- syslog-ng - lists.balabit.hu

Reliable tcp logging
by Peter Daum 12 May '05

12 May '05

I am trying to send all important messages from a bunch of other machines to a central syslog-ng server via tcp. I chose tcp partly, because the same log server gets all kinds of less important stuff via udp from other machines, which can easily be distinguished that way, but partially also because I expected tcp to be more reliable. Unfortunately, this does not seem to be the case: When the connection has died for any reason, the client will only discover this when it is trying to send the next message to the server. Only then it starts to wait until "time_reopen" is over and establishes a new connection - the message that originally triggered this and whatever comes in between is lost. Is there any way to get syslog-ng (v 1.6.5) to check more often whether a tcp connection to a log host still exists and re-establish it otherwise? I did not see any reference to this in the documentation, but this seems to happen every 2 hours. Setting "tcp-keep-alive(yes)" does not seem to make it any better. I also discovered that version 1.6.7 has a new option "log_fifo_size" which sounded promising but setting this to a higher value also does not seem to have any influence on this issue. Regards, Peter Daum

5 6

"above message repeats"
by Andrew Morris 11 May '05

11 May '05

One of the messages I'm getting (I'm sorting messages by hostname) is the "above message repeats n times" message, but syslog-ng is logging this under the host "above". Shouldn't syslog-ng decide what the hostname is by the ip address it is connected from? eg: host A connects, syslog-ng looks up the host by it's connecting ip address and uses that name resolution as the $HOST variable? (Note, in this case all hosts are in a local hosts file) So, why would it ever write to the file "above"? Is this a bug, or am I missing something? As per my previous messages, here's a quick rundown of the config: (used with 1.6.7) options { # Don't trust the sender to supply a hostname. keep_hostname(no); # Don't track relayed messages. chain_hostnames(no); # Make sure the hostnames have valid characters. check_hostname(yes); # Since we're only tracking local hosts, don't worry about the fqdn. use_fqdn(no); # As soon as we get the log entry, write it to disk. sync(0); # Set the fifo size to 1024 lines. log_fifo_size(1024); # Increase the log_msg_size to 8192 bytes. log_msg_size(8192); # If we need a directory and it doesn't exist, create it and use # the permissions shown below. create_dirs(yes); perm(0644); dir_perm(0755); # Use an internal dns cache, but don't use any dns lookups. dns_cache(yes); use_dns(no); }; source localsyslog {unix-stream("/dev/log");}; source kernellog {file("/proc/kmsg");}; source intsyslog {internal();}; source extsyslog {udp();}; destination syslog-ng {file("/logs/syslog-ng");}; destination messages {file("/var/log/messages");}; destination kernmessages {file("/var/log/kernel");}; destination hosts { file("/logs/hosts/$YEAR-$MONTH/$HOST" template("$DATE $HOST $MESSAGE\n") template_escape(yes) ); } ; destination services { file("/logs/services/$YEAR-$MONTH/$PROGRAM" template("$DATE $HOST $MESSAGE\n") template_escape(yes) ); }; filter levelfilter { level(info..emerg); }; log { source(intsyslog); destination(syslog-ng); }; log { source(localsyslog); filter(levelfilter); destination(messages);}; log { source(kernellog); destination(kernmessages);}; log { source(extsyslog); source(localsyslog); destination(hosts); }; log { source(extsyslog); source(localsyslog); destination(services); };

2 2

Minor Compile Issue
by Andrew Morris 11 May '05

11 May '05

Just a minor compiling issue for version 1.6.7 (actually it's been there for a while...). If I want to put the syslog-ng.conf file in a different location, I use the --sysconfdir option to configure. The problem is the configure.in file automatically adds "/syslog-ng" on to the end of whatever I put in. I have no problem with it doing this by default, but if I go through the effort of using --sysconfdir, then the configure script should do what it's told (even if that's thought to be wrong by some). Since syslog-ng only uses one conf file, I'd rather put it directly under /etc... My fix so far is to go and comment out that line before I run configure, but that's just a quick hack. Oh, and just before someone says otherwise, configure modifies some .h files and there's no way (that I know of anyways - please correct me if I'm wrong) to override those settings via make. I'm not asking anyone to change the defaults, but is it possible to either: 1) Add another option to configure to handle the subdirectory? eg: --sysconfsubdir or something like this? (eg: the default would end up being $PREFIX/$SYSCONFDIR/$SYSCONFSUBDIR/syslog-ng.conf) 2) If --sysconfdir is specified, use whatever it is set to. Otherwise use $PREFIX/etc/syslog-ng

2 2

klogctl: Invalid argument
by micah milano 11 May '05

11 May '05

Hello, Whenever I stop/start/restart syslog-ng, I see the entirity of my kernel buffer spit onto the screen, as well as the following message sent to STDERR: klogctl: Invalid argument I cannot figure out where this comes from, I do not have a program called klogctl on my system, and I've looked through the syslog-ng sources to see if I could find anything there, and I can only find an item in the NEWS file: ChangeLog: * utils/klogctl.c: New file to control kernel log level NEWS: * Added klogctl program to control kernel logging level on Linux but there is no utils/ folder at all, nor is there anything else related to klogctl. Thanks! micah

2 2

Re: [syslog-ng]Pix problem
by Ben Whittaker 11 May '05

11 May '05

This is from my config. # PIX # source network { udp () ; tcp (); }; log{source(net);filter(f_pix);destination(pixlog);}; destination pixlog { file("/var/log/pix.log"); }; filter f_pix { facility(local4); }; And on my PIX logging on logging timestamp logging buffered notifications logging trap notifications logging queue 1024 logging host inside 10.x.x.x no logging message 106001 no logging message 106023 --- Damien Michau <d.michau(a)ag.com> wrote: > Hi All ! > I have some probleme ta log my pix's log into my > syslog-ng server . > i have mounted a Syslog-ng server to store my pix's > log . But there is nothing in my pix.log > i'have put this lines in my syslog-ng.conf > > > source pix { udp(ip(10.60.10.111) port());}; > destination pix { file("/var/log/pix.log"); }; > log { source(pix);destination(pix); }; > > > Have you one idea ? > > Thx > > Damien Michau > Paris Discover Yahoo! Use Yahoo! to plan a weekend, have fun online and more. Check it out! http://discover.yahoo.com/

3 5

More fun with hostnames....
by Andrew Morris 10 May '05

10 May '05

I've been using syslog-ng for a little while and so far I like what I see, but I'm confused over the hostname options in the config file. Yes, I've read the man pages/FAQ, but I guess I'm still not getting it. I'm going to send each issue as a separate message so the answers can easily be tracked in the archives for others...

1 0

Logging to Oracle - Quoting issue
by André Bonhôte 10 May '05

10 May '05

Hi! I have already written a mail to info(a)balabit.hu today, but I am impatient. Forgive me please! We have an issue when logging to Oracle. Obviously, Oracle requires a single quote to be quoted by a single quote. I have found this [1] article about it. Since it's 2005 now, I'd like to know whether this one is fixed in the latest version or not. I have 1.6.2 running in production now on a few machines. I didn't find anything in the Changelog about this, unfortunately. Could someone give me a hint? Thanks IA André [1] https://lists.balabit.hu/pipermail/syslog-ng/2003-November/ 005510.html ___ ___ ___ ___ \C/ \O/ \L/ \T/ Andre Bonhote t: +41 (0)44 5 600 600 V V V V Platform Infrastructure f: +41 (0)44 5 630 501 we make business Senior IP Engineer straight.forward COLT Telecom e: andre(a)colt.net

2 3

Re: Re: [syslog-ng]Syntax error in default config?
by jbrunke＠ctsgi.com 06 May '05

06 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0

Re: [syslog-ng]Syntax error in default config?
by jbrunke＠ctsgi.com 05 May '05

05 May '05

I will be out of the office with no access to email or voicemail until May 11, 2005. I will attend to your email promptly upon my return. Thank you, James Brunke Crystal Technology Solutions Group Inc

1 0

RE: Issues with HP-UX
by Jenny-Lou Sequeira 05 May '05

05 May '05

I have used the following syslog-ng config file on HP-UX 11.23 (syslog-ng 1.6.6) and have not seen any problem : options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; # Source source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; # Destination destination d_mesg { file("/var/adm/syslog/syslog-ng/syslog.log"); }; destination d_mail { file("/var/adm/syslog/syslog-ng/mail.log"); }; destination d_cons { file("/dev/console"); }; destination d_mail { file("/var/adm/syslog/syslog-ng/mail.log"); }; destination d_cons { file("/dev/console"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; # Filter filter f_filter1 { facility(mail) and level(debug .. emerg); }; filter f_filter2 { level(info .. emerg) and not facility(mail); }; filter f_filter3 { level(alert .. emerg); }; filter f_filter4 { level(emerg); }; # Log log { source(s_sys); filter(f_filter1); destination(d_mail); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_cons); destination(d_mlrt); }; log { source(s_sys); filter(f_filter4); destination(d_mlal); }; Note : If your destination directories do not exist you need the "create_dirs (yes);" in the options. Also, make sure that syslogd is stopped. I used the following test program, and all messages show up in /var/adm/syslog-ng/mail.log and /var/adm/syslog/syslog.log resp. ( #!/usr/bin/sh echo "Testing mail" logger -p mail.debug "test mail debug" logger -p mail.info "test mail info" logger -p mail.notice "test mail notice" logger -p mail.warning "test mail warning" logger -p mail.err "test mail err" logger -p mail.crit "test mail crit" logger -p mail.alert "test mail alert" logger -p mail.emerg "test mail emerg" echo "Testing syslog" logger -p auth.debug "test syslog debug" logger -p user.info "test syslog info" logger -p auth.notice "test syslog notice" logger -p news.warning "test syslog warning" logger -p daemon.err "test syslog err" logger -p lpr.crit "test syslog crit" logger -p cron.alert "test syslog alert" logger -p kern.emerg "test syslog emerg" Jenny-Lou Sequeira

1 0