- syslog-ng - lists.balabit.hu

RE: [syslog-ng] syslog.conf for Solaris box to send to Syslog-NG server
by Stew Redfield 05 Jul '05

05 Jul '05

Shane, Here's my base /etc/syslog.conf for Solaris # Push to loghost (/etc/hosts or DNS) [syslog-ng] # syslog-ng handles prioritization/alerting *.warn;*.alert;*.emerg;*.err;*.info @loghost # Keep mail annoyances local mail.debug /var/log/syslog.mail # Keep consistency for debugging/console work kern.notice;auth.notice /dev/sysmsg kern.debug;daemon.notice;mail.crit /var/adm/messages When in doubt, be explicit (and syslog is m4 parsed so make sure the tabs are really tabs...) HTH, Stew -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Shane Presley Sent: Tuesday, July 05, 2005 12:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog.conf for Solaris box to send to Syslog-NG server Hello, I have a syslog-ng centralized host, setup and working great. My routers and various other devices send their messages to it. I'd like to have my Solaris servers send to it as well. They run the solaris syslog deamon, not syslog-ng. I've included the syslog.conf below for a server that we have doing this (forwarding logs). But I didn't set this up myself, and I'd like to understand the format. The line that seems to forward the logs is # Send all messages to the logger *.debug @10.10.10.1 auth.notice @10.10.10.1 Is that sending all syslog messages? Basically we want anything that would normally be logged to /var/adm/messages to go the log server as well. Does the above line only mean debug, or does that mean anything debug or greater? Thanks Shane # Copyright (c) 1991-1998 by Sun Microsystems, Inc. # All rights reserved. # # syslog configuration file. # # This file is processed by m4 so be careful to quote (`') names # that match m4 reserved words. Also, within ifdef's, arguments # containing commas must be quoted. # *.err;kern.notice;auth.notice /dev/sysmsg *.err;kern.debug;daemon.notice;mail.crit /var/adm/messages *.alert;kern.err;daemon.err operator *.alert root *.emerg * # Send all messages to the logger *.debug @10.10.10.1 auth.notice @10.10.10.1 # if a non-loghost machine chooses to have authentication messages # sent to the loghost machine, un-comment out the following line: #auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost) mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) # # non-loghost machines will use the following lines to cause "user" # log messages to be logged locally. # ifdef(`LOGHOST', , user.err /dev/sysmsg user.err /var/adm/messages user.alert `root' user.emerg * _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog.conf for Solaris box to send to Syslog-NG server
by Shane Presley 05 Jul '05

05 Jul '05

Hello, I have a syslog-ng centralized host, setup and working great. My routers and various other devices send their messages to it. I'd like to have my Solaris servers send to it as well. They run the solaris syslog deamon, not syslog-ng. I've included the syslog.conf below for a server that we have doing this (forwarding logs). But I didn't set this up myself, and I'd like to understand the format. The line that seems to forward the logs is # Send all messages to the logger *.debug @10.10.10.1 auth.notice @10.10.10.1 Is that sending all syslog messages? Basically we want anything that would normally be logged to /var/adm/messages to go the log server as well. Does the above line only mean debug, or does that mean anything debug or greater? Thanks Shane # Copyright (c) 1991-1998 by Sun Microsystems, Inc. # All rights reserved. # # syslog configuration file. # # This file is processed by m4 so be careful to quote (`') names # that match m4 reserved words. Also, within ifdef's, arguments # containing commas must be quoted. # *.err;kern.notice;auth.notice /dev/sysmsg *.err;kern.debug;daemon.notice;mail.crit /var/adm/messages *.alert;kern.err;daemon.err operator *.alert root *.emerg * # Send all messages to the logger *.debug @10.10.10.1 auth.notice @10.10.10.1 # if a non-loghost machine chooses to have authentication messages # sent to the loghost machine, un-comment out the following line: #auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost) mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) # # non-loghost machines will use the following lines to cause "user" # log messages to be logged locally. # ifdef(`LOGHOST', , user.err /dev/sysmsg user.err /var/adm/messages user.alert `root' user.emerg *

1 0

RE: [syslog-ng] Error parsing conf file?
by Zb Indelak 05 Jul '05

05 Jul '05

Any progress / clues on the multiple file-open bug? I'm using a multi-processor (2 CPUs) system, if that perhaps makes a difference. With the 20050704 snapshot I've seen a single file open over 20 times each. -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, June 30, 2005 3:16 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Error parsing conf file? On Thu, 2005-06-30 at 11:07 +0200, Balazs Scheidler wrote: > On Tue, 2005-06-28 at 09:46 -0600, Zb Indelak wrote: > > *** Problems start here *** > > syslog-ng 1651 root 82w REG 8,8 489 5216302 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280843 > > syslog-ng 1651 root 83w REG 8,8 489 5216302 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280843 > > [root@simda02 NSM]# ps -ef|grep syslog > > root 1651 1 0 15:36 ? 00:00:01 ./syslog-ng -f /etc/syslog-ng/syslog-ng.conf > > root 1682 1508 0 15:39 pts/2 00:00:00 grep syslog > > [root@simda02 NSM]# kill -9 1651 > > [root@simda02 NSM]# echo;date;lsof +d > > /var/nsm/inbox/router/cisco/ios/12.0/syslog > > > > This seems to be an unrelated issue that it opens the same file > multiple times. This is no good. I'll look into this as well. > I don't really see how syslog-ng could open the same file twice, unless you had multiple file() destinations which refers to the same file. Is it the case? (judging your posted configuration, it is not, but maybe you did not copy-paste your complete config. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Year in logs
by syrykh Alain 04 Jul '05

04 Jul '05

Hello, Is there a way to include year directly in log messages , without rewrite logs into a specific format; I would like find messages in log like that : "*2005 *Jun 3 16:09:12 s_sys@..........." Thanks In advance

3 2

RE: [syslog-ng] Error parsing conf file?
by Zb Indelak 30 Jun '05

30 Jun '05

Here's my complete syslog-ng.conf file. It only has a single reference to each destination. ---syslog-ng.conf--- # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # # 20000925 gb(a)sysfive.com # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 10 Aug 2002 # - for Red Hat 7.3 # - totally do away with klogd # - add message "kernel:" as is done with klogd. # # Updated by Frank Crawford (<Frank.Crawford(a)ac3.com.au>) - 22 Aug 2002 # - use the log_prefix option as per Balazs Scheidler's email # options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); dir_perm (0755); perm(0644); chain_hostnames(yes); keep_hostname (no); use_time_recvd(yes); time_reap(1); }; source remote { udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; source local { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; # SDW Inbox destinations start here destination d_alcatel { file("/var/nsm/inbox/switch/alcatel/7450/syslog/alcatel-$MONTH$DAY$HOUR$MIN"); }; destination d_arbor { file("/var/nsm/inbox/nids/arbor_networks/peakflow_dos/2.5/syslog/arbor-$MONTH$DAY$HOUR$MIN"); }; destination d_nortel { file("/var/nsm/inbox/switch/nortel/passport_8600/syslog/nortel-$MONTH$DAY$HOUR$MIN"); }; destination d_juniper { file("/var/nsm/inbox/oslog/juniper/junos/6.4/syslog/juniper-$MONTH$DAY$HOUR$MIN"); }; destination d_pix { file("/var/nsm/inbox/fw/cisco/pix/6.0/syslog/pix-$MONTH$DAY$HOUR$MIN"); }; destination d_ios { file("/var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-$MONTH$DAY$HOUR$MIN"); }; destination d_snort { file("/var/nsm/inbox/nids/snort.org/snort/1.9/syslog/snort-$MONTH$DAY$HOUR$MIN"); }; destination d_netscreen { file("/var/nsm/inbox/fw/netscreen/netscreen/syslog/netscreen-$MONTH$DAY$HOUR$MIN"); }; destination d_neoteris { file("/var/nsm/inbox/fw/netscreen/neoteris/3.2/syslog/neoteris-$MONTH$DAY$HOUR$MIN"); }; destination d_solaris { file("/var/nsm/inbox/oslog/sun/solaris/7/syslog/solaris-$MONTH$DAY$HOUR$MIN"); }; destination d_gnu { file("/var/nsm/inbox/oslog/gnu/tools/syslog/gnu-$MONTH$DAY$HOUR$MIN"); }; destination d_tripwire { file("/var/nsm/inbox/hids/tripwire/tripwire_for_servers/3/syslog/tripwire-$MONTH$DAY$HOUR$MIN"); }; destination d_sidewinder { file("/var/nsm/inbox/fw/secure_computing/sidewinder/g2/syslog/sidewinder-$MONTH$DAY$HOUR$MIN"); }; destination d_dragon { file("/var/nsm/inbox/nids/enterasys/dragon/6.0/syslog/dragon-$MONTH$DAY$HOUR$MIN"); }; destination d_catchall { tcp("154.11.193.8" port(514)); }; destination d_dump { file("/var/tmp/dump-$MONTH$DAY$HOUR"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; # Filters for NSM supported products start here filter f_pix { match(PIX); }; filter f_tripwire { match(tripwire); }; filter f_snort { program(snort); }; filter f_netscreen { match(NetScreen); }; filter f_neoteris { match(Neoteris); }; filter f_arbor { match(Neoteris); }; filter f_alcatel { match(TMNX) and (match(login) or match(logout)); }; filter f_juniper { match("LOGIN_") or match("ASP_") or match("UI_") ; }; filter f_nortel { match("\\[[[:digit:]]{2}/[[:digit:]]{2}/[[:digit:]]{2} [[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}\\]"); }; #filter f_nortel_test { match("\\[[[:digit:]]{2}/[[:digit:]]{2}/[[:digit:]]{2} [[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}\\]"); }; # IOS filter is IP address/hostname based, customize for your network filter f_ios { match(%) and not match(PIX); }; # Solaris filter is IP address/hostname based, customize for your network #filter f_solaris { host("192\.168\.101\.2"); }; # GNU filter is IP address/hostname based, customize for your network #filter f_gnu { host("192\.168\.101\.3"); }; # Sidewinder filter is IP address/hostname based, customize for your network #filter f_sidewinder { host("192\.168\.101\.4"); }; # Dragon filter is IP address/hostname based, customize for your network #filter f_dragon { host("192\.168\.101\.5"); }; #filter f_only_printable_chars { match("^[[\s!-~]]*$"); }; filter f_only_printable_chars { match(^[[:print:]]*$); }; filter f_troubleshoot { host("207\.229\.63\.39"); }; filter f_test { match(TEST); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(local); filter(f_filter2); destination(d_mesg); }; log { source(local); filter(f_filter3); destination(d_auth); }; log { source(local); filter(f_filter4); destination(d_mail); }; log { source(local); filter(f_filter5); destination(d_mlal); }; log { source(local); filter(f_filter6); destination(d_spol); }; log { source(local); filter(f_filter7); destination(d_boot); }; log { source(local); filter(f_filter8); destination(d_cron); }; # Log NSM supported devices to the correct inbox log { source(remote); filter(f_only_printable_chars); filter(f_pix); destination(d_pix); }; log { source(remote); filter(f_only_printable_chars); filter(f_ios); destination(d_ios); }; log { source(remote); filter(f_only_printable_chars); filter(f_snort); destination(d_snort); }; log { source(remote); filter(f_only_printable_chars); filter(f_netscreen); destination(d_netscreen); }; log { source(remote); filter(f_only_printable_chars); filter(f_neoteris); destination(d_neoteris); }; log { source(remote); filter(f_only_printable_chars); filter(f_tripwire); destination(d_tripwire); }; log { source(remote); filter(f_only_printable_chars); filter(f_arbor); destination(d_arbor); }; #log { source(remote); filter(f_arbor); destination(d_arbor); }; log { source(remote); filter(f_only_printable_chars); filter(f_juniper); destination(d_juniper); }; #log { source(remote); filter(f_juniper); destination(d_juniper); }; log { source(remote); filter(f_only_printable_chars); filter(f_alcatel); destination(d_alcatel); }; log { source(remote); filter(f_only_printable_chars); filter(f_nortel); destination(d_nortel); }; log { source(remote); filter(f_only_printable_chars); destination(d_catchall); }; #log { source(remote); destination(d_dump); }; #log { source(remote); filter(f_sidewinder); destination(d_sidewinder); }; #log { source(remote); filter(f_only_printable_chars); filter(f_dragon); destination(d_dragon); }; #log { source(remote); destination(d_catchall); }; #log { source(remote); filter(f_solaris); destination(d_solaris); }; #log { source(remote); filter(f_gnu); destination(d_gnu); }; # Use the following line for testing only and clean up /var/tmp/dump when done #log { source(remote); destination(d_dump); }; #log { source(remote); filter(f_troubleshoot); destination(d_dump); }; #log { source(remote); filter(f_only_printable_chars); destination(d_dump); }; #log { source (local); filter(f_only_printable_chars); filter(f_nortel_test); destination(d_dump); }; #log { source(local); filter(f_test); destination(d_dump); }; ---end syslog-ng.conf--- -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, June 30, 2005 3:16 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Error parsing conf file? On Thu, 2005-06-30 at 11:07 +0200, Balazs Scheidler wrote: > On Tue, 2005-06-28 at 09:46 -0600, Zb Indelak wrote: > > *** Problems start here *** > > syslog-ng 1651 root 82w REG 8,8 489 5216302 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280843 > > syslog-ng 1651 root 83w REG 8,8 489 5216302 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280843 > > [root@simda02 NSM]# ps -ef|grep syslog > > root 1651 1 0 15:36 ? 00:00:01 ./syslog-ng -f /etc/syslog-ng/syslog-ng.conf > > root 1682 1508 0 15:39 pts/2 00:00:00 grep syslog > > [root@simda02 NSM]# kill -9 1651 > > [root@simda02 NSM]# echo;date;lsof +d > > /var/nsm/inbox/router/cisco/ios/12.0/syslog > > > > This seems to be an unrelated issue that it opens the same file > multiple times. This is no good. I'll look into this as well. > I don't really see how syslog-ng could open the same file twice, unless you had multiple file() destinations which refers to the same file. Is it the case? (judging your posted configuration, it is not, but maybe you did not copy-paste your complete config. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] Error parsing conf file?
by Zb Indelak 30 Jun '05

30 Jun '05

Thank you. I downloaded the 20050628 snapshot and the file permission problem goes away. I also collected some more information on the second problem I reported. First, the relevant portions of my config file: ---syslog-ng.conf--- options { time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); dir_perm (0755); perm(0644); chain_hostnames(yes); keep_hostname (no); use_time_recvd(yes); time_reap(1); }; source remote { udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; destination d_ios { file("/var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-$MONTH$DAY$HOUR$MIN"); }; filter f_ios { match(%) and not match(PIX); }; filter f_only_printable_chars { match(^[[:print:]]*$); }; log { source(remote); filter(f_only_printable_chars); filter(f_ios); destination(d_ios); }; ---end syslog-ng.conf--- Now the symptoms. I have an application that continuously monitors the /var/nsm/inbox/router/cisco/ios/12.0/syslog directory and when a file is released in that directory, the application copies it to its working directory and removes it from the original directory. The following shows the files in the directory when using syslog-ng 1.6.5 and then the same is repeated for syslog-ng 1.9.4+20050628. I have also noticed that while version 1.6.5 was producing a single file in a directory per minute (and the time stamp corresponded to current time), version 1.9.4 produces a number of files and the timestamp varies (probably depends on the timestamp received). [root@simda02 NSM]# ./syslog-ng.orig -V syslog-ng 1.6.5 [root@simda02 NSM]# ./syslog-ng.orig -f /etc/syslog-ng/syslog-ng.conf [root@simda02 NSM]# ps -ef|grep syslog root 1597 1 0 15:30 ? 00:00:00 ./syslog-ng.orig -f /etc/syslog-ng/syslog-ng.conf root 1599 1508 0 15:30 pts/2 00:00:00 grep syslog [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:31:57 GMT 2005 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1597 root 15w REG 8,8 141584 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281531 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:32:10 GMT 2005 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1597 root 15w REG 8,8 24612 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281532 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:32:21 GMT 2005 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1597 root 11w REG 8,8 5862 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281532 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:32:35 GMT 2005 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1597 root 15w REG 8,8 26855 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281532 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:32:49 GMT 2005 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1597 root 11w REG 8,8 56055 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281532 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:32:59 GMT 2005 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1597 root 15w REG 8,8 73955 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281532 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:33:02 GMT 2005 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1597 root 11w REG 8,8 3529 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281533 [root@simda02 NSM]# kill -9 1597 [root@simda02 NSM]# ps -ef|grep syslog root 1622 1508 0 15:33 pts/2 00:00:00 grep syslog [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:33:21 GMT 2005 [root@simda02 NSM]# *** Problems start here *** [root@simda02 NSM]# ./syslog-ng -V syslog-ng 1.9.4 [root@simda02 NSM]# ./syslog-ng -f /etc/syslog-ng/syslog-ng.conf [root@simda02 NSM]# ps -ef|grep syslog root 1651 1 0 15:36 ? 00:00:00 ./syslog-ng -f /etc/syslog-ng/syslog-ng.conf root 1653 1508 0 15:36 pts/2 00:00:00 grep syslog [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:36:50 GMT 2005 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:36:58 GMT 2005 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:37:09 GMT 2005 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:37:20 GMT 2005 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:37:30 GMT 2005 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1651 root 11w REG 8,8 21143 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 12w REG 8,8 28571 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 14w REG 8,8 21143 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 15w REG 8,8 28571 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 17w REG 8,8 21143 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 19w REG 8,8 873 5216292 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281140 syslog-ng 1651 root 20w REG 8,8 1496 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:37:43 GMT 2005 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1651 root 11w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 12w REG 8,8 55008 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 14w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 15w REG 8,8 55008 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 17w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 19w REG 8,8 873 5216292 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281140 syslog-ng 1651 root 20w REG 8,8 1909 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 syslog-ng 1651 root 22w REG 8,8 1175 5216294 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280840 syslog-ng 1651 root 23w REG 8,8 1945 5216295 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280841 syslog-ng 1651 root 24w REG 8,8 512 5216296 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281537 syslog-ng 1651 root 25w REG 8,8 1909 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 syslog-ng 1651 root 27w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 28w REG 8,8 1945 5216295 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280841 syslog-ng 1651 root 29w REG 8,8 1909 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:38:01 GMT 2005 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1651 root 11w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 12w REG 8,8 57356 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 14w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 15w REG 8,8 57356 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 17w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 19w REG 8,8 873 5216292 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281140 syslog-ng 1651 root 20w REG 8,8 1909 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 syslog-ng 1651 root 22w REG 8,8 1175 5216294 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280840 syslog-ng 1651 root 23w REG 8,8 2337 5216295 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280841 syslog-ng 1651 root 24w REG 8,8 512 5216296 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281537 syslog-ng 1651 root 25w REG 8,8 1909 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 syslog-ng 1651 root 27w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 28w REG 8,8 2337 5216295 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280841 syslog-ng 1651 root 29w REG 8,8 1909 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 syslog-ng 1651 root 30w REG 8,8 57356 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 31w REG 8,8 57356 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 32w REG 8,8 2337 5216295 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280841 syslog-ng 1651 root 33w REG 8,8 35554 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 34w REG 8,8 35554 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 35w REG 8,8 35554 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 36w REG 8,8 544 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 37w REG 8,8 490 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 38w REG 8,8 490 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 39w REG 8,8 490 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 40w REG 8,8 544 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:38:30 GMT 2005 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1651 root 11w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 12w REG 8,8 57356 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 14w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 15w REG 8,8 57356 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 17w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 19w REG 8,8 873 5216292 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281140 syslog-ng 1651 root 20w REG 8,8 1909 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 syslog-ng 1651 root 22w REG 8,8 1175 5216294 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280840 syslog-ng 1651 root 23w REG 8,8 2337 5216295 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280841 syslog-ng 1651 root 24w REG 8,8 512 5216296 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281537 syslog-ng 1651 root 25w REG 8,8 1909 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 syslog-ng 1651 root 27w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 28w REG 8,8 2337 5216295 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280841 syslog-ng 1651 root 29w REG 8,8 1909 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 syslog-ng 1651 root 30w REG 8,8 57356 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 31w REG 8,8 57356 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 32w REG 8,8 2337 5216295 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280841 syslog-ng 1651 root 33w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 34w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 35w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 36w REG 8,8 1958 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 37w REG 8,8 882 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 38w REG 8,8 882 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 39w REG 8,8 882 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 40w REG 8,8 1958 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 41w REG 8,8 1958 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 42w REG 8,8 1958 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 43w REG 8,8 1958 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 44w REG 8,8 1958 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 45w REG 8,8 1958 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 46w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 47w REG 8,8 1958 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 48w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 49w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 50w REG 8,8 1958 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 51w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 52w REG 8,8 882 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 53w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 54w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 55w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 56w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 57w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 58w REG 8,8 882 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 59w REG 8,8 1958 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 60w REG 8,8 92808 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:39:01 GMT 2005 COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME syslog-ng 1651 root 11w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 12w REG 8,8 57356 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 14w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 15w REG 8,8 57356 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 17w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 19w REG 8,8 873 5216292 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281140 syslog-ng 1651 root 20w REG 8,8 1909 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 syslog-ng 1651 root 22w REG 8,8 1175 5216294 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280840 syslog-ng 1651 root 23w REG 8,8 2337 5216295 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280841 syslog-ng 1651 root 24w REG 8,8 512 5216296 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281537 syslog-ng 1651 root 25w REG 8,8 1909 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 syslog-ng 1651 root 27w REG 8,8 22015 5216290 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280940 syslog-ng 1651 root 28w REG 8,8 2337 5216295 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280841 syslog-ng 1651 root 29w REG 8,8 1909 5216293 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281141 syslog-ng 1651 root 30w REG 8,8 57356 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 31w REG 8,8 57356 5216291 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280941 syslog-ng 1651 root 32w REG 8,8 2337 5216295 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280841 syslog-ng 1651 root 33w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 34w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 35w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 36w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 37w REG 8,8 1467 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 38w REG 8,8 1467 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 39w REG 8,8 1467 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 40w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 41w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 42w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 43w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 44w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 45w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 46w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 47w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 48w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 49w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 50w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 51w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 52w REG 8,8 1467 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 53w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 54w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 55w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 56w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 57w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 58w REG 8,8 1467 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 59w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 60w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 61w REG 8,8 1467 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 62w REG 8,8 1467 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 63w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 64w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 65w REG 8,8 1467 5216299 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280842 syslog-ng 1651 root 66w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 67w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 68w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 69w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 70w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 71w REG 8,8 3347 5216298 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281142 syslog-ng 1651 root 72w REG 8,8 35436 5216300 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280943 syslog-ng 1651 root 73w REG 8,8 35436 5216300 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280943 syslog-ng 1651 root 74w REG 8,8 129975 5216297 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280942 syslog-ng 1651 root 75w REG 8,8 840 5216301 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281143 syslog-ng 1651 root 76w REG 8,8 840 5216301 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281143 syslog-ng 1651 root 77w REG 8,8 489 5216302 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280843 syslog-ng 1651 root 78w REG 8,8 35436 5216300 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280943 syslog-ng 1651 root 79w REG 8,8 840 5216301 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281143 syslog-ng 1651 root 80w REG 8,8 840 5216301 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06281143 syslog-ng 1651 root 81w REG 8,8 35436 5216300 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280943 syslog-ng 1651 root 82w REG 8,8 489 5216302 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280843 syslog-ng 1651 root 83w REG 8,8 489 5216302 /var/nsm/inbox/router/cisco/ios/12.0/syslog/ios-06280843 [root@simda02 NSM]# ps -ef|grep syslog root 1651 1 0 15:36 ? 00:00:01 ./syslog-ng -f /etc/syslog-ng/syslog-ng.conf root 1682 1508 0 15:39 pts/2 00:00:00 grep syslog [root@simda02 NSM]# kill -9 1651 [root@simda02 NSM]# echo;date;lsof +d /var/nsm/inbox/router/cisco/ios/12.0/syslog Tue Jun 28 15:39:21 GMT 2005 [root@simda02 NSM]# -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Monday, June 27, 2005 3:33 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Error parsing conf file? On Fri, 2005-06-24 at 09:15 -0600, Zb Indelak wrote: > Thank you for such a quick turn-around on this issue. I've run into a > couple more. > > 1) New files are being created with file permissions equal to the > inverse of umask, entirely ignoring the permissions specified in the > perm() option. Hardcoding the permissions in the open() call in > affile.c fixes the problem (yes, I know it's not the way to do it, but > I was in a hurry). In other words, it appears that the value of mode > is all ones rather than whatever was specified in the perm() option. this one is fixed, committed, the next snapshot should contain the fix. > > 2) Syslog-ng does not appear to be closing the log files and maintains > a lock on the > files until the application exits. This one is causing me no end of grief. I don't really know what you mean here? syslog-ng does not lock files on its own and according to my tests dynamic output files were properly reaped (closed in time as time_reap() specifies) non-dynamic files (which has no macros in the name) are not reaped, but IIRC syslog-ng 1.6.x did not reap those either. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 2

about syslog-ng 1.9.4+20050629 and log_prefix
by kyle lo 30 Jun '05

30 Jun '05

hi everybody..... i have two problems first is when i execute syslog-ng-1.9.4+20050629 i got this message "getsockopt(SOL_SOCKET, SO_ERROR) failed for connecting socket; reconnect='10', error='Socket opreation on non-socket (88)'" could anyone tell me what's happened and how to resolve that? the second is in syslog-ng 1.6.x can i use log_prefix() in udp source driver? thx Regards coin

2 1

multiple source/destination setup
by William Bell 30 Jun '05

30 Jun '05

For a while now I have been using a configuration that includes 3 sources (remote udp, remote tcp, internal) and 3 destinations ( remote archive, local, loopback for an analyzer). Today I tried to move this setup that works on all levels to another machine. This new machine has an EXTREMELY large udp traffic base. About 7.5gb of syslog per day. The setup of the new machine is exactly the same the only variable is this large traffic volume. Now, to the problem. I am receiving all the syslog on the remote destination archive across normal syslog export mechanisms. However the two log destinations under it are not receiving the "copies" of the logs. I was wondering if anyone else uses syslog-ng to log large pix firewall syslog traffic, and have seen anything similar. My theory is that syslog-ng is just not keeping up with the speed that its receiving data. Here is a copy of the conf file with only the private info adjusted. options { long_hostnames(off); chain_hostnames(yes); log_fifo_size(0); stats(5); sync(1); time_reopen(5); time_reap(20); use_dns(no); use_fqdn(yes); use_time_recvd(no); }; ## Normal syslog domain socket source devlog { unix-dgram("/dev/log"); }; source r_tcp { tcp(ip(0.0.0.0) port(514) max-connections(200)); }; source r_udp { udp(ip(0.0.0.0) port(514)); }; ## This stuff goes straight to the syslog server destination xxxx { tcp('X.X.X.X' port(514)); }; destination r_all { file("/var1/syslog/$HOST-$MONTH-$DAY"); }; destination AAAAAAA { file("/var1/AAAAAAA/$FACILITY" create_dirs(yes) ); }; destination analyzer { tcp('localhost' port(10000)); }; ################################################################ filter fil_local7 { facility(local7); }; filter fil_local4 { facility(local4); }; ## syslog-ng messages like STATS, etc ## This also tells us when it can't find a source (i.e. Hermes) source int { internal(); }; log { source(int); source(devlog); source(r_tcp); source(r_udp); destination(xxxx); <<<WORKS destination(analyzer); <<< DOESN'T WORK }; log { source(r_udp); destination(AAAAAAAA); <<< DOESN'T WORK }; log { source(int); source(devlog); destination(r_all);<<<WORKS flags(final); ## Stop processing rules }; WillyBeamenHere

3 2

RE: [syslog-ng] multiple source/destination setup
by William Bell 29 Jun '05

29 Jun '05

Kevin, The internal buffering saved the day, as fyi we are running at about 1100 packets/s in udp of 1 pix(fluctuates heavily during peak hours to about 1500-1600), and we are going to be adding two more pix's soon that this syslog engine will have to handle aswell so this really did the trick. Its helping my analyzer out a bit aswell. Thanks alot for your time to take a look at my config. William -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu on behalf of Kevin Sent: Tue 6/28/2005 10:26 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] multiple source/destination setup On 6/28/05, William Bell <williamb(a)cwie.net> wrote: > For a while now I have been using a configuration that includes 3 sources > (remote udp, remote tcp, internal) and 3 destinations ( remote archive, > local, loopback for an analyzer). Today I tried to move this setup that > works on all levels to another machine. This new machine has an EXTREMELY > large udp traffic base. About 7.5gb of syslog per day. The setup of the new > machine is exactly the same the only variable is this large traffic volume. Is the hardware the same? Can you provide details on the average and peak packets per second (PPS) for the new host? Perhaps you might monitor the switch port, perhaps by using something like MRTG? > Now, to the problem. > I am receiving all the syslog on the remote destination archive across > normal syslog export mechanisms. However the two log destinations under it > are not receiving the "copies" of the logs. So you are saying that the archive is locally logging the messages correctly, but is failing to forward copies of the messages out? > I was wondering if anyone else uses syslog-ng to log large pix firewall syslog > traffic, and have seen anything similar. My theory is that syslog-ng is just not > keeping up with the speed that its receiving data. This is possible. A syslog server is limited by the log software, by the OS, and by the drives and drive controller. The limits are usually more about the number of messages (packets) per second than bytes per second. Packets can be dropped in syslog-ng itself (logged via the internal source, usually as "stats"), by the TCP/IP stack (logged in OS-specific kernel data structures usually viewable via "netstat -p udp") or because the OS or NIC cannot handle the data coming in over the LAN (often logged nowhere). > Here is a copy of the conf file with only the private info adjusted. . . . > log_fifo_size(0); . . . > sync(1); . . . Ouch. With these settings, syslog-ng isn't doing any internal buffering, In my experience, a high-volume logger needs these two values set high, I use the following: sync(256); log_fifo_size(4095); With these settings, we are currently processing UDP syslog data totalling just over 11GB/day (65 million messages/day) without significant packet loss, there is some loss (perhaps one in fifty thousand packets) during the peak hour of the day -- at the peak hour the logger processes 6 million messages totalling just over 1GB, at that volume a few packets dropped by the OS is acceptable :) Kevin Kadow (P.S. Our record for log events successfully received and written in a one second interval is 2,100; this is based on the message timestamp, I haven't yet tried the recently posted patch to count messages/second.) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

SQLsyslogd
by Michael Laccetti 29 Jun '05

29 Jun '05

Hey guys, just a quick notification that 0.2 of SQLsyslogd has been released. This version adds support for MySQL (already had PostgreSQL) and support for buffering the database inserts. You can find more information here: http://projects.codeogre.com/sqlsyslogd/ Cheers, Mike -- ------------------------ [ SECURITY NOTICE ] ------------------------ To: syslog-ng(a)lists.balabit.hu. For your security, michael(a)s2g-limited.com digitally signed this message on 29 June 2005 at 02:38:11 UTC. Verify this digital signature at http://www.ciphire.com/verify. ------------------- [ CIPHIRE DIGITAL SIGNATURE ] ------------------- Q2lwaGlyZSBTaWcuAVdzeXNsb2ctbmdAbGlzdHMuYmFsYWJpdC5odQBtaWNoYWVsQHMyZ y1saW1pdGVkLmNvbQBlbWFpbCBib2R5AO8AAAB8AHwAAAABAAAAkwnCQu8AAAAMAwACAA IAAgAghdicC/BUmddiR42qouJHlnIdErtbS2JMBhxXunW5fyYBADFOR2Yt22whsx7gUTo GnIPH+715U3RbKhA9xYKZYPIPCgRnY8xidejdB+RJQpAZyyFBEDw9c5BWJ3GCfbMOP7Tx yeDXU2lnRW5k --------------------- [ END DIGITAL SIGNATURE ] ---------------------

1 0