- syslog-ng - lists.balabit.hu

Syslog-ng dropped packets.
by Vaibhav Goel 25 May '06

25 May '06

Recently, I started seeing dropped packets in syslog-ng. I increased the log_fifo_size to 2000 (it was 1000) and it abated the problem somewhat. But I am still seeing some dropped packets. Could I increase the log_fifo_size? Are there any other tips? Unfortunately, we are going to be adding more logging load to this loghost and I am worried that this problem might increase. Any ideas? Thanks!

2 1

syslog-ng 1.9.11 released
by Balazs Scheidler 23 May '06

23 May '06

Hi, Syslog-ng 1.9.11 has been released and uploaded to the usual places at http://www.balabit.com/products/syslog-ng/ with the following list of user-visible changes: 1.9.11 Tue, 23 May 2006 19:45:21 +0200 Some minor new features: * Added IPv6 support. * Added multicast support. Bugfixes: * Avoid changing owner/group/permission information for files that do not exist, to avoid clobbering the error value. * Added close-on-exec flag to avoid inheriting file descriptors for programs started by syslog-ng. * Fixed an off-by-one in flush_lines() calculation. * Fixed a possible memory leak. * Fixed a CPU spinning possibility when a non-existing filter is referenced on the log path the processes internal() messages. * Fixed hanging on reading /proc/kmsg on Linux. * Fixed sun-streams() fetching problem on Solaris. Other changes: * Documentation updates. I would like to release 2.0.0 real soon now, for this to happen I would need some positive feedback on this release. Anyone using the 1.9.x series and especially 1.9.11, please speak up. People on non-Linux platforms, now is the time to submit bugreports on portability issues. If nothing major shows up, I am going to release 2.0.0 in about a months time and obsolete 1.6.x once and for all. Thanks in advance, -- Bazsi

1 0

Syslog-ng + Freebsd
by Stefan Lind 23 May '06

23 May '06

I have a problem with syslog-ng It hangs every now and then, When it hangs I have to "kill -9" and then start again. I know this is a bad description do you know what I can do to find the problem? Mvh Stefan Lind 0520-500525 Leissner Data AB

2 1

filter set but still logged to mySQL
by Dennis Kavadas 23 May '06

23 May '06

Hi all I have a question, or rather a problem I've written a filter to trap entries from our BIND host that sends the output to /de/null (see below) I can send the match to any file or to /dev/null but syslog-ng is still seeing the entry from the host and is logging it to "destination d_mysql " I just need to filter out the match so it never reaches "destination d_mysql" Can anyone offer any advice ? my syslog-ng file below.... -------------------------------------- options { long_hostnames(off); sync(0); stats(43200); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_dns(yes); }; source shell { internal(); unix-stream("/dev/log"); udp(ip( my.syslog-ng.host.com)) }; destination err-update-dns { file("/dev/null"); }; filter err-update-dns { match("(59.167.232.229)"); }; log {source(shell); filter(err-update-dns); destination(err-update-dns); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(shell); destination(d_mysql); };

2 2

syslog-ng stalls system
by Mario Aeby 19 May '06

19 May '06

Hi Guys Wow, thanks for all your replies! So at least I'm not the only one having problems. - I'm running Debian testing with (self-compiled *boah*) Kernel 2.4.25 - I replaced syslog-ng with syslog until the issues are fixed - dpkg says I had the following syslog-ng installed: rc syslog-ng 1.9.9-1 Next generation logging daemon Really confusing, since Balazs is talking about 1.6.11 ... Do Debian maintainers follow a different numbering scheme? - My configuration is available as a download at http://mad4you.homeip.net/downloads/syslog-ng.conf . Note: It cannot be caused by this, since I soon replaced syslog-ng.conf with the one the original Debian package provided (to rule out exactly such a cause) Many thanks! Kind regards Mario -- Mario Aeby Stritenstrasse 47 CH-3176 Neuenegg Mobile 078 690 50 11 Fax 031 741 28 93 http://www.eMeidi.com/

2 1

Solaris 8 login hangs
by Neill Flynn 19 May '06

19 May '06

I have been running syslog-ng 1.6.6 in a Solaris/RH environment (almost 70 syslog-ng clients). All works fine but for two Solaris machines which do not allow me to su from my own account, if I "su -", the process hangs indefinitely. I can open a second connection and kill part of the su process and gain access. When I switch off syslog-ng and start syslog, all work fine. Also, both the local files and the remote syslog-ng server log the su as it happens. Anyone any ideas? ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

1 0

Re: [syslog-ng] syslog-ng stalls system
by Tony Davis 18 May '06

18 May '06

> Hi > > I've ran into serious problems yesterday with my Debian server and > finally was able to nail down the problem to syslog-ng and/or the > logging subsystem (or whatever it is called). I first noticed troubles > after I did a apt-get install, which hang while installing ssl-cert due > to a failure to create a group (connected to the symptoms mentioned > below). > > Symptoms: > - a growing number of unterminated /USR/SBIN/CRON processes (strace: > "connect(7, {sa_family=AF_FILE, path="/dev/log"}, 16") > - unable to 'su <user>' (Ctrl-C to return to shell) > - unable to establish a ssh connection (terminal hangs after entering > password, sshd <defunct> in processes) > - unable to login physically at the server itself ("You have new mail", > but no command line, Ctrl-C to return to the login screen) > - when logged in prior the failures, either 'shutdown' nor 'reboot' > have any effect (system must be shut down by /etc/init.d/reboot stop) > - no new entries in /var/log/cron.log or /var/log/syslog > > Temporary Cure: > - reboot and prevent syslog-ng from starting at boot > > Sidenotes: > - All other services work as expected > > I've got to know Linux in recent years, but it seems I'm not capable of > solving such a difficult issue by myself. Do you have any suggestions? > > Thank you very much! > Kind regards > Mario Hi Mario, I reported the exact same problem back on the 5th May but, so far, I haven't found a resolution. This was running syslog-ng version 1-6-10-1 on RedHat EL 3 using the RedHat conf file in the contribs directory bundled with the source. Tony ***************************************************** You can find us at www.voca.com ***************************************************** This communication is confidential and intended for the exclusive use of the addressee only. You should not disclose its contents to any other person. If you are not the intended recipient please notify the sender named above immediately. Registered in England, No 1023742, Registered Office: Voca Limited Drake House, Three Rivers Court, Homestead Road, Rickmansworth, Hertfordshire, WD3 1FX This message has been checked for all email viruses by MessageLabs.

3 2

log messages with LF
by PREVOSTO, Laurent 18 May '06

18 May '06

Hi, i'm afraid this is some kind of FAQ but is there a way to have syslog-ng correctly prints logs messages that contain LF ('\n') ? It looks like they are wiped out in log_msg_parse() (logmsg.c) but is there a reason for such a behaviour ? Regards Laurent

2 1

syslog-ng stalls system
by Mario Aeby 18 May '06

18 May '06

Hi I've ran into serious problems yesterday with my Debian server and finally was able to nail down the problem to syslog-ng and/or the logging subsystem (or whatever it is called). I first noticed troubles after I did a apt-get install, which hang while installing ssl-cert due to a failure to create a group (connected to the symptoms mentioned below). Symptoms: - a growing number of unterminated /USR/SBIN/CRON processes (strace: "connect(7, {sa_family=AF_FILE, path="/dev/log"}, 16") - unable to 'su <user>' (Ctrl-C to return to shell) - unable to establish a ssh connection (terminal hangs after entering password, sshd <defunct> in processes) - unable to login physically at the server itself ("You have new mail", but no command line, Ctrl-C to return to the login screen) - when logged in prior the failures, either 'shutdown' nor 'reboot' have any effect (system must be shut down by /etc/init.d/reboot stop) - no new entries in /var/log/cron.log or /var/log/syslog Temporary Cure: - reboot and prevent syslog-ng from starting at boot Sidenotes: - All other services work as expected I've got to know Linux in recent years, but it seems I'm not capable of solving such a difficult issue by myself. Do you have any suggestions? Thank you very much! Kind regards Mario -- Mario Aeby Stritenstrasse 47 CH-3176 Neuenegg Mobile 078 690 50 11 Fax 031 741 28 93 http://www.eMeidi.com/

3 2

syslog-ng GUI
by Arya, Manish Kumar 18 May '06

18 May '06

Hi Guys, I am storing logs on a central server having 3T SAN, using follwing template destination indexlog { file("/logs/log01/indexlog/$YEAR/$MONTH/$DAY/$HOST" template("$HOUR:$MIN:$SEC,$PROGRAM,$FACILITY,$PRIORITY,$MSGONLY\n") template-escape(yes) owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; my logging is done perfectly :) like /logs/log01/indexlog/2006/05/11/hostnames I want to have a GUI to view logs with following facilities -search logs on basis on date/time, text patterns in messages,hostnames. -should provide facility to have filters associated with user authentication/authorization. -should be able to to parallel search to improve search response time. Regards, -Manish __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

8 13