- syslog-ng - lists.balabit.hu

Re: [syslog-ng] I/O error since upgrade to v1.9.9-1
by ma.LAN.ge 06 Apr '06

06 Apr '06

> On Wed, 2006-04-05 at 20:00 +0200, ma.LAN.ge wrote: > > > > Yesterday I updated my Debian Etch (kernel 2.6.16-1) with syslog-ng > > > > v1.9.9-1. > > > > > > > > I had to modify syslog-ng.conf, cause syslog-ng did not start after > > > > upgrading (syntax error line xxx). > > > > > > I already reported similar issues in our bugzilla about (currently) > > > unimplemented features in the 1.9 branch which were working in the 1.6 > > > branch. Hopefully Bazsi will implement the missing features or convert > > > these errors into warnings and FIXME-s in the near future :)) > > > > > > > OK, I merged my old .conf with the new .conf and cleaned some old > .log > > > files > > > > in /var/log/. > > > > > > > > syslog-ng script started now w/o any syntax errors, but in > > > /var/log/messages > > > > folowing occurs massively and rapidly: > > > > > > > > syslog-ng: I/O error occurred while writing, error='Operation not > > > permitted > > > > (1)', fd='5' | fd='17' > > > > > > If your configuration isn't confidental, please post your > configuration > > OK, attached. (now compressed ;) > > > with the list of the /proc/[syslog-ng_pid]/fd directory. > > Hm, unbeliebvable, but true: I only restarted syslog-ng and it seems to > > work. No more errors like mentioned above occurred anymore (until now > =). > > It must have been some kind of permission problem on one/more of the > destination files. "Operation not permitted" was returned in response > for write(). OK, I've got this problem again. (see attachments, 1 for private mail) I attached the syslog and a pic from the /proc/<pid>/fd/ directory with sockets etc. The syslog seems to point me to a possible reason: while initializing my firewall with iptables rules, these I/O errors occur. After that, the errors disappear in syslog. But a good syslog should always be started before most services, cause it should log system messages ;) So it should also work while initializing my firewall rules 8) So, how can we cath this problem to find a solution? > > > > > But a question besides: How can I hide the syslog-ng 'log statistics' > list > > from being displayed in syslog? It nerves a little bit ;) > > use stats_freq(-1) in your global options. Thx for this =) -- Thx in advance "Feel free" - 10 GB Mailbox, 100 FreeSMS/Monat ... Jetzt GMX TopMail testen: http://www.gmx.net/de/go/topmail

2 1

Re: [syslog-ng] I/O error since upgrade to v1.9.9-1 [again w/o attachments]
by ma.LAN.ge 06 Apr '06

06 Apr '06

> > Yesterday I updated my Debian Etch (kernel 2.6.16-1) with syslog-ng > > v1.9.9-1. > > > > I had to modify syslog-ng.conf, cause syslog-ng did not start after > > upgrading (syntax error line xxx). > > I already reported similar issues in our bugzilla about (currently) > unimplemented features in the 1.9 branch which were working in the 1.6 > branch. Hopefully Bazsi will implement the missing features or convert > these errors into warnings and FIXME-s in the near future :)) > > > OK, I merged my old .conf with the new .conf and cleaned some old .log > files > > in /var/log/. > > > > syslog-ng script started now w/o any syntax errors, but in > /var/log/messages > > folowing occurs massively and rapidly: > > > > syslog-ng: I/O error occurred while writing, error='Operation not > permitted > > (1)', fd='5' | fd='17' > > If your configuration isn't confidental, please post your configuration OK, attached. (now compressed ;) > with the list of the /proc/[syslog-ng_pid]/fd directory. Hm, unbeliebvable, but true: I only restarted syslog-ng and it seems to work. No more errors like mentioned above occurred anymore (until now =). But a question besides: How can I hide the syslog-ng 'log statistics' list from being displayed in syslog? It nerves a little bit ;) > > Unfortunately there are issues with the current 1.9.9 version. Syslog-ng > 1.9.x entered into debian unstable and testing, so it's getting > used/tested more widely than before. If your machine is in production > use, I recommend to downgrade to the latest 1.6.x package, and hold it > until the remaining issues will be fixed. -- Thx in advance. E-Mails und Internet immer und �berall! 1&1 PocketWeb, perfekt mit GMX: http://www.gmx.net/de/go/pocketweb

2 2

I/O error since upgrade to v1.9.9-1 [again w/o attachments]
by ma.LAN.ge 06 Apr '06

06 Apr '06

Hi everybody out there =) Yesterday I updated my Debian Etch (kernel 2.6.16-1) with syslog-ng v1.9.9-1. I had to modify syslog-ng.conf, cause syslog-ng did not start after upgrading (syntax error line xxx). OK, I merged my old .conf with the new .conf and cleaned some old .log files in /var/log/. syslog-ng script started now w/o any syntax errors, but in /var/log/messages folowing occurs massively and rapidly: syslog-ng: I/O error occurred while writing, error='Operation not permitted (1)', fd='5' | fd='17' Please help me =) [I've sent this message again w/o attachments, cause maybe my first mail was too big for this list.] -- Thx in advance =) Analog-/ISDN-Nutzer sparen mit GMX SmartSurfer bis zu 70%! Kostenlos downloaden: http://www.gmx.net/de/go/smartsurfer

3 3

IPv6 support
by Michael Clark 05 Apr '06

05 Apr '06

We've got a client looking into moving to IPv6 and their asking if syslog-ng support IPv6. My initial response is sure if the OS supports IPv6 (Solaris in this case, which it does). However, there are some address centric parameters in the configuration file that might be affected by IPv6. I checked the FAQ but didn't find anything on the search. Does anyone know if IPv6 support works with syslog-ng? BTW, this is a large network which will have lots of legacy IPv4 networks that it will have to connect to as well so this isn't going to happen within the next year. It's more of a planning question so they can start mapping out the change. ______________________ Michael W. Clark Adaptive Architecture, Inc. (www.adapt2.com) mclark(a)adapt2.com

2 2

syslog-ng dying after reload
by Rune V. Sjøen 05 Apr '06

05 Apr '06

When logrotate does this: /var/log/messages { rotate 4 weekly missingok notifempty postrotate /etc/init.d/syslog-ng reload >/dev/null <--- this endscript } syslog-ng dies without any trace in the logs. '/etc/init.d/syslog-ng restart' works fine. I've included an strace[1] of '/etc/init.d/syslog-ng reload' and the syslog-ng config file[2]. This is version 1.9.9-1 Any help in this matter would be appreciated. [1] Strace execve("/etc/init.d/syslog-ng", ["/etc/init.d/syslog-ng", "reload"], [/* 15 vars */]) = 0 uname({sys="Linux", node="rainbow.homelinux.org", ...}) = 0 brk(0) = 0x80f5000 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=27071, ...}) = 0 old_mmap(NULL, 27071, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7fc2000 close(3) = 0 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/libncurses.so.5", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p\343\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0644, st_size=268396, ...}) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc1000 old_mmap(NULL, 273580, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f7e000 old_mmap(0xb7fb8000, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x39000) = 0xb7fb8000 close(3) = 0 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/tls/libdl.so.2", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\20\f\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0644, st_size=9592, ...}) = 0 old_mmap(NULL, 12404, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f7a000 old_mmap(0xb7f7c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0xb7f7c000 close(3) = 0 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/tls/libc.so.6", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\320O\1"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0755, st_size=1266800, ...}) = 0 old_mmap(NULL, 1272764, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7e43000 old_mmap(0xb7f70000, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x12d000) = 0xb7f70000 old_mmap(0xb7f78000, 7100, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f78000 close(3) = 0 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7e42000 mprotect(0xb7f70000, 20480, PROT_READ) = 0 set_thread_area({entry_number:-1 -> 6, base_addr:0xb7e426c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 munmap(0xb7fc2000, 27071) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 open("/dev/tty", O_RDWR|O_NONBLOCK|O_LARGEFILE) = 3 close(3) = 0 open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=288544, ...}) = 0 mmap2(NULL, 288544, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7dfb000 close(3) = 0 brk(0) = 0x80f5000 brk(0x80f6000) = 0x80f6000 brk(0x80f7000) = 0x80f7000 brk(0x80f8000) = 0x80f8000 getuid32() = 0 getgid32() = 0 geteuid32() = 0 getegid32() = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 time(NULL) = 1143980943 brk(0x80f9000) = 0x80f9000 open("/etc/mtab", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=242, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc8000 read(3, "/dev/hda1 / ext3 rw,acl,errors=r"..., 4096) = 242 close(3) = 0 munmap(0xb7fc8000, 4096) = 0 open("/proc/meminfo", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc8000 read(3, "MemTotal: 515576 kB\nMemFre"..., 1024) = 598 close(3) = 0 munmap(0xb7fc8000, 4096) = 0 brk(0x80fa000) = 0x80fa000 rt_sigaction(SIGCHLD, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGCHLD, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGQUIT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigaction(SIGQUIT, {SIG_DFL}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigaction(SIGQUIT, {SIG_IGN}, {SIG_DFL}, 8) = 0 uname({sys="Linux", node="rainbow.homelinux.org", ...}) = 0 brk(0x80fb000) = 0x80fb000 stat64("/root", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat64(".", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 getpid() = 6890 getppid() = 6889 getpgrp() = 6889 rt_sigaction(SIGCHLD, {0x807b7c0, [], 0}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 open("/etc/init.d/syslog-ng", O_RDONLY|O_LARGEFILE) = 3 ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfcdd8f8) = -1 ENOTTY (Inappropriate ioctl for device) _llseek(3, 0, [0], SEEK_CUR) = 0 read(3, "#! /bin/sh\n#\n# skeleton\texample "..., 80) = 80 _llseek(3, 0, [0], SEEK_SET) = 0 getrlimit(RLIMIT_NOFILE, {rlim_cur=1024, rlim_max=1024}) = 0 dup2(3, 255) = 255 close(3) = 0 fcntl64(255, F_SETFD, FD_CLOEXEC) = 0 fcntl64(255, F_GETFL) = 0x8000 (flags O_RDONLY|O_LARGEFILE) fstat64(255, {st_mode=S_IFREG|0755, st_size=2199, ...}) = 0 _llseek(255, 0, [0], SEEK_CUR) = 0 brk(0x80fc000) = 0x80fc000 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 read(255, "#! /bin/sh\n#\n# skeleton\texample "..., 2199) = 2199 brk(0x80fd000) = 0x80fd000 open("/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/lib/gconv/gconv-modules", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=45568, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc8000 read(3, "# GNU libc iconv configuration.\n"..., 4096) = 4096 brk(0x80fe000) = 0x80fe000 read(3, "lias\tJS//\t\t\tJUS_I.B1.002//\nalias"..., 4096) = 4096 brk(0x80ff000) = 0x80ff000 brk(0x8100000) = 0x8100000 brk(0x8101000) = 0x8101000 read(3, "ule\tINTERNAL\t\tISO-8859-3//\t\tISO8"..., 4096) = 4096 brk(0x8102000) = 0x8102000 brk(0x8103000) = 0x8103000 brk(0x8104000) = 0x8104000 read(3, "lias\tISO-IR-199//\t\tISO-8859-14//"..., 4096) = 4096 brk(0x8105000) = 0x8105000 brk(0x8106000) = 0x8106000 brk(0x8107000) = 0x8107000 read(3, "\t\tto\t\t\tmodule\t\tcost\nalias\tCSEBCD"..., 4096) = 4096 brk(0x8108000) = 0x8108000 brk(0x8109000) = 0x8109000 read(3, "ule\t\tcost\nalias\tCP284//\t\t\tIBM284"..., 4096) = 4096 brk(0x810a000) = 0x810a000 brk(0x810b000) = 0x810b000 brk(0x810c000) = 0x810c000 read(3, "lias\tCP864//\t\t\tIBM864//\nalias\t86"..., 4096) = 4096 brk(0x810d000) = 0x810d000 brk(0x810e000) = 0x810e000 brk(0x810f000) = 0x810f000 read(3, "module\tIBM937//\t\tINTERNAL\t\tIBM93"..., 4096) = 4096 brk(0x8110000) = 0x8110000 brk(0x8111000) = 0x8111000 brk(0x8112000) = 0x8112000 read(3, "\tEUC-JP//\nalias\tUJIS//\t\t\tEUC-JP/"..., 4096) = 4096 brk(0x8113000) = 0x8113000 brk(0x8114000) = 0x8114000 brk(0x8115000) = 0x8115000 read(3, "module\t\tcost\nalias\tISO-IR-143//\t"..., 4096) = 4096 brk(0x8116000) = 0x8116000 brk(0x8117000) = 0x8117000 brk(0x8118000) = 0x8118000 read(3, "-BOX//\nmodule\tISO_10367-BOX//\t\tI"..., 4096) = 4096 brk(0x8119000) = 0x8119000 brk(0x811a000) = 0x811a000 read(3, "module\tINTERNAL\t\tEUC-JISX0213//\t"..., 4096) = 512 read(3, "", 4096) = 0 close(3) = 0 munmap(0xb7fc8000, 4096) = 0 brk(0x811b000) = 0x811b000 open("/usr/lib/gconv/ISO8859-1.so", O_RDONLY) = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\200\4\0"..., 512) = 512 fstat64(3, {st_mode=S_IFREG|0644, st_size=5340, ...}) = 0 brk(0x811c000) = 0x811c000 old_mmap(NULL, 8228, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7fc6000 old_mmap(0xb7fc7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0xb7fc7000 close(3) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 stat64("/sbin/syslog-ng", {st_mode=S_IFREG|0755, st_size=243436, ...}) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 stat64("/etc/default/syslog-ng", {st_mode=S_IFREG|0644, st_size=320, ...}) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 stat64("/etc/default/syslog-ng", {st_mode=S_IFREG|0644, st_size=320, ...}) = 0 open("/etc/default/syslog-ng", O_RDONLY|O_LARGEFILE) = 3 fstat64(3, {st_mode=S_IFREG|0644, st_size=320, ...}) = 0 brk(0x811d000) = 0x811d000 read(3, "# If variables is not set here, "..., 320) = 320 close(3) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 brk(0x811e000) = 0x811e000 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 brk(0x811f000) = 0x811f000 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 brk(0x8120000) = 0x8120000 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 brk(0x8121000) = 0x8121000 rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0 _llseek(255, -9, [2190], SEEK_CUR) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7e42708) = 6891 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGCHLD (Child exited) @ 0 (0) --- waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], WNOHANG) = 6891 waitpid(-1, 0xbfcdc4ec, WNOHANG) = -1 ECHILD (No child processes) sigreturn() = ? (mask now []) rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigaction(SIGINT, {0x807a090, [], 0}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {0x807a090, [], 0}, 8) = 0 stat64(".", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 stat64("/sbin/start-stop-daemon", {st_mode=S_IFREG|0755, st_size=18488, ...}) = 0 stat64("/sbin/start-stop-daemon", {st_mode=S_IFREG|0755, st_size=18488, ...}) = 0 brk(0x8122000) = 0x8122000 rt_sigprocmask(SIG_BLOCK, [INT CHLD], [], 8) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7e42708) = 6892 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 --- SIGCHLD (Child exited) @ 0 (0) --- waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], WNOHANG) = 6892 waitpid(-1, 0xbfcdbdac, WNOHANG) = -1 ECHILD (No child processes) sigreturn() = ? (mask now []) rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0 rt_sigaction(SIGINT, {0x807a090, [], 0}, {SIG_DFL}, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigaction(SIGINT, {SIG_DFL}, {0x807a090, [], 0}, 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 read(255, "\nexit 0\n\n", 2199) = 9 rt_sigprocmask(SIG_BLOCK, NULL, [], 8) = 0 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 exit_group(0) = ? [2] syslog-ng.conf ###### # Standard syslog levels # emerg alert crit err warning notice info debug # Standard syslog facilities # auth, authpriv, cron, daemon, ftp, kernel, lpr, mail, news, syslog, user, uucp ###### # Options options { chain_hostnames(0); time_reopen(10); time_reap(360); #sync(0); log_fifo_size(2048); create_dirs(yes); owner(root); group(adm); perm(0640); dir_owner(root); dir_group(root); dir_perm(0755); use_dns(no); #log_msg_size(2048); stats_freq(86400); }; ###### # Sources source all { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); # udp(); }; source krnl {file("/proc/kmsg" log_prefix("kernel: "));}; source int { internal(); }; source main { unix-stream("/dev/log"); }; source net { udp(); }; ###### # Destinations destination df_auth { file("/var/log/auth.log"); }; destination df_syslog { file("/var/log/syslog"); }; destination df_cron { file("/var/log/cron.log"); }; destination df_daemon { file("/var/log/daemon.log"); }; destination df_kern { file("/var/log/kern.log"); }; destination df_lpr { file("/var/log/lpr.log"); }; destination df_mail { file("/var/log/mail.log"); }; destination df_mail_err { file("/var/log/mail.err"); }; destination df_user { file("/var/log/user.log"); }; destination df_uucp { file("/var/log/uucp.log"); }; destination df_messages { file("/var/log/messages"); }; destination df_debug { file("/var/log/debug.log"); }; destination df_network { file("/var/log/network.log"); }; destination dp_xconsole { pipe("/dev/xconsole"); }; # X console destination du_all { usertty("*"); }; # Users logged in destination df_report { file("/var/log/report.log"); }; ###### # Filters filter f_auth { facility(auth,authpriv); }; filter f_syslog { not facility(auth,authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warning { level(warn); }; filter f_error { level(err); }; filter f_critical { level(crit); }; filter f_over_info_up { level(info..emerg); }; filter f_over_notice { level(notice..emerg); }; filter f_over_warning { level(warn..emerg); }; filter f_over_error { level(err..emerg); }; filter f_over_critical { level(crit..emerg); }; filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; filter f_xconsole { facility(daemon,mail) or level(debug,info,notice,warn) or (facility(news) and level(crit,err,notice)); }; ###### # Logs # order matters if you use "flags(final);" log { source(net); destination(df_network); flags(final); }; log { source(all); filter(f_auth); destination(df_auth); flags(final); }; log { source(all); filter(f_mail); filter(f_error); destination(df_mail_err); }; log { source(all); filter(f_mail); destination(df_mail); flags(final); }; log { source(all); filter(f_cron); destination(df_cron); flags(final); }; log { source(all); filter(f_daemon); destination(df_daemon); }; log { source(all); filter(f_kern); destination(df_kern); }; log { source(all); filter(f_debug); destination(df_debug); }; log { source(all); filter(f_over_error); destination(df_report); }; log { source(all); filter(f_emergency); destination(du_all); }; log { source(all); destination(df_messages); }; log { source(all); filter(f_xconsole); destination(dp_xconsole); }; -- -=<X>=- Rune V. Sjøen You always pass failure on the way to success http://www.opensourcesolutions.no

2 6

2GB log file size restrictions 1.9 tree
by William Bell 01 Apr '06

01 Apr '06

Is there a way to configure this restriction, nothin is mentioned about it in the doc's. Up until recently I deployed 1.6 tree across all my devices and i never ran into this problem. I just recently upgraded to the 1.9 tree and now syslog-ng just crashes when a 2gb file is reached. If anyone has ANY ideas there are greatly accepted. William Bell CWIE Security

2 1

syslog-ng 1.6.10 released
by Balazs Scheidler 31 Mar '06

31 Mar '06

Hi, As some of you might have read it on my blog (http://bazsi.blogspot.com) I have released syslog-ng 1.6.10, the next stable version in the 1.6.x series, with the following changes: News for the 1.6.10 release Mon, 27 Mar 2006 16:43:08 +0200 * Updated documentation, documentation is now generated from XML instead of SGML. * Scalability improvements for many parallel syslog connections tunable using the time_sleep() global option. -- Bazsi

1 0

syslog-ng & mysql set up for network devices only
by Patrick Topping 31 Mar '06

31 Mar '06

I have a MySQL question that I hope does not sound to 'newbie-ish'..:-) I have just set up a new server for logging all the network devices. Syslog-ng is working fine and now I am ready to move onto setting up the MySQL side. I was wondering if any had created a MySQL database specifically for network devices and if it was significantly different than what is on the following URL: http://vermeer.org/display_doc.php?doc_id=1 CREATE TABLE logs ( host varchar(32) default NULL, facility varchar(10) default NULL, priority varchar(10) default NULL, level varchar(10) default NULL, tag varchar(10) default NULL, date date default NULL, time time default NULL, program varchar(15) default NULL, msg text, seq int(10) unsigned NOT NULL auto_increment, PRIMARY KEY (seq), KEY host (host), KEY seq (seq), KEY program (program), KEY time (time), KEY date (date), KEY priority (priority), KEY facility (facility) ) TYPE=MyISAM; The question that I have relates to following tables in the DB: priority : where would this come into play for network devices? level: not sure what this is tag: where would this come into play for network devices? program: where would this come into play for network devices? If there is anyone who could help me with this network specific DB I would appreciate it. Thanks in advance. -Patrick

1 0

RE: [syslog-ng] Creating a named pipe (FIFO)
by Timothy A. Holmes 29 Mar '06

29 Mar '06

Good morning Peter: thank you for your reply Does the name of the named pipe need to be the same as the destination line mkfifo splunk; destination splunk { pipe("/var/syslog-ng/syslog_fifo"); }; This is what I currently have in the config file now, and I am still getting an error. Thank you TIM My entire syslog-ng.conf is posted at http://www.pastebin.com/616048 Thank you Timothy A. Holmes IT Manager / Network Admin / Web Master / Computer Teacher Medina Christian Academy A Higher Standard... Jeremiah 33:3 Jeremiah 29:11 Esther 4:14 > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng- > bounces(a)lists.balabit.hu] On Behalf Of HÖLTZL Péter > Sent: Wednesday, March 22, 2006 9:07 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] Creating a named pipe (FIFO) > > On Wed, 2006-03-22 at 08:50 -0500, Timothy A. Holmes wrote: > > I did some investigation and asked a few questions on IRC, and someone > > told me that I needed to use the mkpipe command, however I have been > > unable to locate (using google) the proper syntax for the mkpipe > > command. > > you can create pipes by 'mknod PIPENAME p' command on any linux box. > 'mkfifo PIPENAME' makes the same pipe as well. > > Péter > > > -- > BalaBit IT Bizt. Kft | Tel: +36 1 371-0540 | GnuPG Fingerprint: > holtzl.peter(a)balabit.hu | Mobil: +36 20 366-9667 | 796B C9D3 E492 B006 > C8B2 > http://www.balabit.hu/ | Fax: +36 1 208-0875 | 4D1F 5320 28E3 9A1B > 3FC6

3 2

blog available
by Balazs Scheidler 28 Mar '06

28 Mar '06

Hi, After giving some thought to the idea I decided to start my blog where I'm planning to publish syslog-ng related things as well. If you are interested you can find it at: http://bazsi.blogspot.com/ blogger.com has RSS feeds, so you can use that as well. -- Bazsi

1 0