- syslog-ng - lists.balabit.hu

syslog-ng crash
by Chriss 19 Mar '03

19 Mar '03

Hello List, my syslog-ng "loghost" crash every 1-5 minute, so I did the update to 1.6.0rc1, but the problem still exist. The service died with a "Segmentation fault". A run in debug mode and/ore strace report: ----->8------schnipp-----8<----------------------------------- time(NULL) = 1047983908 time(NULL) = 1047983908 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ ----->8------schnapp-----8<----------------------------------- after the last logging entry. The os is a debian unstable on a Siemens Nixdorf 2x333Mhz server. Anybody with an idea? Bye Bye, Chriss mailto:syslog-ng@kordesee.de ---- Turn your Pentium into a Gameboy: Type WIN at C:\>

3 7

syslog-ng 1.4.17 / cron messages / RH 7.3
by Tim Sheets 19 Mar '03

19 Mar '03

Hello group, I have just installed syslog-ng 1.4.17 and playing with it on RH 7.3 Initially I was getting crond messages in my logs (was attempting to send them to a separate cron log file, but they were ending up in both /var/log/cron as well as the standard /var/log/messages files. I tried to change the filter (I hadn't matched the case, etc...) thinking that may help. The messages stopped going to both places. I have tried various things like changing it back, re-organizing the filter/log statements (grasping at straws), and added a log entry for filter(DEFAULT), but I still can't seem to get them to come back. Here is my conf file: options { sync(0); chain_hostnames(no); dir_perm(0755); perm(0644); time_reopen(10); log_fifo_size(1000); long_hostnames(off); use__dns(yes); use_fqdn(yes); create_dirs(yes); keep_hostname(yes); }; source s_sys { unix-stream("/dev/log"); internal(); udp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_hosts { file("/var/syslog/hosts/$YEAR/$MONTH/$HOST" owner(root) group(root) perm(0644) dir_perm(0700) create_dirs(yes)); }; destination d_mlal { usertty("*"); }; destination d_cron { file("/var/log/cron"); }; filter f_auth { facility(authpriv); }; filter f_cron { facility(CROND) or facility(cron); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_spooler { facility(uucp) or (facility(news) and level(crit)); }; filter f_boot { facility(local7); }; filter f_hosts { facility(local3) or facility(local4); }; # filter f_mesg { level(info) or facility(mail) or facility(authpriv) or facility(user) and not facility(cron); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_spooler); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_hosts); destination(d_hosts); }; # log { source(s_sys); filter(f_mesg); destination(d_mesg); }; log { source(s_sys); filter(DEFAULT); destination(d_mesg); }; Here is a sample of the /var/log/cron file that has a couple of the messages that aren't showing up: Mar 6 15:10:00 chumly CROND[6213]: (root) CMD (/home/mrtg/run-rrd-cfgs) Mar 6 15:15:00 chumly CROND[6232]: (root) CMD (/home/mrtg/run-rrd-cfgs) I have implemented the init.d file that is included in the contrib directory, and between config file changes, used service syslog-ng restart to kick it into re-reading the new conf file. Any ideas what I am doing wrong, or where to start looking? I am relatively new to the whole linux world, but trying very hard to get a handle on things. :-) Any help is appreciated. Tim _________________________________________________________________ Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

2 1

TCP reconnections randomly failing
by Xavier de Labouret 19 Mar '03

19 Mar '03

Hello, We are using syslog-ng with a central loghost. Our applications run on remote servers, all their syslog logs being forwarded to the central loghost with TCP forwarding. However, we are facing a problem now with TCP reconnections. Sometimes, we have to restart the syslog-ng daemon on our central loghost. And when this happens, some clients fail to reconnect to the loghost. The failing client syslog-ng complains about being unable to reconnect, tries a variable number of reattempts, and then gives up. On the server side, nothing is logged on these failed attempts. We have no clue on why this fails on some servers and not on the others. The maximum number of TCP connections on our loghost is set to 100, and this number is never approached, by far. To have the TCP connection come back again with the remote server, we must restart the client syslog-ng daemon. Here are our logs on the client daemon: -----------------8<--------------------- Mar 10 09:41:43 java-as02 syslog-ng[23311]: io.c: do_write: write() failed (errno 32), Broken pipe Mar 10 09:41:43 java-as02 syslog-ng[23311]: Connection broken, reopening in 1 seconds Mar 10 09:41:45 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:46 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:47 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:49 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:50 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:51 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:52 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:53 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds ----------------->8--------------------- We can see 8 reconnection attempts, and then no more message. Last precision: we are running syslog-ng 1.4.16 on Debian/Linux platforms. Here are my questions: - could there be a weakness in the TCP reconnection procedure of syslog-ng 1.4.16? - we don't think this comes from our network equipments. Maybe we could get more traces of the syslog-ng behaviour in these cases. How could we do it (options/tools)? - can we toggle some parameters now to make this less probably happen (augmenting the reconnection delay...)? - or maybe we should use syslog-ng 1.5.25? Thank you in advance, Xavier de Labouret

2 1

Syslog-NG on Mac OSX?
by Blaise St-Laurent 19 Mar '03

19 Mar '03

So i picked up a powerbook recently, and i was looking around in the init files, and noticed it's using the syslogd from the BSD system (which of course, is what i expected). I've been thinking of moving it over to syslog-ng but i noticed something quite strange... syslogd's startup script first deletes the /dev/log entry, and then starts up the daemon, which to me means that the syslogd daemon creates the dev entry itself. Am I correct in assuming this? If i want to install syslog-ng onto my mac, how do i emulate this functionality? has anyone done this yet? Blaise St-Laurent Senior Security Architect 613-266-4258 ____________________________________________________________________ Okiok Data http://www.okiok.com (450) 681-1681 Solutions de sécurité d'entreprise et d'affaires électroniques Enterprise and e-business security solutions This e-mail message (including attachments, if any) is intended for the use of the individual or entity to which it is addressed and may contain information that is privileged, proprietary, confidential and exempt from disclosure. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender and erase this e-mail message immediately. Le présent message électronique (y compris les pièces qui y sont annexées, le cas échéant) s'adresse au destinataire indiqué et peut contenir des renseignements de caractère privé ou confidentiel. Si vous n'êtes pas le destinataire de ce document, nous vous signalons qu'il est strictement interdit de le diffuser, de le distribuer ou de le reproduire. Si ce message vous a été transmis par erreur, veuillez en informer l'expéditeur et le supprimer immédiatement.

1 0

File Permissions Not Being Set
by Collin Lichtenberger 19 Mar '03

19 Mar '03

Could anyone be able to give me an idea of what is going on with my system. I am running Redhat 8.0 with syslog-ng 1.4.17. I use it to watch network devices. The devices log to syslog-ng running on my RH8 box. Syslog-ng runs and creates log files like it should except the permission on the files are always the default 600. Even though my config file looks like this: /etc/syslog-ng/syslog-ng.conf - ... destination d_snmptrapd { file("/var/log/snmptrapd" perm(0644) ); }; destination d_radiusd { file("/var/log/radiusd"); }; destination d_nethost { file("/var/log/net/$HOST/$YEAR$MONTH$DAY" owner(apache) group(apache) perm(0644) dir_perm(0755)create_dirs(yes) ); }; destination d_nethost_clump { file("/var/log/net/netdevice" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes) ); # Special ... log { source(s_src); filter(f_snmptrapd); destination(d_snmptrapd); }; log { source(s_src); filter(f_radiusd); destination(d_radiusd); }; log { source(s_src); filter(f_all); destination(d_all); }; # # Network Logging # log { source(s_net); destination(d_nethost); }; log { source(s_net); destination(d_nethost_clump); };}; - Even though I have the permissions set as something else it still creates files with 600 permission instead of 644 like it's instructed. (This is for any file it creates.) Though syslog-ng will create the file in the correct directories. I am thoroughly confused and would appreciate any help. Thank You. Thanks, COLLIN

2 1

Syslog-NG & MySQL.....
by Matthias Krawutschke 19 Mar '03

19 Mar '03

Sander, i have read your email, that you are running an SYSLOG - Server on Solaris 8 with MySQL. Can you tell me please, how does it works or can you send me your files? I must create these environment too here in my office. Kind regards and thank you for advance ..... Matthias Krawutschke

1 0

help
by toohs 19 Mar '03

19 Mar '03

Please unsubscribe me. thank you. regards, han soon

1 0

RE: [syslog-ng]TCP reconnections randomly failing
by Hamilton, Andrew 18 Mar '03

18 Mar '03

You should at the very least move to the most recent 1.5.* line. The 1.6.* line though still a release candidate is very stable and I would recommend it. There are some bugs in the 1.4.* line that were corrected in later releases. Regards, Drew -----Original Message----- From: Xavier de Labouret [mailto:Xavier.de_Labouret@cvf.fr] Sent: Tuesday, March 18, 2003 5:50 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]TCP reconnections randomly failing Hello, We are using syslog-ng with a central loghost. Our applications run on remote servers, all their syslog logs being forwarded to the central loghost with TCP forwarding. However, we are facing a problem now with TCP reconnections. Sometimes, we have to restart the syslog-ng daemon on our central loghost. And when this happens, some clients fail to reconnect to the loghost. The failing client syslog-ng complains about being unable to reconnect, tries a variable number of reattempts, and then gives up. On the server side, nothing is logged on these failed attempts. We have no clue on why this fails on some servers and not on the others. The maximum number of TCP connections on our loghost is set to 100, and this number is never approached, by far. To have the TCP connection come back again with the remote server, we must restart the client syslog-ng daemon. Here are our logs on the client daemon: -----------------8<--------------------- Mar 10 09:41:43 java-as02 syslog-ng[23311]: io.c: do_write: write() failed (errno 32), Broken pipe Mar 10 09:41:43 java-as02 syslog-ng[23311]: Connection broken, reopening in 1 seconds Mar 10 09:41:45 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:46 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:47 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:49 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:50 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:51 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:52 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:53 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds ----------------->8--------------------- We can see 8 reconnection attempts, and then no more message. Last precision: we are running syslog-ng 1.4.16 on Debian/Linux platforms. Here are my questions: - could there be a weakness in the TCP reconnection procedure of syslog-ng 1.4.16? - we don't think this comes from our network equipments. Maybe we could get more traces of the syslog-ng behaviour in these cases. How could we do it (options/tools)? - can we toggle some parameters now to make this less probably happen (augmenting the reconnection delay...)? - or maybe we should use syslog-ng 1.5.25? Thank you in advance, Xavier de Labouret _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

TCP reconnections randomly failing
by Xavier de Labouret 18 Mar '03

18 Mar '03

Hello, We are using syslog-ng with a central loghost. Our applications run on remote servers, all their syslog logs being forwarded to the central loghost with TCP forwarding. However, we are facing a problem now with TCP reconnections. Sometimes, we have to restart the syslog-ng daemon on our central loghost. And when this happens, some clients fail to reconnect to the loghost. The failing client syslog-ng complains about being unable to reconnect, tries a variable number of reattempts, and then gives up. On the server side, nothing is logged on these failed attempts. We have no clue on why this fails on some servers and not on the others. The maximum number of TCP connections on our loghost is set to 100, and this number is never approached, by far. To have the TCP connection come back again with the remote server, we must restart the client syslog-ng daemon. Here are our logs on the client daemon: -----------------8<--------------------- Mar 10 09:41:43 java-as02 syslog-ng[23311]: io.c: do_write: write() failed (errno 32), Broken pipe Mar 10 09:41:43 java-as02 syslog-ng[23311]: Connection broken, reopening in 1 seconds Mar 10 09:41:45 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:46 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:47 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:49 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:50 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:51 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:52 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds Mar 10 09:41:53 java-as02 syslog-ng[23311]: Error connecting to remote host (62.160.234.84), reattempting in 1 seconds ----------------->8--------------------- We can see 8 reconnection attempts, and then no more message. Last precision: we are running syslog-ng 1.4.16 on Debian/Linux platforms. Here are my questions: - could there be a weakness in the TCP reconnection procedure of syslog-ng 1.4.16? - we don't think this comes from our network equipments. Maybe we could get more traces of the syslog-ng behaviour in these cases. How could we do it (options/tools)? - can we toggle some parameters now to make this less probably happen (augmenting the reconnection delay...)? - or maybe we should use syslog-ng 1.5.25? Thank you in advance, Xavier de Labouret

1 0

syslog-ng dies on reload
by Florian Heissenhuber 17 Mar '03

17 Mar '03

Hi, I'm using syslog-ng on our central syslog server and it works really great. However I've found the following problem as I added a new filter rule: I've added a filter rule that filters specific error messages and sends these error messages to a shell script that generates a SNMP traps. The relavant configuration lines look as follows: destination snmpsend { program("/data/scripts/pix_snmp_send.ksh "); }; filter f_SNMPTRAP1 { match('PIX-1-10100[1-5]|PIX-1-102001'); }; log { source(net); filter(f_SNMPTRAP1); destination(snmpsend); }; If I send a reload signal to syslog-ng (kill -HUP) the first time, everything is OK. Syslog-ng reloads its configuration and the following messages is found in /var/log/messages: Mar 17 11:15:47 pixsysl01 syslog-ng[11020]: new configuration initialized Mar 17 11:15:46 pixsysl01 syslog-ng[11020]: SIGHUP received, restarting syslog-ng If I send a reload signal to syslog-ng (kill -HUP) the next time, syslog-ng dies with the following message: Mar 17 11:17:36 pixsysl01 syslog-ng[11020]: new configuration initialized Mar 17 11:17:35 pixsysl01 syslog-ng[11020]: SIGHUP received, restarting syslog-ng Mar 17 11:17:36 pixsysl01 syslog-ng[11020]: syslog-ng version 1.5.26 going down Since I'm using logrotate for automatic log rotation, syslog-ng is reloaded more than once a day (and dies with the second reload). Any idea what's wrong? I've already tried version 1.6rc1, but it has the same effect! Regards, Florian -- Florian Heissenhuber

1 0