- syslog-ng - lists.balabit.hu

RE: [syslog-ng]Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 13 May '04

13 May '04

Tried to increase UDP udp_max_buf to 524288 (from 262144) - doesn't help. STATS reports 0 lost messages... ;( Plus 1.6.3 hangs for me after 200-300 messages (3-5 minutes)... 1.6.1 doesn't hang but losing messages :( Dmitri -----Original Message----- > > Another problem with syslog-ng in general (1.6.1 or later) - we're > started to lose about 10% of syslog messages. > The config file is not too big and messages do arrive on server for > sure (confirmed with snoop) but every few minutes syslog-ng is losing > some of them. Any recommendation on tuning or troubleshooting? if the packet arrives to the log host but syslog-ng does not receive it (e.g. your STATS line shows 0 dropped messages), it is possible that the UDP receive buffer is too small. try increasing the UDP receive buffer, it should be possible with some OS dependant tools (ndd comes to mind on Solaris)

1 0

Problem with 1.6.3 on Solaris. Message
by Dmitri Smirnov 13 May '04

13 May '04

Looks like version 1.6.3 is not working well on Solaris 8. Few minutes after the start it generates hundreds of messages like: syslog.err syslog-ng[27013]: do_stream_read: STREAMS device gave too long line I think it is the result of changes related to HP-UX and pad_size (from 10k to 256 bytes ?) Another problem with syslog-ng in general (1.6.1 or later) - we're started to lose about 10% of syslog messages. The config file is not too big and messages do arrive on server for sure (confirmed with snoop) but every few minutes syslog-ng is losing some of them. Any recommendation on tuning or troubleshooting? Dmitri

2 2

RE: [syslog-ng]min options needed for logserver?
by Hamilton, Andrew 10 May '04

10 May '04

Unfortunately, optimizing it is really particular to your setup and what you are trying to do. You can use no options and take just defaults or you can have 15 different ones. It is difficult to tell what minimum you need without knowing how your system is configured and what you want it to do. A start might be just to use no options and work from there. Regards, Drew -----Original Message----- From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] Sent: Monday, May 10, 2004 1:09 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]min options needed for logserver? To aid in understanding and minimize complexity I'd like to use the minimum options in syslog-ng.conf possible. Different examples I've seen use lots of different options so I'm not sure which ones are crucial. What is a good smallest set of vital options for a log server? Chris _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

min options needed for logserver?
by seberino＠spawar.navy.mil 10 May '04

10 May '04

To aid in understanding and minimize complexity I'd like to use the minimum options in syslog-ng.conf possible. Different examples I've seen use lots of different options so I'm not sure which ones are crucial. What is a good smallest set of vital options for a log server? Chris _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

how to push sulogs/utmp/wtmp to central logserver
by Nilesh Naik 10 May '04

10 May '04

Hello All is it possible to push sulogs/wtmp/utmp etc logfiles from the hosts running solaris 7/8/9, to the redhat linux box running syslog-ng ? if this is possible kindly guide me how can i configure the same and how to rotate the sulog/wtmp/utmp etc log files on solaris regards Prashant __________________________________ Do you Yahoo!? Win a $20,000 Career Makeover at Yahoo! HotJobs http://hotjobs.sweepstakes.yahoo.com/careermakeover

1 0

Re: [syslog-ng]How to log into mysql database - help required
by Michael Earls 10 May '04

10 May '04

I would use if statement in cron to check to see if this is running if not running start it. ## Mysql insert run the check 0-55/1 * * * * root if [ -x /bin/bash ] && [ -r /etc/syslog-ng/mysql_pipe.sh ]; then /bin/bash /etc/syslog-ng/mysql_pipe.sh >> /var/log/syslog-ng/mysql_pipe.log 2>&1; fi Michael >>> gjg(a)sltnet.lk 5/10/2004 8:13:02 AM >>> I require to log syslogs into a mysql database. I used syslog-ng (downloaded the rpm for syslog-ng - ver 1.6 and libol from rpmseek.com and installed it) and used the information available in the site http://www.vermeer.org/display_doc.php?doc_id=1 for this purpose. As given in this website (1) First I made the pipe file using the following command # mkfifo /tmp/mysql.pipe (2) Then I used the following command to log into mysql (first tried with local logging) # mysql -u root --password=passwd syslog < /tmp/mysql.pipe This command gets stuck But when syslog-ng is stopped and started it logs and the contenets in /tmp/mysql.pipe gets loaded into the database table. The following commands were used to stop and start syslog-ng /etc/init.d/syslog-ng stop # Stop syslog-ng /etc/ini.d/syslog-ng start # Start syslog-ng (3) The site states about an initialization script like this one which needs to be started at start up. The script given is provided below. #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u theuserid --password=thepassword syslogdb < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi Where should I put this script and how to start it up at initialization? Could you explain the working pricipal of this script?

1 0

Eventog to syslog
by Edwards, Thomas 10 May '04

10 May '04

Has anyone ever used the Eventlog to syslog program found here. https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys I was trying to decipher their input as to how to word the filters and am coming up short other than putting a direct match for the host name I am using. Any help would be greatly appreciated. Tom ******************************************** This message is intended only for the use of the Addressee and may contain information that is PRIVILEGED and CONFIDENTIAL. If you are not the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please erase all copies of the message and its attachments and notify us immediately. Thank you. ********************************************

4 3

RE: [syslog-ng]How to log into mysql database - help required
by Hamilton, Andrew 10 May '04

10 May '04

Try going here: <http://www.campin.net/syslog-ng/faq.html> http://www.campin.net/syslog-ng/faq.html Regards. -----Original Message----- From: Gayathri J. Gunawardena [mailto:gjg@sltnet.lk] Sent: Monday, May 10, 2004 8:13 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]How to log into mysql database - help required I require to log syslogs into a mysql database. I used syslog-ng (downloaded the rpm for syslog-ng - ver 1.6 and libol from rpmseek.com and installed it) and used the information available in the site http://www.vermeer.org/display_doc.php?doc_id=1 <http://www.vermeer.org/display_doc.php?doc_id=1> for this purpose. As given in this website (1) First I made the pipe file using the following command # mkfifo /tmp/mysql.pipe (2) Then I used the following command to log into mysql (first tried with local logging) # mysql -u root --password=passwd syslog < /tmp/mysql.pipe This command gets stuck But when syslog-ng is stopped and started it logs and the contenets in /tmp/mysql.pipe gets loaded into the database table. The following commands were used to stop and start syslog-ng /etc/init.d/syslog-ng stop # Stop syslog-ng /etc/ini.d/syslog-ng start # Start syslog-ng (3) The site states about an initialization script like this one which needs to be started at start up. The script given is provided below. #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u theuserid --password=thepassword syslogdb < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi Where should I put this script and how to start it up at initialization? Could you explain the working pricipal of this script?

1 0

How to log into mysql database - help required
by Gayathri J. Gunawardena 10 May '04

10 May '04

I require to log syslogs into a mysql database. I used syslog-ng (downloaded the rpm for syslog-ng - ver 1.6 and libol from rpmseek.com and installed it) and used the information available in the site http://www.vermeer.org/display_doc.php?doc_id=1 for this purpose. As given in this website (1) First I made the pipe file using the following command # mkfifo /tmp/mysql.pipe (2) Then I used the following command to log into mysql (first tried with local logging) # mysql -u root --password=passwd syslog < /tmp/mysql.pipe This command gets stuck But when syslog-ng is stopped and started it logs and the contenets in /tmp/mysql.pipe gets loaded into the database table. The following commands were used to stop and start syslog-ng /etc/init.d/syslog-ng stop # Stop syslog-ng /etc/ini.d/syslog-ng start # Start syslog-ng (3) The site states about an initialization script like this one which needs to be started at start up. The script given is provided below. #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u theuserid --password=thepassword syslogdb < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi Where should I put this script and how to start it up at initialization? Could you explain the working pricipal of this script?

1 0

sample syslog-ng.conf with swatch alerts
by Nilesh Naik 09 May '04

09 May '04

Hi any one having syslog-ng.conf file , for linux loghost, getting logs from the solaris and linux servers then please mail me the same for the reference , actually i am getting logs from all the servers but unfortunately , syslog-ng is not passing the same to swatch , (i guess) so if some one can send the same then would be very helpful to me in setting up a loghost in our datacenter regards Prashant __________________________________ Do you Yahoo!? Win a $20,000 Career Makeover at Yahoo! HotJobs http://hotjobs.sweepstakes.yahoo.com/careermakeover

1 0