- syslog-ng - lists.balabit.hu

tcp destination unavailable ... what happens ?
by Ali EL MOUSSAWI 11 Oct '04

11 Oct '04

Hi all, Could you please tell me what can happen if the destination tcp driver is unavailable ? I made the test with a wrong IP address in destination on my machine running syslog-ng, my software generates messages every minutes, and these messages are redirected to the destination tcp driver. The only think I saw is that in /var/adm/messages logs, the following message was repeated every 4 minutes or so ... Oct 11 10:26:39 met-ixb syslog-ng[216]: Error connecting to remote host AF_INET(192.168.192.168:514), reattempting in 10 seconds Is there any risk for my machine if the destination tcp driver is no longer available ? Will there be any buffer over size or something like that ? Or ressources over load ? Thanks a lot Ali

1 0

Re: [syslog-ng]syslog-ng loses messages
by Aaron watkins 07 Oct '04

07 Oct '04

Dave, > * What are the numbers of lines that get dropped in each of those tests? If I kill (-TERM or -9) the receiving server while messages are not being written to the input pipe, I will lose message 0 and message 1. When I kill -TERM while writing to the input pipe: Test 1: Messages 27->34 are lost (8 in total) Test 2: Messages 24->31 are lost (8 in total) When I kill -9 while writing to the input pipe: Test 1: Messages 35->38 are lost (4 in total) Test 2: Messages 23->29 are lost (7 in total) > * What happens in your test if you change machine2 fifo's to 0? I presume you mean the log_fifo_size option... When I set this to 0, the following messages got through: Iteration 1: Message 0,1,14,28 Iteration 2: Message 0,1,12,21,32 Iteration 3: Message 0,1,12,21,30,39 That is to say, in every iteration, around 37 messages were lost. And this was with the system operating normally (ie. without killing the machine2's syslog-ng). Any ideas? Thanks, Aaron > > On Fri, 1 Oct 2004 12:38:56 +0100, Aaron watkins > <aaron.j.watkins(a)gmail.com> wrote: > > Hi there, > > > > I have been doing some stress testing of syslog-ng as a possible > > facilitator of event messaging for use on our network. I have set up a > > system as below: > > > > Event Process > > | > > \_/ > > FIFO/pipe > > | > > _____\_/_______ > > [ ] > > [ Machine 1 ] > > [ running ] > > [ syslog-ng ] > > [______________] > > | > > \_/ > > TCP socket > > | > > _____\_/_______ > > [ ] > > [ Machine 2 ] > > [ running ] > > [ syslog-ng ] > > [______________] > > | > > \_/ > > FIFO/pipe > > | > > \_/ > > cat > > > > Or to describe it, I have a process writing to a pipe on Machine 1, > > which syslog-ng then forwards via a socket to syslog-ng running on > > Machine 2, which then outputs to another pipe, which I am catting. > > > > My event process is in a while(true) loop, simply writing a number of > > messages to the pipe and then sleeping for 1 second. > > > > The problem I have discovered is that if I kill (-TERM or -9) > > syslog-ng running on Machine 2, some messages are lost before it > > starts buffering them in Machine 1. If I kill it while my event > > process is sleeping and then restart it, the first two messages (once > > the event process restarts transmitting) will be lost. Alternatively, > > if I kill it while my event process is writing data (and syslog-ng on > > Machine 1 is transmitting over the socket), normally about five > > messages will be lost. > > > > Is this a recognised problem and is there a way to work around this? > > Obviously, I would like to be able to get all of my messages through > > (up to the buffer limit) without having to reprocess the messages from > > the local event copy file. > > > > I am running this system on Solaris 5.8. > > > > The code for my event process is: > > > > #!/bin/sh > > while [ 1 ] > > do > > count=0 > > while [ $count -le 40 ] > > do > > echo "${count}: Hello World" >> event_pipe > > count=`expr ${count} + 1` > > done > > sleep 1 > > done > > > > My Machine 1 config file: > > > > options { > > sync(0); # Sends message as soon as it's received > > time_reopen(10); # Wait 10 before reopening closed connections > > log_fifo_size(500); # The number of messages that can go in the output queue > > create_dirs(yes); # Whether to create destination directories, if required > > }; > > > > source src_internalEvents { > > internal(); > > }; > > > > source src_InputPipe { > > pipe( "/tmp/event_pipe" ); > > }; > > > > destination dst_localLog { > > file( "/data/gen/log/nievent_all.log" > > template("$YEAR-$MONTH-$DAY--$HOUR:$MIN:$SEC ($HOST:$PROGRAM): > > $MSG\n" )); }; > > > > destination dst_localEventCopy { > > file( "/data/gen/log/nievent_copy.log" > > template("$MSG\n") ); > > }; > > > > destination dst_OutputSocket { > > tcp( "imgwrkfl-inp" port(1515) ); > > }; > > > > log { > > source( src_InputPipe ); > > destination( dst_localLog ); > > destination( dst_localEventCopy ); > > destination( dst_OutputSocket ); > > }; > > > > log { > > source( src_internalEvents ); > > source( src_InputPipe ); > > destination( dst_localLog ); > > flags( fallback ); > > }; > > > > For Machine 2: > > > > options { > > sync(0); # Sends message as soon as it's received > > time_reopen(10); # Wait 10 before reopening closed connections > > log_fifo_size(500); # The number of messages that can go in the output queue > > create_dirs(yes); # Whether to create destination directories, if required > > }; > > > > source src_internalEvents { > > internal(); > > }; > > > > source src_InputSocket { > > tcp( port(1515) ); > > }; > > > > destination dst_localLog { > > file( "/data/gen/log/nievent_all.log" > > template( "$YEAR-$MONTH-$DAY--$HOUR:$MIN:$SEC ($HOST:$PROGRAM): $MSG\n" ) ); > > }; > > > > destination dst_localEventCopy { > > file( "/data/gen/log/nievent_copy.log" > > template( "$MSG\n") ); > > }; > > > > destination dst_OutputPipe { > > pipe( "/tmp/prepress/nievents_pipe" > > template( "$MSG\n") ); > > }; > > > > log { > > source( src_InputSocket ); > > destination( dst_localLog ); > > destination( dst_localEventCopy ); > > destination( dst_OutputPipe ); > > }; > > > > log { > > source( src_internalEvents ); > > source( src_InputSocket ); > > destination( dst_localLog ); > > flags( fallback ); > > }; > > > > Thanks in advance for your help. > > > > Aaron Watkins > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > >

2 1

perl syslog::parse problem
by lists＠mhcsoftware.de 07 Oct '04

07 Oct '04

hi, i've switched to syslog-ng and now mailgraph stoped working. i've read that there is a patch requiered for syslog::parse but i can't find it anywhere. can some one please point me to this patch ? TIA matthias -- Matthias Henze matthias(a)mhcsoftware.de Use PGP!! http://www.mhcsoftware.de/MatthiasHenze.asc - - - - - - - - - - - - - - - - - - - - - - - - - - - - MHC SoftWare GmbH voice: +49-(0)9533-92006-0 Fichtera 17 fax: +49-(0)9533-92006-6 96274 Itzgrund/Germany e-Mail: info(a)mhcsoftware.de - - - - - - - - - - - - - - - - - - - - - - - - - - - -

1 0

syslog-ng loses messages
by Aaron watkins 01 Oct '04

01 Oct '04

Hi there, I have been doing some stress testing of syslog-ng as a possible facilitator of event messaging for use on our network. I have set up a system as below: Event Process | \_/ FIFO/pipe | _____\_/_______ [ ] [ Machine 1 ] [ running ] [ syslog-ng ] [______________] | \_/ TCP socket | _____\_/_______ [ ] [ Machine 2 ] [ running ] [ syslog-ng ] [______________] | \_/ FIFO/pipe | \_/ cat Or to describe it, I have a process writing to a pipe on Machine 1, which syslog-ng then forwards via a socket to syslog-ng running on Machine 2, which then outputs to another pipe, which I am catting. My event process is in a while(true) loop, simply writing a number of messages to the pipe and then sleeping for 1 second. The problem I have discovered is that if I kill (-TERM or -9) syslog-ng running on Machine 2, some messages are lost before it starts buffering them in Machine 1. If I kill it while my event process is sleeping and then restart it, the first two messages (once the event process restarts transmitting) will be lost. Alternatively, if I kill it while my event process is writing data (and syslog-ng on Machine 1 is transmitting over the socket), normally about five messages will be lost. Is this a recognised problem and is there a way to work around this? Obviously, I would like to be able to get all of my messages through (up to the buffer limit) without having to reprocess the messages from the local event copy file. I am running this system on Solaris 5.8. The code for my event process is: #!/bin/sh while [ 1 ] do count=0 while [ $count -le 40 ] do echo "${count}: Hello World" >> event_pipe count=`expr ${count} + 1` done sleep 1 done My Machine 1 config file: options { sync(0); # Sends message as soon as it's received time_reopen(10); # Wait 10 before reopening closed connections log_fifo_size(500); # The number of messages that can go in the output queue create_dirs(yes); # Whether to create destination directories, if required }; source src_internalEvents { internal(); }; source src_InputPipe { pipe( "/tmp/event_pipe" ); }; destination dst_localLog { file( "/data/gen/log/nievent_all.log" template("$YEAR-$MONTH-$DAY--$HOUR:$MIN:$SEC ($HOST:$PROGRAM): $MSG\n" )); }; destination dst_localEventCopy { file( "/data/gen/log/nievent_copy.log" template("$MSG\n") ); }; destination dst_OutputSocket { tcp( "imgwrkfl-inp" port(1515) ); }; log { source( src_InputPipe ); destination( dst_localLog ); destination( dst_localEventCopy ); destination( dst_OutputSocket ); }; log { source( src_internalEvents ); source( src_InputPipe ); destination( dst_localLog ); flags( fallback ); }; For Machine 2: options { sync(0); # Sends message as soon as it's received time_reopen(10); # Wait 10 before reopening closed connections log_fifo_size(500); # The number of messages that can go in the output queue create_dirs(yes); # Whether to create destination directories, if required }; source src_internalEvents { internal(); }; source src_InputSocket { tcp( port(1515) ); }; destination dst_localLog { file( "/data/gen/log/nievent_all.log" template( "$YEAR-$MONTH-$DAY--$HOUR:$MIN:$SEC ($HOST:$PROGRAM): $MSG\n" ) ); }; destination dst_localEventCopy { file( "/data/gen/log/nievent_copy.log" template( "$MSG\n") ); }; destination dst_OutputPipe { pipe( "/tmp/prepress/nievents_pipe" template( "$MSG\n") ); }; log { source( src_InputSocket ); destination( dst_localLog ); destination( dst_localEventCopy ); destination( dst_OutputPipe ); }; log { source( src_internalEvents ); source( src_InputSocket ); destination( dst_localLog ); flags( fallback ); }; Thanks in advance for your help. Aaron Watkins

2 1

syslog-ng to MySQL question
by Ron Clark 01 Oct '04

01 Oct '04

Hello all, This may be off topic, but I would be very appreciative of any help. I am using the sqlsyslogd file from http://www.frasunek.com/sources/security/sqlsyslogd/. But when it reads from the logs coming into syslog, on the time stamp field, it adds some text in <> signs, and does not fully capture the time stamp. Does anyone know what these are? And more important, how does one get the script to get fully imput the time stamp in the syslogs? Does anyone have any tricks to the sqlsyslog.c file that might fix this? If this is not the correct forum, then please forward me to the right person or place. Thank you in advance, Ron Clark actual syslog: Sep 30 16:03:05 system1 /kernel: mysql entry: | 15468 | <118>Sep 30 18: | system1 | psmintr |

2 1

/proc/kmsg and chrooted syslog-ng
by Michael D. (Mick) Bauer 01 Oct '04

01 Oct '04

One more ignorance-betraying question about Syslog-ng chroot-jails: what should one do about /proc/kmsg? Maybe "touch /var/logjail/proc/kmsg; ln -s /var/logjail/proc/kmsg /proc/kmsg"? And do I take it that, per another recent posting, one should similarly create a new dev/log in the jail and link to it from /dev/log? I'd like to post a revised Syslog-ng chroot jail procedure later this week. Thanks to the two of you who've replied so far! Mick /-------------------------------------------------\ | Michael D. (Mick) Bauer | | Security Editor, Linux Journal | | Dir. of Value-Subtracted Svcs., Wiremonkeys.org | \-------------------------------------------------/

3 2

syslog-ng to MySQL question
by Ron Clark 01 Oct '04

01 Oct '04

Hello all, This may be off topic, but I would be very appreciative of any help. I am using the sqlsyslogd file from http://www.frasunek.com/sources/security/sqlsyslogd/. But when it reads from the logs coming into syslog, on the time stamp field, it adds some text in <> signs, and does not fully capture the time stamp. Does anyone know what these are? And more important, how does one get the script to get fully imput the time stamp in the syslogs? Does anyone have any tricks to the sqlsyslog.c file that might fix this? If this is not the correct forum, then please forward me to the right person or place. Thank you in advance, Ron Clark actual syslog: Sep 30 16:03:05 system1 /kernel: mysql entry: | 15468 | <118>Sep 30 18: | system1 | psmintr |

1 0

Loghost can't see its own syslogs
by Doug Hanks 01 Oct '04

01 Oct '04

Hello, I have an interesting problem. I have a loghost with the servername of FFLOGSVR. Everything works wonderfully except that FFLOGSVR isn't logging its own logs. When I perform the command "logger FFLOGSVR" I do not see entry in my syslog. I have attached my syslog-ng.conf for review. Thank you in advance, -- - Doug Hanks = dhanks(at)gmail(dot)com # Syslog-ng (new generation) configuration file # syslog.conf by Doug Hanks 9/25/04 # Global options options { time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (no); create_dirs(yes); dns_cache(yes); keep_hostname(yes); }; # Define where the logs come from - udp and /dev/log only source gateway { unix-stream("/dev/log"); internal(); udp(port(514)); }; # Define some filters so we can break down the logs by facility filter f_auth { facility(auth); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; # LogWatch filter f_logwatch { match("su") or match("ssh") or match("sudo"); }; # SU filter f_su_0 { match("su: from [a-zA-Z0-9]+ to") or # AIX match("'su [a-zA-Z0-9]+' succeeded for") or # Solaris match(": su : \+"); # HPUX }; filter f_su_1 { match("su: BAD SU from") or # AIX match("'su [a-zA-Z0-9]+' failed for") or # Solaris match(": su : \-"); # HPUX }; # SSH filter f_ssh_0 { match("Accepted [a-zA-Z0-9]+ for") or # AIX, Solaris, and HPUX match("[a-zA-Z0-9]+ authentication for user [a-zA-Z0-9]+ accepted"); # SAP }; filter f_ssh_1 { match("Failed [a-zA-Z0-9]+ for") or # AIX, Solaris, and HPUX match("[a-zA-Z0-9]+ authentication for user [a-zA-Z0-9]+ failed"); # SAP }; # SUDO filter f_sudo_0 { match("sudo:"); }; filter f_sudo_1 { match("sudo:") and ( match("command not allowed") or match("user NOT in sudoers") ); }; # Define containers where you want to stuff the logs destination localhost { file("/usr/logs/syslog/messages.all"); }; destination loghost { file("/usr/logs/HOSTS/$HOST/messages" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # Program template for alerts destination fifo_alert { program("/usr/local/sbin/email-syslog-alert" template("$HOST:$PROGRAM:$MSG\n") template-escape(yes) ); }; # SU log destination su_0 { file("/usr/logs/syslog/messages.su0"); }; destination su_1 { file("/usr/logs/syslog/messages.su1"); }; # SSH logs destination ssh_0 { file("/usr/logs/syslog/messages.ssh0"); }; destination ssh_1 { file("/usr/logs/syslog/messages.ssh1"); }; # SUDO logs destination sudo_0 { file("/usr/logs/syslog/messages.sudo0"); }; destination sudo_1 { file("/usr/logs/syslog/messages.sudo1"); }; # LogWatch destination logwatch { file("/usr/logs/syslog/logwatch.log"); }; # Regular syslogs destination authlog { file("/usr/logs/syslog/messages.auth"); }; destination cron { file("/usr/logs/syslog/messages.cron"); }; destination daemon { file("/usr/logs/syslog/messages.daemon"); }; destination kern { file("/usr/logs/syslog/messages.kern"); }; destination lpr { file("/usr/logs/syslog/messages.lpr"); }; destination user { file("/usr/logs/syslog/messages.user"); }; destination mail { file("/usr/logs/syslog/messages.mail"); }; destination debug { file("/usr/logs/syslog/messages.debug"); }; destination messages { file("/usr/logs/syslog/messages"); }; destination console { file("/dev/console"); }; # Bring the sources, filters (if any) together and shove it in a log (read destination) log { source(gateway); destination(localhost); }; log { source(gateway); destination(loghost); }; # FIFO alert log { source(gateway); filter(f_su_1); destination(fifo_alert); }; log { source(gateway); filter(f_ssh_1); destination(fifo_alert); }; log { source(gateway); filter(f_sudo_1); destination(fifo_alert); }; # Log SU to roots log { source(gateway); filter(f_su_0); destination(su_0); }; log { source(gateway); filter(f_su_1); destination(su_1); }; # Log SSH stuff log { source(gateway); filter(f_ssh_0); destination(ssh_0); }; log { source(gateway); filter(f_ssh_1); destination(ssh_1); }; # Log SUDO stuff log { source(gateway); filter(f_sudo_0); destination(sudo_0); }; log { source(gateway); filter(f_sudo_1); destination(sudo_1); }; # A master log of SSH, SUDO and SU for LogWatch log { source(gateway); filter(f_logwatch); destination(logwatch); }; # Break down the logs further log { source(gateway); filter(f_auth); destination(authlog); }; log { source(gateway); filter(f_cron); destination(cron); }; log { source(gateway); filter(f_daemon); destination(daemon); }; log { source(gateway); filter(f_kern); destination(kern); }; log { source(gateway); filter(f_mail); destination(mail); }; log { source(gateway); filter(f_user); destination(user); }; log { source(gateway); filter(f_debug); destination(debug); }; log { source(gateway); filter(f_messages); destination(messages); }; log { source(gateway); filter(f_emergency); destination(console); };

2 2

RE: [syslog-ng]Corrupted messages in log
by Dmitri Smirnov 28 Sep '04

28 Sep '04

Thanks a lot, It fixed the problem! Dmitri -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, September 27, 2004 1:30 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Corrupted messages in log Hi, I've found the problem, this is syslog-ng 1.6.3 specific, you should upgrade to at least 1.6.4, or apply the patch in the mailing list archive around 2004 May.

1 0

RE: [syslog-ng]Corrupted messages in log
by Dmitri Smirnov 27 Sep '04

27 Sep '04

An example of corrupted message (one line in syslog file instead of six): Sep 27 02:01:09 loghost local1.err MSWTRS [5572]: [ user.error] Error: 256 Couldn't get W3SVC11/ex040926.log from XXX Sep 27 02:01:11 loghost local1.err MSWTRS [5572]: [ user.error] Error: 256 Couldn't get W3SVC15/ex040926.log from XXX Sep 27 02:01:15 loghost local1.err MSWTRS [5572]: [ user.error] Error: 256 Couldn't get W3SVC20/ex040926.log from XXX Sep 27 02:01:15 loghost local1.err MSWTRS [5572]: [ user.error] Error: 256 Couldn't get W3SVC22/ex040926.log from XXX Sep 27 02:01:30 loghost local1.err MSWTRS [5572]: [ user.error] Error: 256 Couldn't get W3SVC7/ex040926.log from XXX Sep 27 02:02:00 REMOTEHOST/REMOTEHOST user.warning loader: [ID 702911 user.warning] Autoload has been locked for over an hour I just realized that I haven't seen two messages from remote hosts contatenated. It only happens with messages generated on loghost (server where syslog-ng is installed) and messages from remote hosts (sun-stream() plus udp()). Platform is Solaris 8 with 117350-06. Dmitri -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, September 27, 2004 3:24 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Corrupted messages in log On Sun, 2004-09-26 at 23:44, Dmitri Smirnov wrote: > Thanks, Loic, > > some important parts of config, skipping filters: > > # > source local { sun-streams("/dev/log"); internal(); udp(); }; > > options { > use_fqdn(yes); > use_dns(yes); > dns_cache(yes); > keep_hostname(yes); > chain_hostnames(no); > bad_hostname("^5.*"); > sync(0); > stats(0); > log_fifo_size(1024); > log_msg_size(2048); > use_time_recvd(yes); > dns_cache_expire(36000); > dns_cache_expire_failed(3600); > dns_cache_size(10000); > > }; > > > destination syslog { file("/var/log/syslog" owner(root) group(other) > perm(0644) template("$DATE $FULLHOST $FACILITY.$PRIORITY $MESSAGE\n") > template_escape(no)); }; > > log { source(local); filter(filter1_not); filter(filter2_not); > filter(filter3_not); filter(filter4_not); filter(filter5_not); > destination(syslog); }; In what way are messages corrupted? You said they are concatenated, but could you post an example? It would also be important to check which syslog-ng parts are used, e.g. the message path as it is received from the network. (udp source, sun-stream source) It would also be useful to verify whether it was mangled on the syslog-ng host itself, or it was already mangled before. BTW: it is known that certain kernel messages on Linux might get corrupted, because of the kernel ring-buffer overflow, increasing the ring buffer size can be used to mitigate (but not solve) the problem. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1