- syslog-ng - lists.balabit.hu

Syslog-ng Event Parsing Question
by Stringfellow, William G 12 Aug '05

12 Aug '05

I am running syslog-ng version 1.6.4 in place of syslogd on Solaris 8. Getting the following results when receiving syslog events with an embedded dash '-': Actual Event Aug 10 04:15:22 <Device Name A>.<Domain Name> 4844: Aug 10 05:15:21.204 R: %AAA-3-BUFFER_OVERFLOW: Radius I/O buffer has overflowed -Traceback= 253274 253414 252B98 2524FC E97CC E75D4 E9974 124DDC Shows up in Syslog log as Aug 10 04:15:22 <Device Name A>.<Domain Name> 4844: Aug 10 05:15:21.204 R: %AAA-3-BUFFER_OVERFLOW: Radius I/O buffer has overflowed Aug 10 04:15:22 <Device Name A>.<Domain Name> 4845: -Traceback= 253274 253414 252B98 2524FC E97CC E75D4 E9974 124DDC Actual Event May 6 10:04:45 <Device Name B>.<Domain Name> 40: May 6 07:04:44: %TCP-2-INVALIDTCPENCAPS: Invalid TCB encaps pointer: 0x61180434 -Process= \"DLSw msg proc\", ipl= 0, pid= 62 -Traceback= 6035CF34 6035E4A8 60709AE0 607067DC 60706370 607359A0 6072BDB8 6072911C 60716EE4 607147A8 602616E4 602616D0 Shows up in Syslog log as May 6 10:04:45 <Device Name B>.<Domain Name> 40: May 6 07:04:44: %TCP-2-INVALIDTCPENCAPS: Invalid TCB encaps pointer: 0x61180434 May 6 10:04:45 <Device Name B>.<Domain Name> 41: -Process= \"DLSw msg proc\", ipl= 0, pid= 62 May 6 10:04:45 <Device Name B>.<Domain Name> 42: -Traceback= 6035CF34 6035E4A8 60709AE0 607067DC 60706370 607359A0 6072BDB8 6072911C 60716EE4 607147A8 602616E4 602616D0 Anyone have an answer as to why it is splitting up the Syslog events this way, and if so, how do you correct it? Also, is there a search function for the archives? Visually looking through month after month put me to sleep pretty quickly! Thanks Bill

2 1

Last Message Repeated XX times...
by Ken Garland 11 Aug '05

11 Aug '05

I would like to receive all messages on a syslog server, is there any way to have syslog stop gathering messages in a 'last message repeated' cluster. The host is running Syslog 1.4.1 - I know this is not syslog-ng but I can't install that onto this host. Everything is remotely logging to my Central Syslog-NG server, but it's getting nothing but junk 'last message repeated X times' messages which are useless to me. - Ken

1 1

Antw: Re: [syslog-ng] STATS: dropped with version 1.6.8 under rh el4
by Stephan Hendl 11 Aug '05

11 Aug '05

the lines with values "STATS: dropped <!=0>" are very annoying. How can I prevent the syslog-ng from dropping lines??? I put the line "log_fifo_size(1000);" into the global section - hope that helps ;-))) - Stephan >>> ken.garland(a)rotech.com 10.08.2005 15:48:59 >>> Yes, receiving those lines are annoying and I drop this line into the client syslog-ng.conf: filter f_syslog { not facility(auth, authpriv, kern) and not match("STATS: dropped 0"); }; Then just use that filter in your log line. - Ken Stephan Hendl wrote: >Hi all, > >recently I upgraded one of my central syslog servers from hpux to redhat el4 with syslog-ng-1.6.8-1 and get from time to time messages like > >Aug 10 11:43:57 pns1 syslog-ng[10542]: STATS: dropped 19 >Aug 10 11:48:57 pns1 syslog-ng[10542]: STATS: dropped 45 >Aug 10 11:53:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 11:58:57 pns1 syslog-ng[10542]: STATS: dropped 36 >Aug 10 12:03:57 pns1 syslog-ng[10542]: STATS: dropped 7 >Aug 10 12:08:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:13:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:18:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:23:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:28:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:33:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:38:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:43:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:48:57 pns1 syslog-ng[10542]: STATS: dropped 37 >Aug 10 12:53:57 pns1 syslog-ng[10542]: STATS: dropped 52 >Aug 10 12:58:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:03:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:08:57 pns1 syslog-ng[10542]: STATS: dropped 51 >Aug 10 13:13:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:18:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:23:57 pns1 syslog-ng[10542]: STATS: dropped 11 >Aug 10 13:28:57 pns1 syslog-ng[10542]: STATS: dropped 1 >Aug 10 13:33:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:38:57 pns1 syslog-ng[10542]: STATS: dropped 0 > >There are 5 servers who are sending their syslog messages via tcp an one 2 servers who are sending via udp to that central server. The load of the machine (2xXenon CPU, 3 GHz, 1 GB RAM) is really low. For revison purposes (maillogdata) I have to keep _all_ syslog lines!!! What can I change in order to avoid dropped lines? > >Stephan > >top - 15:39:06 up 36 days, 1:49, 2 users, load average: 0.10, 0.09, 0.04 >Tasks: 194 total, 1 running, 193 sleeping, 0 stopped, 0 zombie >Cpu(s): 0.3% us, 0.2% sy, 0.0% ni, 99.2% id, 0.4% wa, 0.0% hi, 0.0% si >Mem: 1034692k total, 1018520k used, 16172k free, 141372k buffers >Swap: 2096440k total, 144k used, 2096296k free, 602228k cached > > PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND > 690 root 16 0 43644 4784 2180 S 0.7 0.5 129:42.96 nco_p_syslog > 779 root 16 0 43644 4784 2180 S 0.3 0.5 254:33.32 nco_p_syslog >10542 root 15 0 1876 1048 776 S 0.3 0.1 6:59.31 syslog-ng > 1 root 16 0 3236 548 472 S 0.0 0.1 0:00.96 init > 2 root RT 0 0 0 0 S 0.0 0.0 0:04.37 migration/0 > 3 root 34 19 0 0 0 S 0.0 0.0 0:00.06 ksoftirqd/0 > 4 root RT 0 0 0 0 S 0.0 0.0 0:03.11 migration/1 > 5 root 34 19 0 0 0 S 0.0 0.0 0:00.02 ksoftirqd/1 > >My syslog-ng.conf looks like: > >root@pns1:~# vi /etc/syslog-ng/syslog-ng.conf ># syslog-ng configuration file. ># ># This should behave pretty much like the original syslog on RedHat Linux 9. ># But it could be configured a lot smarter. ># ># See syslog-ng(8) and syslog-ng.conf(5) for more information. > >options {sync (0); > time_reopen (10); > long_hostnames (off); > use_dns (yes); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > stats (300); >}; > >source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; >source s_tcp { tcp(ip(a.b.c.d) port(10514) keep-alive(no)); }; >source s_udp { udp(ip(a.b.c.d) port(514)); }; > ># Log all kernel messages to the console. ># Logging much else clutters up the screen. >#destination d_cons { file("/dev/console"); }; >#filter f_cons { facility(kern); }; >#log { source(s_sys); filter(f_cons); destination(d_cons); }; > ># Log anything (except mail) of level info or higher. ># Don't log private authentication messages! >destination d_mesg { file("/var/log/messages"); }; >filter f_mesg { not facility(mail,news,authpriv,cron) and level(emerg..info); }; >log { source(s_sys); filter(f_mesg); destination(d_mesg); }; > ># The authpriv file has restricted access. >destination d_auth { file("/var/log/secure"); }; >filter f_auth { facility(authpriv); }; >log { source(s_sys); filter(f_auth); destination(d_auth); }; > ># Log all the mail messages in one place. >destination d_mail { file("/var/log/maillog" template( "$DATE $HOST $MESSAGE\n")); }; >filter f_mail { facility(mail); }; >log { source(s_sys); filter(f_mail); destination(d_mail); }; > ># Log cron stuff. >destination d_cron { file("/var/log/cron"); }; >filter f_cron { facility(cron); }; >log { source(s_sys); filter(f_cron); destination(d_cron); }; > ># Everybody gets emergency messages. >destination d_mlal { usertty("*"); }; >filter f_mlal { level(emerg); }; >log { source(s_sys); filter(f_mlal); destination(d_mlal); }; > ># Save news errors of level crit and higher in a special file. >destination d_spol { file("/var/log/spooler"); }; >filter f_spol {facility(uucp) or facility(news) and level(emerg..crit); }; >log { source(s_sys); filter(f_spol); destination(d_spol); }; > ># Save boot messages also to boot.log. >destination d_boot { file("/var/log/boot.log"); }; >filter f_boot { facility(local7); }; >log { source(s_sys); filter(f_boot); destination(d_boot); }; > ># Save all mesages to syslog.lvnbb.de >destination d_tcp { tcp("localhost" port(10514)); }; >log { source(s_sys); destination(d_tcp); }; >log { source(s_tcp); destination(d_tcp); }; >log { source(s_udp); destination(d_tcp); }; > ># Save all messages to pipe /tmp/cic.pipe >destination d_cic { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template("$DATE $HOST $MESSAGE\n") template-escape(yes)); }; >log { source(s_sys); destination(d_cic); }; >log { source(s_tcp); destination(d_cic); }; >log { source(s_udp); destination(d_cic); }; > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

syslog-ng 1.9.5 under Solaris 10 (sparc)
by Andrea.DAlessandro＠esa.int 10 Aug '05

10 Aug '05

I know that release 1.9.5 is in development phase. Maybe the below is useful to "our" developers. FYI - I have installed 1.6.8 with no troubles (up to now...) Regards, Andrea # /usr/local/bin/make /usr/local/bin/make all-recursive make[1]: Entering directory `/lhome/esacom96/admest/packages/Sol10/balabit/syslog-ng-1.9.5' Making all in src make[2]: Entering directory `/lhome/esacom96/admest/packages/Sol10/balabit/syslog-ng-1.9.5/src' if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT misc.o -MD -MP -MF ".deps/misc.Tpo" \ -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ else rm -f ".deps/misc.Tpo"; exit 1; \ fi if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT utils.o -MD -MP -MF ".deps/utils.Tpo" \ -c -o utils.o `test -f 'utils.c' || echo './'`utils.c; \ then mv -f ".deps/utils.Tpo" ".deps/utils.Po"; \ else rm -f ".deps/utils.Tpo"; exit 1; \ fi if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT messages.o -MD -MP -MF ".deps/messages.Tpo" \ -c -o messages.o `test -f 'messages.c' || echo './'`messages.c; \ then mv -f ".deps/messages.Tpo" ".deps/messages.Po"; \ else rm -f ".deps/messages.Tpo"; exit 1; \ fi In file included from messages.c:24: messages.h:49: error: parse error before "EVTTAG" messages.c:40: error: parse error before '*' token messages.c:40: warning: type defaults to `int' in declaration of `evt_context' messages.c:40: warning: data definition has no type or storage class messages.c: In function `msg_send_internal_message': messages.c:56: warning: int format, pid_t arg (arg 5) messages.c: At top level: messages.c:63: error: parse error before "EVTTAG" messages.c: In function `msg_event': messages.c:69: error: `prio' undeclared (first use in this function) messages.c:69: error: (Each undeclared identifier is reported only once messages.c:69: error: for each function it appears in.) messages.c:69: error: `desc' undeclared (first use in this function) messages.c:69: warning: passing arg 1 of `evt_rec_init' from incompatible pointer type messages.c:69: warning: assignment makes pointer from integer without a cast messages.c:70: error: `tag1' undeclared (first use in this function) messages.c:72: warning: implicit declaration of function `evt_rec_add_tag' messages.c:74: warning: implicit declaration of function `evt_rec_add_tagsv' messages.c:80: error: `EVT_PRI_DEBUG' undeclared (first use in this function) messages.c:84: warning: implicit declaration of function `evt_rec_get_syslog_pri' messages.c:73: error: `va_start' used in function with fixed args messages.c: In function `msg_log_func': messages.c:94: error: `EVT_PRI_INFO' undeclared (first use in this function) messages.c:97: error: `EVT_PRI_DEBUG' undeclared (first use in this function) messages.c:99: error: `EVT_PRI_WARNING' undeclared (first use in this function) messages.c:101: error: `EVT_PRI_ERR' undeclared (first use in this function) messages.c:103: error: `EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c: In function `msg_init': messages.c:119: warning: implicit declaration of function `evt_ctx_init' messages.c:119: error: `EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c:119: warning: assignment makes pointer from integer without a cast messages.c: In function `msg_deinit': messages.c:130: warning: implicit declaration of function `evt_ctx_free' make[2]: *** [messages.o] Error 1 make[2]: Leaving directory `/lhome/esacom96/admest/packages/Sol10/balabit/syslog-ng-1.9.5/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/lhome/esacom96/admest/packages/Sol10/balabit/syslog-ng-1.9.5' make: *** [all] Error 2

2 1

missing logs when forwarded from one syslog-ng to another syslog-ng
by Arnold Wang 09 Aug '05

09 Aug '05

I have two syslog-ng servers configured, one in the DMZ for devices outside firewall send logs to and another one in the LAN. The logs send to the DMZ one will be forwarded to the LAN one, at least that's my original idea. However, it seems very unstable on the forwarding. Some of the logs appeared in the DMZ one were not shown up in the LAN one. For example, I just did a test from two routers outside the firewall and there were two logs generated in DMZ log server: [root@rcarhlp01 qwestdia1]# tail -1 qwestdia1.log Aug 9 13:30:25 qwestdia1 128: *Apr 28 06:56:48: %SYS-5-CONFIG_I: Configured from console by vty0 (204.146.209.151) [root@rcarhlp01 qwestdia1]# tail -1 ../qwestdia2/qwestdia2.log Aug 9 13:30:59 qwestdia2 46: *Apr 28 06:57:24: %SYS-5-CONFIG_I: Configured from console by vty0 (204.146.209.151) However, I only saw one in the LAN log server: [root@rcarhlp02 qwestdia1]# tail -1 qwestdia1.log Aug 8 16:18:39 qwestdia1 127: *Apr 27 09:35:42: %SYS-5-CONFIG_I: Configured from console by vty0 (204.146.209.248) ** This is still the one from last night ** [root@rcarhlp02 qwestdia1]# tail -1 ../qwestdia2/qwestdia2.log Aug 9 13:30:59 qwestdia2 46: *Apr 28 06:57:24: %SYS-5-CONFIG_I: Configured from console by vty0 (204.146.209.151) My configurations on both machines are like the following: ---- Configuration for LAN server -------- [root@rcarhlp02 syslog-ng]# more syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_slng { internal(); }; source s_tcp { tcp(port (5140) tcp-keep-alive(yes)); }; source s_udp { udp(port (514)); }; destination d_slng { file("/var/syslog-ng/syslog-ng.log"); }; destination d_file { file("/var/syslog-ng/HOSTS/$HOST/$HOST.log" owner (root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; destination d_mysql { pipe("/var/syslog-ng/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(s_slng); destination(d_slng); }; log { source(s_tcp); source(s_udp); destination(d_file); destination (d_mysql); }; #log { source(s_tcp); destination(d_mysql); }; #log { source(s_udp); destination(d_file); }; #log { source(s_udp); destination(d_mysql); }; # vim: syntax=syslog-ng [root@rcarhlp02 syslog-ng]# ----- Configuration for DMZ server --------- [root@rcarhlp01 syslog-ng]# more syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_udp { udp(port(514)); }; source s_slng { internal(); }; destination d_slng { file("/var/syslog-ng/syslog-ng.log"); }; destination d_local { file("/var/syslog-ng/HOSTS/$HOST/$HOST.log" owner (root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; destination d_remote { tcp("10.17.2.146" port(5140) tcp-keep-alive (yes)); }; log { source(s_udp); destination(d_local); destination(d_remote); }; #log { source(s_udp); destination(d_remote); }; log { source(s_slng); destination(d_slng); }; # vim: syntax=syslog-ng [root@rcarhlp01 syslog-ng]#

1 0

streams log driver on AIX
by Michael Mannsberger 09 Aug '05

09 Aug '05

What streams log driver is syslog using on AIX besides /dev/log?

1 0

'make fails' @ conflicting types for 'affile_dd_set_file_perm'
by OpenMacNews 08 Aug '05

08 Aug '05

hi, moving (finally) to bldg syslog-ng 1.9-snapshot on OSX 10.4.2 prereqs of glib 2.7.7 & eventlog-snapshot are built/installed. syslog-ng-1.9-snapshot fails on 'make' @: ... if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/bind9/include -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT affile.o -MD -MP -MF ".deps/affile.Tpo" -c -o affile.o affile.c; \ then mv -f ".deps/affile.Tpo" ".deps/affile.Po"; else rm -f ".deps/affile.Tpo"; exit 1; fi affile.c:305: error: conflicting types for 'affile_dd_set_file_perm' affile.c:305: note: an argument type that has a default promotion can't match an empty parameter name list declaration affile.h:75: error: previous declaration of 'affile_dd_set_file_perm' was here affile.c:329: error: conflicting types for 'affile_dd_set_dir_perm' affile.c:329: note: an argument type that has a default promotion can't match an empty parameter name list declaration affile.h:78: error: previous declaration of 'affile_dd_set_dir_perm' was here affile.c: In function 'affile_dd_init': affile.c:422: warning: comparison is always false due to limited range of data type affile.c:428: warning: comparison is always false due to limited range of data type make[2]: *** [affile.o] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 % checking the declarations for 'affile_dd_set_file_perm' ... % grep affile_dd_set_file_perm `grep -rln affile_dd_set_file_perm .` ./src/affile.c:affile_dd_set_file_perm(LogPipe *s, mode_t file_perm) ./src/affile.h:void affile_dd_set_file_perm(); ./src/cfg-grammar.c: { affile_dd_set_file_perm(last_driver, yyvsp[-1].num); } ./src/cfg-grammar.c: { affile_dd_set_file_perm(last_driver, yyvsp[-1].num); } ./src/cfg-grammar.y: | KW_PERM '(' NUMBER ')' { affile_dd_set_file_perm(last_driver, $3); } ./src/cfg-grammar.y: | KW_PERM '(' NUMBER ')' { affile_dd_set_file_perm(last_driver, $3); } it's not immediately clear which is the conflict. ideas? richard

2 3

eventlog snap missing AUTHORS
by OpenMacNews 07 Aug '05

07 Aug '05

hi, the eventlog snapshot src tree is missing "AUTHORS" which causes "autoreconf -i -f" to complain/choke ... a simple % touch AUTHORS fixes the prob, so you might wish to add it to the distro ... cheers, richard

1 0

messages when I restart syslog-ng
by Thierry B 07 Aug '05

07 Aug '05

Hello, When I restart syslog-ng, he tells me that: debian:/home/thierry# /etc/init.d/syslog-ng restart CONSOLE_LOG_LEVEL is of unaccepted value. KERNEL_RINGBUF_SIZE is of unaccepted value. Thanks :-) Bye

2 1

exemple for logging with a regexp
by Thierry B 07 Aug '05

07 Aug '05

Hello, I'd like to ask you a queqtion about syslog-ng. I'd like to log for example, all mails from postfix in mail.log and for example all mails from courier imap to /var/log/imapd. I already manage to do that with syslog using facility like that: local0.* -/var/log/imapd.log mail.* -/var/log/mail.log But I'd like to add a regexp, so he didn't log all things. For example, for postfix, I'd like to add a blank line each time he find a line called "disconnect" or "removed". Is it possible to do that easyly with syslog-ng? Or I can also do that with my actual syslog? Because if I pass to syslog-ng instead of syslog, I'd like to keep my syslog config, except for those logs, that I want to filter with regexp. Thanks :-)

1 0