- syslog-ng - lists.balabit.hu

1.6.0rc4 released
by Balazs Scheidler 09 Oct '03

09 Oct '03

Hi, I've released version 1.6.0rc4 with the following NEWS entry: News for the 1.6.0rc4 release Fri, 3 Oct 2003 16:00:47 +0200 * close stderr when going into background * set the fd for file sources into nonblocking mode to avoid blocking in the case both klogd and syslog-ng is reading /proc/kmsg * added support to parse PIX timestamps A couple of parsing errors reported earlier are _not_ fixed in this release as they would change the parsing code, and I don't want to get it wrong in the stable series. I'll post a patch instead which can be tested by interested parties. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 2

syslog-ng filename expansion - 1.6.0rc3
by James B. Davis 08 Oct '03

08 Oct '03

Hi, I've tried in vain to get underscores in the filename expansion but all I get is the last variable. For example: destination hosts { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$FACILITY-$YEAR-$MONTH-$DAY" owner(root) group(nms) perm(0640) dir_perm(0750) create_dirs(yes) ); }; Works but changing the "-" with "_" leaves me with files named "$DAY" rather than the whole string. Using "." works ok but it is real messy when you need fqdn. thx jbd -- James Davis Lead Systems Administrator Douglas County Government Information Technology Department 100 Third Street, Castle Rock CO 80104 USA cell 303.994.8881 fax 303.688.6908 direct 303.663.7654 http://www.douglas.co.us/ mailto:jdavis@douglas.co.us

1 0

bug report: interlaced messages
by Thomas Morin 03 Oct '03

03 Oct '03

Hi, I've just run into a problem I had already seen during my tests for the previous bug report I sent : I see pieces of logs that appear in the middle of other messages. Example: $ grep 'Sep 22 06:17:0' messages Sep 22 06:17:01 ker0009901 )<38>Sep 22 06:17:01 cron(pam_unix)[1173]: session closed for user mail We see, in the middle of a message, the beginning of a syslog header ( "<..>" ) and the message that follows does not belong to the 'messages' destination, and we see that it is actually missing from the 'auth.log' file : $ grep 'Sep 22 06:17:0' auth.log Sep 22 06:17:01 ker0009901 cron(pam_unix)[1173]: session opened for user mail by (uid=0) Sep 22 06:17:01 ker0009901 cron(pam_unix)[1174]: session opened for user root by (uid=0) Sep 22 06:17:02 ker0009901 cron(pam_unix)[1174]: session closed for user root (no "session closed" for user mail) This kind of problem might be a security issue if it can be triggered easily. I'm no expert here, but this looks a bit similar to the other bug I've just reported, since the same thing (interlaced messages) is happening when syslog-ng receives UDP syslog messages not NULL terminated of which size exceeds log_msg_size. Regards, -Thomas PS: this is syslog-ng 1.6.0, version 1.6.0rc1+20030310 (debian package), running on Linux 2.6.0-test5 -- == Thomas Morin == Ingénieur Consultant Atlantide - www.ago.fr - thomas.morin(a)ago.fr == PGP Id:8CEA233D Key FP:503BF6CFD3AE8719377B832A02FB94E08CEA233D --

2 3

syslog-ng writes two files
by Serge Torop 03 Oct '03

03 Oct '03

Hello! I'm using Linux RH 9.0, libol 0.3.9 and syslog-ng 1.6.0rc3. In my syslog-ng.conf: destination d_fetchmail { file("/var/log/fetchmail/fetchmaillog.$DAY.$MONTH.$YE$ Then syslog-ng operate the log it writes two files: 1. fetchmaillog.03.10.2003 2. fetchmaillog.31.12.2002 with different contents. Is writing fetchmaillog.31.12.2002 bug, then 3 Oct 2003 now? -- Serge P. Torop St.Petersburg, Russia

2 1

Still - "Assertion `i == nfds' failed."
by Dennis Skinner 30 Sep '03

30 Sep '03

Still looking for help with this. What other information can I provide? It has been running for a week inside a screen in debug mode, but I would really like to get it working properly. Still getting this error: syslog-ng: io.c:270: io_iter: Assertion `i == nfds' failed. syslog-ng version 1.6.0rc3 libol 0.3.10 RedHat 9 I only have 3 sources: internal and 2 udp sources (no /proc/kmsg or /dev/log). It runs fine for a short while and then dies with the above error. Sometimes it runs for a minute or so and sometimes for 15-20 mins without a problem before it dies (logging properly from the various servers while it runs). I had setup the local syslogd to pass its messages to syslog-ng via udp. I stopped syslogd (and klogd) and getting same problem. Tried running both using chroot option and not, same thing. Seems to run forever in debug mode. I can see it does garbage collection every now and then. > So you have three sources and a single file destination? Or you also log to > remote hosts uding TCP or UDP? No, I have 2 destinations....other servers are sending logs here. source s_local { internal(); }; source s_int1_udp { udp(ip("10.0.1.123") port(514)); }; source s_int2_udp { udp(ip("192.168.1.123") port(514)); }; destination d_sort_program_host { file("/export/syslog-ng/var/log/$HOST/$PROGRAM.$MONTH$DAY$YEAR" group("logs") perm(0640) create_dirs(yes) dir_perm(0750) ); }; destination d_sort_host { file("/export/syslog-ng/var/log/$HOST/$MONTH$DAY$YEAR" group("logs") perm(0640) create_dirs(yes) dir_perm(0750) ); }; log { source(s_local); source(s_int1_udp); destination(d_sort_program_host); }; log { source(s_int2_udp); destination(d_sort_host); }; -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

2 1

Can I run multiple Syslog-ng instances on different ports?
by Wayne Sweatt 29 Sep '03

29 Sep '03

I was interested in running 2-3 instances of Syslog-ng on a single system, with a single interface. I would use different port numbers for each, of course. The reason was to separate logs from different client OS types. We have a different team that supports Mac OS X, for example, and would like to keep a separate directory tree of logs for those systems. The syslog-ng.conf file would be pushed out to the different *NIX Oses with Cfengine, and then Syslog-ng could keep the logs separate and then could be parsed those logs with my scripts and email the appropriate admins. Is the running 2-3 concurrent instances ok? Wayne Sweatt Sr. UNIX System Administrator Comforce Technical Services LANL SCC Team

2 1

Destination program: Syslog-ng stops writing to program
by K Resar 29 Sep '03

29 Sep '03

I've setup syslog-ng to output its messages to a destination program. However, when the server gets heavily loaded [1] either syslog-ng stops writing messages to the program's STDIN or the program stops reading these messages. Has anyone else experienced this behavior? If this appears to be a known problem that cannot be resolved, a solution for me would be to output all messages received with some sort of a destination file driver, but keeping the PRI portion of the syslog message intact. Does this functionality currently exist? Keith. 1: Or perhaps just for the fun of it too -- this has happened at times when I would not expect the log server to be getting too many messages. --

1 0

RE: [syslog-ng]permissions being changed for certain devices
by Clemson, Chris 29 Sep '03

29 Sep '03

> > everytime i restart syslog-ng i have to chmod the /dev/null > file or squid > > goes nuts and spawns off loads of its own processes, which > eventually hangs > > the machine. > > > > all 3 files are referenced in /etc/syslog-ng.conf as destinations. > > if syslog-ng has access to the files (i chmod /dev/null to > 666), why should > > it change the permissions to block other programs? > > > > i am running this on SuSE 8.0. > > use perm(-1) for those files. ah, thank you! however, http://www.balabit.com/products/syslog_ng/reference/x354.html doesn't actually explain how to use them. for example, if i had a line: destination null { file("/dev/null"); }; where would i put the perm(-1) option? wherever i stick it, it seems to complain! thanks! chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

permissions being changed for certain devices
by Clemson, Chris 29 Sep '03

29 Sep '03

ever since i upgraded to syslog-ng 1.6.0rc3 from 1.4.14, when syslog-ng is restarted something wierd happens. I get 3 error messages: Sep 29 11:56:47 proxy syslog-ng[1614]: Changing permissions on special file /dev/xconsole Sep 29 11:56:47 proxy syslog-ng[1614]: Changing permissions on special file /dev/tty10 Sep 29 11:56:47 proxy syslog-ng[1614]: Changing permissions on special file /dev/null in particular, it changes /dev/null to rw access for root only. q1: why does it do this? and q2: how to i stop it? everytime i restart syslog-ng i have to chmod the /dev/null file or squid goes nuts and spawns off loads of its own processes, which eventually hangs the machine. all 3 files are referenced in /etc/syslog-ng.conf as destinations. if syslog-ng has access to the files (i chmod /dev/null to 666), why should it change the permissions to block other programs? i am running this on SuSE 8.0. thank you! chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 1

recall issue on coosbay server
by Wang, Zhenyu Z 27 Sep '03

27 Sep '03

Hi, I've asked the question about some strange result when running syslog-ng-1.6.0rc3 on coosbay server. Syslog-ng couldn't create log files, but generate wild files in current work directory. --sample config file- # Simple syslog-ng.conf file. options {use_fqdn(no);sync(0);}; source s_sys { unix-stream("/dev/log"); internal(); }; destination d_security { file("/usr/local/var/log/security" create_dirs(yes)); }; destination d_messages { file("/usr/local/var/log/messages" create_dirs(yes)); }; destination d_console { usertty("root"); }; filter f_authpriv { facility(auth, authpriv); }; filter f_messages { level(info .. emerg) and not facility(auth, authpriv); }; filter f_emergency { level(emerg); }; log { source(s_sys); filter(f_authpriv); destination(d_security); }; log { source(s_sys); filter(f_messages); destination(d_messages); }; log { source(s_sys); filter(f_emergency); destination(d_console); }; --end- [root@power sbin]#./syslog-ng [root@power sbin]# ls ? stunnel syslog-ng ... [root@power sbin]# cat ? Sep 27 13:53:56 s_sys@power syslog-ng[28098]: syslog-ng version 1.6.0rc3 starting Sep 27 13:53:56 s_sys@power syslog-ng[28098]: syslog-ng version 1.6.0rc3 starting Any idea on why this file is created but normal log files fail to be exist? Thanks zhen

1 0