. ----- Message d'origine ---- De : Gellér Sándor <wildy(a)balabit.hu> À : Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Envoyé le : Mercredi, 11 Octobre 2006, 11h29mn 17s Objet : Re: [syslog-ng] Syslog and syslog-ng on HP-UX olivier "madmax"rolland wrote: > Hello! > I have a problem, > I want that syslog and syslog-ng 1.6.7 to coexist on a HP-UX 11.11 and HP-UX 11.23. > I install syslog-ng 1.6.7 and it works but the problem is that syslog-ng don't log when syslogd runs. I'n not familiar with HP-UX, but my first guess is that you are using the same source for both daemons. Remove the standard HP-UX log source from syslog-ng.conf and reload syslog-ng. What is the purpose to use two syslog daemons on the same machine? Do you want to log the same messages with syslog and syslog-ng, or do you want to separate them? -- Gellér Sándor wildy(a)balabit.hu _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Demandez à ceux qui savent sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

Re: Subject: [syslog-ng] 1.6.11 stops logging on Garbage Collect (Solaris 9)
by Kim Cary 11 Oct '06

11 Oct '06

Whilst working further on this problem, I was tailing the log and this popped up: /var/log/syslog:Oct 10 13:50:01 mylogserver syslog-ng[20167]: do_stream_read: getmsg() trying to return too much ctl data, res=4294967295 Resource temporarily unavailable Is this any clue to the problem we are having? How do I interpret that message? I don't find any info on it in Google or this list... > Date: Mon, 9 Oct 2006 09:19:42 -0700 > From: Kim Cary <Kim.Cary(a)pepperdine.edu> > Subject: [syslog-ng] 1.6.11 stops logging on Garbage Collect (Solaris > 9) > To: syslog-ng(a)lists.balabit.hu > Message-ID: <9B0A23E1-566A-465A-BB00-BA3FF0EA0FBC(a)pepperdine.edu> > Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed > > Our installation of syslog-ng writes to 3 pipes and a dozen files > from 2 IP sources. > > About 2-3 times a week it will stop logging in 1-12 files. The last > record in these files will almost always coincide with a Garbage > Collect record in /var/log/syslog (which always continues to collect > records). > > Solaris syslog is NOT running. > Solaris logadm sends HUP to syslog-ng on any rotate. > We tried TCP logging from some systems for a while, but its all UDP > now. > > Important to note, it may not be all files that stop receiving > records, or even all the files from a single source. > > We need reliable logs. How do we begin to debug this issue?

2 1

Syslog and syslog-ng on HP-UX
by olivier "madmax"rolland 11 Oct '06

11 Oct '06

Hello! I have a problem, I want that syslog and syslog-ng 1.6.7 to coexist on a HP-UX 11.11 and HP-UX 11.23. I install syslog-ng 1.6.7 and it works but the problem is that syslog-ng don't log when syslogd runs. My syslog-ng.conf look like: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe("/dev/log" pad_size(2048)); internal(); unix-stream ("/dev/log.un"); }; What I have to do to resolve this problem? Thanks for help! ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com

2 1

Syslog-ng and filter question ...
by Sébastien CRAMATTE 10 Oct '06

10 Oct '06

Hello list, I've just setup a centralized syslog-ng server with mysql Remote clients work well but I'v got a little problem with a filter ... On each client I've got snmp daemon running and nagios network manager server polling clients ... My problem is that each time my nagios NMS connect it to a client it appears this line in daemon.info client log "Oct 10 03:15:48 vlanrouter1 snmpd[1868]: Connection from 192.168.0.12 " I would like to filter this line to exclude it from the remote log ... So I 've added this filter filter f_not_daemon_info { (not facility(daemon) and not level(info)); }; but not works and all "daemon" and all "info" levels are removed not just "daemon.info" I've search to remove this log from snmp daemon directly but seems to be a bug on my snmpd release ... I hope that someone have got the solution Regards Sebastien

4 7

bug report
by Matt Zagrabelny 09 Oct '06

09 Oct '06

i sent out an email a couple of days ago asking about this. i will try once more... does anyone on the list know the preferred way of submitting bug reports to the developers? i have considered using reportbug and letting the debian maintainer facilitate my bug. thanks, -- Matt Zagrabelny - mzagrabe(a)d.umn.edu - (218) 726 8844 University of Minnesota Duluth Information Technology Systems & Services PGP key 1024D/84E22DA2 2005-11-07 Fingerprint: 78F9 18B3 EF58 56F5 FC85 C5CA 53E7 887F 84E2 2DA2 He is not a fool who gives up what he cannot keep to gain what he cannot lose. -Jim Elliot

4 8

Re: question regarding program name logs
by G.W. Haywood 09 Oct '06

09 Oct '06

Hi there, On Sun, 8 Oct 2006 Balazs Scheidler wrote: > > I would really like to release 2.0.0. But if your findings indeed > > turn out to be a bug in syslog-ng that'd prevent me from doing so. > > So helping me to track this down in a timely manner would be > > appreciated. Thanks. > > An important question relating this: Does anyone else experience the > same problem? For the avoidance of doubt, I'm still using 2.0.rc1 with your patch of 04 Sep 2006 12:18:46 but I'm only using local logging. Most of my log messages are from sendmail and a number of sendmail milters, and it's quite common for them to produce a few thousand log messages per second although messages at that rate would be written direct to a file - just a small subset of them is piped to a script for storage in our database. I haven't noticed any problem with missing messages. If this were a problem for us I'd have expected someone here to have noticed by now, although we haven't looked for the issue specifically. -- 73, Ged.

2 1

program() doesn't restart if it dies
by Hari Sekhon 09 Oct '06

09 Oct '06

I have an email alert script written in python to send me security alerts depending on criteria I have defined. I was working on something else and wanted to clean up so I did a pkill -9 python without remembering that I'm on the syslog server. Of course this killed the alert script, which I noticed didn't restart and syslog-ng kept running without it. So I tested it by creating a condition to generate a log and therefore an alert and I didn't get the email. Not very good. Syslog-ng didn't restart the script defined in program() in syslog-ng.conf, even when it had more input for it, which has gotten me thinking, what happens if the script really dies or is accidentally killed? Syslog-ng must have just dropped the output on the floor or something. The only way I can see to restart it is to restart syslog-ng itself. What is the best way to make this more resilient? I'm currently thinking a cron job to test for the python script and then restart the server if it is not found. Anybody got anything better? -h -- Hari Sekhon

3 4

Re: bug report
by G.W. Haywood 07 Oct '06

07 Oct '06

Hi there, On Sat, 7 Oct 2006 Balazs Scheidler wrote: > > > using the "flow-control" flag, like this: > > > > > > log { source(src); destination(dst); flags(flow-control); }; > > > > Hmmm. I knew I'd seen that syntax somewhere. But where...? :) > > Probably in the 2.0 reference manual: Blast. I was looking in the man pages. Would you like a patch? :) -- 73, Ged.

3 2