- syslog-ng - lists.balabit.hu

filter on level don't work with kernel source
by Olleg Samoylov 14 Jul '06

14 Jul '06

$ syslog-ng --version syslog-ng 1.9.9 subj from syslog-ng.conf: source s_all { # message generated by Syslog-NG internal(); # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); }; filter f_at_least_crit { level(crit..emerg); }; log { source(s_all); filter(f_at_least_crit); destination(d_email2root); }; And I get emails like: Date: 2006-04-05T14:59:23+04:00 Facility: kern Level: debug Program: kernel ISO 9660 Extensions: Microsoft Joliet Level 3 Date: 2006-04-05T14:59:23+04:00 Facility: kern Level: debug Program: kernel ISO 9660 Extensions: Microsoft Joliet Level 3 -- Olleg Samoylov

2 2

RE: [syslog-ng] Syslog-ng dropped packets.
by Vaibhav Goel 14 Jul '06

14 Jul '06

Hi Bazsi We are still having issues with dropped packets under heavy load. We increased the size of rmem_default and rmem_max drastically but we are not seeing much of an improvement....Maybe about 50% or so. Currently, the sizes are $ > cat /proc/sys/net/core/rmem_default 786426 $ > cat /proc/sys/net/core/rmem_max 1572852 Do you have any other suggestions? We are running syslog-ng 1.6.11. All the logging is done over TCP (except 1 UDP source but that doesn't generate a lot of logging data). Thanks, -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: May 26, 2006 2:05 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Syslog-ng dropped packets. On Thu, 2006-05-25 at 06:27 -0700, Vaibhav Goel wrote: > We are using 1.6.5 (soon to upgrade to 1.6.11) in a production > environment. Is 1.9.11 production ready? I recall a message from you > saying that you are looking to release 2.0.0 within a month. I will > install 1.9.11 on my QA server and start testing it once we deploy > 1.6.11 to prod. I am actually not using /dev/xconsole... I have 2 > production loghosts and one of them is more heavily used then the other. > I am seeing dropped packets on that one during peak hours. That leads > me to believe that syslog-ng. Is there a way to increase the incoming > buffer in another way? Are you using UDP or TCP transport? You could increase the socket receive buffer size. /proc/sys/net/core/rmem_default and /proc/sys/net/core/rmem_max -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog-ng on IRIX?
by Andy G. 12 Jul '06

12 Jul '06

I'm trying to get syslog-ng to read from the log device /dev/log on IRIX, but it's not reading the messages. I tried these drivers: unix-stream: won't open /dev/log (io.c: bind_unix_socket(): /dev/log not a socket) unix-dgram: won't open /dev/log (io.c: bind_unix_socket(): /dev/log not a socket) file: opens, but no messages pipe: opens, but no messages I saw several similar posts asking how to get syslog-ng to work on IRIX, but no answers. Has anybody gotten this to work? Thanks, Andy

1 0

Problems compiling syslog-ng 1.6.11 on sparc running Solaris 10
by Stuart_Weaver＠ElementK.com 10 Jul '06

10 Jul '06

Hello. I am trying to build syslog-ng version 1.6.11 (I have also tried version 1.6.8 with the same results) on a sparc running Solaris 10 ( SunOS frylock 5.10 Generic_118833-17 sun4u sparc SUNW,Sun-Fire-V890 ). The output leads me to believe I may be missing a library. If anyone could help me out I would be very thankful. I am building with the following .... PATH=$PATH:/usr/elmk/bin:/usr/sfw/bin:/usr/ccs/bin:/usr/ucb export PATH CC=/usr/elmk/bin/gcc export CC cd libol-0.3.18 && ./configure && gmake && cd .. && ./configure --prefix=/usr/local --with-libol=./libol-0.3.18 -with-as=/usr/sfw/bin/gas --with-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld && gmake && gmake install The runtime linking environment looks as follows.... Default Library Path (ELF): /lib:/usr/lib:/usr/sfw/lib Trusted Directories (ELF): /lib/secure:/usr/lib/secure (system default) The build stops while trying to compile syslog-ng with the following output.... /usr/elmk/bin/gcc -g -O2 -Wall -I/src/solaris10/syslog-ng/syslog-ng-1.6.8/libol-0.3.18/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lpthread -lnsl -lsocket -ldoor -lresolv /src/solaris10/syslog-ng/syslog-ng-1.6.8/libol-0.3.18/src/.libs/libol.a -lsocket -lnsl -lxnet -Wl,-Bstatic -ll -Wl,-Bdynamic ld: fatal: library -ll: not found ld: fatal: File processing errors. No output written to syslog-ng collect2: ld returned 1 exit status gmake[3]: *** [syslog-ng] Error 1 gmake[3]: Leaving directory `/src/solaris10/syslog-ng/syslog-ng-1.6.8/src' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/src/solaris10/syslog-ng/syslog-ng-1.6.8/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/src/solaris10/syslog-ng/syslog-ng-1.6.8/src' gmake: *** [all-recursive] Error 1 gcc version is ... Using built-in specs. Target: sparc-sun-solaris2.10 Configured with: ./configure --prefix=/usr/elmk -with-as=/usr/sfw/bin/gas --with-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 4.1.1

2 2

segfaults with 1.9.x series syslog-ng and stream socket
by func tionate 30 Jun '06

30 Jun '06

I have written a sql stream socket daemon that for now is listening on /var/tmp/syslog-socket and passes inserts to child processes. Starting syslog-ng up with this socket as a destination on both the latest beta release and today's cvs of 1.9.x (2.0rc1) cause it to bomb out with a segfault. I have tested this both on an x86_64 linux gentoo amd64 box and a centos 4 i386 xeon box. I have used the same stream socket daemon with the latest 1.6 release and it has been reliable. I have configured syslog-ng and built it with stock ./configure. also, when i pull out the stream socket and associated config and start the daemon, everything works as expected. Below I've included the only deviations from the syslog-ng.conf RedHat config from the contrib directory (and the source definition for clarity), and an strace. Please let me know if there is any further info i can provide. (some cleansing of node names was done for obvious reasons) Regards, Chris source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination syslog-stream { unix-stream("/var/tmp/syslog-socket" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template_escape(yes) ) ; }; log { source(s_sys); destination(syslog-stream); }; root@host-1 [/usr/local/sbin] # /usr/bin/strace syslog-ng execve("/usr/local/sbin/syslog-ng", ["syslog-ng"], [/* 20 vars */]) = 0 uname({sys="Linux", node="host-1.domain.com", ...}) = 0 brk(0) = 0x934f000 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=50262, ...}) = 0 old_mmap(NULL, 50262, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7ff3000 close(3) = 0 open("/lib/libnsl.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\320dH\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=95148, ...}) = 0 old_mmap(0x483000, 88064, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x483000 old_mmap(0x495000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x11000) = 0x495000 old_mmap(0x497000, 6144, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x497000 close(3) = 0 open("/lib/tls/librt.so.1", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\320P,\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=47671, ...}) = 0 old_mmap(0x2c3000, 81656, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x2c3000 old_mmap(0x2cb000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x2cb000 old_mmap(0x2cd000, 40696, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2cd000 close(3) = 0 open("/lib/tls/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\20_\24"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1454546, ...}) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ff2000 old_mmap(0x131000, 1219772, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x131000 old_mmap(0x255000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x124000) = 0x255000 old_mmap(0x259000, 7356, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x259000 close(3) = 0 open("/lib/tls/libpthread.so.0", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P\350)\000"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=93985, ...}) = 0 old_mmap(0x29a000, 70108, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x29a000 old_mmap(0x2a8000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xd000) = 0x2a8000 old_mmap(0x2aa000, 4572, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x2aa000 close(3) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7ff1000 mprotect(0x255000, 4096, PROT_READ) = 0 mprotect(0x12d000, 4096, PROT_READ) = 0 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7ff16c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 munmap(0xb7ff3000, 50262) = 0 set_tid_address(0xb7ff1708) = 31245 rt_sigaction(SIGRTMIN, {0x29e380, [], SA_RESTORER|SA_SIGINFO, 0x2a5880}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {0x29e3f0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x2a5880}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=10240*1024, rlim_max=RLIM_INFINITY}) = 0 _sysctl({{CTL_KERN, KERN_VERSION, 0, 20d91, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, 2, 0xbfe4743c, 34, (nil), 0}) = 0 brk(0) = 0x934f000 brk(0x9370000) = 0x9370000 open("/etc/localtime", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=1267, ...}) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=1267, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fff000 read(3, "TZif\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0"..., 4096) = 1267 close(3) = 0 munmap(0xb7fff000, 4096) = 0 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0 rt_sigaction(SIGHUP, {0x804a814, [], SA_RESTORER, 0x1588e8}, NULL, 8) = 0 rt_sigaction(SIGTERM, {0x804a824, [], SA_RESTORER, 0x1588e8}, NULL, 8) = 0 rt_sigaction(SIGINT, {0x804a824, [], SA_RESTORER, 0x1588e8}, NULL, 8) = 0 rt_sigaction(SIGCHLD, {0x804a84c, [], SA_RESTORER, 0x1588e8}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {0x804a834, [], SA_RESTORER|SA_ONESHOT, 0x1588e8}, NULL, 8) = 0 open("/etc/eventlog.conf", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/etc/syslog-ng.conf", O_RDONLY) = 3 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfe473f8) = -1 ENOTTY (Inappropriate ioctl for device) fstat64(3, {st_mode=S_IFREG|0644, st_size=3080, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fff000 read(3, "# syslog-ng configuration file.\n"..., 8192) = 3080 read(3, "", 4096) = 0 read(3, "", 8192) = 0 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfe46eb8) = -1 ENOTTY (Inappropriate ioctl for device) close(3) = 0 munmap(0xb7fff000, 4096) = 0 open("/proc/kmsg", O_RDONLY|O_NONBLOCK|O_NOCTTY|O_LARGEFILE) = 3 fcntl64(3, F_GETFD) = 0 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 4 fcntl64(4, F_GETFL) = 0x2 (flags O_RDWR) fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 stat64("/dev/log", {st_mode=S_IFSOCK|0666, st_size=0, ...}) = 0 unlink("/dev/log") = 0 bind(4, {sa_family=AF_FILE, path="/dev/log"}, 11) = 0 listen(4, 255) = 0 chmod("/dev/log", 0666) = 0 --- SIGSEGV (Segmentation fault) @ 0 (0) --- kill(31245, SIGSEGV) = 0 sigreturn() = ? (mask now []) --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 31245 detached root@host-1 [/usr/local/sbin] # ./syslog-ng --version syslog-ng 2.0rc1 root@host-1 [/usr/local/sbin] # uname -a Linux host-1.domain.com 2.6.9-11.ELsmp #1 SMP Wed Jun 8 17:54:20 CDT 2005 i686 i686 i386 GNU/Linux

3 4

Rick Daoust is out of the office - Rick Daoust est hors du bureau
by Rick.Daoust＠borealc.on.ca 28 Jun '06

28 Jun '06

I will be out of the office starting 26/06/2006 and will not return until 03/07/2006. Je serai hors du bureau à partir de lundi le 26 juin 2006 et retournerai que lundi le 3 juillet 2006!

1 0

using a logfile per host, with it's own name
by Jacco Rens 27 Jun '06

27 Jun '06

Hi List-members, I just started using syslog-ng, and I am still not confident with the technique to write the config files. What I basically want, is every host that send the udp syslog, to log in it's own file. Hereunder is what I have now, but that seems not to do the trick. Maybe there's an better technique for this? And I don't want the program, where '/var/log/HOSTS/$HOST/' is used. Best, Jacco options { use_dns(no); keep_hostname(yes); long_hostnames(off); sync(1); log_fifo_size(1024); create_dirs(yes); }; source src { udp(); }; # # ADSL logfiles # destination d_adsluitgeest { file("/var/log/routers/ adsluitgeest.log"); }; destination d_adslhaarlem { file("/var/log/routers/adslhaarlem.log"); }; destination d_adslbijenkorf { file("/var/log/routers/ adslbijenkorf.log"); }; destination d_adslcs { file("/var/log/routers/adslcs.log"); }; destination d_adslalkmaar { file("/var/log/routers/adslalkmaar.log"); }; # # ADSL filters # filter f_adsluitgeest { host(192.168.1.2); }; filter f_adslhaarlem { host(192.168.4.2); }; filter f_adslbijenkorf { host(192.168.3.2); }; filter f_adslcs { host(192.168.2.2); }; filter f_adslalkmaar { host(192.168.5.2); }; # # ADSL programs # log { source(src); filter(f_adsluitgeest); destination (d_adsluitgeest); }; log { source(src); filter(f_adslhaarlem); destination(d_adslhaarlem); }; log { source(src); filter(f_adslbijenkorf); destination (d_adslbijenkorf); }; log { source(src); filter(f_adslcs); destination(d_adslcs); }; log { source(src); filter(f_adslalkmaar); destination(d_adslalkmaar); };

1 0

facilities
by donjames 26 Jun '06

26 Jun '06

Hi, Where is the list of allowable facilities for use with syslog-ng? Sincerely, Don

2 1

global option dir_group() didn't take effect
by Wolfram Schlich 23 Jun '06

23 Jun '06

Syslog-NG (1.9.11) was configured with the global option dir_group(adm), but directories it created were root:root. Anyone else experiencing this? -- Regards, Wolfram Schlich <wschlich(a)gentoo.org> Gentoo Linux * http://dev.gentoo.org/~wschlich/

2 3

suppress repeated messages feature in 2.0 ?
by stucky 23 Jun '06

23 Jun '06

Balzi Sorry if this is redundant. I thought I read something about it but I can't find it anymore so I thought I ask again. It's a very simple question. Will syslog-ng-2.0 include the 'suppress repeated messages' feature that syslogd has ? That's the one thing I really miss since it causes email floods (5000 and more at one time). I know there is stuff like SEC and I am trying to look into it. However, I like the mechanism I have in place right now except it has no threshold feature. I honestly believe that this should be accomplished by the log daemon itself rather than a parser. Just something similar to syslogd where it prints a certain burst of 5 or 10 messages of the same kind that then adds one line saying "previous message repeated 1000 times" etc.. I know with SEC I can say if this message shows up x times within a certain window then alert me. However that's not really what I want. I want a logparser that says if one source logs the same message 1000 times in a row then alert me once and skip the other messages... Well I'm sure everyone knows what I'm talking about. Is anyone using SEC in conjunction with syslog-ng to achieve exactly that ? -- stucky

1 0