- syslog-ng - lists.balabit.hu

STATS: dropped N
by bedo.sandor＠ln.matav.hu 23 Sep '04

23 Sep '04

Hi, Could You tell me what is the measure exactly of the number at the end of the "STATS: dropped" log lines? I have really great numbers found... Thanks, bSanyI

3 2

Problems with syslog-ng remote logging on Sun/Linux environment!
by Jörgen Ekstedt 22 Sep '04

22 Sep '04

Hi! I have a loghos that is running RedHat9 and everything work just fine. except for one Sun we have in the network I have configured syslog-ng to include support for Doors and sun-streams,and it logs everything well to its local logfiles. I have configured it to send the logs via tcp to my loghost, but nothing is beeing sent? Anyone got any good hint ? BR Jorgen.E

2 1

Corrupted messages in log
by Dmitri Smirnov 22 Sep '04

22 Sep '04

syslog-ng 1.6.3, Solaris 8 with latest patches. Destination to file using templates, network and local sources, multiple filters. Started to receive multiple syslog messages from different hosts concatenated in one big syslog message .. Can be a result of new filters or increased load on syslog. Did anyone see anything like this? Dmitri

2 1

STATS: dropped 0
by Angelita Soares de Camargos 21 Sep '04

21 Sep '04

Hello everybody. I installed the syslog-ng 1.6.5, storing the logs in mysql 4.0.21 and it seems to be working fine, but sometimes I get this message at the log: "STATS: dropped 0". Reading older messages I understood that some log that did not match any of my filters and was flushed. Well, how can I know what message is it. Below, a part of my syslog-ng.conf: filter f_emerg { level(emerg); }; filter f_kern_info {facility(kern) and not priority(debug); }; filter f_user_info {facility(user) and not priority(debug); }; filter f_mail_info {facility(mail) and not priority(debug); }; filter f_daemon_info {facility(daemon) and not priority(debug); }; filter f_auth_info {facility(auth) and not priority(debug); }; filter f_cron_info {facility(cron) and not priority(debug); }; filter f_err {priority(err..emerg); }; filter f_messages{ not priority(debug); }; thanks in advance, Angel.

2 2

Message retension period
by Jim Mozley 20 Sep '04

20 Sep '04

I have a remote server running syslog-ng collecting messages from network devices that are local to it and transferring them to a central server using TCP. This is to avoid messages being lost when UDP is used a a network problem occurs. All works as it should and I have tested breaking the link between the local collection station and the central server; the messages are passed to the central server when the link is restored. I had a question regarding how long the remote server will hold on to the messages when it cannot pass them to the central server. Is this a time dependent parameter, memory limit or hard coded somewhere? I couldn't find a destination driver configuration parameter for this in the documentation. Jim Mozley

2 9

Problem on Solaris with door?
by jesse.keefe＠convergys.com 19 Sep '04

19 Sep '04

Hello, On Solaris 8 and Solaris 9, I have problems with syslog-ng mysteriously dying because of door problems. This setup has worked well for over a year and is cropping up randomly. The symptom is su - hangs. I can shut syslog-ng down and start syslog and everything is fine. I've tried bringing a syslog-ng daemon and conf file from a working server over and the problem still exists. Any help would be appreciated!! Thanks, Jesse Keefe Sr Analyst, Open Systems Convergys Corp 513-723-3689 -- "NOTICE: The information contained in this electronic mail transmission is intended by Convergys Corporation for the use of the named individual or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone (collect), so that the sender's address records can be corrected."

3 2

Core Dump issue on FreeBSD 4.10-STABLE
by Emre Bastuz 18 Sep '04

18 Sep '04

Hi, on https://lists.balabit.hu/pipermail/syslog-ng/2004-September/ I saw that some people (Loic Minier, Michihito Matsubara and Mike Williams) already had discussed the core dump issue on FreeBSD 4.10-STABLE. Apparently they have the same problem that I have desribed in https://lists.balabit.hu/pipermail/syslog-ng/2004-September/006444.html. I was just wondering if there has been any progress? Any fixes in sight? Regards, Emre -- http://www.emre.de UIN: 561260 PGP Key ID: 0xAFAC77FD I don't see why some people even HAVE cars. -- Calvin

3 4

Logging to program destinations has odd prefix?
by Lars Kellogg-Stedman 17 Sep '04

17 Sep '04

Hello, Text logged to a program via the program() destination has a prefix of the form <nnn>, which I'm assuming is the encoding of the syslog level and facility. Great! But I don't want it :). Is there any way to prevent this text from being logged? Sure, I can write a "wrapper" program to edit these messages before they reach the intended destination, but my template doesn't ask for this information, so I'm not sure it should be there. -- Lars -- Lars Kellogg-Stedman <lars(a)oddbit.com>

2 1

Re: [syslog-ng]Message retension period
by Jim Mozley 16 Sep '04

16 Sep '04

Todd Glassey @ Att.Net wrote: > If you are looking for a legal answer then under SOX and other global > legislation there are formal retension periods of as much as seven > years. While that wasnt quite what you asked, any company or entity > would need some kind of log management process under ISO17799/ITIL/ and > COBIT standards that assures that *no* information is lost in the > logging process - that means what it means - if your logging systems are > separate and not auditable - then you may have to provide log management > for the whole period. > > > > That means simply that the remote server needs to hold onto the logs for > whatever the periodicity of your log maintanence process/program is. Thanks for that, they are being stored locally on the remote server too. It was a purely technical question about passing messages between syslog-ng servers. Jim Mozley

1 0

Message queueing
by mailing lists 16 Sep '04

16 Sep '04

This is in regards to the method in which syslog-ng queues and writes messages to disk. The way I understand it, syslog-ng accepts syslog messages on UDP port 514, determines what action to take, then writes each line separately to its determined place. Even if the queueing option is set, syslog-ng will still write the messages one at a time into their respective files. If this is a correct (albeit slim) understanding of syslog-ng's workings, I ask the following questions: Why is this the case? Is it possible to alter syslog-ng to queue multiple lines and write them together in a single write to speed up the IO process? The reason I am asking this question is that our syslog-ng instance will often receive thousands of requests per second, and I believe it is the disk IO that is causing the loss of data. The machines are powerful enough (dual 2.8Ghz processors, though I understand syslog-ng is not multi threading), with plenty of memory (2GB) and storage space (500GB). Any insight into this issue would be greatly appreciated. Thanks, Bill

1 0