- syslog-ng - lists.balabit.hu

RE: [syslog-ng]src/tests/testall failed!
by Wang, Zhenyu Z 19 Aug '03

19 Aug '03

Can you tell me why the script does not work? On my RH7.3, syslog-ng.conf.Redhat is not working fine. source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; $syslog-ng Error opening file /proc/kmsg for reading (No such file or directory) Error initializing configuration, exiting. Is there something in system I should tune? zhen -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Monday, August 18, 2003 9:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]src/tests/testall failed! On Mon, Aug 18, 2003 at 05:19:20PM +0800, Wang, Zhenyu Z wrote: > After I have successfully compiled syslog-ng-1.0.6rc3, I run > src/tests/testall script but it failed. that script was written years ago and may not function correctly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Reliable syslog and network outages
by Roland Turner 18 Aug '03

18 Aug '03

I'm trying to work out whether syslog-ng can deliver syslog messages reliably in the face of client reboots during network partitions. From reading the documentation, it is not clear where log_fifo stores its data (disk or memory) and therefore whether or not log entries on a remote syslog client that queue up during a partition of the network which seperates syslog client from loghost will remain queued if the syslog client host reboots. If my approach is unworkable, pointers or aid on how to solve the general problem another way would be greatly appreciated. Here are the details: 1. Several administered machines are located at diverse locations, generally where they are used primarily/entirely by local users. 2. Local users can ordinarily continue to do useful work even if they lose external network connectivity for a while; consequently HA network connectivity is not a user requirement. 3. The machines do not generally require direct intervention very often, so from an administration standpoint, 100% reachability is also not a requirement. 4. As a result of points 2 and 3, highly reliable connectivity is not available; outages of minutes or hours really do occur. 5. Pre-syslog-ng implementations of syslog using UDP will simply lose all log entries during the time that a network is partitioned. This is definitely not OK. 6. Syslog-ng appears to offer TCP-based delivery which certainly solves one issue; normal network paket loss is not an issue. 7. Syslog-ng appears to maintain an internal FIFO which, if sized large enough on a syslog relay host at the remote location(s), could collect all log information generated during a partition and then successfully deliver it when connectivity is restored. 8. If, however, syslog-ng's internal FIFO is memory-based then if the remote location's syslog relay host is rebooted during the network partition then all that it has accumulated and not yet transferred will be lost. (Similarly if the death of the TCP connection is treated as reason to give up, rather than continually retry.) 9. What information I have found on dealing with this appears to deal with loghost unreliability rather than network unreliability, and thus recommends providing HA through additional, redundant, loghosts. Setting aside the problems in reconcilliation of logs that this implies, it takes away the reason for having syslog deliver via IP directly (rather than, say, email) entirely. Does syslog-ng provide a means to deal with this problem? Does some other solution exist? Thanks in advance. - Raz

3 5

src/tests/testall failed!
by Wang, Zhenyu Z 18 Aug '03

18 Aug '03

After I have successfully compiled syslog-ng-1.0.6rc3, I run src/tests/testall script but it failed. Config file is syslog-ng.conf.eval. source src { unix-stream("input"); }; destination d1 { file("d1"); }; destination d2 { file("d2"); }; destination d3 { file("d3"); }; destination d4 { file("d4"); }; destination d5 { file("d5"); }; destination d6 { file("d6"); }; destination d7 { file("d7"); }; filter f1 { facility(local0); }; filter f2 { facility(local1) and level(debug); }; filter f3 { facility(local2) and not level(debug); }; filter f4 { not (facility(local3) and level(debug)); }; filter f5 { facility(local4) or level(info); }; filter f6 { facility(local4) or not level(info); }; filter f7 { not (facility(local4) or level(info)); }; log { source(src); filter(f1); destination(d1); }; log { source(src); filter(f2); destination(d2); }; log { source(src); filter(f3); destination(d3); }; log { source(src); filter(f4); destination(d4); }; log { source(src); filter(f5); destination(d5); }; log { source(src); filter(f6); destination(d6); }; log { source(src); filter(f7); destination(d7); }; Error message is like: + rm 'd?' rm: cannot remove `d?': No such file or directory + ../syslog-ng -f syslog-ng.conf.eval -p syslog-ng.pid Warning: No source refers to internal messages, they'll go to /dev/null + logger -u input -p local0.debug 'msg: local0.debug' + logger -u input -p local1.debug 'msg: local1.debug' + logger -u input -p local1.info 'msg: local1.info' + logger -u input -p local2.debug 'msg: local2.debug' + logger -u input -p local2.info 'msg: local2.info' + logger -u input -p local3.debug 'msg: local3.debug' + logger -u input -p local4.info 'msg: local4.info' + logger -u input -p local6.info 'msg: local6.info' + logger -u input -p local4.debug 'msg: local4.debug' + logger -u input -p local6.info 'msg: local6.info' ++ cat syslog-ng.pid + pid= + kill -TERM ./test.eval: kill: : no such pid + sleep 2 + kill -TERM ./test.eval: kill: : no such pid + rm syslog-ng.pid ++ wc -l 'd?' wc: d?: No such file or directory + result= + rm 'd?' rm: cannot remove `d?': No such file or directory + '[' '' '!=' ' 1 d1 1 d2 1 d3 10 d4 6 d5 7 d6 5 d7 31 total' ']' + echo 'evaluation test failed' evaluation test failed + exit 1 I appreciate somebody tell me why. I have also found some "?" files in the direcotory starting syslog-ng daemon. What can these "?" be used? Zhen Not speaking for my employer -- all opinions are my own (and my fault)

2 1

syslog-ng-1.6.0rc3 crashes after some hours
by Rudolfs Osins 15 Aug '03

15 Aug '03

Hello everyone, I have the folloving problem: After some hours as daemon (~1 - 2h) syslog-ng crashes, leaving no info on what happened in the logs or elsewhere. I run the daemon with syslog-ng -u syslog-ng -g syslog-ng and the user and group exists in the system. The config file I use is attached. Compile options are following: libol-0.3.10 ./configure --prefix=/usr/local/opt/libol make syslog-ng-1.6.0rc3 ./configure --prefix=/usr/local/opt/syslog-ng --with-libol=/usr/src/libol-0.3.10 make make install The system is a celeron 1700Mhz with 128Mb ram and there are just 2 other proccesses beside syslog-ng - fcron and ntpd. Another question is: when I delete a logfile when syslog-ng is still running for the first time, syslog-ng recreates the file, when it recives a message thats destination is the deleted file, but when I delete the same file a second time, it's not being recreated. Is there a way to make syslog-ng recreate the file everytime ? And the last question is, when could the message encryption feature be implemented ? Btw. great work ! Syslog-ng is a really good product ! best regards, Rudolfs

1 1

Behaviour on comm failure.
by Erik Ivanenko 14 Aug '03

14 Aug '03

Does syslog-ng guarantee delivery of messages when communcations to the logging host is lost? ie. are syslog-ng messages buffered until the communcations are re-established? Thank you!

1 0

half open connections.
by Erik Ivanenko 14 Aug '03

14 Aug '03

Hello, I don't know if this has been implemented, but I think not yet... Our intended usage of syslog-ng is for remote devices to annunciate alarms as part of a building automation system as folows: When a remote devices detects an alarm in a building system, a message is issued to the host via a syslog-ng TCP connection. The syslog-ng daemon on the host uses a FIFO to pass the message to a waiting task to dump that message into a database and add further formatting to the message for delivery to our alarms terminals. My problem is that if the remote devices is powered off, a 1/2 open connected will result on the server, that necessitates a SIGHUP to remove (or the syslog-ng to be restarted.) Is there a version of syslog-ng that will test each connection at a timed interval and close if the remote device is not present? Thank you for a great piece of work! Cheers.

1 0

RE: [syslog-ng]IETF Syslog Draft
by Clemson, Chris 13 Aug '03

13 Aug '03

Interesting. There's also http://www.ietf.org/internet-drafts/draft-ietf-syslog-sign-11.txt for security stuff. I know it's dated May but did anyone see it? > For those interested in where the standard is going: > > http://www.ietf.org/internet-drafts/draft-ietf-syslog-internat > ional-00.txt > > If you are interested in features and option, now is the time to speak > up. > > > Richard -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 2

RE: [syslog-ng]syslog-ng&logrotate
by Hamilton, Andrew 13 Aug '03

13 Aug '03

When you rotate the logs you have to send syslog-ng a SIGHUP to make it look at your new file. If you are using Linux if you look in /etc/logrotate.d there is a file called syslog, make sure it is picking up the correct pid file so that it is HUPing the right process on log rotation. Regards, Drew -----Original Message----- From: yannick.haguenier(a)tuxfamily.org [mailto:yannick.haguenier@tuxfamily.org] Sent: Thursday, July 10, 2003 7:03 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng&logrotate Hy, i have squid + syslog-ng 1.0.6.rc1 Syslog-ng look squid/access.log, and write log file (with date format) on a remote server (tcp). On squid there is a logrotate at 6 am. My pb : before the log rotate, all is good. After logrotate, syslog-ng don't write in the remote file. The last line appear in this file was create at 6am. The process run on the both server, and i have no error. If i run syslog-ng restart, syslog-ng write the ligne in remote file . the next error appear after the next logrotate. Does anyone know why this is happening? thanks _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

resolve IP addresses
by Madhvi Gokool 12 Aug '03

12 Aug '03

> Hello > Can syslog-ng resolve IP addresses using the /etc/hosts file? We do not have > an internal dns at the moment. Currently , the filenames that are created > are the IP addresses of the routers that are pushing their syslog onto the > syslog server. > > Regards > Madhvi >

3 2

end of line character
by Franky Van Liedekerke 08 Aug '03

08 Aug '03

Hi all, I'm using syslog-ng for quite a while now, and I'm a happy user. However, there's one thing that I can't seem to be getting right: how to filter out messages ending on a specific word, e.g. I would like to ignore all messages that have the string "admin: $" in it (the dollar-sign indicating end-of-line). But the match expression doesn't seem to recognize this end-of-line character, so can anybody tell me how to achieve this? thanx already! Franky

1 0