- syslog-ng - lists.balabit.hu

Re: RE: Re: syslog-ng 2.0rc1 memory usage
by Martin, David M 10 Sep '06

10 Sep '06

here are the definitely lost record results. short duration (start valgrind, send hup, wait, send hup, kill) ==7989== 70 bytes in 1 blocks are definitely lost in loss record 15 of 43 ==7989== at 0x1B904984: malloc (vg_replace_malloc.c:131) ==7989== by 0x12AB72: g_malloc (in /usr/lib/libglib-2.0.so.0.400.7) ==7989== by 0x1394F5: g_strdup (in /usr/lib/libglib-2.0.so.0.400.7) ==7989== by 0x80559B6: log_writer_options_init (logwriter.c:507) ==7989== 1080 bytes in 10 blocks are definitely lost in loss record 35 of 43 ==7989== at 0x1B905301: calloc (vg_replace_malloc.c:176) ==7989== by 0x12ABDF: g_malloc0 (in /usr/lib/libglib-2.0.so.0.400.7) ==7989== by 0x80530FD: log_msg_new (logmsg.c:545) ==7989== by 0x805BE42: log_reader_handle_line (logreader.c:178) ==7989== LEAK SUMMARY: ==7989== definitely lost: 1150 bytes in 11 blocks. ==7989== possibly lost: 0 bytes in 0 blocks. ==7989== still reachable: 113453 bytes in 1157 blocks. ==7989== suppressed: 200 bytes in 1 blocks. ------------------------------ Message: 2 Date: Wed, 09 Aug 2006 10:00:02 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] RE: Re: syslog-ng 2.0rc1 memory usage (Balazs Scheidler) To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1155110402.6312.14.camel(a)bzorp.balabit> Content-Type: text/plain On Tue, 2006-08-08 at 15:56 -0500, Martin, David M wrote: > applied the patch and resident size increased only marginally over a > 10 minute period. much better. > ran through valgrind another 10 minutes, here's the report. Only one definitely lost record was present, which should be fixed by the patch below. Some of the remaining leaks seem to be part of buffered messages not yet sent to destinations, but they were still reachable. Some reload tests would be appreciated (e.g. run syslog-ng and reload it a couple of times with your configuration and load), that might reveal some real leaks. --- orig/src/messages.c +++ mod/src/messages.c @@ -53,10 +53,12 @@ msg_send_internal_message(int prio, cons { LogMessage *m; - g_snprintf(buf, sizeof(buf), "<%d> syslog-ng[%d]: %s\n", prio, getpid(), msg); - m = log_msg_new(buf, strlen(buf), NULL, LP_INTERNAL | LP_LOCAL, NULL); if (G_LIKELY(internal_msg_queue)) - g_queue_push_tail(internal_msg_queue, m); + { + g_snprintf(buf, sizeof(buf), "<%d> syslog-ng[%d]: %s\n", prio, getpid(), msg); + m = log_msg_new(buf, strlen(buf), NULL, LP_INTERNAL | LP_LOCAL, NULL); + g_queue_push_tail(internal_msg_queue, m); + } } } -- Bazsi ------------------------------ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng End of syslog-ng Digest, Vol 16, Issue 9 **************************************** The information transmitted (including attachments) is covered by the Electronic Communications Privacy Act, 18 U.S.C. 2510-2521, is intended only for the person(s) or entity/entities to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient(s) is prohibited. If you received this in error, please contact the sender and delete the material from any computer.

2 1

syslog-ng-2.0rc1 doesn't log hostaddress using ipv6
by Bruce Penrod 10 Sep '06

10 Sep '06

I'm using the unpatched syslog-ng-2.0rc1. When logging messages sent from another machine over udp6, the hostname of the sending machine is not logged and the receiving host's name is logged instead, so that it looks like the message was generated locally. When using udp, it works fine. -- Bruce Penrod

2 1

Problems compiling Syslog-NG 2.0 rc1 (error 'va_start' used in function with fixed args)
by Jochen Kirn 08 Sep '06

08 Sep '06

Hi, Currently I stumble over a problem when trying to compile syslog-ng: OS: Solaris 5.10 Generic_118822-25 sun4u sparc (also tried on Solaris 5.9Generic_117171-12 sun4u sparc) Syslog-NG: 2.0 rc1 eventlog: eventlog-0.2.5 1) configure & make of enventlog works fine 2) configure of syslog-ng works fine 3) make of syslog-ng fails with following error: messages.c:105: error: `EVT_PRI_ERR' undeclared (first use in this function) messages.c:107: error: `EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c: In function `msg_init': messages.c:123: warning: implicit declaration of function `evt_ctx_init' messages.c:123: error: `EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c:123: warning: assignment makes pointer from integer without a cast messages.c: In function `msg_deinit': messages.c:134: warning: implicit declaration of function `evt_ctx_free' messages.c: In function `msg_event_create': messages.c:72: error: `va_start' used in function with fixed args *** Error code 1 make: Fatal error: Command failed for target `messages.o' Current working directory /opt/dcx/build/syslog-ng/wrk/syslog-ng-2.0rc1/src *** Error code 1 does anyone have a clue how to fix this va_start call to get a succesfully compile run ? thx Jochen

1 0

Re: Messages concatenated on one line in log file.
by G.W. Haywood 06 Sep '06

06 Sep '06

Hi there, On Tue, 5 Sep 2006 syslog-ng-request(a)lists.balabit.hu wrote: > On Fri, 2006-09-01 at 23:04 +0100, G.W. Haywood wrote: > > > > Using 2.0rc1 I find lines like this in /var/log/messages: > > > > Sep 1 22:18:32 mail3 by lists.balabit.hu (Postfix) with ESMTP id 83E8A4C117 > > Sep 1 22:18:32 mail3 for <ged(a)jubileegroup.co.uk>; Fri, 1 Sep 2006 23:18:17 +0200 (CEST)')<31>Sep 1 22:18:32 milter-regex[20073]: 212.92.18.33: cb_header('MIME-Version', '1.0') > > Sep 1 22:18:32 mail3 <syslog-ng.lists.balabit.hu>')<31>Sep 1 22:18:32 milter-regex[20073]: 212.92.18.33: cb_header('X-List-Administrivia', 'yes') > > [...] > > There are two problems. First, these lines shouldn't be written to > > this log at all. Second, some of the lines are being concatenated > > onto a single line instead of being written to two lines. [...] > > Can you check if this patch fixes the problem That's fixed it, thanks. -- 73, Ged.

1 0

couple install questions
by Nick Baronian 06 Sep '06

06 Sep '06

I have a RedHat Ent.4 box I want to put syslog-ng on. Should I remove syslogd (sysklogd) first? If so how do I get syslog-ng to handle the cron (vixie) and initscripts? How can I find out what configure options are available to me for syslog-ng? I figured I would just try compiling syslog-ng on the machine and see what happens with syslogd. I built glib-2.12.0 & eventlog-0.2.4 and then exported PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/usr/local/lib/pkgconfig I did a ./configure --enable-tcp-wrapper. But during make I get this error gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -Wl,-Bdynamic libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format': /root/syslog-ng-2.0rc1/src/logmsg.c:111: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x2c2): In function `log_msg_ref': /root/syslog-ng-2.0rc1/src/logmsg.c:489: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x35e): In function `log_msg_unref': /root/syslog-ng-2.0rc1/src/logmsg.c:503: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xd9a): In function `log_msg_ack_block_end': /root/syslog-ng-2.0rc1/src/logmsg.c:623: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref': /root/syslog-ng-2.0rc1/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref': /root/syslog-ng-2.0rc1/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free': /root/syslog-ng-2.0rc1/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new': /root/syslog-ng-2.0rc1/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x2a6): In function `log_template_ref': /root/syslog-ng-2.0rc1/src/templates.c:169: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x30e):/root/syslog-ng-2.0rc1/src/templates.c:180: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/root/syslog-ng-2.0rc1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-2.0rc1' make: *** [all] Error 2 Does anyone have any ideas on what is causing this? Thanks, Nick Baronian

4 3

Compilation problems under RH AS3
by news gonzo news gonzo 06 Sep '06

06 Sep '06

Hello, I have some problem to install syslog-ng 2rc1. The install/compilation of glib and eventlog worked fine. Besides, the ./configure of syslog is also OK. But after the make I have this error : gcc: cannot specify -o with -c or -S and multiple compilations So what can I do for fixing this ? Regards. p3.vert.ukl.yahoo.com uncompressed/chunked Mon Sep 4 14:33:45 GMT 2006 ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com

2 4

Messages concatenated on one line in log file.
by G.W. Haywood 04 Sep '06

04 Sep '06

Hi folks, Using 2.0rc1 I find lines like this in /var/log/messages: Sep 1 22:18:32 mail3 by lists.balabit.hu (Postfix) with ESMTP id 83E8A4C117 Sep 1 22:18:32 mail3 for <ged(a)jubileegroup.co.uk>; Fri, 1 Sep 2006 23:18:17 +0200 (CEST)')<31>Sep 1 22:18:32 milter-regex[20073]: 212.92.18.33: cb_header('MIME-Version', '1.0') Sep 1 22:18:32 mail3 <syslog-ng.lists.balabit.hu>')<31>Sep 1 22:18:32 milter-regex[20073]: 212.92.18.33: cb_header('X-List-Administrivia', 'yes') Sorry if the three lines above wrap for you. I haven't attempted to break them. They are imported using an editor, not copy-n-paste, so that non-printing characters are reproduced correctly in the mail. Each line above has a tab character after the string "mail3 ", which is the hostname followed by a single space. There are two problems. First, these lines shouldn't be written to this log at all. Second, some of the lines are being concatenated onto a single line instead of being written to two lines. Instead of three lines above, there should have been five lines. The <facility, priority> info is visible at the points where the lines are joined. The lines that you see here are produced by a sendmail milter called 'milter-regex' which is supposed to be logging with facility 'daemon' and according to the syslog-ng configuration messages from this milter should not appear in the 'messages' file at all. Most of them don't (milter-regex is producing a _lot_ of output), but mail message header continuation lines do. A log message following a header continuation line is concatenated to it, and the filter doesn't seem to notice it. The lines that incorrectly appear in 'messages' do not appear in the correct file, which is 'mail.milter-regex' in the config below. Any ideas? -- 73, Ged. =========================================================================== # Relevant extracts from configuration: =========================================================================== options {long_hostnames(off);sync(0);perm(0640);stats(3600);mark_freq(0);}; source src { internal(); unix-dgram("/dev/log"); }; ... # output from milter-regex is facility daemon filter f_mailmrx { facility(daemon); }; # facility daemon should not go to 'messages' filter f_messages { not facility(news, mail, daemon) and not ... }; # most facility daemon messages are correctly written to 'mail.milter-regex' destination mailmrx { file("/var/log/mail.milter-regex"); }; # but some make it to 'messages' destination messages { file("/var/log/messages"); }; ... log { source(src); filter(f_mailmrx); destination(mailmrx); }; log { source(src); filter(f_messages); destination(messages); }; ...

3 2

Re: Messages concatenated on one line in log file.
by G.W. Haywood 02 Sep '06

02 Sep '06

Hi there, On Sat, 2 Sep 2006 Evan Rempel wrote: > Is syslong-ng running on the host that produced these messages. Yes. Sorry, I should have said. > (don't ask why we do all three :-) OK. I understand. :) > As soon as I replace the standard syslog software on the source server > with syslog-ng (I am running 1.6 series) this problem goes away. My logs are all on the local machines, I don't do any remote logging (yet:). Thanks for the tip, though, it might help shed some light on the issue eventually. -- 73, Ged.

1 0

syslog.err
by Anshul Saxena 01 Sep '06

01 Sep '06

Hi, I am trying to send syslog-ng error messages over stunnel My client side's stunnel.conf file is : client = yes cert = /etc/stunnel/syslog-ng-client.pem CAfile = /etc/stunnel/syslog-ng-server.pem verify = 3 #verify = 1 [5140] accept = 127.0.0.1:514 connect = 10.105.1.25:5140 My server side's stunnel.conf file is : chroot = /chroot/stunnel setuid = stunnel setgid = stunnel pid = /stunnel.pid debug = mail.notice client = no #cert = /etc/stunnel/stunnel.pem cert = /etc/stunnel/syslog-ng-server.pem CAfile = /etc/stunnel/syslog-ng-client.pem #verify = 1 verify = 3 service = syslog-ng #Service-level configuration [syslog-ng] accept = 5140 connect = 127.0.0.1:514 But at runtime , I am getting the following error message at client : <syslog.err> syslog-ng[32460]: I/O error occurred while writing; fd='7', error='Broken pipe (32)' I don't understand what the number 32460 means here. If it is the port number running syslog-ng then why is it not 514 as marked in the accept parameter of the client ? Kindly let me know where to look for the bug Regards

1 0

Installation options
by Anshul Saxena 01 Sep '06

01 Sep '06

Hi, I want to install syslog-ng on my rhel4.0 box. I was going through the "Hardening Linux" book, Chapter 5 , "Understanding Logging and Log monitoring" . It is written there that in order to install syslog-ng, i have to first install the "libol" package . But I cannot find the package anywhere on this page: http://www.balabit.com/products/syslog_ng/upgrades.bbq which has been mentioned in the book. So I haven't started to install syslog-ng as yet. Please let me know the step by step procedure to install syslog-ng and ny dependencies with it. Regards

3 2