- syslog-ng - lists.balabit.hu

1.6.0rc3 dumps core on gc when listening on TCP?
by Michaelmas 07 Nov '03

07 Nov '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is there a known issue with syslog-ng-1.6.0rc3 dumping core when reaping an idle TCP listener? I've had a high-volume syslog-ng server installed and running fine for a couple of months now with rc3, I just started to install syslog-ng on client hosts recently, so I added TCP listener options on the server. If TCP is enabled, syslog-ng dies (dumps core with signal 6) apparently when doing gc on an idle TCP listener. The problem does not happen if I comment out the TCP line: # source s_tcp { tcp( ip(192.168.192.92)); }; I don't see anything in the ChangeLog for rc4 to suggest upgrading would fix this? $ gdb /usr/local/sbin/syslog-ng ./syslog-ng.core . . . Core was generated by `syslog-ng'. Program terminated with signal 6, Abort trap. Reading symbols from /usr/libexec/ld.so...done. Reading symbols from /usr/lib/libc.so.29.0...done. #0 0x400a4fcf in _thread_sys_kill () (gdb) bt #0 0x400a4fcf in _thread_sys_kill () #1 0x400a48bb in abort () #2 0x11014 in do_object_queue_mark () #3 0x120a5 in dont_free_live_resource () #4 0x11f7c in do_resource_free () #5 0x11625 in gc_sweep () #6 0x116fd in gc () #7 0x117a4 in gc_maybe () #8 0xeebe in io_iter () #9 0x1e1a in main_loop (backend=0x1b000) at main.c:255 #10 0x2b7b in main (argc=2, argv=0xcfbfd994) at main.c:545 (gdb) quit $ exit I run "syslog-ng -F" under DJB's daemontools, so when the application dies I get an alert message and svscan restarts it immediately, but in the interim I lose some (UDP) log data... mas -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.3 wkYEARECAAYFAj+q9O0ACgkQKo6Jkwn+K0gNvQCeNfzvOSzM0aaI+YENoQSTC1dqvwYA njjCWIFA1klWjZHDvyZWFozJr6sm =38xg -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

FW: parse error on Template (
by KELLY,THOMAS (HP-Boise,ex1) 06 Nov '03

06 Nov '03

Attached is my syslog-ng.conf file <<syslog-ng.conf>> _____________________________________________ From: KELLY,THOMAS (HP-Boise,ex1) Sent: Tuesday, November 04, 2003 11:39 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: parse error on Template ( Hello, I am using syslog-ng-1.6.0rc4 on RH 9. I just migrated to using mysql for syslog-ng. After I added in the support for mysql in my syslog-ng.conf, when I try starting syslog-ng is gives me a parse error on the line that specifies the template: template("INSERT INTO logs (host, facility, priority, level, tag, date, Does anyone know how to resolve this error? Thanks, Tom Kelly

2 1

Re: [syslog-ng]FW: parse error on Template (
by Michael Earls 04 Nov '03

04 Nov '03

The only thing i see missing on your config is the " source net { udp(); }; ". I know template version does work on syslog-ng 1.6.0rc1. I would assume it would work on the next version up. Can any one else verify that template versions work on versions 1.6.0rc4. michael PGP Info: KeyID 0x5EB59708 Fingerprint 108B A1D8 76F5 08A8 501A F28C 86F4 4BC5 5EB5 9708 >>> tom.kelly(a)hp.com 11/04/03 03:31PM >>> Attached is my syslog-ng.conf file <<syslog-ng.conf>> _____________________________________________ From: KELLY,THOMAS (HP-Boise,ex1) Sent: Tuesday, November 04, 2003 11:39 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: parse error on Template ( Hello, I am using syslog-ng-1.6.0rc4 on RH 9. I just migrated to using mysql for syslog-ng. After I added in the support for mysql in my syslog-ng.conf, when I try starting syslog-ng is gives me a parse error on the line that specifies the template: template("INSERT INTO logs (host, facility, priority, level, tag, date, Does anyone know how to resolve this error? Thanks, Tom Kelly

1 0

Re: [syslog-ng]parse error on Template (
by Michael Earls 04 Nov '03

04 Nov '03

Can you past the rest of the config. michael >>> tom.kelly(a)hp.com 11/04/03 01:39PM >>> Hello, I am using syslog-ng-1.6.0rc4 on RH 9. I just migrated to using mysql for syslog-ng. After I added in the support for mysql in my syslog-ng.conf, when I try starting syslog-ng is gives me a parse error on the line that specifies the template: template("INSERT INTO logs (host, facility, priority, level, tag, date, Does anyone know how to resolve this error? Thanks, Tom Kelly

1 0

parse error on Template (
by KELLY,THOMAS (HP-Boise,ex1) 04 Nov '03

04 Nov '03

Hello, I am using syslog-ng-1.6.0rc4 on RH 9. I just migrated to using mysql for syslog-ng. After I added in the support for mysql in my syslog-ng.conf, when I try starting syslog-ng is gives me a parse error on the line that specifies the template: template("INSERT INTO logs (host, facility, priority, level, tag, date, Does anyone know how to resolve this error? Thanks, Tom Kelly

1 0

chain_hostnames = long_hostnames option?
by seberino＠spawar.navy.mil 30 Oct '03

30 Oct '03

-- _______________________________________ Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax : (619) 553-6521 Email: seberino(a)spawar.navy.mil _______________________________________

2 2

Syslog-ng Apache and Samba logs
by Rui Teixeira 30 Oct '03

30 Oct '03

Can someone indicate me the way so i can catch the logs of Samba and Apache with Syslog-ng?? I can't find a way to do this... Thanks in advance Rui Teixeira

2 1

re-writing hostnames before sending over TCP
by nate 30 Oct '03

30 Oct '03

I am tryin to configure a semi-secure syslog setup. The primary program that will be logging to it is java via log4j. log4j apparently cannot log to a socket with syslog(as far as I can tell?) only to a udp source, so I configured syslog-ng to bind to 127.0.0.1 on port 514 tcp/udp and it recives the messages fine but the 'host' that is being logged is localhost. I can re-write the log entries using a template for local files but I can't seem to get it workin for sending to a remote syslog server. No matter what options I use it always ends up either localhost or 127.0.0.1 for the hostname. One thing I haven't tried is setting up a filter on the remote server using the host() option but I don't think it would work because the host there would be localhost too not the host of the server sending the message ? is there a way to get syslog-ng to ignore the hostname that's in the message itself and use the hostname/ip of the system that is actually sending the message? or is there another way to accomplish this while keeping syslog-ng bound to the loopback interface? on the local server I also have syslog-ng logging everything to a file, and without using the template all log entries from log4j also appear as being from the host 'localhost'. I suppose I could have log4j log directly to the remote server but rather would use the local one as a buffer incase there is a network problem or something. using ssyslog-ng 1.5.26(on both systems). If I need to upgrade I could .. thanks! nate

2 3

Syslog-ng and Apache logs
by Rui Teixeira 28 Oct '03

28 Oct '03

Hi to all. Can someone tell me how can i catch the apache logs in a machine so the syslog-ng can process them? I can't find the correct facility. Thanks in advance. Rui Teixeira

1 0

RE: syslog-ng digest, Vol 1 #1042 - 12 msgs
by Jay Davis 27 Oct '03

27 Oct '03

This may be a bit late, but I am doing exactly the same thing you need with network devices. I doubt you want chain_hostnames. This just puts the chain of hostnames with the path (hosts) that the message has passed through. We log to several (load balanced) dedicated syslog hosts, which then forward the messages to an event management system. We also use syslog-ng to then forward all messages to a central syslog system that we have simple Web apps to peruse the messages. This last part will soon be an applicance (can't mention the vendor). I have found that the syslog-ng.conf.doc file in the contrib directory will have everything you could possibly need to know about syslog-ng. Plus the very smart peeps that read this listserv. Here are my options. I certainly hope this helps. If you need to feel free to give me a shout. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); dns_cache_size(1000); dns_cache_expire_failed(5); use_fqdn (no); create_dirs (no); perm(644); keep_hostname (yes); }; ==========Christians Part. ( Cut and paste job. ) My little brainless syslog-ng.conf below NEEDS the one option you see or else the log file will refer to host as "src@myhostname" instead of just "myhostname". Please explain a little better what chain_hostnames does/means and why it fixes this problem. Is there some other simpler way to fix aforementioned problem?? options {chain_hostnames(no);}; source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internal();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; Christian Seberino, Ph.D. SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. ===========================

1 0