- syslog-ng - lists.balabit.hu

RE: [syslog-ng]cisco host not being resolved
by Badat, Qassim, ALABS 15 May '04

15 May '04

Nothing to do with syslog-ng. It's the DNS, there should exist both the A -record and the PTR for the host. That is you should be able to resolve NAME-to-IP and also IP-to-NAME. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Asif Iqbal Sent: Friday, May 14, 2004 5:34 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]cisco host not being resolved Badat, Qassim, ALABS wrote: > I resolved it, the problem was due to DNS and missing reverse entries > for these hosts. Guess what, it was the logs in the syslog-ng that led > to its own resolution !!! Would you care to share the diff of the not working and working syslog.conf? I am having the same problem Thanks > > > > _____ > > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Badat, Qassim, > ALABS > Sent: Friday, May 14, 2004 11:58 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]cisco host not being resolved > > > > Hi, > > > > I am new to syslog-ng so excuse my ignorance. I have installed > syslog-ng 1.6.2 on Solaris 8. I am getting the logs but the host names > are not being resolved. . Strangely logs from another vendor's does > have the names resolved by syslog-ng. Any idea whats causing the > problem for cisco ? > > > > > > My syslog-ng.conf file: > > > > options { long_hostnames(off); sync(0); }; > > source sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); > internal(); }; > > source net { udp(); }; > > > > destination network { file("/var/log/syslog-ng"); }; > > > > log { source(net); destination(network); }; > > log { source(sys); destination(network); }; > > > > > > > > Regards, > > QB > -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu There's no place like 127.0.0.1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

IRC channel: #syslog-ng on FreeNode
by Andrew J Caines 14 May '04

14 May '04

Folks, Having failed to find an existing one, I've set up an IRC channel #thttpd on the FreeNode IRC network`[1], where I'm AJ_Z0 and AJC_Z0 (at home and work, respectively). It's registered with ChanServ. Please feel free to drop in to say hello, as well as share questions, answers and ideas about syslog-ng. If no-one responds straight away, don't feel slighted since not everyone is actively participating in the channel all the time. Hang around and someone will respond. In case you're not familiar with Internet Relay Chat (IRC), it's an old but very much alive collection of distributed networks, wherein your IRC client connects to any node and you join any of the channels (chat groups) and chat with everyone else in that channel on the network. It's a bit like some of the instant messenger groups, but without the proprietary protocols, poor client platform support, etc. For the record, I'm not involved with syslog-ng, except as a (fairly new) user. ----8<---- [1] irc.freenode.org - See http://freenode.org/ -Andrew- -- _______________________________________________________________________ | -Andrew J. Caines- Unix Systems Engineer A.J.Caines(a)halplant.com | | "They that can give up essential liberty to obtain a little temporary | | safety deserve neither liberty nor safety" - Benjamin Franklin, 1759 |

1 0

Problem with 1.6.2 on Solaris 8 - lwp_sema_wait(0xFEF0DE60)
by Wyner, Peter 14 May '04

14 May '04

All, I am running into an issue on a previously working syslog_ng 1.6.2 server. There were no configuration changes between when it worked and now (when it doesn't). The syslog sever will process a large number of packets for a period of time and then suddenly the processor utilization goes down to zero, files stop being written, and truss shows: door_call(6, 0xFFBED340) (sleeping...) signotifywait() (sleeping...) lwp_sema_wait(0xFEF0DE60) (sleeping...) I am collecting syslog on a high udp port: # # Syslog-ng example configuration file for Solaris # # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.solaris,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Solaris 2.5.1 and below uses the STREAMS driver, above extends it # with doors. For 2.5.1 remove the door() option from the source declaration. # options { log_fifo_size(1024); sync(0); dns_cache(yes); dns_cache_expire(60); use_dns(yes); chain_hostnames(no); keep_hostname(no); }; source local { sun-streams("/dev/log"); internal(); }; source std_udp { udp( port(52001) ); }; destination all { file("/var/log/messages"); }; destination dst1 { file("/syslog/dst1/current/$HOST" dir_perm(0755) perm(0644)); }; log { source(local); destination(all); }; log { source(std_udp); destination(dst1); }; Any ideas? Thanks, Peter

2 1

cisco host not being resolved
by Badat, Qassim, ALABS 14 May '04

14 May '04

Hi, I am new to syslog-ng so excuse my ignorance. I have installed syslog-ng 1.6.2 on Solaris 8. I am getting the logs but the host names are not being resolved. . Strangely logs from another vendor's does have the names resolved by syslog-ng. Any idea whats causing the problem for cisco ? My syslog-ng.conf file: options { long_hostnames(off); sync(0); }; source sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source net { udp(); }; destination network { file("/var/log/syslog-ng"); }; log { source(net); destination(network); }; log { source(sys); destination(network); }; Regards, QB

1 0

syslog-ng 1.6.4
by Balazs Scheidler 14 May '04

14 May '04

Hi, After the embarassing Solaris related problem in 1.6.3, I'm releasing 1.6.4 which fixes that issue, otherwise nothing else changed. It is being uploaded to our website and should be available tomorrow at the latest. Here's the NEWS file: News for the 1.6.4 release Fri, 14 May 2004 16:42:25 +0200 * fixed a STREAMS handling bug introduced by the IRIX compatibility patches integrated in 1.6.3 -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 14 May '04

14 May '04

Yes, patch is working well. Dmitri -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, May 14, 2004 3:13 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message Does this mean that the patch works well?

1 0

Syslog-ng will not configure properly on vanilla Red Hat
by Keg 14 May '04

14 May '04

syslog-ng needs the libol library, which I compiled and installed to it's default location, /usr/local/lib. When configuring syslog-ng I get this error: <snip> checking for strptime... yes checking for TCP wrapper library... -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.13... no configure: error: Required libol version not found Here is the library: syslog:/usr/local/lib #ls -la total 124 drwxr-xr-x 2 root root 4096 May 13 06:45 . drwxr-xr-x 23 root root 4096 Jan 10 10:55 .. -rw-r--r-- 1 root root 51408 May 13 06:45 libol.a -rwxr-xr-x 1 root root 698 May 13 06:45 libol.la lrwxrwxrwx 1 root root 14 May 13 06:45 libol.so -> libol.so.0.0.0 lrwxrwxrwx 1 root root 14 May 13 06:45 libol.so.0 -> libol.so.0.0.0 -rwxr-xr-x 1 root root 50799 May 13 06:45 libol.so.0.0.0 I added /usr/local/lib to /etc/ld.so.conf and ran ldconfig. (even rebooted as well) This did not work. I added /usr/local/lib to LD_LIBRARY_PATH, this did not work. I tried configuring with --with-libol=/usr/local and got same error. I tried configuring with --with-libol=/usr/local/lib and got same error. I tried configuring with --with-libol=/usr/local, however, this time I get this error: checking for TCP wrapper library... -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.13... configure: error: libol-config not found in the specified location libol-config is in /usr/local/bin: syslog:/usr/local/src/Syslog-Ng/syslog-ng-1.6.3 #ls -l /usr/local/bin/ -rwxr-xr-x 1 root root 1298 May 13 06:45 libol-config I have followed every doc as instructed. This is a vanilla RH 9 system with all updates. Thx for any help. cc

4 7

RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 14 May '04

14 May '04

Thank you, The patch fixed the problem with an error message about STREAMS. Dmitri -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, May 13, 2004 4:32 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Problem with 1.6.3 on Solaris. Message Can you test if this patch fixes it? For me it seems to work. diff -u -r1.16.4.1 afstreams.c --- src/afstreams.c 10 Mar 2004 18:43:28 -0000 1.16.4.1 +++ src/afstreams.c 13 May 2004 11:31:10 -0000 @@ -175,6 +175,7 @@ struct nonblocking_fd *io_stream_get(struct io_backend *backend, int fd, UINT8 *hostname_re, + UINT32 max_log_line, struct log_handler *pipe) { NEW(stream_fd, f); @@ -184,6 +185,7 @@ f->super.read = stream_read_callback; f->super.want_read = 1; f->pipe = pipe; + f->max_log_line = max_log_line; if (hostname_re == NULL) regcomp(&f->bad_hostname, "^$", REG_NOSUB | REG_EXTENDED); else @@ -239,7 +241,7 @@ close(fd); return ST_FAIL | ST_QUIT; } - self->stream_fd = io_stream_get(cfg->backend, fd, cfg->bad_hostname, c); + self->stream_fd = io_stream_get(cfg->backend, fd, + cfg->bad_hostname, cfg->log_msg_size, c); REMEMBER_RESOURCE(cfg->resources, &self->stream_fd->super); -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

Re: [syslog-ng]Syslog-ng will not configure properly on vanilla Red Hat
by Chris Paalman 13 May '04

13 May '04

If you look more carefully on the website you will notice that the files are sorted by filename and not by date. Thus you will find what you are looking for in the middle of the list. Chris Paalman >Reply-To: syslog-ng(a)lists.balabit.hu > > >I just realized it is looking for libol > 0.3.13, but the latest on the >site is 0.3.9 which it says to use with syslog-ng 1.6.3. > >Where can I get this newer version of libol???? >??

1 0

RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 13 May '04

13 May '04

Sorry for confusion - may be the solution will help someone in future as well. The problem I had was related to reverse lookups - I didn't have few zones registered in DNS and reverse lookup was taking 1-2 minutes.. During that time syslog-ng was dropping messages.. I guess it will be nice to isolate lookup function from messages processing if possible.. Thank you for your help and for really nice product! Sorry for confusion - 1.6.3 is working just fine! Dmitri -----Original Message----- From: Dmitri Smirnov Sent: Thursday, May 13, 2004 11:13 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message Tried to increase UDP udp_max_buf to 524288 (from 262144) - doesn't help. STATS reports 0 lost messages... ;( Plus 1.6.3 hangs for me after 200-300 messages (3-5 minutes)... 1.6.1 doesn't hang but losing messages :( Dmitri -----Original Message----- > > Another problem with syslog-ng in general (1.6.1 or later) - we're > started to lose about 10% of syslog messages. > The config file is not too big and messages do arrive on server for > sure (confirmed with snoop) but every few minutes syslog-ng is losing > some of them. Any recommendation on tuning or troubleshooting? if the packet arrives to the log host but syslog-ng does not receive it (e.g. your STATS line shows 0 dropped messages), it is possible that the UDP receive buffer is too small. try increasing the UDP receive buffer, it should be possible with some OS dependant tools (ndd comes to mind on Solaris)

1 0