- syslog-ng - lists.balabit.hu

RE: [syslog-ng] Solaris 8 Hangs
by Neill Flynn 07 Jun '06

07 Jun '06

offending server: source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; Syslog-ng server: source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_tcp { tcp(port(5140) max-connections(200)); }; source s_udp { udp(); }; -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 07 June 2006 10:19 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Solaris 8 Hangs On Wed, 2006-06-07 at 08:47 +0100, Neill Flynn wrote: > I have been running syslog-ng 1.6.6 in a Solaris/RH environment > (almost 70 syslog-ng clients). All works fine but for two Solaris 8 > machines which do not allow me to su from my own account, if I "su -", > the process hangs indefinitely. I can open a second connection and > kill part of the su process and gain access. When I switch off > syslog-ng and start syslog, all work fine. Also, both the local files > and the remote syslog-ng server log the su as it happens. can you paste your source statement (more specifically, do you have sun_door() configured?) -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

2 1

RE: [syslog-ng] memory leak?
by Cai Wang(CD) 07 Jun '06

07 Jun '06

How can I limit it if modify the src code manually? Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Cai Wang(CD) Sent: 2006年6月7日 17:35 To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] memory leak? Thanks I used 1.6.10 now, and the memory usage grows from 5800K bytes to 9800K bytes, and I have last the traffic for 2 hours. Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 2006年6月7日 17:32 To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] memory leak? On Wed, 2006-06-07 at 17:20 +0800, Cai Wang(CD) wrote: > But, I have tested the version 1.6.5, it can be reproduced. But does it grow without limit? 8.5MB does not really ring the alarm for a busy syslog-ng process. And as I said 1.6.7 included the last leak fix and 1.6.5 is certainly before that. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] memory leak?
by Cai Wang(CD) 07 Jun '06

07 Jun '06

Thanks I used 1.6.10 now, and the memory usage grows from 5800K bytes to 9800K bytes, and I have last the traffic for 2 hours. Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 2006年6月7日 17:32 To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] memory leak? On Wed, 2006-06-07 at 17:20 +0800, Cai Wang(CD) wrote: > But, I have tested the version 1.6.5, it can be reproduced. But does it grow without limit? 8.5MB does not really ring the alarm for a busy syslog-ng process. And as I said 1.6.7 included the last leak fix and 1.6.5 is certainly before that. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] memory leak?
by Cai Wang(CD) 07 Jun '06

07 Jun '06

But, I have tested the version 1.6.5, it can be reproduced. Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: 2006年6月7日 17:19 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] memory leak? On Wed, 2006-06-07 at 15:41 +0800, Cai Wang(CD) wrote: > Hi > > I have installed the Syslog-NG 1.6.10 in Red Hat 9.0 > environment, but when I test it as the following situation: > > > > Message sender à RH9 (Syslog-NG) à Message receiver > > > > They worked in Giga bits networks, but when I send message to > receiver in 800M bps rate, the memory usage of Syslog-NG last to > increase > > When Syslog-NG started, it used 5800k bytes of memory, and it > used 8500k bytes after 1 hour. > > Could u give me some advice? It might be used for internal memory based buffers (controlled by log_fifo_size) I currently don't know about any memory leaks after 1.6.7 (which was related to spoof-source support) -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Solaris 8 Hangs
by Neill Flynn 07 Jun '06

07 Jun '06

I have been running syslog-ng 1.6.6 in a Solaris/RH environment (almost 70 syslog-ng clients). All works fine but for two Solaris 8 machines which do not allow me to su from my own account, if I "su -", the process hangs indefinitely. I can open a second connection and kill part of the su process and gain access. When I switch off syslog-ng and start syslog, all work fine. Also, both the local files and the remote syslog-ng server log the su as it happens. Anyone any ideas? Thanks, Neill ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

2 1

memory leak?
by Cai Wang(CD) 07 Jun '06

07 Jun '06

Hi I have installed the Syslog-NG 1.6.10 in Red Hat 9.0 environment, but when I test it as the following situation: Message sender --> RH9 (Syslog-NG) --> Message receiver They worked in Giga bits networks, but when I send message to receiver in 800M bps rate, the memory usage of Syslog-NG last to increase When Syslog-NG started, it used 5800k bytes of memory, and it used 8500k bytes after 1 hour. Could u give me some advice? Best Regards Cai Wang O2Micro (Chengdu) Co., Inc. TEL: 86-28-8514 6308 ext.311 www.O2Micro.com

2 1

RE: [syslog-ng] Starting syslog-ng as root
by Muath Al Khalaf 02 Jun '06

02 Jun '06

Thank you very much. I have disabled SELinux and every thing goes fine. Do you think it is better to run syslog-ng with or without SELinux especially that I may use MySQL and PHP-syslog-ng? Kind regards -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Jose Pedro Oliveira Sent: Saturday, May 27, 2006 6:59 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Starting syslog-ng as root -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Muath Al Khalaf wrote: > Hi, > I am using Redhat Enterprise 4. I am using the official rpm image built > by Balabit for RHE 4 with their startup script. The executable did not > return anything (at least in front of me inside console). For strace I > do not know how to use it. You may be having problems with SELinux. In RHEL4, CentOS, and Fedora Core 3 you need to enable the use_syslogng SELinux boolean before starting the syslog-ng daemon [1]. To check the use_syslogng boolean status getsebool -a | grep syslogng To enable it (and saving its value) setsebool -P use_syslogng 1 jpo [1] - you need to have the a recent selinux-policy-targeted - -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B * -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iD8DBQFEeHc6l0metZG9hRsRAvqLAJ41iuwCrKNhFhyG2lWyv6Q2eScdzACgmoMD QzNXnXkc4tuHT0bbK5Fl5iw= =s/7p -----END PGP SIGNATURE-----

4 7

Solaris 10
by Walt Rich 02 Jun '06

02 Jun '06

Gents, I found some instructions on the net where Roberto Nibali had successfully installed syslog-ng on Solaris 10 (although I've not seen the email come from the mailing list) and have a couple of questions: What version of syslog-ng would be best to use? I've currently installed 1.6.11 and libol 0.3.18. Where do I find the file svc.method.syslog-ng? Step 4 of Roberto's instructions are to copy that file to /lib/svc/method/syslog-ng Where do I find the file svc.manifest.syslog-ng.xml as in Step 5 the instructions read to copy this to /var/svc/manifest/system/syslog-ng.xml. Any input regarding installing syslog-ng on solaris 1- would be most appreciated. Thanks!

1 0

1.9.11 compile failure on Solaris 2.6/7
by Albert Chin 01 Jun '06

01 Jun '06

Seems AF_INET6 is used unconditionally in src/cfg-grammar.y: source_afsocket : KW_UNIX_DGRAM '(' source_afunix_dgram_params ')' { $$ = $3; } | KW_UNIX_STREAM '(' source_afunix_stream_params ')' { $$ = $3; } | KW_UDP { last_addr_family = AF_INET; } '(' source_afinet_udp_params ') ' { $$ = $4; } | KW_TCP { last_addr_family = AF_INET; } '(' source_afinet_tcp_params ') ' { $$ = $4; } | KW_UDP6 { last_addr_family = AF_INET6; } '(' source_afinet_udp_params ')' { $$ = $4; } | KW_TCP6 { last_addr_family = AF_INET6; } '(' source_afinet_tcp_params ')' { $$ = $4; } ; A build on solaris 2.6/7 fails with: cc -DHAVE_CONFIG_H -I. -I. -I.. -DPATH_SYSCONFDIR=\"/etc/opt/TWWfsw/syslogng1911\" -DPATH_LOCALSTATEDIR=\"/var/opt/TWWfsw/syslogng1911\" -I/opt/TWWfsw/libglib26/include -I/opt/TWWfsw/libglib26/lib/include -I/opt/TWWfsw/gettext014/include -I/opt/TWWfsw/syslogng1911/include/eventlog -D_GNU_SOURCE -mr -Qn -xstrconst -xO2 -xtarget=ultra2 -xarch=v8plusa -c cfg-grammar.c "/home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y", line 303: undefined symbol: AF_INET6 "/home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y", line 304: undefined symbol: AF_INET6 "/home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y", line 539: undefined symbol: AF_INET6 "/home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y", line 540: undefined symbol: AF_INET6 cc: acomp failed for cfg-grammar.c -- albert chin (china(a)thewrittenword.com)

1 0

1.9.11 compile failure on IRIX 6.5, Tru64 UNIX 5.1
by Albert Chin 01 Jun '06

01 Jun '06

Seems like IRIX 6.5 and Tru64 UNIX 5.1 don't have IPV6_ADD_MEMBERSHIP. They do have IP_ADD_MEMBERSHIP though. Should we just: #ifndef IPV6_ADD_MEMBERSHIP #define IPV6_ADD_MEMBERSHIP IP_ADD_MEMBERSHIP #endif cc -DHAVE_CONFIG_H -I. -I. -I.. -DPATH_SYSCONFDIR=\"/etc/opt/TWWfsw/syslogng1911\" -DPATH_LOCALSTATEDIR=\"/var/opt/TWWfsw/syslogng1911\" -I/opt/TWWfsw/libglib26/include -I/opt/TWWfsw/libglib26/lib/include -I/opt/TWWfsw/gettext014/include -I/opt/TWWfsw/syslogng198/include/eventlog -D_GNU_SOURCE -Wl,-woff,84 -Wl,-woff,85 -woff 1009,1429 -use_readonly_const -G0 -rdata_shared -DEBUG:optimize_space=ON -O2 -OPT:Olimit=0 -c afinet.c cc-1020 cc: ERROR File = afinet.c, Line = 190 The identifier "IPV6_ADD_MEMBERSHIP" is undefined. setsockopt(fd, IPPROTO_IPV6, IPV6_ADD_MEMBERSHIP, &mreq6, sizeof(mreq6)); ^ 1 error detected in the compilation of "afinet.c". -- albert chin (china(a)thewrittenword.com)

2 2