- syslog-ng - lists.balabit.hu

UNSUBSCRIBE.
by Virgil 06 Dec '04

06 Dec '04

1 0

FYI: Performance
by Jay Guerette 03 Dec '04

03 Dec '04

( I hope I don't offend anyone with an attachment, it's only 8k. ) My largest single-server syslog-ng implementation currently handles over 13M lines per day, totalling about 1.8Gb per day. I've only recently been able to gather this data by creating a process to count incoming lines, sum their lengths, and report via syslog at 1 minute intervals. See attached graph ( if the attachment survived ). I added this configuration before all other entries to make sure it sees everything: <syslog-ng.conf> destination syslog-perf { program(syslog-perf); }; log { source(syslog); destination(syslog-perf); }; </syslog-ng.conf> I originally tried this in Perl, then Bash, but neither could keep up with the incoming messages. This works like a champ. It compiles on Linux. The output format is specific to my syslog-to-rrd implementation, but you get the idea. It is suitable for an installation that is assured of at least 1 message for each reporting interval! <syslog-perf.c> #include <stdio.h> #include <time.h> #include <syslog.h> #define BUFFER_SIZE 8192 #define REPORT_INTERVAL 60 void main(void) { char buf[BUFFER_SIZE]; long count, bytes; time_t lastupdate; lastupdate = time(NULL); while (fgets(buf, BUFFER_SIZE, stdin)) { count++; bytes += (strlen(buf) - 1); if (time(NULL) > (lastupdate + REPORT_INTERVAL)) { openlog("127.0.0.1", LOG_NDELAY, LOG_LOCAL3); syslog(LOG_INFO, "Syslog-ng\\Lines=%d Syslog-ng\\Bytes=%d", count, bytes); closelog(); lastupdate += REPORT_INTERVAL; count = 0; bytes = 0; } } } </syslog-perf.c>

7 12

Separator for $MSGONLY
by Thomas Lohschmidt 03 Dec '04

03 Dec '04

Hi folks, I've got a small feature request regarding the $MSGONLY macro. I've noticed there is a colon ':' hard coded in macros.c as separator between preamble and the message content. I would like to have this character configurable. We use a lot of solaris boxes sending messages using the logger command and it puts some additional information in brackets in front of the message which I don't want to see in my logfiles. So I hardcoded the closing bracket ']' into macros.c as a workaroung to achieve the desired result. It would be nice to have a parameter in the config file, say "msgonly_sep" or something like that, so I don't have to patch new releases of syslog-ng. Regards Thomas Der Inhalt dieser E-Mail ist vertraulich. Falls Sie nicht der angegebene Empfänger sind oder falls diese E-Mail irrtümlich an Sie adressiert wurde, verständigen Sie bitte den Absender sofort und löschen Sie die E-Mail sodann. Das unerlaubte Kopieren sowie die unbefugte Übermittlung sind nicht gestattet. Die Sicherheit von Übermittlungen per E-Mail kann nicht garantiert werden. Falls Sie eine Bestätigung wünschen, fordern Sie bitte den Inhalt der E-Mail als Hardcopy an. The contents of this e-mail are confidential. If you are not the named addressee or if this transmission has been addressed to you in error, please notify the sender immediately and then delete this e-mail. Any unauthorized copying and transmission is forbidden. E-Mail transmission cannot be guaranteed to be secure. If verification is required, please request a hard copy version.

2 1

stripping domain name
by ravi pina 03 Dec '04

03 Dec '04

does a combination of options exist to have the HOST macro return the hostname up to but not including the domain name? for example i have host.site.domain.com and with fqdn(yes) i get that where if fqdn(no) i just get 'host' -r

1 0

RE: [syslog-ng]Syslog-ng log file rollover question
by Xiaodong Lin 02 Dec '04

02 Dec '04

Thanks, Bazsi! R_versions of the macros work. Xiaodong -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, December 02, 2004 4:44 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Syslog-ng log file rollover question On Wed, 2004-12-01 at 21:55, Xiaodong Lin wrote: > Hi all, > > I am wondering whether anyone here knows how to config syslog-ng to > perform log file rollover. I was told that I can roll over a log file > in syslog-ng by configuring syslog-ng in a format which includes time > related macroes, such as $MONTH, $DAY, $HOUR, $MIN. For example > > destination snort { file("/var/snort/snort-$MONTH$DAY$HOUR$MIN"); }; > > In this case, the log file should roll over to a new file every 1 > minute. However, I found it doesn't work and syslog-ng keeps appending > its received syslog message into a log file, for example > snort-08091208. > > Does anyone know how to do it or figure out what I have done wrong? Or > does syslog-ng support the log file rollover? it should work, however the macros referenced above use the timestamp found in the log message itself, thus if there is a timestamp with invalid stamp you might see messages appearing in wrong files. You might want to check out the S_ and R_ versions of the macros above. (one refers to the timestamp of the message, the other the time the message was received by syslog-ng) -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Syslog-ng log file rollover question
by Xiaodong Lin 02 Dec '04

02 Dec '04

Hi all, I am wondering whether anyone here knows how to config syslog-ng to perform log file rollover. I was told that I can roll over a log file in syslog-ng by configuring syslog-ng in a format which includes time related macroes, such as $MONTH, $DAY, $HOUR, $MIN. For example destination snort { file("/var/snort/snort-$MONTH$DAY$HOUR$MIN"); }; In this case, the log file should roll over to a new file every 1 minute. However, I found it doesn't work and syslog-ng keeps appending its received syslog message into a log file, for example snort-08091208. Does anyone know how to do it or figure out what I have done wrong? Or does syslog-ng support the log file rollover? Thanks! Xiaodong

3 2

RES: [syslog-ng]php-syslog-ng
by Eduardo Oliveira Scricco (Service) 30 Nov '04

30 Nov '04

> why dont you use the latest version ? When I tried to install syslog-ng-1.6.2-1 (the lastest compiled version I've found for Suse), I had this error: error: failed dependencies: libc.so.6(GLIBC_2.3) is needed by syslog-ng-1.6.2-1 So, I tri to upgrade glibc, but... error: failed dependencies: glibc = 2.2.5 is needed by lsb-runtime-1.2-37 glibc = 2.2.5 is needed by glibc-devel-2.2.5-213 glibc = 2.2.5 is needed by glibc-locale-2.2.5-213 libdb.so.2 is needed by db-utils-4.0.14-194 libdb.so.2 is needed by gnome-libs-1.4.1.7-134 libdb.so.2 is needed by gdk-pixbuf-0.18.0-108 libdb.so.2 is needed by xchat-1.8.10-59 libdb.so.2 is needed by eel-1.0.2-509 libdb.so.2 is needed by gnome-print-0.36-210 libdb.so.2 is needed by libglade-0.16-835 libdb.so.2 is needed by medusa-0.5.1-644 libdb.so.2 is needed by rpm-3.0.6-418 libdb.so.2 is needed by bonobo-1.0.20-221 libdb.so.2 is needed by bonobo-conf-0.14-505 libdb.so.2 is needed by susewm-3.6.0-159 libdb.so.2 is needed by kdebase3-SLES-8-73 libdb.so.2(GLIBC_2.0) is needed by db-utils-4.0.14-194 libdb.so.2(GLIBC_2.0) is needed by gnome-libs-1.4.1.7-134 libdb.so.2(GLIBC_2.0) is needed by rpm-3.0.6-418 libdb.so.2(GLIBC_2.0) is needed by susewm-3.6.0-159 As I don't want to upgrade all these items, I prefeer not to install it. > > * app-admin/syslog-ng > Latest version available: 1.6.5-r1 > Latest version installed: 1.6.5-r1 > Size of downloaded files: 387 kB > Homepage: http://www.balabit.com/products/syslog_ng/ > Description: syslog replacement with advanced filtering features > License: GPL-2 > > i got php-syslog-ng working perfectly, i even hacked it to my > needs.. its great. > > Petre Daniel > System & Network Administrator > Romania Data Systems Pitesti > http://www.rdspt.ro > Phone: +40-348-400401

2 1

php-syslog-ng
by Eduardo Oliveira Scricco (Service) 30 Nov '04

30 Nov '04

Hi all, Using syslog-ng 1.4.14 at Suse Linux 8.1 I'm trying to run php-syslog-ng (a syslog webviewer), but it does not work. For it works, is needed to log to a database, as MySQL. PHP-Syslog-ng website have on step-by-step script, that I used. When I try to run syslog-ng, it complains about this line (in syslog-ng.conf is at one line): destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; I believe this "template" isn't supported in this syslog version. Is that true? The problem is I couldn't upgrade it to version 1.5 or higher, because of libs dependencies... Have one of you logged to mySQL using syslog-ng 1.4.14? Thanks a lot, Eddie

2 1

syslog-ng chrooted vs timezone
by Horvath Gabor Kalman 30 Nov '04

30 Nov '04

Hi! I have a problem with syslog-ng running in chroot: Nov 17 15:45:02 burp /USR/SBIN/CRON[26238]: ... Nov 17 14:47:42 burp syslog-ng[16074]: syslog-ng version 1.6.4 going down Nov 17 14:47:47 burp syslog-ng[26331]: syslog-ng version 1.6.4 starting Nov 17 14:47:47 burp syslog-ng[26331]: io.c: do_read: read() failed (errno 1), Operation not permitted Nov 17 14:48:27 burp syslog-ng[26331]: syslog-ng version 1.6.4 going down It seems that all messages that are generated internally within syslog-ng are logged with false timstamps. The system is debian testing. I am testing syslog-ng in chroot before deploying it on our production syslog server. :) Good thing I did this test. The second start in the log snippet was done by hand. Not from the init script. I am also interested to know what that io.c message is. It does not seem to affect syslog-ng. I had another problem: when logrotate rotated the logs the sent a reload to the chrooted syslog-ng process, it kept the syslog open. So after that was deleted it kept happily logging there not into the newly created file. I works just fine if I send restart instead of reload. Thanks in advance. g.

2 5

compiling error syslog-ng 1.6.5
by Lopez Fernandez, Jose 30 Nov '04

30 Nov '04

Hi, I`m compiling syslog-NG 1.6.5 but i get this error: configure:2159: gcc --version </dev/null >&5 gcc (GCC) 3.4.2 Copyright (C) 2004 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. configure:2162: $? = 0 configure:2164: gcc -v </dev/null >&5 Reading specs from /usr/local/lib/gcc/sparc-sun-solaris2.8/3.4.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.4.2 configure:2167: $? = 0 configure:2169: gcc -V </dev/null >&5 gcc: `-V' option must have argument configure:2172: $? = 1 configure:2195: checking for C compiler default output file name configure:2198: gcc conftest.c >&5 ld: fatal: file values-Xa.o: open failed: No such file or directory ld: fatal: File processing errors. No output written to a.out collect2: ld returned 1 exit status configure:2201: $? = 1 ideas? help? :-) Greetings, Jose Lopez Dieses Dokument ist vertraulich und ausschliesslich fuer den Adressaten bestimmt. Falls Sie diese E-Mail versehentlich bekommen haben, informieren Sie uns bitte unverzueglich und loeschen Sie diese Nachricht von Ihrem Computer. Jegliche Art von Reproduktion, Verbreitung, Vervielfaeltigung, Modifikation, Verteilung und/oder Publikation dieser E-Mail Nachricht ist untersagt. Die in dieser E-Mail enthaltenen Angaben und Erklaerungen sind unverbindlich. Haftungsansprueche des Empfaengers jeglicher Art werden ausgeschlossen. Die GZS schliesst ausser fuer den Fall von Vorsatz oder grober Fahrlaessigkeit die Haftung fuer jeglichen Verlust oder Schaeden durch virenbefallene Software oder E-Mails aus. ----------------------------------------------------------------------------------------------------------- This message contains confidential information and is intended only for the named individual. If you are not the named addressee, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this message in error and delete this e-message from your system. No reliance may be placed on this message without written confirmation of its contents from an authorized representative. GZS accepts no liability for loss or damage caused by software viruses except in case of gross negligence or willful behaviour.

1 0