- syslog-ng - lists.balabit.hu

RE: [syslog-ng]syslog-ng - AIX 5.x.x
by Gehring, Andrew x66132 10 Jul '03

10 Jul '03

I've successfully compiled it on 5.2 using gcc 3.3 Problems? Andrew _ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

1 0

syslog-ng - AIX 5.x.x
by sey mor 10 Jul '03

10 Jul '03

Has anyone run across any problems on AIX 5.x.x? syslog-ng(a)lists.balabit.hu _________________________________________________________________ Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail

1 0

syslog-ng&logrotate
by yannick.haguenier＠tuxfamily.org 10 Jul '03

10 Jul '03

Hy, i have squid + syslog-ng 1.0.6.rc1 Syslog-ng look squid/access.log, and write log file (with date format) on a remote server (tcp). On squid there is a logrotate at 6 am. My pb : before the log rotate, all is good. After logrotate, syslog-ng don't write in the remote file. The last line appear in this file was create at 6am. The process run on the both server, and i have no error. If i run syslog-ng restart, syslog-ng write the ligne in remote file . the next error appear after the next logrotate. Does anyone know why this is happening? thanks

1 0

List of Valid Source Addresess
by Daniel.N.Sferas＠us.hsbc.Com 10 Jul '03

10 Jul '03

Greetings, I would like to be able to validate that incoming syslog messages from the network are from "Well known" sources. Is there a way for syslog-ng to parse the source address against a flat file of IP addresses or patterns? I hesitate to use a match string in the syslog-ng.conf file as the filter would be very large. I am using 1.6.0rc3. Thanks in advance for any tips. Dan Sferas ************************************************************************ This E-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return E-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions. ************************************************************************

2 1

The syslog-ng process dies
by Madhvi Gokool 10 Jul '03

10 Jul '03

Hello I have noticed this problem twice now- I start syslog-ng manually from a script with the following command : - syslog-ng -f /etc/syslog-ng.conf Syslog messages get logged in their respective files/directories. However, some time during the night, the syslog-ng process dies by itself - The command ps -aux |grep syslog-ng yields no process ID and the log files show nothing. Syslog-ng version is 1.5.9 Is this a bug ?? Regards Madhvi

3 5

Dropped messages and UDP buffer sizes
by Clemson, Chris 10 Jul '03

10 Jul '03

Hello! We are trying to use syslog-ng to log messages from several servers. We get quite a few "dropped" messages from syslog-ng saying between 70 and 290 are being dropped each time. According to the list, it sounds like we need to increase out UDP receive buffer size. We are running suse 8.2 on a Pentium II 266 and a SCSI HD. The machine had 64mb in it, and we increased this to 128mb which didn't help. We get around the same number of "dropped" messages. We are logging from 5 machines, and getting ~9500 messages a day and we are making it log to just /var/log/messages at the moment. The network card is a 3com 3c905b (cyclone). Watching top for memory and processor usage doesn't indicate that anything is using a lot of either. Do we need to increase the UDP receive buffer? if so, where do we find it? it sounds worryingly like a kernel recompile job! Any help would be appreciated. thanks, chris -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

2 1

syslog-ng and logrotate
by yannick.haguenier＠tuxfamily.org 10 Jul '03

10 Jul '03

Hy, i have squid + syslog-ng 1.0.6.rc1 Syslog-ng look squid/access.log, and write log file (with date format) on a remote server (tcp). On squid there is a logrotate at 6 am. My pb : before the log rotate, all is good. After logrotate, syslog-ng don't write in the remote file. The last line appear in this file was create at 6am. The process run on the both server, and i have no error. If i run syslog-ng restart, syslog-ng write the ligne in remote file . the next error appear after the next logrotate. Does anyone know why this is happening? thanks

1 0

RE: [syslog-ng]The syslog-ng process dies
by Michael.Semling＠swisscom.com 10 Jul '03

10 Jul '03

Hi Madhvi, I had the same experience - I updated to 1.6.0rc3 and libol 0.3.10 since then I do not have this problem anymore. Regards, Michael -----Original Message----- From: Madhvi Gokool [mailto:madhvin@yahoo.com] Sent: Donnerstag, 10. Juli 2003 08:42 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]The syslog-ng process dies Hello I have noticed this problem twice now- I start syslog-ng manually from a script with the following command : - syslog-ng -f /etc/syslog-ng.conf Syslog messages get logged in their respective files/directories. However, some time during the night, the syslog-ng process dies by itself - The command ps -aux |grep syslog-ng yields no process ID and the log files show nothing. Syslog-ng version is 1.5.9 Is this a bug ?? Regards Madhvi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Does flags(fallback) work?
by Asher Yanich 09 Jul '03

09 Jul '03

Hi, I finally went ahead and upgraded my syslog-ng from 1.5.7 to 1.6.0r3. Previously, I used filter(DEFAULT) to catch all logs that had not matched anything else. I updated my config, to log { source(src); destination(d_default); flags(fallback); }; I however do not recieve anything to this destination, so it seems that fallback is broken? Can someone verify that this is the current state of syslog-ng? Thanks, -asher Asher Yanich Systems & Network Support Group Florida International University School of Computer Science "I've never had problems with 'extra time'. As far as I know, 'extra time' as a concept is right up there with Santa Claus and the Tooth Fairy." -Linus Torvalds

1 0

Regarding Php-Syslog-NG
by Perriero, Robert A. 07 Jul '03

07 Jul '03

ok, i have everything set up, and syslog-ng is working very nicely. Problem is that the script that runs to move logs from named pipe in /tmp to the mysql server does not work from cron. It works succesfully from a putty window, but that defeats the purpose. Does anyone have a working shell script for php-syslog-ng? My OS is Solaris 9 (SPARC). If anyone has this, could you please email me as soon as possible? Thanks in advance. Sincerely, Robert Perriero PS. Please don't send me the existing MySQL script that's currently on vermeer.org as that's the one I'm using. I need an updated script, or I need advice on how to get this to work correctly.

2 1