- syslog-ng - lists.balabit.hu

Re: [syslog-ng]logs getting stomped on
by Brian Landers 02 Feb '03

02 Feb '03

Sorry to keep harping on this guys, but this is a ^%$#@ mystery! Once again, my mail log restarted at around 10:30pm tonight. Lest you think I'm just whining and not making an effort to solve this one, here's what I've come up with: 1) I've checked all of my crontabs and at jobs, and there's nothing that runs around that time. 2) Went through all the long-running processes. Nothing that would interact with syslog-ng or the log files directly. No processes started or restarted around that time in ps. No weird logins around that time that would seem to indicate operator error. 3) My /var/adm/messages file did NOT restart, just the mail logs coming in from the remote SSH tunnels. 4) I changed my syslog-ng.conf to not use macros for the filename, but rather to log to a static filename "current.log". Didn't help. 5) I added a second destination, breaking out the logs by hour: destination inboundlog { file("/system/inbound_mail/logs/current.log"); file("/system/inbound_mail/logs/$YEAR/$MONTH/$DAY/$HOUR.log"); }; current.log had the entire day's logs, and was truncated and restarted at 22:33:04, however the hourly log 2003/01/29/22.log was NOT, it kept right on ticking. 6) total size of messages logged up to 22:33:04 was approximately 29mb, so largefile issues should not be a factor. I'm at a loss here, folks. I'm ready to consult an exorcist. I seem to have a workaround in that my logs split out by hour don't appear to be getting truncated, but I'd love to track this one down. Any suggestions for things I've haven't considered or should I start shopping for goats and black candles? Thanks, Brian P.S. sorry for the threading issues, was reading through the web archives but I've now joined the list since I'm busily replacing Solaris syslog everywhere with syslog-ng! -- "We've heard that a million monkeys at a million keyboards coud produce the complete works of Shakespeare; now, thanks to the Internet, we know that is not true."

2 2

messages with newlines
by Dmitry Frolov 01 Feb '03

01 Feb '03

Hello! I encountered some problems with syslog-ng 1.5.25, while trying to separate logs by program name. Our developers often use multiline log messages, stack traces for example. The problem is that when multiline message received via network (udp) it is logged as several lines, and only first line has program name in it. So, when i configure 'program' filter, it only catches first line. Example: We are logging this message and it is sent to loghost (in one udp packet, tested with snoop). <30>Jan 31 13:51:30 Yadda yadda[17245]: Time to die. die now! Loghost writes it in this way: Jan 31 13:42:29 host yadda[17231]: Time to die. Jan 31 13:42:29 host die now! The second line "die now!" will not match 'program' filter. I suppose it would be correct to replace all '\n', '\r', etc in log messages and log them as single line as common syslogd does in any case and as syslog-ng does when source is unix domain socket. Another problem is that first word of program name disappears. if program name is missing, the first word of log msg disappears instead. Here's script to send log message used in my example. #!/usr/bin/perl -w use strict; use Sys::Syslog; # all except setlogsock, or: use Sys::Syslog qw(:DEFAULT setlogsock); # default set, plus setlogsock my $ident = 'Yadda yadda'; my $logopt = 'pid,ndelay'; my $facility = 'daemon'; my $priority = 'info'; my $format = "Time to die.\ndie now!"; my @args; setlogsock 'unix'; openlog $ident, $logopt, $facility; syslog $priority, $format, @args; closelog; -- Dmitry Frolov, Zenon N.S.P. (095) 250-4629, http://www.zenon.net/

3 4

Writers wanted, readers needed
by Zachie 01 Feb '03

01 Feb '03

Poetrylist is a literary journal based in Maryland whose goal is to give writers of poetry, both beginners and professionals, exposure. Through our efforts we hope to bring more diversity to the online literary world. Poetrylist at this time reaches 400 subscribers from over 24 different nations. The newsletter is sent out on the fifteenth of every month. To subscribe, email poetrylist_editor(a)yahoo.com for more information. Poetrylist is currently looking for staff members, both editorial and technical, email us your résumé for consideration. Email Zach back for more info. Please mention ID# 121 To be remove please type remove me in the subject line.

1 0

RE: [syslog-ng]Please help with simple syslog-ng.conf creation qu estions....
by Hamilton, Andrew 01 Feb '03

01 Feb '03

Nope. But you can do this: source s_all{ unix-stream("/dev/log"); internal(); }; destination d_messages { file("/var/log/messages"); }; log { source(s_all); destination(d_messages); }; That should do it. If you are using Solaris you should use source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; Look in the syslog-ng/doc directory for sample configs. Regards, Drew -----Original Message----- From: seberino(a)spawar.navy.mil [mailto:seberino@spawar.navy.mil] Sent: Thursday, January 30, 2003 2:01 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Please help with simple syslog-ng.conf creation questions.... configure;make;make install of syslog-ng source did not create /etc/syslog-ng directory with /etc/syslog-ng.conf ready to go. I assume I must create this directory and file myself??? syslog-ng has *tons* of features. Please tell me how I can just throw everything into /var/log/messages. I don't require fancy stuff just yet. In old syslog.conf this would be: *.info /var/log/messages Will syslog-ng recognize a one line syslog-ng.conf containing this old style config??? thanks, Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2363 49590 Lassing Road, Room A339 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-7940 Fax: (619) 553-1269 Email: seberino(a)spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Please help with simple syslog-ng.conf creation questions....
by seberino＠spawar.navy.mil 30 Jan '03

30 Jan '03

configure;make;make install of syslog-ng source did not create /etc/syslog-ng directory with /etc/syslog-ng.conf ready to go. I assume I must create this directory and file myself??? syslog-ng has *tons* of features. Please tell me how I can just throw everything into /var/log/messages. I don't require fancy stuff just yet. In old syslog.conf this would be: *.info /var/log/messages Will syslog-ng recognize a one line syslog-ng.conf containing this old style config??? thanks, Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2363 49590 Lassing Road, Room A339 San Diego, CA 92152-6147 U.S.A. Phone: (619) 553-7940 Fax: (619) 553-1269 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

template() and template_escape() extension for all destination drivers
by Achim Gsell 30 Jan '03

30 Jan '03

Hi, On Wed, Oct 30, 2002 at 20:47:55+0100, Balazs Scheidler wrote: > I came to having some time to integrate pending patches, and found your > patch. I have a couple of comments, which needs to be fixed before releasing > a syslog-ng with these parts integrated. > > * expand_macro & friends should be declared in a header file instead of > declaring it in every referencing module. maybe a new file called > macros.c would be a good way of resolving this problem. > * expand_macros returns a newly allocated string, which must be freed, so > constructs like this cause memory leaks: > + if (self->template_output) > + A_WRITE_STRING(&self->dest_buf->super, > + c_format("<%i>%S\n", > + msg->pri, > expand_macros(self->cfg, self->template_output, self->template_escape, msg))); > > c_format() has an option to free an ol_string by specifying 'f' like this: > > c_format("%fS", expand_macros()) ... > Otherwise your patch looks ok to me. If you want to have it integrated prior > to 1.6.0 is being released, please send a modified diff. In the attachment you find a revised version of the patch. The functions "expand_macros()" & friend are now declared in "macros.h" and coded in "macros.c". The memory leaks are fixed ... Achim

1 0

Differences between 1.5.x and 1.4.x
by Brian E. Seppanen 30 Jan '03

30 Jan '03

How stable is the 1.5.x series of syslog-ng release, and is the only difference that 1.5.x is a development tree? Are their significant configuration file differences? Where would I find information on variations and additional features within 1.5.x series? Thanks for all the help Brian Seppanen seppy(a)chartermi.net 906-228-4226 ext 23

2 1

RE: [syslog-ng]Question about syslog-ng conf file syntax...
by Michael Breton 30 Jan '03

30 Jan '03

> -----Original Message----- > From: Ryan Dooley [mailto:dooleyr@missouri.edu] > Sent: Wednesday, January 29, 2003 4:53 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Question about syslog-ng conf file syntax... > > > Hello All, > > I have a question about syslog-ng conf file... I have a destination > filter that looks like this: > > destination d_somefile { > file("/path/to/file"); > }; > > That "syslog-ng -s" says there is a syntax error... Any ideas? I have a hunch that the third line with the }; need to start with whitespace to be considered on the same line. Michael Breton Commtel

2 2

Question about syslog-ng conf file syntax...
by Ryan Dooley 29 Jan '03

29 Jan '03

Hello All, I have a question about syslog-ng conf file... I have a destination filter that looks like this: destination d_somefile { file("/path/to/file"); }; That "syslog-ng -s" says there is a syntax error... Any ideas? Cheers, Ryan

2 1

RE: [syslog-ng]UDP syslog not being logged by syslog-ng
by Hamilton, Andrew 29 Jan '03

29 Jan '03

Glad you figured it out. Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 1:11 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Drew, Thanks for you help. It was me being stupid! It's the Red Hat firewall stopping it working! Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 5:14 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Joel, I'm not sure this will really make a difference and it may just be a typo in the message, but in the filters you have authprov which should be authpriv, I believe. You could also try logging just source, destination and not use any filters to see what you are getting. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 12:02 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng They are in the local log files either. I tried changing the parameter to yes and still no success. Thanks for the ideas so far... Joel -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: 29 January 2003 2:23 pm To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]UDP syslog not being logged by syslog-ng Did you check the log file for the log server host? You have keep_hostname(no) so I think that the machine will log as from the local log server. Check to see if they are in the local host log file. Regards, Drew -----Original Message----- From: Moxey, Joel, CND Tech Dev, VF UK [mailto:Joel.Moxey@gb.vodafone.co.uk] Sent: Wednesday, January 29, 2003 9:08 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]UDP syslog not being logged by syslog-ng Hi! I'm having some problems getting remote hosts to log as desired to a log server. I'm using version 1.4.17 on Red Hat with the following config: #Start options { sync(0); log_fifo_size(1000); use_dns(no); use_fqdn(no); create_dirs(no); keep_hostname(no); }; source s_all { pipe("/proc/kmsg"); unix-stream("/dev/log"); udp(localip(A.B.C.D) localport(514)); internal(); }; destination d_notauth { file("/systems/$HOST/messages" perm(0644)); }; destination d_auth { file("/systems/$HOST/authmsg"); }; filter f_notauth { not facility(auth, authprov); }; filter f_auth { facility(auth, authprov); }; log { source(s_all); filter(f_notauth); destination(d_notauth) }; log { source(s_all); filter(f_auth); destination(d_auth) }; #End I have created appropriate directories for each remote host, and each host has an entry in the /etc/hosts file. Using logger, I have confirmed the config works as desired for the log server. However, using logger on remote hosts (I've tried Solaris and Red Hat), I can not seem to get the message written to file. I have confirmed using tcpdump that the messages reach the log server, and can see by netstat that the UDP socket is open. I thought it might be because of the $HOST part, but also tried using destinations without this to no success. Any suggestions to what my problem might be? Thanks for any help, Joel _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0