- syslog-ng - lists.balabit.hu

Syslog-ng/libol: broken snapshots creation
by José Pedro Oliveira 29 Dec '04

29 Dec '04

Hi, The last syslog-ng (and libol) snapshot listed in the http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/ is from 2004-12-06. Could someone correct the problem and, maybe, delete libol-0.3.13 and syslog-ng-1.6.4 snapshots? Thanks in advance, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

1 0

RE: [syslog-ng]Problem with TCP connection not timing out
by ARGEXT-HIDALGO, FRANCISCO 28 Dec '04

28 Dec '04

Thanks for the response, I'll test it now, but the documentation says that this is the default behaviour, so I'm not sure if this will change anything. On the other hand, shouldn't the OS drop these connections?, some of them have days there, and this monday, there where almost 40 dead connections that where "ESTABLISHED". -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of Balazs Scheidler Sent: Lunes, 27 de Diciembre de 2004 05:58 p.m. To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Problem with TCP connection not timing out On Wed, 2004-12-22 at 17:16 -0300, ARGEXT-HIDALGO, FRANCISCO wrote: > I'm really not sure what the problem is, I'm logging with a server in different countries and they send through TCP the logs to a central server. The problem I'm having is that the central server is not dropping TCP connections that no longer exist. > As an example: > > CENTRAL SERVER: > TCP > Local Address Remote Address Swind Send-Q Rwind Recv-Q State > -------------------- -------------------- ----- ------ ----- ------ ------- > CENTRAL.shell syslogA.33969 5840 0 10136 0 ESTABLISHED > CENTRAL.shell syslogB.4930 5840 0 10136 0 ESTABLISHED > CENTRAL.shell syslogC.33924 24820 0 8760 0 ESTABLISHED > CENTRAL.shell syslogC.33925 24820 0 8760 0 ESTABLISHED > CENTRAL.shell syslogD.44925 5840 0 10136 0 ESTABLISHED > CENTRAL.shell syslogE.32783 24820 0 8760 0 ESTABLISHED > CENTRAL.shell syslogC.33926 24820 0 8760 0 ESTABLISHED > CENTRAL.22 host.1624 51968 0 10136 0 ESTABLISHED > CENTRAL.shell syslogD.44934 5840 0 10136 0 ESTABLISHED > > SYSLOGC: > TCP: IPv4 > Local Address Remote Address Swind Send-Q Rwind Recv-Q State > -------------------- -------------------- ----- ------ ----- ------ ------- > syslogC.33926 CENTRAL.shell 8760 0 24820 0 ESTABLISHED > SyslogC.22 host.4663 57920 0 24616 0 ESTABLISHED > > > Notice that the active conection is the one from SyslogC port 33926, but CentralSyslog has 3 established connections (33924, 33925 and 33926), 33924 is active since some days ago, but doesn't exist in the original server. The problem is that my total connections allowed start to fill up and then I can no longer connect. > Any ideas on what could this be? Maybe there were some network outages and the connection on the client timed out, but as there are no packets for established connections without traffic this connection remained in the server's connection table. A possible solution is to enable TCP keep-alive, which periodically sends probes for established connections, and reports an error if the peer does not react to a probe, you can enable this by setting tcp-keep-alive option to yes, for example: source s_tcp { tcp(port(2000) tcp-keep-alive(yes)); }; -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

STATS: dropped 644 ?
by Matthias Keller 28 Dec '04

28 Dec '04

Hi I'm using syslog-ng for quite a while now and finally want to resolve this problem (I suppose)... I pretty much daily get a whole bunch of dropped messages... It's not always at the same times but always for several hours! I'm logging the stats hourly so usually for about 8h a day I get drops in the hundreds....? I guess this isn't normal and shouldn't be as my system isn't really busy at all... As options I'm using: options { long_hostnames(off); sync(5); # How many lines have to be queued until a disc synch is done. use 0 for immediate stats(3600); log_fifo_size(8192); log_msg_size(1024); time_reopen(10); }; Since there are a lot of apps running on the system I dont go for a 'Application X gets localZ' approach but instead I'm filtering by application name One example entry would be: filter f_dhcpd { program("dhcpd"); }; destination dhcpd { file("/var/log/dhcpd.log"); }; log { source(src); filter(f_dhcpd); destination(dhcpd); flags(final); }; I dont know if that flags(final) does some harm as I haven't seen that much in the wild but I dont want any further rule care about dhcpd-logs so I want to stop matched entries there... I have about 10 such entries... I also have a catchall in the end: destination other { file("/var/log/other"); }; log { source(src); destination(other); }; which doesn't really catch anything at all because the messages before already catches pretty much everything I can give you the whole config if you like So I'm hoping you could give me some good advices on how to track down my problem? Thanks!! Matt

2 2

can't figure out how to convert syslog.conf entry to syslog-ng
by Philip J. Hollenback 28 Dec '04

28 Dec '04

I have the following syslog.conf entry on my linux server: *.info;mail.none;mail.err;authpriv.none;auth.none;auth.warning;cron.none;cron.warning;local0.none /var/log/messages The syslog2ng script converts it to this: destination d_mesg { file("/var/log/messages"); }; filter f_1 { level(info..emerg); }; filter f_2 { not facility(mail); }; filter f_3 { facility(mail) and level(err..emerg); }; filter f_4 { not facility(authpriv); }; filter f_5 { not facility(auth); }; filter f_6 { facility(auth) and level(warning..emerg); }; filter f_7 { not facility(cron); }; filter f_8 { facility(cron) and level(warning..emerg); }; filter f_9 { not facility(local0); }; log { source(local); filter(f_1); filter(f_2); filter(f_3); filter(f_4); filter(f_5); filter(f_6); filter(f_7); filter(f_8); filter(f_9); destination(d_mesg); }; Problem: this doesn't work; the above syslog-ng.conf entry doesn't send any messages to /var/log/messages. I know syslog-ng is working because other entries in the config file do catch messages as they should. I've narrowed it down to something with the compound filter statements. If I remove f_3, f_6, and f_8, the entry starts working. Works correctly on regular syslog. syslog-ng version 1.6.5. Thanks, P. -- Philip J. Hollenback Telemetry Investments phollenback(a)telemetry-investments.com

3 3

reading debug output
by Nate Campi 28 Dec '04

28 Dec '04

I have syslog-ng (1.6.4) running as "syslog-ng -d -v" and I happen to know that messages are buffering up, because I defined a TCP endpoint where there's nothing listening. I can't tell from the debug output what the buffer looks like (how full it is), is it possible to tell or is there no way to know? Well, no way except failed connection messages on internal() and the eventual STATS messages telling of dropped messages of course. TIA -- Nate "A computer will do what you tell it to do, but that may be much different from what you had in mind." - JOSEPH WEIZENBAUM, quoted in Time

1 0

typo? changelog
by Pavel Urban 27 Dec '04

27 Dec '04

Hello, I've tried to rebuild our local RPM for syslog-ng and was somewhat confused by 1.6.5 ChangeLog claiming that the required libol version is 0.3.15. It seems to me that it should be 0.3.14, am I right? Or am I wrong as usual? ;-) -- *********************************************************************** Pavel Urban (pavel.urban(a)imaginet.cz) IOL system disaster Internet OnLine, owned by Cesky Telecom, a.s. (www.ct.cz) *********************************************************************** Vegetables should not operate electronic equipment. Computer Stupidities, http://rinkworks.com/stupid/ ***********************************************************************

2 1

Problem with TCP connection not timing out
by ARGEXT-HIDALGO, FRANCISCO 27 Dec '04

27 Dec '04

I'm really not sure what the problem is, I'm logging with a server in different countries and they send through TCP the logs to a central server. The problem I'm having is that the central server is not dropping TCP connections that no longer exist. As an example: CENTRAL SERVER: TCP Local Address Remote Address Swind Send-Q Rwind Recv-Q State -------------------- -------------------- ----- ------ ----- ------ ------- CENTRAL.shell syslogA.33969 5840 0 10136 0 ESTABLISHED CENTRAL.shell syslogB.4930 5840 0 10136 0 ESTABLISHED CENTRAL.shell syslogC.33924 24820 0 8760 0 ESTABLISHED CENTRAL.shell syslogC.33925 24820 0 8760 0 ESTABLISHED CENTRAL.shell syslogD.44925 5840 0 10136 0 ESTABLISHED CENTRAL.shell syslogE.32783 24820 0 8760 0 ESTABLISHED CENTRAL.shell syslogC.33926 24820 0 8760 0 ESTABLISHED CENTRAL.22 host.1624 51968 0 10136 0 ESTABLISHED CENTRAL.shell syslogD.44934 5840 0 10136 0 ESTABLISHED SYSLOGC: TCP: IPv4 Local Address Remote Address Swind Send-Q Rwind Recv-Q State -------------------- -------------------- ----- ------ ----- ------ ------- syslogC.33926 CENTRAL.shell 8760 0 24820 0 ESTABLISHED SyslogC.22 host.4663 57920 0 24616 0 ESTABLISHED Notice that the active conection is the one from SyslogC port 33926, but CentralSyslog has 3 established connections (33924, 33925 and 33926), 33924 is active since some days ago, but doesn't exist in the original server. The problem is that my total connections allowed start to fill up and then I can no longer connect. Any ideas on what could this be? Thank you.

2 1

syslog2ng not working on Solaris10
by Majumdar, Anamitra 23 Dec '04

23 Dec '04

Hello, I need to convert some existing syslog.conf files to the syslog-ng configuration. There is an utility syslog2ng which is packaged with syslog-ng. But does not work on solaris 10. I am having the folowing error ./syslog2ng <syslog.conf> syslog-ng.conf ./syslog2ng: BEGIN: not found ./syslog2ng: getline: not found ./syslog2ng: syntax error at line 9: `close' unexpected Anamitra X4696

3 2

RE: [syslog-ng]syslog2ng not working on Solaris10
by Stew Redfield 23 Dec '04

23 Dec '04

on Solaris10 (s10_63 at least) /usr/bin/awk || /usr/bin/nawk Usually that error means a missing ' in the script or sourced in config. Happy non-religious merry generic holiday greetings... -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Ed Ravin Sent: Wednesday, December 22, 2004 9:46 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog2ng not working on Solaris10 On Wed, Dec 22, 2004 at 05:40:31PM -0800, Majumdar, Anamitra wrote: > There is an utility syslog2ng which is packaged with syslog-ng. > But does not work on solaris 10. > > I am having the folowing error > > ./syslog2ng <syslog.conf> syslog-ng.conf > ./syslog2ng: BEGIN: not found > ./syslog2ng: getline: not found > ./syslog2ng: syntax error at line 9: `close' unexpected Look at the first few lines of syslog2ng: #!/usr/bin/awk -f # # syslog2ng # # Translator from syslog.conf to syslog-ng.conf # by Jonathan W. Marks <j-marks(a)uiuc.edu> You probably don't have /usr/bin/awk - maybe Sun keeps it in /bin, /usr/ucb, or some other directory? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]pipe destination and HPUX
by Stephan Hendl 21 Dec '04

21 Dec '04

I've tried that out but it doesn't help me. The messages from the "syslog-clients" arrive perectly and are written into the cic.log-file but _not_ into the pipe ;-((( Stephan >>> brett.stevens(a)hubbub.com.au 12/21/04 12:02 >>> Looking at your config you seem to have specified a ip and prot for your tcp. Just try it without such as source s_tcp{();}; This is what I use to log approximately 80-100 devices to two servers (number varies as this is a development site with large amounts of vmware servers. Best of luck Brett Stevens -----Original Message----- From: Stephan Hendl [mailto:Stephan.Hendl@lds.brandenburg.de] Sent: Monday, December 20, 2004 6:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]pipe destination and HPUX Hi all, I try to get syslog messages via tcp and want to write them into a pipe with HPUX 11.11v1 and syslog-ng-1.6.5. The messages arrive perfectly (I conttrolled this via writing in a file) but the pipe is still empty. Only messages from local sources get into it. Does anybody have an idea? Ciao Stephan # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; source s_tcp { tcp(ip(10.128.8.173) port(10514) keep-alive(no)); }; destination d_cic.log { file("/var/adm/syslog/cic.$YEAR$MONTH$DAY" owner("root") group("sys") perm(0644) template( "$DATE $HOST $MESSAGE\n") template-escape(yes)); }; destination d_cic.pipe { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template( "$DATE $HOST $MESSA GE\n") template-escape(yes)); }; log { source(s_sys); destination(d_cic.log); }; log { source(s_tcp); destination(d_cic.log); }; log { source(s_sys); destination(d_cic.pipe); }; log { source(s_tcp); destination(d_cic.pipe); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0