- syslog-ng - lists.balabit.hu

Lost CR-LF ?
by Hypo 10 Jan '03

10 Jan '03

Hi all, I' have a question regarding syslog-ng. I'm using last development version and I tried to stress test it using a message generator ( Kiwi ). I configured syslog-ng to accept remote messages via both UDP and TCP. Then I start sending lot messages like 100msg/s burst and 500msg/s burst. In UDP mode I just lost some messages, but I expected that. In TCP mode there's a strange behaviour. What happened is that when I use TCP and send a lot ( 100/sec and more ) msg a time , syslog-ng will 'forgot' a carriage return between each line, and put all them on a single line. I cannot understand why. This will not happen when i send less messages for second. Any clue ? Amodiovalerio Verde

2 1

source unix-dgram - Unsupported address family
by Carlos Velasco 10 Jan '03

10 Jan '03

Hi, I have successfully compiled libol-0.3.6 and syslog-ng-1.5.24 All works ok, messages are logged. However, when I use source unix-dgram for /dev/log, I see these messages in the syslog logs Jan 9 17:07:26 syslog:err syslog-ng: syslog-ng[179]: io.c: sockaddr2info(): Unsupported address family 64000 (addrlen=256). Jan 9 17:07:36 syslog:err syslog-ng: syslog-ng[179]: io.c: sockaddr2info(): Unsupported address family 64000 (addrlen=256). Jan 9 17:07:36 syslog:err syslog-ng: syslog-ng[179]: io.c: sockaddr2info(): Unsupported address family 64000 (addrlen=256). Jan 9 17:07:37 syslog:notice syslog-ng: syslog-ng[179]: syslog-ng version 1.5.24 going down Jan 9 17:00:29 syslog:notice syslog-ng: syslog-ng[4220]: syslog-ng version 1.5.24 starting Jan 9 17:00:30 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 35703 (addrlen=256). Jan 9 17:00:30 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). Jan 9 17:00:31 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). Jan 9 17:00:31 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). Jan 9 17:00:31 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). Jan 9 17:01:44 syslog:err syslog-ng: syslog-ng[4220]: io.c: sockaddr2info(): Unsupported address family 62912 (addrlen=256). As you can see, numbers change when I stop and start syslog-ng. Also, if I use unix-stream, it works, but I'm using klogd 1.4.1 and need dgram. My system is: Linux 2.4.20 glibc 2.3.1 Any suggestions? Regards, Carlos Velasco

1 2

[syslog-ng 1.4.17] configuration error
by Arno Luppold 10 Jan '03

10 Jan '03

Hi! I'm trying to set up syslog-ng, but it fails at startup. I'm using this configuration (excerpt): filter f_news { facility(news); }; filter f_mail { facility(mail); }; filter f_local { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_firewall { match("SuSE-FW"); }; filter f_messages { not filter(f_firewall) not filter(f_mail) not filter(f_news); }; # that's normally at the same line as f_messages When I try to run syslog-ng I get this error message: parse error at 25 Parse error reading configuration file, exiting. At line 25 there's the f_message filter. If I use filter f_message { not filter(f_firewall); }; it's working fine. But as soon as I add another "not" I get the error posted above. Can anyone tell me where's my mistake, please? :-) Arno

2 2

postfix requiring syslog?
by netsec novice 09 Jan '03

09 Jan '03

I am using SuSE 8.1 to build a cental syslog server and have installed syslog-ng. I need to run postfix in order to send alerts. Now that I have disabled syslog and enabled/installed syslog-ng, postfix no longer starts on its own at boot. When I attempt to start it manually, it responds that syslog is required to be running to start postfix.. do I want to start syslog? If I say yes then postfix starts fine but I don't really want to be running syslog AND syslog-ng do I? Linux is new to me so I apologize for my ignorance. Is there a simple work-around to tell postfix to use syslog-ng rather than syslog? I guess I don't understand where this dependency comes from. Any help is appreciated. N _________________________________________________________________ MSN 8 helps eliminate e-mail viruses. Get 2 months FREE* http://join.msn.com/?page=features/virus

3 2

v1.5.23 crashes
by Joerg Sommer 09 Jan '03

09 Jan '03

Hi, I don't know since when and what I did before, but my syslog-ng crashes. I the core dump I saw, it prints a message "io.c: sockaddr2info(): Unsupported address family %i.\n" where %i is 27749. But the value of %i changes with every crash. The crashes occures in line 1032 of the file io.c. But the error is before. The addr parameter in do_read_line (sources.c:61) is a invalid value for an address family. I couldn't find the piont, where the incorrect address family is set. Is this a known bug? Bye, Joerg.

2 1

RE: [syslog-ng]sending mail
by Michael.Semling＠swisscom.com 08 Jan '03

08 Jan '03

Hi N! If you really need an SMTP server running, I can highly recommend postfix. Otherwise, set up the mailhost correctly and use the mailx programm. e.g. for an empty message mailx -v -s test_email John.Doe(a)mailinglist.net </dev/null -v to see all the messages. But maybe I misunderstood your question and you just want to read the mails? Generally the mails are stored under /var/mail/<user>, you can easily read them be entering the command "mail" You'll see the mail list. Just type the number and you have the content. Regards, Michael -----Original Message----- From: netsec novice [mailto:netsec9@hotmail.com] Sent: Dienstag, 7. Januar 2003 22:03 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]sending mail I am a linux newbie - sorry. I already have an SMTP server on my network. Can I use mail from within syslog-ng to send messages to my account for alerting purposes without configuring a full blown mail server on my linux box? I don't know if there is a default SMTP client on linux (SuSE 8.1) or how to configure it. any help is appreciated N _____ The new MSN 8 is here: Try it free* for 2 months <http://g.msn.com/8HMEEN/2018> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]sending mail
by Hamilton, Andrew 08 Jan '03

08 Jan '03

You don't need a mail server running to SEND mail. Most, if not all, UNIX flavors come with some form of mail client, most of which are based upon some version of sendmail. However, you will need to send it to a mail SERVER. You'll have to check for a mail client, since I don't use SuSE I can't tell you where one will be, I have used several other flavors of Linux and they have all had the "mail" client. You could set up your mail program inside your syslog-ng.conf the same as you would to any other program by using the "program" key word in a destination. The message from syslog-ng is then passed to the program as an argument I believe. If you are using syslog-ng version 1.5.x, you can also use templates to format the message passed to the program. Or you can write a small program that parses the message sent to it from syslog-ng and then use that program to intelligently send mail. I think that is the best option since then you can control what you send and how you send it as opposed to trying to make syslog-ng do it. If you have a busy syslog-ng host, that could slow it down and you don't want that. Regards, Drew -----Original Message----- From: netsec novice [mailto:netsec9@hotmail.com] Sent: Tuesday, January 07, 2003 4:03 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]sending mail I am a linux newbie - sorry. I already have an SMTP server on my network. Can I use mail from within syslog-ng to send messages to my account for alerting purposes without configuring a full blown mail server on my linux box? I don't know if there is a default SMTP client on linux (SuSE 8.1) or how to configure it. any help is appreciated N _____ The new MSN 8 is here: Try it free* for <http://g.msn.com/8HMEEN/2018> 2 months _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

caching/tcp fault tolerant syslog?
by Aleksandr Koltsoff 08 Jan '03

08 Jan '03

hello (pls cc the replies, I'm not on the list) I have the following scenario: about 20 linux boxes in separate geographical areas, connected via WAN links which I don't completely trust. what I would like is this: run syslog-ng on each box, they should not write to files, but instead they should send all their messages over to a central log server so far so good :-) in the event of tcp-breakage (when the client boxes cannot reach the server via tcp, maybe with some keepalive "pings"), the syslogd should firstly start collating the log messages into memory (size settable by user), after that to disk (or directly to disk, if memory cache size is 0)). after some retries, cached log entries should be flushed to central server once connection is established. I went trough the archives (not all of them, but some) and seems that some ppl could use this functionality as well. basically I think couple of options, write my own syslogd or start hacking on syslog-ng, or, write a fault transparent buffering program that would implement all this and stick with stock syslog-ng that would always feed this program. any ideas on this? Aleksandr Koltsoff

1 0

sending mail
by netsec novice 07 Jan '03

07 Jan '03

1 0

Re: [syslog-ng]replacing part of prog name with hostname
by Noam Meltzer 07 Jan '03

07 Jan '03

I thing you confused it a little... According to my last message (and a similar thread I created recently) The problem with the hostname resolving of Solaris is fixed with using: keep_hostname(no) But, I would really like to understand what's going on in there. Is my assumption correct? Noam --- On Thu 01/02, Balazs Scheidler wrote:From: Balazs Scheidler [mailto: bazsi(a)balabit.hu]To: syslog-ng(a)lists.balabit.huDate: Thu, 2 Jan 2003 10:43:45 +0100Subject: Re: [syslog-ng]replacing part of prog name with hostnameOn Tue, Dec 31, 2002 at 02:05:34PM -0800, Nate Campi wrote:> I have syslog-ng 1.5.24 on solaris 8, reading from /etc/.syslog_door and> I have a log entry like this:> > Dec 31 13:48:15 larry 6.0[8704]: [ID 702911 local0.warning] [0] Can't> stat file in FlushFile [news/PointCast]: No such file or directory> > ...but the program name was sent from the app was: "ctlds 6.0[8704]:"> and syslog-ng replaced the first part of the messed up program name with> the host's name. > > In the next version, can syslog-ng "learn" that it don't get a hostname> from solaris ever and that the entire text coming in is actually the log> message? I'm losing information this way. I wonder how many other apps> split up the program name and lose data - most people would never know> as end users.the problem is ctlds sends a space in the program name tag, thus syslog-nginterprets 'ctlds' as hostname and '6.0' as program name. askeep_hostname() is set to no it rewrites originating host name.Try setting keep_hostname() to yes, it will not touch the hostname then.-- BazsiPGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

4 10