- syslog-ng - lists.balabit.hu

RE: [syslog-ng] multicast support
by Heigl Florian - Munich-MR - external 28 Mar '06

28 Mar '06

Hi, > Let me know what you think, I wrote this patch to make > clustering logging > servers dead easy and straight forward....I hope its useful > to someone else > too. This will come in handy some day, and even if I can't use it 'right now', thank You lots for taking the time to implement that. florian

1 0

RE: [syslog-ng] prune identical messages
by Richard Legault 28 Mar '06

28 Mar '06

I would prefer the message suppressed if possible as it gives more information, sorry for not being specific. So is it possible to have the suppressed message. As I have not seen any such option? Richard -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Valdis.Kletnieks(a)vt.edu Sent: March 27, 2006 4:42 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] prune identical messages On Mon, 27 Mar 2006 15:26:41 EST, Richard Legault said: > But the message repeating does not give you any new information so it is a wa ste of diskspace to store it. > Because It is just as helpfull to say > foo1: ssh connection from 129.257.10.4 > foo1: 2,348 duplicate messages suppressed *exactly*. But what you asked for was (your words now): "those occurring between would simply be dropped." Producing a "duplicate messages suppressed" is *not* "simply dropping". Also, notice that if you have an interleaved series of 2 or more message streams that are identical to themselves but not each other, you can get this: foo1: message 1 foo1: message 2 foo1: message 3 foo1: message 2 foo1: message 3 foo1: message 1 foo1: message 3 and so on - this requires keeping a copy of the last N messages rather than just the last single one to do it correctly. Proper choice of N to prevent being DoS'ed by an out-of-memory when flooded by a mass of non-identical messages is left as an exercise for the student....

3 4

multicast support
by Alexander Clouter 28 Mar '06

28 Mar '06

Hi, I dug around for ages and could not find any hint of multicast support in syslog-ng so I decided to throw a patch together. Its a Works For Me(tm) job and took a little longer than I was expecting but hopefully others will find it useful. It applies to a 1.9.9 tree and should just work. I have not tested the IPv6 support but I cannot see a reason why it would not work, unless I have borked up my struct's :) Let me know what you think, I wrote this patch to make clustering logging servers dead easy and straight forward....I hope its useful to someone else too. The only improvement I can think of is adding a multicast 'drop membership' occurance, however I could not see a nice simple place to do this; it should be before the socket closes. Cheers Alex

1 0

prune identical messages
by Richard Legault 28 Mar '06

28 Mar '06

How can I prevent a log from being written that is identical to the log message that immediately preceded it. I would like to throttle those messages so that they can only be printed once every 10 minutes, those occurring between would simply be dropped. Richard Legault Senior Engineer 519-880-2400 ext 2722 www.sandvine.com

3 2

RE: [syslog-ng] prune identical messages
by Richard Legault 27 Mar '06

27 Mar '06

But the message repeating does not give you any new information so it is a waste of diskspace to store it. Because It is just as helpfull to say foo1: ssh connection from 129.257.10.4 foo1: 2,348 duplicate messages suppressed then to say foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 ... foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 I only want to throttle the part that writes the message to the disk. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Valdis.Kletnieks(a)vt.edu Sent: March 27, 2006 2:59 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] prune identical messages On Mon, 27 Mar 2006 14:25:51 EST, Richard Legault said: > How can I prevent a log from being written that is identical to the log message > that immediately preceded it. I would like to throttle those messages so that > they can only be printed once every 10 minutes, those occurring between would > simply be dropped. You *don't* want to simply drop them. For instance, there's a *big* difference between: foo1: ssh connection from 129.257.10.4 and foo1: ssh connection from 129.257.10.4 foo1: 2,348 duplicate messages suppressed Similarly, how would your response differ for: frobozz13: Correctable ECC error detected on board 4, SIMM 7. and frobozz13: Correctable ECC error detected on board 4, SIMM 7. frobozz13: 1,438,598 duplicate messages suppressed

2 1

RE: [syslog-ng] prune identical messages
by SOLIS, ALEX 27 Mar '06

27 Mar '06

I don't get a "duplicate messages suppressed" log when I have multiple entries. Is there an option I need to turn on or is there a certain threshold for this feature to engage? I could really use this type of suppression for some logs that I actively alert on. Alex -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Richard Legault Sent: Monday, March 27, 2006 2:27 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] prune identical messages But the message repeating does not give you any new information so it is a waste of diskspace to store it. Because It is just as helpfull to say foo1: ssh connection from 129.257.10.4 foo1: 2,348 duplicate messages suppressed then to say foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 ... foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 foo1: ssh connection from 129.257.10.4 I only want to throttle the part that writes the message to the disk. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Valdis.Kletnieks(a)vt.edu Sent: March 27, 2006 2:59 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] prune identical messages On Mon, 27 Mar 2006 14:25:51 EST, Richard Legault said: > How can I prevent a log from being written that is identical to the log message > that immediately preceded it. I would like to throttle those messages so that > they can only be printed once every 10 minutes, those occurring between would > simply be dropped. You *don't* want to simply drop them. For instance, there's a *big* difference between: foo1: ssh connection from 129.257.10.4 and foo1: ssh connection from 129.257.10.4 foo1: 2,348 duplicate messages suppressed Similarly, how would your response differ for: frobozz13: Correctable ECC error detected on board 4, SIMM 7. and frobozz13: Correctable ECC error detected on board 4, SIMM 7. frobozz13: 1,438,598 duplicate messages suppressed _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Profiling syslog-ng
by John Morrissey 27 Mar '06

27 Mar '06

I'm trying to profile syslog-ng on a set of servers that generate high levels of logging traffic (a few GB/day). Currently, syslog-ng is consuming anywhere from 40-80% of a CPU on a dual Pentium IV Xeon machine. gprof(1) generates a profile, except for time consumed - it says "no time accumulated" even after running a profile-enabled syslog-ng for several minutes. For example: Flat profile: Each sample counts as 0.01 seconds. no time accumulated % cumulative self self total time seconds seconds calls Ts/call Ts/call name 0.00 0.00 0.00 667 0.00 0.00 xalloc 0.00 0.00 0.00 593 0.00 0.00 prepare 0.00 0.00 0.00 434 0.00 0.00 gc_mark 0.00 0.00 0.00 372 0.00 0.00 ol_string_free 0.00 0.00 0.00 313 0.00 0.00 do_prepare_write I've found similar complaints in the binutils list archives: http://sourceware.org/ml/binutils/2005-07/msg00364.html http://sourceware.org/ml/binutils/2002-01/msg00121.html http://sourceware.org/ml/binutils/2001-10/msg00315.html Personally, we're using glibc 2.3.2.ds1-22 and building the Debian syslog-ng 1.6.9-1 package using gcc 3.3.5-3 or 3.4.3-13. I've also tried oprofile, but it only(?) seems to report call counts, not time consumed. For example: samples % symbol name 102829 67.7349 io_iter 16560 10.9083 prepare 2975 1.9597 parse_log_msg 2518 1.6586 expand_macro I've read io_iter() and it doesn't seem to contain any smoking guns that would account for 68% of total syslog-ng CPU usage. Any suggestions on how to profile syslog-ng? I can post my configuration if it'd be helpful, but we've twisted many knobs (gc idle/busy thresholds, buffering via different sync() levels, disabling remote syslogging via UDP, etc.) without a major change in CPU consumption. john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

5 23

Re: [syslog-ng] AIX compilation of syslog-ng 1.6.* (problems with ld)
by Jochen Kirn 27 Mar '06

27 Mar '06

I use gcc to build full static syslog binaries on AIX 5.1/5.3 gcc version 3.3.2 from AIX Toolbox site (http://www-03.ibm.com/servers/aix/products/aixos/linux/download.html ) 1) configure & compile libol 0.3.17 ./configure --disable-shared 2) configure & compile syslog ng 1.6.9 ./configure --prefix=/opt/syslog-ng --with-libol=/home/build/work/libol- 0.3.17 LIBS=-ldl --enable-full-static afaik you'll fail to build full static version on AIX unless you tweak the 'configure' script of syslog ng, since it can not identify the ld version on AIX @Balazs: I think the the syslog-ng's configure script requires additional tweaking for supporting AIX's version of the ld command. The configure script tries to identify the ld option by issuing 'ld -V' which doesn't work on AIX 5.1. The output of AIX 5.3 isn't recognized. AIX 5.1 (ML8): root@aix51host:/root : uname -a AIX aix51host 1 5 00594BAA4C00 root@aix51host:/root : ld -V ld: 0706-011 The -V flag needs a parameter. ld: 0706-030 No processing done. Specify at least one input or import file or use at least one -b ex<n> option. AIX 5.3 (ML3): root@aix53host:/root : uname -a AIX aix53host 3 5 00C6D95B4C00 root@aix53host:/root : ld -V ld: LD 1.64 (08/19/2003) It would make sense to me to have an additional configure parameter '--with-ldflags' because AIX's ld requires '-dn' parameter for performing a static build what do you think ? thx, Jochen

2 3

RE: [syslog-ng] Creating a named pipe (FIFO)
by William Bell 24 Mar '06

24 Mar '06

As a feature request / bonus to this conversation, has any investigation been done into adding create fifo ability to the pipe source driver. Im sure that everyone could benefit from pipes that are created and torn down by syslog-ng so that unless syslog-ng is holding the pipe open and holding ownership of the pipe the pipe does not exist. This would be an extra added bonus on the security front. Its an ok fix to have the pipe created by the startup script and even torn down by that same script, however if for some reason syslog-ng crashes or an administrator thinks it's a good idea to just kill off the process that pipe hangs around and is a potential security risk. Its just an idea. Maybe someone can run with it. William Bell II CWIE Security -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel Sent: Wednesday, March 22, 2006 10:21 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Creating a named pipe (FIFO) We do the opposite. We wanted to use the message matching rules of syslog-ng to essentially rewrite the facility.level (priority) of messages and then log them again. To accomplish this, we have a "normal" syslog-ng running that listens on the localhost:514 port that then logs to the local files, and to a central syslog-ng server. We then start a second instance of syslog-ng within the startup script for the applications, such as apache. - check for and create the named pipe(s) - start syslong-ng specific to this application - start the application that logs to the named pipe(s) This instance of syslog-ng parses the messages and relogs via syslog to localhost with a new set of priorities. This allows local syslog files to contain the appriopriate facitliy.level of messages as well as our central syslog-ng server. It also allows for a very complicated set of match rules for a given application without making an overly complicated syslong-ng configuration file. Basically you end up with one configuration file per application. This is just our syslog architecture, so your milage may vary. Evan. On Wed, 22 Mar 2006, Cary, Kim wrote: > Date: Wed, 22 Mar 2006 09:11:26 -0800 > From: "Cary, Kim" <Kim.Cary(a)pepperdine.edu> > Reply-To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Creating a named pipe (FIFO) > > We create our pipes by placing the appropriate commands in the > syslog-ng startup file (/etc/init.d/syslog-ng). > > [Actually, we test to see if the pipe already exists; if not, we > create it. We do this creation in /var/run and here the pipe needs to > be recreated after every boot. We don't want to recreate it when we > restart the process (syslog-ng) that is feeding it, since recreating > it requires us to bounce the process that is reading from it (fisq.pl)]. > > Kim Cary > Infrastructure Security Administrator > M-F 7-4 ~ 310 506 6655 > > > -- Evan Rempel erempel(a)uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Forward to eIQ?
by Kevin 24 Mar '06

24 Mar '06

Is anybody using syslog-ng to forward events to EIQ's "Syslog Service"? I'm using Secure Computing's new "Security Reporter" (aka "G2SR"), a relabeled EIQ product, to process logs from multiple Sidewinder G2 firewalls. When forwarding events from syslog-ng to EIQ, their proprietary Windows syslog daemon takes the source IP address of the syslog-ng box and puts it into the resulting logfiles as the source of the event. I'm wondering if there's a template() I can use to insert the original hostname/IP such that EIQ will respect the forwarded hostname, or if I must use source IP spoofing when forwarding to EIQ? Thanks, Kevin

1 0