- syslog-ng - lists.balabit.hu

syslog-ng.conf
by wayne yu 08 May '06

08 May '06

Hi : I've been spending 3 weeks on configuring syslog-ng.conf, can some show me a syslog-ng.conf for reference? Thanks Wayne Yu __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Defunct processes when doing log rotation
by Dev Man 08 May '06

08 May '06

Hi, I'm using syslog-ng 1.9.9 In syslog-ng.conf, I have specified a program to process the syslog-ng output. destination df_mail { file("/var/log/mail.log"); program("/home/readlog/readlog.php"); }; When cron performs it's logrotation daily, it runs a reload of the syslog-ng system. The readlog.php script ends up being <defunct>. For example: root@thehost:/etc/logrotate.d# ps -ef | grep read root 9 1 0 Mar27 ? 00:00:00 [kthread] root 1652 537 0 Apr20 ? 00:00:00 [readlog.php] <defunct> root 4000 537 0 Apr21 ? 00:00:00 [readlog.php] <defunct> root 7189 537 0 Apr22 ? 00:00:00 [readlog.php] <defunct> Thanks for any suggestions. D

3 3

"not netmask(...)" not working
by Brian Candler 08 May '06

08 May '06

Hello, I am using syslog-ng-1.6.11 under RHEL 4, using an RPM built from http://www.balabit.com/downloads/syslog-ng/1.6/src/syslog-ng-1.6.11.tar.gz [*] I tried to use the following rule to match all packets except those from certain host ranges: destination estate { file("/logs/estate.log" ); }; filter f_estate { not netmask( "10.1.0.0/16" ) and not netmask( "172.17.0.0/24" ) and not netmask( "192.168.1.254" ); }; log { source(s_sys); filter(f_estate); destination(estate); }; but it didn't work. tcpdump showed packets from outside those ranges were being received, but syslog-ng did not log them. Now, inspecting the code, firstly it seems I should have written the expressions in dotted netmask form, i.e. "10.1.0.0/255.255.0.0". It would be nice if syslog-ng were to validate this a bit better :-) However when I fixed that nothing changed. Looking in the code, I think that a negation operation is missing for the netmask() function, perhaps something like this: --- src/filters.c.orig Fri May 5 13:19:18 2006 +++ src/filters.c Fri May 5 13:24:44 2006 @@ -272,10 +272,10 @@ netw = self->network.s_addr; mask = self->netmask.s_addr; - return ((host & mask) == (netw & mask)); + return ((host & mask) == (netw & mask)) ^ c->comp; } else { - return 0; + return c->comp; } } However, I don't understand why some of the functions use c->comp, and others use self->super.comp, so I'm a bit hesitant to modify in this way. I was able to workaround by rewriting the expression thus: destination estate { file("/logs/estate.log" ); }; filter f_not_estate { netmask( "10.1.0.0/255.255.0.0" ) or netmask( "172.17.0.0/255.255.255.0" ) or netmask( "192.168.1.254" ); }; filter f_estate { not filter("f_not_estate"); }; log { source(s_sys); filter(f_estate); destination(estate); }; but perhaps someone who understands the expression parser could look at fixing this properly? Thanks, Brian. [*] I had to use syslog-ng.spec.bb, because syslog-ng.spec references a number of non-existent files, such as Source3: mysql-syslog.pipe Source4: mysql-syslog.buffer) With a small change to syslog-ng.bb, changing an underscore to dash, it was happy.

2 1

syslog-ng blocking on read() from /proc/kmsg
by John Morrissey 07 May '06

07 May '06

I'm running the Debian 1.6.9-1 package with the 'read from each file descriptor n times or until EAGAIN' patch backported. There seems to be a problem with this behavior when it's applied to /proc/kmsg. Here's the source we use: source s_kmsg { file("/proc/kmsg" log_prefix("kernel: ")); }; What happens is: 1. syslog-ng calls poll(2) and waits. 2. Data appears on /proc/kmsg and causes poll() to return. 3. syslog-ng read(2)s from /proc/kmsg, grabbing some data. 4. Since it hasn't received EAGAIN or read n times from this file descriptor, syslog-ng happily read()s again. Since it's exhausted the available data, the read() blocks. Forever. 5. Meanwhile, other syslog traffic to /dev/log piles up. Eventually, whatever buffer there is on Unix domain sockets fills up and causes other applications on the machine to block, waiting to syslog. 6. The box eventually runs out of file descriptors since other processes (cron is a big culprit because it runs jobs so often) are piling up, holding onto file descriptors and blocking on writes to /dev/log. The blocking behavior on /proc/kmsg is interesting, since if I'm reading the source correctly, file sources are set O_NONBLOCK: affile.c: 152 static int do_init_affile_source(struct log_handler *c, struct syslog_con 153 { 154 CAST(affile_source, self, c); 155 int fd, flags; 156 157 if (self->flags & AFFILE_PIPE) 158 flags = O_RDWR | O_NOCTTY | O_NONBLOCK | O_LARGEFILE; 159 else 160 flags = O_RDONLY | O_NOCTTY | O_NONBLOCK | O_LARGEFILE; Any thoughts? thanks, john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

2 2

syslog-ng 1.6.11 released
by Balazs Scheidler 06 May '06

06 May '06

Hi, I have released syslog-ng version 1.6.11, available at http://www.balabit.com/products/syslog-ng/ The user visible changes this time: News for the 1.6.11 release Wed, 03 May 2006 13:08:38 +0200 * Using time_sleep() caused a parser error as a rule was missed from the configuration parser. * Scalability improvements applied in 1.6.10 broke reading /proc/kmsg on Linux. -- Bazsi

1 0

Searching past posts?
by jarrod.schous＠sasktel.sk.ca 05 May '06

05 May '06

Is there a way to search the past posts so I don't need to waste everyone valuable time with questions that have likely been asked many times before? NOTICE: This confidential e-mail message is only for the intended recipient(s). If you are not the intended recipient, be advised that disclosing, copying, distributing, or any other use of this message, is strictly prohibited. In such case, please destroy this message and notify the sender.

2 1

Problem logging messages from console server
by Berthold Cogel 05 May '06

05 May '06

Hello! I've build our loghost with syslog-ng 1.6.9 on a RHEL 3 system with destinations which include the hostnames: destination d_mesg { file ("/var/local/logmaster/$HOST/messages"); }; ... Global options are: check_hostname (yes); keep_hostname (yes); use_dns (yes); dns_cache (yes); use_fqdn (yes); chain_hostnames (no); create_dirs (yes); This works as expected for all hosts, except one. Our console server (Digi CM 32) sends lines like LOCAL1.NOTICE: May 4 09:53:17 Data Buffering: ... This gets logged by syslog-ng as 'May 4 09:53:17 Data Buffering: ... ' for a host 'Data'. With the syslog, that comes with RHEL 3, I get log entrys like 'May 4 09:53:17 digi-cm32 Data Buffering: ... '. To me this doesn't look like a DNS problem. The log format of the console server looks similar to the format I get when I transfer the log entrys via a second syslog-ng: <facility>.<level>: <date> <host> DATA I've run out of ideas at the moment. Any help is welcome. Regards Berthold Cogel

2 2

Howto avoid or reduce nr of STATS dropped?
by Martin Meiler 04 May '06

04 May '06

Hello everybody, we face a problem with our log-server at our department since the last few weeks. Previously there was no problem concerning this log-server but now we get messages like syslog-ng[...] STATS: dropped 38142 or sometimes even more. How can we avoid these dropped messages? Or how can we influence the number of dropped messages? Or why are messages dropped? Since the syslog protocol is based on UDP we can not really avoid that some packets are dropped if many of them arrive at nearly the same time, or is there a solution. Thanks for an answer. Best regards Martin -- -------------------------------------------------------------------- _/ _/_/ _/_/_/ Friedrich Alexander Universität Erlangen _/ _/ _/ _/ Lehrstuhl für Sensorik _/ _/ _/ Paul-Gordanstr. 5, 91052 Erlangen, Germany _/ _/_/ _/_/ _/ _/ _/ University of Erlangen _/ _/ _/ _/ Department of Sensor Technology _/_/_/ _/_/ _/_/_/ Paul-Gordanstr. 5, 91052 Erlangen, Germany Dipl.-Ing. Martin Meiler tel.: (+49)-9131-85-23140 fax.: (+49)-9131-85-23133 email: Martin.Meiler(a)lse.eei.uni-erlangen.de

2 1

TTL patch, helpful for multicasting logs
by Alexander Clouter 04 May '06

04 May '06

Hi, After my earlier multicast patch I quickly realised that if syslog-ng is actually sending UDP multicast syslog data the TTL on the IP packets is by default 1. This results in the packet being expired at the gateway and never being able to leave the subnet....not too handy :( After clobbering it around for a few days I have rolled out this patch to address the problem which should be applied in addition, and after, the multicast patch I released the other day (also re-included in this email). The patch adds a new parameter to the destination tcp()/udp() drivers called ttl() and it takes a number between 0 and 255. When set to zero, it uses the default kernel parameter[1] but when set to 1->255 the TTL on the packet being sent is set to this. Of course if the parameter is not specified it defaults to zero. This should now allow you to use destination du_moo { udp("239.1.2.3" port(514) ttl(7)); }; in your config files. It works on unicast traffic too, I guess you could use it as a layer of defence to guarentee that your syslog packets never leave your network by setting the TTL to a low value. I always wanted to get around to emailing the samba folk a TTL patch to do this sort of thing, so roaming samba laptop users could get some feeling of security that only the local network can get access to their shares....however this is now getting a bit offtopic :) Hope you all find it useful, now back to my multicasting syslog cluster :) Cheers Alex [1] under linux its one, and probably the same for most OS's

2 5

Silent fail on program() without execute bit
by Brian A. Seklecki 03 May '06

03 May '06

When an external program is not executable by the user running the syslong-ng process, messages sent to destination{}; with system fail silently. Even ith "-dvv" flags, there's no indication of a problem. No mention of this behavior as a feature in the docs, either. l8* -lava

1 0