- syslog-ng - lists.balabit.hu

syslog-ng[3933]: STATS: dropped 1074
by ashish tyagi 01 Jun '06

01 Jun '06

hi all I am using syslog-ng and php-syslog-ng with mysql to store logs on fedora core 4. i installed it using RPM for fedora 4. it is being used as a central loging server.in /var/log/messages a message appeares regularly "syslog-ng[3933]: STATS: dropped 1027".what does this message means, is it dropping messages comming from other servers.if i have done something wrong. i have attached syslog-ng configuration file. Thanks & Regards Ashish Tyagi

2 1

1.9.11 compile failure on HP-UX 11.23 and AIX 5.x
by Albert Chin 01 Jun '06

01 Jun '06

I'm getting the same compile failure on HP-UX and AIX using the vendor compiler: xlc -DHAVE_CONFIG_H -I. -I. -I.. -DPATH_SYSCONFDIR=\"/etc/opt/TWWfsw/syslogng1911\" -DPATH_LOCALSTATEDIR=\"/var/opt/TWWfsw/syslogng1911\" -I/opt/TWWfsw/libglib26/include -I/opt/TWWfsw/libglib26/lib/include -I/opt/TWWfsw/gettext014/include -I/opt/TWWfsw/syslogng1911/include/eventlog -D_GNU_SOURCE -O2 -ma -qro -qroconst -qmaxmem=-1 -qarch=com -c afinet.c "/usr/include/alloca.h", line 34.1: 1506-224 (I) Incorrect pragma ignored. "afinet.c", line 183.13: 1506-021 (S) Expecting struct or union. gmake[2]: *** [afinet.o] Error 1 gmake[2]: Leaving directory `/opt/build/syslog-ng-1.9.11/src' The problem is the following line: if (IN6_IS_ADDR_MULTICAST(g_sockaddr_inet6_get_address(addr)->s6_addr)) On AIX, from <netinet/in.h>: #define IN6_IS_ADDR_MULTICAST(p) IS_MULTIADDR6(*p) #define IS_MULTIADDR6(a) ((a).s6_addr8[0] == 0xff) #define s6_addr8 u6_addr.u6_addr8 #define s6_addr u6_addr.u6_addr8 So, IN6_IS_ADDR_MULTICAST(addr) is converted to IS_MULTIADDR6(*addr) and then: ((*addr).u6_addr.u6_addr8[0] == 0xff So, because addr == g_sockaddr_inet6_get_address(addr)->s6_addr, we get the following expansion: if (((*g_sockaddr_inet6_get_address(addr)->u6_addr.u6_addr8).u6_addr.u6_addr8[0] == 0xff)) The Redhat Linux definition is: #define IN6_IS_ADDR_MULTICAST(a) (((__const uint8_t *) (a))[0] == 0xff) The HP-UX 11.23 definition is: #define IN6_IS_ADDR_MULTICAST(i) ((((i)->s6_addr[0] ^ 0xff) \ | ((i)->s6_addr[1] & 0xe0)) == 0) ntp-4.2.0a also uses IN6_IS_ADDR_MULTICAST but does the following: if (IN6_IS_ADDR_MULTICAST(&((struct sockaddr_in6*)srcadr)->sin6_addr)) -- albert chin (china(a)thewrittenword.com)

2 2

RE: [syslog-ng] Compiling 1.9.11 on Solaris 9
by Heigl Florian - Munich-MR - external 29 May '06

29 May '06

> Not to mention that IPPROTO_IPV6 as a name suggests the IPv6 is a > subprotocol of IP itself, which is IPv4. This is certainly not true. You're just calling the 'Internet Protocol Version 4' 'IP'. This certainly can be confusing. SCNR, florian

1 0

RE: [syslog-ng] Starting syslog-ng as root
by Muath Al Khalaf 27 May '06

27 May '06

Hi, I am using Redhat Enterprise 4. I am using the official rpm image built by Balabit for RHE 4 with their startup script. The executable did not return anything (at least in front of me inside console). For strace I do not know how to use it. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Friday, May 26, 2006 10:35 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Starting syslog-ng as root On Fri, 2006-05-26 at 16:58 +0300, Muath Al Khalaf wrote: > Hi, > > > > I am trying to start syslog-ng as root but failed. The startup script > is using daemon. I have tried also by issuing /sbin/syslog-ng but got > nothing. I know it is better to run it with user privileges but this > is to be able to log kernel messages file("proc/kmsg"); hmm.. I don't see why it failed, but I would certainly need some more information to be able to help you. The return code of the executable, an strace dump or something. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Compiling 1.9.11 on Solaris 9
by Albert Chin 26 May '06

26 May '06

I tried building syslog-ng 1.9.11 on Solaris 9 with the Sun C compiler. It failed with the following: cc -DHAVE_CONFIG_H -I. -I. -I.. -DPATH_SYSCONFDIR=\"/etc/opt/TWWfsw/syslogng1911\" -DPATH_LOCALSTATEDIR=\"/var/opt/TWWfsw/syslogng1911\" -I/opt/TWWfsw/libglib26/include -I/opt/TWWfsw/libglib26/lib/include -I/opt/TWWfsw/gettext014/include -I/opt/TWWfsw/syslogng198/include/eventlog -D_GNU_SOURCE -mr -Qn -xstrconst -xO2 -xtarget=ultra2 -xarch=v8plusa -c afinet.c "afinet.c", line 81: warning: implicit function declaration: memset "afinet.c", line 156: undefined symbol: SOL_IP "afinet.c", line 162: undefined symbol: SOL_IP "afinet.c", line 169: undefined symbol: SOL_IP "afinet.c", line 172: undefined symbol: SOL_IP "afinet.c", line 181: warning: left operand of "->" must be pointer to struct/union "afinet.c", line 188: undefined symbol: SOL_IPV6 "afinet.c", line 194: undefined symbol: SOL_IPV6 "afinet.c", line 200: undefined symbol: SOL_IPV6 cc: acomp failed for afinet.c gmake[2]: *** [afinet.o] Error 2 gmake[2]: Leaving directory `/opt/build/syslog-ng-1.9.11/src' The prototype for memset() is in <string.h>. Solaris 9 doesn't have SOL_IP anywhere in /usr/include. From setsockopt(3SOCKET) on Solaris 9: When manipulating socket options, the level at which the option resides and the name of the option must be specified. To manipulate options at the "socket" level, level is speci- fied as SOL_SOCKET. To manipulate options at any other level, level is the protocol number of the protocol that controls the option. For example, to indicate that an option is to be interpreted by the TCP protocol, level is set to the TCP protocol number . See getprotobyname(3SOCKET). AIX 5.3 doesn't build for the same reason: "afinet.c", line 157.32: 1506-045 (S) Undeclared identifier SOL_IP. "afinet.c", line 182.13: 1506-021 (S) Expecting struct or union. "afinet.c", line 189.32: 1506-045 (S) Undeclared identifier SOL_IPV6. gmake[2]: *** [afinet.o] Error 1 gmake[2]: Leaving directory `/opt/build/syslog-ng-1.9.11/src' Ditto for HP-UX 11.23/PA and 11.23/IA. -- albert chin (china(a)thewrittenword.com)

2 3

Starting syslog-ng as root
by Muath Al Khalaf 26 May '06

26 May '06

Hi, I am trying to start syslog-ng as root but failed. The startup script is using daemon. I have tried also by issuing /sbin/syslog-ng but got nothing. I know it is better to run it with user privileges but this is to be able to log kernel messages file("proc/kmsg");

2 1

1.9.11 patch for src/stats.c
by Albert Chin 26 May '06

26 May '06

src/stats.c has the following: gchar *tag_names[SC_TYPE_MAX] = { [SC_TYPE_DROPPED] = "dropped", [SC_TYPE_PROCESSED] = "processed", }; "[SC_TYPE_DROPPED]" is a GCC thing. I guess GCC allows you to index items in an array. But, the vendor compilers from Sun, HP, IBM, etc. don't. -- albert chin (china(a)thewrittenword.com) -- snip snip Index: src/stats.c =================================================================== --- src/stats.c.orig 2006-02-11 04:57:29.000000000 -0600 +++ src/stats.c 2006-05-25 17:14:38.681857000 -0500 @@ -143,8 +143,8 @@ StatsCounterType type; gchar *tag_names[SC_TYPE_MAX] = { - [SC_TYPE_DROPPED] = "dropped", - [SC_TYPE_PROCESSED] = "processed", + "dropped", + "processed" }; e = msg_event_create(EVT_PRI_NOTICE, "Log statistics", NULL);

2 1

Facility / Priority
by Jeremy M. Guthrie 26 May '06

26 May '06

'lo I am the main author of a GPL packaged called Syslog Management Tool(SMT) - smt.dangermen.com. I am currently using Modular Syslog as the syslog package to import from syslog to PostgreSQL. I have found it has issues with about anymore than 70 messages per second. Modular Syslog also looks largely abandoned. Syslog-ng appears to be able to replace the functionality Modular Syslog via the use of pipes. The issue I have found with Syslog-NG is that it does convert the facility & priority/severity to full names when writing. Today I have Modular Syslog writing facility and severity as individual decimal values rather than the aggregate 0-255 decimal(see the table layout below). I was wondering if someone knew of a way to get Syslog-NG to write out the facility/priority values separately? .ie via the syslog-ng.conf filtering/manipulation kung fu? Or does this look like a modification that I will have to make in the .c code? TSyslog=# \d tsyslog Table "public.tsyslog" Column | Type | Modifiers ------------+------------------------+----------------------------------------------------------------- tsyslog_id | bigint | not null default nextval('public.tsyslog_tsyslog_id_seq'::text) facility | integer | severity | integer | date | date | time | time without time zone | host | character varying(128) | message | text | Indexes: "tsyslog_pkey" PRIMARY KEY, btree (tsyslog_id) "host_idx" btree (host) "tsyslhostid_idx" btree (tsyslog_id, host) "tsyslogdatetime_idx" btree (date, "time") -- -------------------------------------------------- Jeremy M. Guthrie jeremy.guthrie(a)berbee.com Senior Network Engineer Phone: 608-298-1061 Berbee Fax: 608-288-3007 5520 Research Park Drive NOC: 608-298-1102 Madison, WI 53711

3 12

RE: [syslog-ng] Syslog-ng dropped packets.
by Vaibhav Goel 26 May '06

26 May '06

We are using 1.6.5 (soon to upgrade to 1.6.11) in a production environment. Is 1.9.11 production ready? I recall a message from you saying that you are looking to release 2.0.0 within a month. I will install 1.9.11 on my QA server and start testing it once we deploy 1.6.11 to prod. I am actually not using /dev/xconsole... I have 2 production loghosts and one of them is more heavily used then the other. I am seeing dropped packets on that one during peak hours. That leads me to believe that syslog-ng. Is there a way to increase the incoming buffer in another way? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: May 25, 2006 3:51 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng dropped packets. On Wed, 2006-05-24 at 16:35 -0700, Vaibhav Goel wrote: > Recently, I started seeing dropped packets in syslog-ng. I increased > the log_fifo_size to 2000 (it was 1000) and it abated the problem > somewhat. But I am still seeing some dropped packets. Could I > increase the log_fifo_size? Are there any other tips? Unfortunately, > we are going to be adding more logging load to this loghost and I am > worried that this problem might increase. Any ideas? The most important part in addressing this problem is finding out which destination drops packets. syslog-ng 1.6.x only gave a global counter. You might have a slow destination (like /dev/xconsole) whereas your normal log flow works fine. If your primary log output is slow, you could switch to 1.9.11 which includes log message flow control. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

log line processed after flags(final)
by Kevin Lee Phair II 25 May '06

25 May '06

Are there any known situations where the use of flags(final) would still allow the processing of a matched line by log statements which come later in the config? In this case there are three log statements total which a particular line could possibly match; I want it to be processed by the first two statements but not the third. After adding flags(final) to the second log statement, all statements are still being matched.

2 3