- syslog-ng - lists.balabit.hu

Problem with syslog-ng and Sys::Syslog
by Jyri Hovila 05 Sep '03

05 Sep '03

Hi! (Jarkko: Sori että häiritsen sinua tällaisella. Ajattelin että saattaisit olla kiinnostunut.) I'm having a weird problem with syslog-ng (version 1.5.24) and Perl module Sys::Syslog. I use Perl 5.8.0 and OpenBSD 3.3. When logging a timestamp using Sys::Syslog, it gets corrupted: This: syslog('local3|info',"TESTING - 12:34:56"); Turns into this: Sep 5 23:49:12 my.server.com root: TESTING - 12: 34:56 Notice the extra space between "12:" and "34". The problem does *not* occur if I do ``logger -p local3.info "TESTING - 12:34:56"''. I don't know if the problem is actually within syslog-ng or Sys::Syslog. Any ideas what could be wrong and how it could be fixed? Thanks! =) - Jyri

2 1

exit matching rules after first match
by Fanselow, William 05 Sep '03

05 Sep '03

Is there any way to configure syslog-ng to exit the matching rules upon it's first match, much as most firewalls do (it appears that all matching rules are checked even after a match has been made). This would make my config file much simpler and presumably ease processing resources. If this feature doesn't currently exist, wouldn't it be a cool addition to future releases! ------------------------ William Fanselow Level(3) Communications 720.888.8363 ------------------------

1 0

RE: [syslog-ng]DNS Problem?
by Glasser, Rob 03 Sep '03

03 Sep '03

Actually all systems are using Veritas Volume Manager to mirror the disk. Rob Glasser desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net -----Original Message----- From: nate [mailto:nate@campin.net] Sent: Tuesday, September 02, 2003 4:16 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]DNS Problem? On Tue, Sep 02, 2003 at 03:45:46PM -0700, Glasser, Rob wrote: > Wow, old thread of mine. > > It appears to be disk/load related on the syslog server itself. These > messages only appear in the middle of the night when a find job runs > on the directories and files syslog-ng writes to and deletes old files > (syslog-ng writes to files with a datestamp in the filename). When I > don't run this script I don't have any problems. Funny thing is this > happens on my boxes that are Netra 1125's, dual 400Mhz procs, 18GB > 10000 RPM disks, but doesn't happen on my boxes that are Ultra 1's, > single 84Mhz prco, 9GB 7200 RPM disks. Go figure. We're moving this > stuff onto new hardware on a SAN so hopefully the problems will go > away then. Wild guess, are you using disksuite to mirror/manage those fast disks? That'll slow things way the hell down and take up all your CPU time when funning find. -- Nate "If builders built buildings they way computer programmers write programs, the first woodpecker that came along would have destroyed all civilization." - Weinberg's Law _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]DNS Problem?
by Glasser, Rob 03 Sep '03

03 Sep '03

Wow, old thread of mine. It appears to be disk/load related on the syslog server itself. These messages only appear in the middle of the night when a find job runs on the directories and files syslog-ng writes to and deletes old files (syslog-ng writes to files with a datestamp in the filename). When I don't run this script I don't have any problems. Funny thing is this happens on my boxes that are Netra 1125's, dual 400Mhz procs, 18GB 10000 RPM disks, but doesn't happen on my boxes that are Ultra 1's, single 84Mhz prco, 9GB 7200 RPM disks. Go figure. We're moving this stuff onto new hardware on a SAN so hopefully the problems will go away then. Rob Glasser -----Original Message----- From: Unger, Christian [mailto:C.unger@st-ag.de] Sent: Tuesday, June 10, 2003 11:33 PM To: syslog-ng(a)lists.balabit.hu Subject: AW: [syslog-ng]DNS Problem? May you using, Windows 2000 ADS integraded DNS Servers. Then you should look into you logfiles of the Windows box. The 2000 DNS Server dies some time on havy load. MS knows that problem and so the DNS kommt with a autorestart funktion. But you can get a dns time out during the restart. Or your ADS is in combination with Exchange 2000, so the DNS (DC Server) has some time havy load during the LDAP querys from Exchange. The DNS Respons now needs extremly long. If you have this you should need 3 DS in the primary Exchange 2000 Site and split the Exchange querys over the tree global catalog Server. Thas my 2000 knowlage ;) I hope it helps someone. -----Ursprüngliche Nachricht----- Von: Glasser, Rob [mailto:rob.glasser@attws.com] Gesendet: Mittwoch, 11. Juni 2003 00:50 An: syslog-ng(a)lists.balabit.hu Betreff: RE: [syslog-ng]DNS Problem? These are internal systems located in the same datacenter although not necessarily on the same network. reverse lookups work, in fact for any system that has a problem, it's usually only one message out of hundreds for the day that has the problem, all other messages from those systems resolve fine. Rob Glasser desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net -----Original Message----- From: Nicholas Bernstein [mailto:nick@docmagic.com] Sent: Tuesday, June 10, 2003 3:47 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]DNS Problem? First off, what hosts are they failing to resolve? If they are hosts from somewhere out on the internet, they might not have an in-addr.arpa address associated with the ip, and may not be reverse lookup-able. Have you tried to verify that the systems can look up the ip? E.G. 'host a.b.c.d '? On Tue, 2003-06-10 at 15:40, Glasser, Rob wrote: > I'm having some name lookup weirdness and not sure of the cause. > Thought I'd post the scenario to the group before I start tweaking my > configuration to see if it can be fixed. > > First off, I'm running syslog-ng 1.6.0rc3, and on the systems I'm > having problems, they are Sun Netra systems, dual procs, 2GB of > memory, running Solaris 8. My options look like this: > > log_fifo_size(2048); > time_reopen(10); > use_fqdn(yes); > keep_hostname(no); > use_dns(yes); > dns_cache(yes); > long_hostnames(off); > > I have 2 servers with this configuration acting as centralized > loghosts for a datacenter. They are identical boxes, running > identical syslog-ng configurations, on the same VLAN as the DNS > servers they point to. > > Both of these boxes will periodically fail to lookup a name? and log > an entry under it's IP address instead of it's fully qualified host > name. There appears to be no pattern what so ever to it, and the log > entries that get logged by IP are different on each syslog-ng server. > The load on these systems is pretty minimal. The number of messages > logged by IP address is averaging about 10 a day out of about 13000 > messages being logged. > > To make things even more interesting, I have a similar setup in > another datacenter, but they are older smaller systems, only Ultra > 1's, single proc, with only 128 MB of memory, running Solaris 2.6, > acting as centralized servers for about 3 times the number of > servers. The syslog-ng version and configuration is identical. On > these systems I can not find any entries logged by IP address, > everything appears to be working fine. > > Any ideas what might be causing this? My gut reaction is to blame it > on the DNS boxes since the problem is only happening in one data > center and not another, but wanted to see if anyone else has already > been down this road first. > > Thanks > > Rob Glasser > AT&T Wireless > UNIX Systems Administrator > -- +---------------------------------------------------------------+ | Nicholas Bernstein | nick(a)docmagic.com | | UNIX Systems Administrator | http://www.docmagic.com | | Document Systems Inc. | | | gpg: F706 8C4E 78FA DDDD 53A0 019F D983 FE28 2002 D1F3 | +---------------------------------------------------------------+ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Sending mail to root?
by Florian Lindner 02 Sep '03

02 Sep '03

Hello, I try to define a destination which sends the log entry to root: destination d_mailroot { program("/usr/bin/mail -s '[syslog] Exception detected' root"); }; But this is not working. mail does not notice that it should close stdin and send the mail. I think something like a EOF or at least in single line with a dot. How can I accomplish sending the mail? Thanks, Florian

4 17

What does this message mean?
by gary_tay＠platts.com 01 Sep '03

01 Sep '03

Hi List Folks, Anyone bother to explain to me what this message means? Aug 28 08:44:50 src@hostname syslog-ng[191]: pkt_buffer::do_flush(): Error flushing data OS: Solaris 8 syslog-ng: 1.6.0rc3 Pls let me know if you need more info. Rgds Gary

2 1

Re: syslog-ng digest, Vol 1 #1033 - 15 msgs (Vacation)
by TIM MOORE 29 Aug '03

29 Aug '03

FYI: I will be out on vacation from 8/28 until 9/8. Please contact the NOC if you need immediate assistance. Thanks, Tim Moore

1 0

logging to file and remote host
by Atif Ghaffar 29 Aug '03

29 Aug '03

hi all, I am not yet a syslog-ng user. I would like to know if it is possible to do what I want with standard syslogd and if not then with syslog-ng On HP-UX 11.00 I want to log messages to a file and to remote host. Is that possible with syslogd? I tried something like mail.* /var/adm/syslog/mail.log and it works I tried mail.* @LOGHOST and it works If I put both lines then only one is used. How can I log to a file and also to LOGHOST? If it is not possible with syslog and is possible with syslog-ng, then please let me know so I can continue the reading of the manuals. best regards and thanks Atif Ghaffar

3 4

Syslog-ng on NetBSD
by Axel Gerster 28 Aug '03

28 Aug '03

Hello, I got some compile errors on syslog-ng on NetBSD. Does anyone know how to fix it? ---snap---- root@blah:/tmp/syslog-ng-1.6.0rc3# gmake Making all in src gmake[1]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' gmake all-recursive gmake[2]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' Making all in . gmake[3]: Entering directory `/tmp/syslog-ng-1.6.0rc3/src' gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c cfg-lex.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c affile.c In file included from /usr/include/arpa/inet.h:65, from affile.c:77: /usr/include/sys/param.h:222: warning: `MIN' redefined /usr/pkg/include/libol/objtypes.h:82: warning: this is the location of the previous definition /usr/include/sys/param.h:223: warning: `MAX' redefined /usr/pkg/include/libol/objtypes.h:86: warning: this is the location of the previous definition gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afsocket.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afunix.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afinet.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afinter.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afuser.c gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.6.0rc3/src -I. -mcpu=v9 -Wall -I/usr/pkg//include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c:37: stropts.h: No such file or directory afstreams.c:38: sys/strlog.h: No such file or directory gmake[3]: *** [afstreams.o] Error 1 gmake[3]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake[1]: *** [all-recursive-am] Error 2 gmake[1]: Leaving directory `/tmp/syslog-ng-1.6.0rc3/src' gmake: *** [all-recursive] Error 1 --snip--- Thx very much. Axel

2 1

RE: [syslog-ng]syslog-ng and logrotate
by Naman Latif 28 Aug '03

28 Aug '03

Have you tried the "copytruncate" option in logrotate.conf ? I am using it without any problems on Solaris8. ++++++++++++++++++++ copytruncate Truncate the original log file in place after creating a copy, instead of moving the old log file and option- ally creating a new one, It can be used when some pro- gram can not be told to close its logfile and thus might continue writing (appending) to the previous log file forever. Note that there is a very small time slice between copying the file and truncating it, so some logging data might be lost. When this option is used, the create option will have no effect, as the old log file stays in place. +++++++++++++++++++++++ Regards \\ Naman > My pb : > before the log rotate, all is good. After logrotate, > syslog-ng don't write in > the remote file.

1 0