- syslog-ng - lists.balabit.hu

too much time() ?
by Dave Johnson 12 Mar '05

12 Mar '05

We did some maintaince on our sol9 central syslog-ng server recently running syslog-ng v1.6.4, and noticed something... truss -p on the syslog-ng process shows an abundant number of time() calls. The ratio of time() to read()/write()s were a factor of 20-40x. * This is even with use_time_recv(no); in the global options. I'm trying to understand if this is something that could be cut down some or if its a standard solaris process overhead... ?

2 2

RE: [syslog-ng]RE: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3
by Marquis Thibodeau 11 Mar '05

11 Mar '05

OK, I will try to make it working.. Thanks for the confirmation Marquis -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Earls, Michael Sent: 11 mars 2005 06:43 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]RE: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3 Syslog-ng version 1.5 and up have support for mysql templates. Thanks, Michael PGP Info: KeyID 0x0DFD993C Fingerprint F903 0325 5105 2CDB 4BF4 C88B 72F7 BA7A 28CC 598A -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] Sent: Thursday, March 03, 2005 7:33 AM To: syslog-ng(a)lists.balabit.hu; syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3 Hi, Thanks for your quick answer... I didn't find the version I need.. the 1.5.x because I want to store the log in MySQL and it says that only 1.5.x is working with template (MySQL) Any other idea?? Thanks Marquis _____ De: syslog-ng-admin(a)lists.balabit.hu de la part de Viper sec Date: mer. 2005-03-02 13:01 À: syslog-ng(a)lists.balabit.hu Objet : Re: [syslog-ng]Installation problem on Fedora C3 Hi I installed on FC3, it was ok. I used rpm from rpm.pbone.net. Regards, Viper$ec On Wed, 2 Mar 2005 12:53:03 -0500, Marquis Thibodeau <mthibodeau(a)avance.info> wrote: > Hi, > > I tried to install syslog-ng on my Fedora Core3 server and I get a bunch of > error in the compilation... > > Is someone can help me out... > > What thing do I need to provide here to get better help...??? > > Thanks > > Marquis _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail transmission contains information that is confidential and may be privileged. It is intended only for the addressee(s) named above. If you receive this e-mail in error, please do not read, copy or disseminate it in any manner. If you are not the intended recipient, any disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please erase it from your computer system. Your assistance in correcting this error is appreciated.

1 0

RE: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3
by Earls, Michael 11 Mar '05

11 Mar '05

Syslog-ng version 1.5 and up have support for mysql templates. Thanks, Michael PGP Info: KeyID 0x0DFD993C Fingerprint F903 0325 5105 2CDB 4BF4 C88B 72F7 BA7A 28CC 598A -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] Sent: Thursday, March 03, 2005 7:33 AM To: syslog-ng(a)lists.balabit.hu; syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]RE : [syslog-ng]Installation problem on Fedora C3 Hi, Thanks for your quick answer... I didn't find the version I need.. the 1.5.x because I want to store the log in MySQL and it says that only 1.5.x is working with template (MySQL) Any other idea?? Thanks Marquis _____ De: syslog-ng-admin(a)lists.balabit.hu de la part de Viper sec Date: mer. 2005-03-02 13:01 À: syslog-ng(a)lists.balabit.hu Objet : Re: [syslog-ng]Installation problem on Fedora C3 Hi I installed on FC3, it was ok. I used rpm from rpm.pbone.net. Regards, Viper$ec On Wed, 2 Mar 2005 12:53:03 -0500, Marquis Thibodeau <mthibodeau(a)avance.info> wrote: > Hi, > > I tried to install syslog-ng on my Fedora Core3 server and I get a bunch of > error in the compilation... > > Is someone can help me out... > > What thing do I need to provide here to get better help...??? > > Thanks > > Marquis _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html This e-mail transmission contains information that is confidential and may be privileged. It is intended only for the addressee(s) named above. If you receive this e-mail in error, please do not read, copy or disseminate it in any manner. If you are not the intended recipient, any disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please erase it from your computer system. Your assistance in correcting this error is appreciated.

1 0

Apache Access Log Load and Syslog-ng Stability
by Jason Stafford 11 Mar '05

11 Mar '05

Howdy, I'm trying to setup a load balanced system with several web servers and one central log server. Currently I have syslog-ng running and pipe the output form apache to logger. This is all running locally on one box. However, syslog-ng just randomly hangs and apache stop processing requests. I can restart apache and it still does not respond, but i can just restart syslog-ng and then it all starts working again. Is syslog-ng designed to handle this kinda of load, around 3 million entries a day? I have been googling for hours and can only find some comments about log_fifo_size and reap_time in the options section? here is my current config, if that helps any options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination d_http_access { file("/var/log/HTTP/$YEAR-$MONTH-$DAY/$YEAR-$MONTH-$DAY.accesslog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(\ yes)); }; destination d_http_search { file("/var/log/HTTP/$YEAR-$MONTH-$DAY/$YEAR-$MONTH-$DAY.searchlog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(\ yes)); }; destination d_http_error { file("/var/log/HTTP/$YEAR-$MONTH-$DAY/$YEAR-$MONTH-$DAY.errorlog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(ye\ s)); }; filter f_http_access { match("APACHE_ACCESS_LOG") and not match("test.html"); }; filter f_http_search { match("APACHE_ACCESS_LOG") and match("/content/search"); }; filter f_http_error { match("APACHE_ERR_LOG"); }; log { source(s_sys); filter(f_http_access); destination(d_http_access); }; #Log httpd search access logs log { source(s_sys); filter(f_http_search); destination(d_http_search); }; #Log httpd error logs log { source(s_sys); filter(f_http_error); destination(d_http_error); }; ###################################################3 httpd.conf log line CustomLog "|/usr/bin/logger -p local0.info -t APACHE_ACCESS_LOG" tracking

2 2

Michael J. Bock/NetServ/DST/US is out of the office.
by MJBock＠dstsystems.com 11 Mar '05

11 Mar '05

I will be out of the office starting 03/10/2005 and will not return until 03/16/2005. I will respond to your message when I return. ----------------------------------------- This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.

1 0

Syslog-ng fails during build
by Phillip Cockrell 10 Mar '05

10 Mar '05

Hi, I have googled and I still cant find an answer to this, wondering if anyone here knows. I am trying to build a syslog-ng RPM on Red Hat AS3, however, I get the following error: gcc -O2 -g -march=i386 -mcpu=i686 -Wall -I/usr/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lnsl -lresolv -lwrap /usr/lib/libol.a -lnsl cfg-lex.o(.text+0x42f): In function `yylex': /usr/src/redhat/BUILD/syslog-ng-1.6.5/src/cfg-lex.c:1123: undefined reference to `yywrap' cfg-lex.o(.text+0xbdf): In function `input': /usr/src/redhat/BUILD/syslog-ng-1.6.5/src/cfg-lex.c:1450: undefined reference to `yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-1.6.5/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-1.6.5/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-1.6.5/src' make: *** [all-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.65939 (%build) I built libol and libol-devel RPMs and they are both installed: libol-0.3.15-1 libol-devel-0.3.15-1 Any ideas? -- Phillip Cockrell [pcockrel(a)rackspace.com] RTS System Administrator Rackspace Managed Hosting Office: (210) 447-4161 Cell: (210) 618-6229 Pager: page.pcockrel(a)rackspace.com

2 2

logging to two files simultaneously
by Mike Pepe 10 Mar '05

10 Mar '05

I'm trying to log to two files at the same time. What's the best way to do it? I put two destinations in a log block, but it doesn't log to both places. Is there a trick to doing this? curious... -Mike

3 2

Re: [syslog-ng]logs are not generated and managed by syslog-ng but it is started properly
by jack alex 10 Mar '05

10 Mar '05

Thanks for listening! Below message is very long! Please specially read 2nd last line of below message becz it is depicting some UNKNOW message, which can help us to resolv the issue. # syslog-ng -d -v io.c: Preparing fd 3 for reading binding fd 4, inetaddr: 0.0.0.0, port: 514 io.c: Preparing fd 4 for reading binding fd 5, unixaddr: /dev/log io.c: listening on fd 5 syslog-ng version 1.6.0rc2 starting Garbage collecting while idle... gc_mark: Marking object of class 'syslog_backend' (0) gc_mark: Marking object of class 'syslog_config' (1) gc_mark: Marking object of class 'resource_list' (2) gc_mark: Marking object of class 'io_fd' (3) gc_mark: Marking object of class 'log_reader' (4) gc_mark: Marking object of class 'affile_source' (5) gc_mark: Marking object of class 'log_source_group' (6) gc_mark: Marking object of class 'log_source_group' (7) gc_mark: Marking object of class 'log_source_group' (8) gc_mark: Marking object of class 'afunix_source' (9) gc_mark: Marking object of class 'listen_fd' (10) gc_mark: Marking object of class 'afsocket_accept_callback' (11) gc_mark: Marking object of class 'io_fd' (11) gc_mark: Marking object of class 'log_reader' (12) gc_mark: Marking object of class 'afsocket_source_connection' (13) gc_mark: Marking object of class 'afinet_source' (14) gc_mark: Marking object of class 'inet_address_info' (15) gc_mark: Marking object of class 'object_queue' (15) gc_mark: Marking object of class 'afsocket_source_close_callback' (12) gc_mark: Marking object of class 'unix_address_info' (10) gc_mark: Marking object of class 'object_queue' (10) gc_mark: Marking object of class 'log_source_driver' (10) gc_mark: Marking object of class 'log_center' (9) gc_mark: Marking object of class 'log_connection' (10) gc_mark: Marking object of class 'log_endpoint_info' (11) gc_mark: Marking object of class 'log_endpoint_info' (12) gc_mark: Marking object of class 'log_endpoint_info' (11) gc_mark: Marking object of class 'log_filter' (12) gc_mark: Marking object of class 'filter_expr_pri' (13) gc_mark: Marking object of class 'log_filter' (13) gc_mark: Marking object of class 'filter_expr_op' (14) gc_mark: Marking object of class 'filter_expr_pri' (15) gc_mark: Marking object of class 'filter_expr_op' (15) gc_mark: Marking object of class 'filter_expr_pri' (16) gc_mark: Marking object of class 'filter_expr_pri' (16) gc_mark: Marking object of class 'log_filter' (14) gc_mark: Marking object of class 'filter_expr_op' (15) gc_mark: Marking object of class 'filter_expr_pri' (16) gc_mark: Marking object of class 'filter_expr_pri' (16) gc_mark: Marking object of class 'log_filter' (15) gc_mark: Marking object of class 'filter_expr_pri' (16) gc_mark: Marking object of class 'log_filter' (16) gc_mark: Marking object of class 'filter_expr_pri' (17) gc_mark: Marking object of class 'log_filter' (17) gc_mark: Marking object of class 'filter_expr_pri' (18) gc_mark: Marking object of class 'log_filter' (18) gc_mark: Marking object of class 'filter_expr_pri' (19) gc_mark: Marking object of class 'log_filter' (19) gc_mark: Marking object of class 'filter_expr_pri' (20) gc_mark: Marking object of class 'log_filter' (20) gc_mark: Marking object of class 'filter_expr_pri' (21) gc_mark: Marking object of class 'log_filter' (21) gc_mark: Marking object of class 'filter_expr_pri' (22) gc_mark: Marking object of class 'log_filter' (22) gc_mark: Marking object of class 'filter_expr_pri' (23) gc_mark: Marking object of class 'log_filter' (23) gc_mark: Marking object of class 'filter_expr_pri' (24) gc_mark: Marking object of class 'log_filter' (24) gc_mark: Marking object of class 'filter_expr_pri' (25) gc_mark: Marking object of class 'log_filter' (25) gc_mark: Marking object of class 'filter_expr_pri' (26) gc_mark: Marking object of class 'log_filter' (26) gc_mark: Marking object of class 'filter_expr_pri' (27) gc_mark: Marking object of class 'log_endpoint_info' (11) gc_mark: Marking object of class 'log_dest_group' (12) gc_mark: Marking object of class 'affile_dest' (13) gc_mark: Marking object of class 'log_connection' (11) gc_mark: Marking object of class 'log_endpoint_info' (12) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_endpoint_info' (12) gc_mark: Marking object of class 'log_endpoint_info' (12) gc_mark: Marking object of class 'log_dest_group' (13) gc_mark: Marking object of class 'log_dest_group' (14) gc_mark: Marking object of class 'affile_dest' (15) gc_mark: Marking object of class 'affile_dest' (14) gc_mark: Marking object of class 'log_connection' (12) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_dest_group' (14) gc_mark: Marking object of class 'affile_dest' (15) gc_mark: Marking object of class 'log_connection' (13) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_dest_group' (15) gc_mark: Marking object of class 'affile_dest' (16) gc_mark: Marking object of class 'log_connection' (14) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_dest_group' (16) gc_mark: Marking object of class 'log_dest_group' (17) gc_mark: Marking object of class 'log_dest_group' (18) gc_mark: Marking object of class 'log_dest_group' (19) gc_mark: Marking object of class 'affile_dest' (20) gc_mark: Marking object of class 'affile_dest' (19) gc_mark: Marking object of class 'affile_dest' (18) gc_mark: Marking object of class 'affile_dest' (17) gc_mark: Marking object of class 'log_connection' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_connection' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_dest_group' (18) gc_mark: Marking object of class 'log_dest_group' (19) gc_mark: Marking object of class 'log_dest_group' (20) gc_mark: Marking object of class 'log_dest_group' (21) gc_mark: Marking object of class 'log_dest_group' (22) gc_mark: Marking object of class 'log_dest_group' (23) gc_mark: Marking object of class 'log_dest_group' (24) gc_mark: Marking object of class 'log_dest_group' (25) gc_mark: Marking object of class 'affile_dest' (26) gc_mark: Marking object of class 'affile_dest' (25) gc_mark: Marking object of class 'affile_dest' (24) gc_mark: Marking object of class 'affile_dest' (23) gc_mark: Marking object of class 'affile_dest' (22) gc_mark: Marking object of class 'affile_dest' (21) gc_mark: Marking object of class 'affile_dest' (20) gc_mark: Marking object of class 'affile_dest' (19) gc_mark: Marking object of class 'log_connection' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_connection' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_connection' (19) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'log_endpoint_info' (21) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'log_connection' (20) gc_mark: Marking object of class 'log_endpoint_info' (21) gc_mark: Marking object of class 'log_connection' (21) gc_mark: Marking object of class 'log_endpoint_info' (22) gc_mark: Marking object of class 'log_endpoint_info' (23) gc_mark: Marking object of class 'log_endpoint_info' (22) gc_mark: Marking object of class 'log_endpoint_info' (22) gc_mark: Marking object of class 'log_connection' (22) gc_mark: Marking object of class 'log_endpoint_info' (23) gc_mark: Marking object of class 'log_endpoint_info' (24) gc_mark: Marking object of class 'log_endpoint_info' (23) gc_mark: Marking object of class 'log_endpoint_info' (23) gc_mark: Marking object of class 'log_connection' (23) gc_mark: Marking object of class 'log_endpoint_info' (24) gc_mark: Marking object of class 'log_endpoint_info' (25) gc_mark: Marking object of class 'log_endpoint_info' (24) gc_mark: Marking object of class 'log_endpoint_info' (24) gc_mark: Marking object of class 'log_connection' (24) gc_mark: Marking object of class 'log_endpoint_info' (25) gc_mark: Marking object of class 'log_endpoint_info' (26) gc_mark: Marking object of class 'log_endpoint_info' (25) gc_mark: Marking object of class 'log_endpoint_info' (25) gc_mark: Marking object of class 'UNKNOWN' (1) Objects alive: 169, garbage collected: 0 Any help appreciated, -jack --- Nate Campi <nate(a)campin.net> wrote: > On Wed, Mar 09, 2005 at 01:43:55AM -0800, jack alex > wrote: > > > > I am trying to configure syslog-ng package for > > managing logs, but there is some where something > wrong > > in my configuration such that it is not > generatinglogs > > > > below file is quite long > > <SNIP> > > > Any guess , why it is not managing log, no new > logs > > have been added to log directory, as > > /var/log/messages doens't contains any new message > > after i configured syslog-ng but if i will restart > my > > syslog(the default that comes with redhat) it will > > start adding new logs to /var/log/messages. . > ...... > > Your config file is syntactically correct (syslog-ng > -s), and I don't > see anything wrong at a glance. I suppose I'd make > sure it's running (as > root since /var/log has strict file perms by > default). Maybe there's > some problem making it exit, so keep it in the > foreground in debugging > when you start it and see what you get: > > # syslog-ng -d -v > > -- > Nate > > ". . . a classic - something that everybody wants to > have read and > nobody wants to read." - speech (1900) - Samuel > Clemens > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

1 0

logs are not generated and managed by syslog-ng but it is started properly
by jack alex 09 Mar '05

09 Mar '05

Dear All, I am trying to configure syslog-ng package for managing logs, but there is some where something wrong in my configuration such that it is not generatinglogs below file is quite long #vi /usr/local/etc/syslog-ng/syslog-ng.conf code: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_fqdn (yes); create_dirs (no); chain_hostnames(no); keep_hostname (yes); perm(0644); dir_perm(0755); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source s_udp { udp(); }; source kernel_file { file("/proc/kmsg"); }; destination d_cons { file("/dev/console"); }; destination d_spol { file("/var/log/spooler.log"); }; destination d_mesg { file("/var/log/messages.log"); }; destination d_auth { file("/var/log/secure.log"); }; destination d_uucp { file("/var/log/uucp.log"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_mlal { usertty("*"); }; destination d_kern { file("/var/log/kernel.log"); }; destination numetrace { file("/var/log/numetrace.log"); }; destination nume { file("/var/log/nume.log"); }; destination postgres { file("/var/log/postgres.log"); }; destination php { file("/var/log/local2.log"); }; destination boot { file("/var/log/boot.log"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination ftp { file("/var/log/ftp.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination mail { file("/var/log/maillog"); }; destination news { file("/var/log/news.log"); }; destination syslog { file("/var/log/syslog.log"); }; destination user { file("/var/log/user.log"); }; destination local3 { file("/var/log/local3.log"); }; destination local4 { file("/var/log/local4.log"); }; destination local5 { file("/var/log/local5.log"); }; destination local6 { file("/var/log/local6.log"); }; destination emerg { file("/var/log/emerg.log"); }; destination crit { file("/var/log/crit.log"); }; destination alert { file("/var/log/alert.log"); }; destination err { file("/var/log/err.log"); }; destination warning { file("/var/log/warning.log"); }; filter cons { facility(kern); }; filter spooler { facility(uucp) or (facility(news) and level(crit)); }; filter mesg { level(info, notice, warning, err, crit, alert, emerg) and facility(kern, uucp, news, local3, local4, local5, local6, daemon, ftp, lpr); }; filter auth { facility(authpriv); }; filter emerg { level(emerg); }; filter uucp { facility(uucp); }; filter cron { facility(cron); }; filter kern_debug { facility(kern); }; filter postgres { facility(local0); }; filter nume_trace { facility(local1); }; filter nume { facility(local1) and level(info, notice, warning, err, crit, alert, emerg); }; filter php { facility(local2); }; filter local3 { facility(local3); }; filter local4 { facility(local4); }; filter local5 { facility(local5); }; filter local6 { facility(local6); }; filter boot { facility(local7); }; filter daemon { facility(daemon); }; filter ftp { facility(ftp); }; filter lpr { facility(lpr); }; filter mail { facility(mail); }; filter news { facility(news); }; filter syslog { facility(syslog); }; filter user { facility(user); }; filter warning { level(warning); }; filter crit { level(crit, alert, emerg); }; filter alert { level(alert, emerg); }; filter err { level(err, crit, alert, emerg); }; log { source(s_sys); source(s_udp); filter(cons); destination(d_cons); }; log { source(s_sys); source(s_udp); filter(mesg); destination(d_mesg); }; log { source(s_sys); source(s_udp); filter(auth); destination(d_auth); }; log { source(s_sys); source(s_udp); filter(emerg); destination(d_mlal); }; log { source(s_sys); source(s_udp); filter(uucp); destination(d_uucp); }; log { source(s_sys); source(s_udp); filter(boot); destination(boot); }; log { source(s_sys); source(s_udp); filter(php); destination(php); }; log { source(s_sys); source(s_udp); filter(postgres); destination(postgres); }; log { source(s_sys); source(s_udp); filter(nume_trace); destination(numetrace); }; log { source(s_sys); source(s_udp); filter(nume); destination(nume); }; log { source(s_sys); source(s_udp); source(kernel_file); filter(kern_debug); destination(d_kern); }; log { source(s_sys); source(s_udp); filter(cron); destination(cron); }; log { source(s_sys); source(s_udp); filter(daemon); destination(daemon); }; log { source(s_sys); source(s_udp); filter(ftp); destination(ftp); }; log { source(s_sys); source(s_udp); filter(lpr); destination(lpr); }; log { source(s_sys); source(s_udp); filter(mail); destination(mail); }; log { source(s_sys); source(s_udp); filter(news); destination(news); }; log { source(s_sys); source(s_udp); filter(syslog); destination(syslog); }; log { source(s_sys); source(s_udp); filter(user); destination(user); }; log { source(s_sys); source(s_udp); filter(local3); destination(local3); }; log { source(s_sys); source(s_udp); filter(local4); destination(local4); }; log { source(s_sys); source(s_udp); filter(local5); destination(local5); }; log { source(s_sys); source(s_udp); filter(local6); destination(local6); }; log { source(s_sys); source(s_udp); filter(spooler); destination(d_spol); }; log { source(s_sys); source(s_udp); filter(emerg); destination(emerg); }; log { source(s_sys); source(s_udp); filter(crit); destination(crit); }; log { source(s_sys); source(s_udp); filter(alert); destination(alert); }; log { source(s_sys); source(s_udp); filter(err); destination(err); }; log { source(s_sys); source(s_udp); filter(warning); destination(warning); }; filter ext_filter { level(warning) or level(err) or level(alert) or level(crit) or level(emerg) or facility(authpriv); }; log { source(s_sys); source(s_udp); source(kernel_file); filter(ext_filter); }; Any guess , why it is not managing log, no new logs have been added to log directory, as /var/log/messages doens't contains any new message after i configured syslog-ng but if i will restart my syslog(the default that comes with redhat) it will start adding new logs to /var/log/messages. . ...... -jack __________________________________ Celebrate Yahoo!'s 10th Birthday! Yahoo! Netrospective: 100 Moments of the Web http://birthday.yahoo.com/netrospective/

2 1

[Fwd: RE: [syslog-ng]Syslog-NG 1.6.6 memory leak when sending UDP logs]
by Balazs Scheidler 08 Mar '05

08 Mar '05

Hi, Some more information about the memory leak. The last fix seems to have fixed for others. Thanks for the report Bryan. So as it seems the spoof related memory leak seems to have been fixed by my last patch. Henry's problem seems to be related but a different bug either in syslog-ng or in libnet. -------- Forwarded Message -------- > From: Ignatow, Bryan <Bryan.Ignatow(a)acs-inc.com> > To: Balazs Scheidler <bazsi(a)balabit.hu> > Subject: RE: [syslog-ng]Syslog-NG 1.6.6 memory leak when sending UDP > logs > Date: Fri, 4 Mar 2005 11:57:46 -0600 > > > A private reply - my home e-mail address is subscribed, not my work. > Feel free to forward to the list. > > We use syslog-ng on some very busy Syslog servers. About 1M logs a > day on average on the largest one. We UDP forward with spoofing over > 300K of those messages a day on average. > > We have been seeing memory problems since we first implemented 1.6.4, > and I recently upgraded to 1.6.6. and libol 0.3.15 (from 0.3.13) and > have been using libnet 1.1.2.1. We compile from source. The system > is a Fedora Core 1 reasonably fully patched, running > 2.4.22-1.2199.nptlsmp on a dual HyperThreaded P4 3GHz with 2 GB of > memory. Well... I am not sure if they were memory leaks, but the > process would keel over when it reached about 3GB of virtual (2GB > resident) in size. Restarting the process would clear the memory > problem. > > I decided since the upgrade to 1.6.6 didn't fix it, I would subscribe > to the mailing list and see what was out there (a shocking concept I > know... but I am a maverick). That is where I ran across this thread. > > I saw the note in the archive from Feb 28th with the patch to afinet.c > adding the "ol_string_free(msg_line);" line I gave this a shot and it > has really helped. We are holding steady at: > > PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU > COMMAND > 4316 root 15 0 1220 1216 756 S 0.0 0.0 5:33 0 > syslog-ng > > We started somewhere around 1023K resident and have not moved up > hardly at all in the 4 days since we put this code in place. Before > we were moving up 8K every 2 seconds. > > Hope this helps, > > Bryan > > > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs > Scheidler > Sent: Friday, March 04, 2005 11:20 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Syslog-NG 1.6.6 memory leak when sending UDP > logs -- Bazsi

2 1