- syslog-ng - lists.balabit.hu

(no subject)
by Madhvi Gokool 21 Nov '02

21 Nov '02

Hello I have configured syslog on several routers and right now all the syslog messages are sent to one file. With syslog-ng, is it possible to have a log file for each router on the network. Regards madhvi

2 1

sylog-ng internal messages
by Guillaume LACHENAL 20 Nov '02

20 Nov '02

Where are syslog-ng internal() logged ? using destination d_hosts { file( "/var/log/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" ); }; i can't find anything relating to syslog-ng when grep'ing from /var/log/*/*/*/*/* thanks for help regards Guillaume

1 0

Syslog-ng 1.6
by Esteban Essed 20 Nov '02

20 Nov '02

Hi Balázs, Do you have any idea when you will be releasing 1.6? I mean a stable version of the 1.5 features. I know 1.5 is quite (very?) stable, but my employer only wants an official stable release. Regards, Esteban Essed. _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

File size limit exceeded??
by Nathan 19 Nov '02

19 Nov '02

i keep getting this error every time i try and start syslog-ng the system is redhat linux 2.4.18. any clues on why i'm getting this? thanks. io.c: Preparing fd 3 for reading io.c: listening on fd 4 syslog-ng version 1.4.17 starting gc_mark: Marking object of class 'syslog_backend' (0) gc_mark: Marking object of class 'syslog_config' (1) gc_mark: Marking object of class 'resource_list' (2) gc_mark: Marking object of class 'log_source_group' (2) gc_mark: Marking object of class 'afunix_source' (3) gc_mark: Marking object of class 'listen_fd' (4) gc_mark: Marking object of class 'afsocket_accept_callback' (5) gc_mark: Marking object of class 'io_fd' (5) gc_mark: Marking object of class 'log_reader' (6) gc_mark: Marking object of class 'afsocket_source_connection' (7) gc_mark: Marking object of class 'afinet_source' (8) gc_mark: Marking object of class 'inet_address_info' (9) gc_mark: Marking object of class 'object_queue' (9) gc_mark: Marking object of class 'log_source_group' (9) gc_mark: Marking object of class 'log_center' (10) gc_mark: Marking object of class 'log_connection' (11) gc_mark: Marking object of class 'log_endpoint_info' (12) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_dest_group' (14) gc_mark: Marking object of class 'log_dest_group' (15)gc_mark: Marking object of class 'log_dest_group' (16) gc_mark: Marking object of class 'log_dest_group' (17) gc_mark: Marking object of class 'log_dest_group' (18) gc_mark: Marking object of class 'log_dest_group' (19) gc_mark: Marking object of class 'log_dest_group' (20) gc_mark: Marking object of class 'affile_dest' (21) gc_mark: Marking object of class 'affile_dest' (20) gc_mark: Marking object of class 'affile_dest' (19) gc_mark: Marking object of class 'affile_dest' (18) gc_mark: Marking object of class 'affile_dest' (17) gc_mark: Marking object of class 'affile_dest' (16) gc_mark: Marking object of class 'affile_dest' (15) gc_mark: Marking object of class 'log_connection' (12) gc_mark: Marking object of class 'log_endpoint_info' (13) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_filter' (15) gc_mark: Marking object of class 'filter_expr_op' (16) gc_mark: Marking object of class 'filter_expr_pri' (17) gc_mark: Marking object of class 'filter_expr_op' (17) gc_mark: Marking object of class 'filter_expr_pri' (18) gc_mark: Marking object of class 'filter_expr_pri' (18)gc_mark: Marking object of class 'log_filter' (16) gc_mark: Marking object of class 'filter_expr_pri' (17) gc_mark: Marking object of class 'log_filter' (17) gc_mark: Marking object of class 'filter_expr_pri' (18) gc_mark: Marking object of class 'log_filter' (18) gc_mark: Marking object of class 'filter_expr_pri' (19) gc_mark: Marking object of class 'log_filter' (19) gc_mark: Marking object of class 'filter_expr_op' (20) gc_mark: Marking object of class 'filter_expr_op' (21) gc_mark: Marking object of class 'filter_expr_pri' (22) gc_mark: Marking object of class 'filter_expr_pri' (22) gc_mark: Marking object of class 'filter_expr_pri' (21) gc_mark: Marking object of class 'log_filter' (20) gc_mark: Marking object of class 'filter_expr_pri' (21) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_connection' (13) gc_mark: Marking object of class 'log_endpoint_info' (14) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_dest_group' (17) gc_mark: Marking object of class 'afuser_dest' (18) gc_mark: Marking object of class 'log_dest_group' (17) gc_mark: Marking object of class 'afuser_dest' (18) gc_mark: Marking object of class 'log_connection' (14) gc_mark: Marking object of class 'log_endpoint_info' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_connection' (15) gc_mark: Marking object of class 'log_endpoint_info' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_connection' (16) gc_mark: Marking object of class 'log_endpoint_info' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_connection' (17) gc_mark: Marking object of class 'log_endpoint_info' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'afsocket_source_close_callback' (6) gc_mark: Marking object of class 'unix_address_info' (4) gc_mark: Marking object of class 'object_queue' (4) gc_mark: Marking object of class 'log_source_driver' (4) io.c: Preparing fd 5 for reading io.c: Preparing fd 6 for writing io.c: Preparing fd 7 for writing io.c: Preparing fd 8 for writing File size limit exceeded

2 4

syslog-ng-1.4.17 crashes
by Heinz Ekker 19 Nov '02

19 Nov '02

Hi! I am using syslog-ng 1.4.17 with libol 0.2.24 on a central log host running RedHat 7.3. It all worked fine so far, until the load on the logging servers got higher and higher, resulting in about 900MB Logs daily. Then, syslog-ng started to die randomly, apparently not connected to any particular load peaks (at least as far as I was able to check), just the normal inferno. After finding and eliminating that d*mn RedHat's 'ulimit -c 0' in the rc-script, I got several core dumps, which, when examined with gdb, all show the following backtrace: (gdb) bt #0 0x400530a1 in kill () from /lib/libc.so.6 #1 0x40052e99 in raise () from /lib/libc.so.6 #2 0x40054364 in abort () from /lib/libc.so.6 #3 0x080529e5 in fatal () #4 0x080530a7 in xalloc () #5 0x080531f7 in ol_string_alloc () #6 0x0805068f in c_format () #7 0x08053501 in do_flush () #8 0x0805162d in write_callback () #9 0x080511d7 in io_iter () #10 0x08049c45 in main_loop () #11 0x08049f81 in main () #12 0x400421c4 in __libc_start_main () from /lib/libc.so.6 As far as I know, malloc only returns NULL, if it was unable to allocate the requested memory. The machine has 1 GB physical RAM and another Gig of Swap space. I'm running the sar data collector, and at all times there were loads of free memory. Swap stays untouched, the machine is not doing much besides syslogging. At loss for any solution, I did a panic upgrade to 1.5.23 with libol 0.3.5 today, when syslog-ng died 3 times within 30 minutes. So far it runs stable, but I'll know more tomorrow. My questions: Is this a bug in the 1.4 series? Can I sleep well while running 1.5 (marked as 'development')? It is imperative for us that no messages, or at least as few as possible, are lost, for dealing with abuse requests and customer inquiries. TIA, -- Heinz Ekker, mailto:heinz.ekker@uta.at Do not meddle in the affairs | UTA Systems Engineering Unix of wizards, for they are | 1220 Wien, Ares Tower Zelle 619 subtle and quick to anger. | Phone: +43 1 9009 4625/Fax -3697

2 5

RE: [syslog-ng]syslog-ng on Redhat 7.1 server
by Hamilton, Andrew 19 Nov '02

19 Nov '02

The configuration files normally reside in this directory. With most of the distributions usually a sample config file ends up in there. 1.4.11 is kind of old though. But here is a sample config file attached you can use. It is only a sample and will need to be modified to suit your environment. Also by default syslog-ng looks for syslog-ng.conf in /etc/syslog-ng. I'm not sure where the rpm would put the contents of the doc directory. Regards, Drew -----Original Message----- From: Madhvi Gokool [mailto:madhvin@yahoo.com] Sent: Tuesday, November 19, 2002 6:31 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng on Redhat 7.1 server hello i have downloaded the rpm for syslog-ng (syslog-ng-1.4.11-1.i386.rpm) and libol(libol-0.2.21-1.i386.rpm). I installed them on my server by using the command rpm -i syslog-ng-1.4.11-1.i386.rpm rpm -i libol-0.2.21-1.i386.rpm the syslog-ng directory is created under the /etc directory. However, the syslog-ng directory does not contain any files. Grateful if someone could help Regards madhvi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng on Redhat 7.1 server
by Madhvi Gokool 19 Nov '02

19 Nov '02

hello i have downloaded the rpm for syslog-ng (syslog-ng-1.4.11-1.i386.rpm) and libol(libol-0.2.21-1.i386.rpm). I installed them on my server by using the command rpm -i syslog-ng-1.4.11-1.i386.rpm rpm -i libol-0.2.21-1.i386.rpm the syslog-ng directory is created under the /etc directory. However, the syslog-ng directory does not contain any files. Grateful if someone could help Regards madhvi

1 0

Locals in Syslog.
by Jon Hofstad 14 Nov '02

14 Nov '02

Hello. I`m working on a project where I need to set up a syslog-environment. I have about 140 servers that needs to send their syslog-info to a centralized syslog-ng server. My challenge is that I need to identify each server with their own local-value. Default, syslog has a limitation in how many locals you can define, isn`t it 8? Has anyone had experience with changing this value to whatever number; e.g 100? Regards Jon Hofstad

2 1

Upgrade problems??
by Abraham, Ajamu 14 Nov '02

14 Nov '02

I updated my freeBSD server running syslog-ng 1.4.12 to syslog-ng 1.5.23. I installed the new libol 0.3.5 prior to the upgrade. It seemed to have installed correctly with no errors. However when I try to start the program I revieve this message: absys# /usr/local/sbin/syslog-ng -v binding fd 3, inetaddr: 0.0.0.0, port: 514 binding fd 5, inetaddr: 0.0.0.0, port: 514 unresolved reference: DEFAULT Error initializing configuration, exiting. I thought this must be related to the options I have chosen in my configuration file. Here is the top section of my syslog-ng.conf file, where I define my options: absys# vi /usr/local/etc/syslog-ng/syslog-ng.conf #syslog-ng configuration. # # what the default options are for files that it writes # options { sync(0); time_reopen(10); log_fifo_size(100); }; ############################################################## # Sources: ############################################################### source src { tcp(); udp(); internal(); }; ### FILTERS ### Please help...thanks in advance! Ajamu Abraham Network Engineer About, Inc. 249 West 17th Street 2nd Floor New York, NY 10011 Direct: 212.204.1525 Cell #: 917.682.2246 "l'argent comptant règne tout autour de moi"

2 1

Re: syslog-ng 2.x
by Balazs Scheidler 13 Nov '02

13 Nov '02

On Wed, Nov 13, 2002 at 05:35:10PM +0100, "Lacruz Gimeno, José" wrote: > Balazs, > > we would like to use syslog-ng on HP-UX boxes, but we've been told it won't > do a good job till version 2, where message padding is handled correctly. We > would like to know if there is an estimated release date for this version. hmm... I've implemented input padding in the latest 1.5.x versions as well, and I had at least one success reports. please give it a try (the option might be undocumented), but it is used this way: source s_hpux { pipe("/dev/log" pad_size(2048)); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0