- syslog-ng - lists.balabit.hu

syslog-n limits.
by Luc Mazardo 12 Nov '02

12 Nov '02

hello, I use syslog-ng (syslog-ng-1.4.17) and try to do some benchmarks with it. I've some problems for tuning it. The load average of syslog is more than 10.0 on a bi PIII 860 on a linux box decreasing to 2.0. My test is 50 clients simultaneously (using syslog() system call) with 500 logs per second during 5 minutes. Here is the option i use: options { use_dns(no); long_hostnames(off); sync(100); log_fifo_size(5000); gc_idle_threshold(50);gc_busy_threshold(5000); }; source src { unix-stream("/dev/log" max-connections(100)); internal(); udp(); }; Is there a different parameter to use for not increasing so much the load avg ? Thanks in advance. -- Luc.Mazardo(a)cvf.fr

1 0

TCP Questions
by Jeff McReynolds 12 Nov '02

12 Nov '02

We are in need of a solution to move many different kinds of logs across our network. Traditionally our developers have pretty much just dumped log files where ever which of course is unmanagable after a while. We are currently using NG with Apache and are comfortable with the idea of loosing a log every now and then. What we cannot do is loose logs that our developer's applications are sending to the server. It appeared that a good way to accomplish this would be to use the TCP functionality built into NG. I have had some difficulty getting NG to accept the parameters listed on the docs page for the TCP connection. I even copied them verbatim at one point and still receive a parse error on the destination line in question. So, Two questions I guess: 1.) Can the TCP functionality be used as a fault tolerant solution for our developers logging needs? 2.) Does anyone have any suggestion as to why the following line would fail? destination d_joust { tcp("192.168.30.225" port(1999); localport(999)); }; <------------ Line 22 causing the parse error. filter f_tcp { (level(info) and facility (local7)); } log { source(s_sys); filter(f_tcp); destionation(d_joust); }; parse error at 22 Parse error reading configuration file, exiting. Thanks for any suggestions. -JMc

2 1

Re: syslog-ng and Solaris 8
by Balazs Scheidler 12 Nov '02

12 Nov '02

On Mon, Nov 11, 2002 at 12:45:18PM -0800, Rude Yak wrote: > Hello, Baszi. I'm having some stability issues on Solaris 8 and I'm not > quite sure how to best go about resolving them. Occasionally, I will notice > syslog-ng crashing, most often after receiving a UDP-based message. Running in > debug mode, I see the following: > > bash-2.05a# /apps/syslog-ng/current/sbin/syslog-ng -vdF -f > /apps/syslog-ng/etc/syslog-ng.conf > binding fd 3, inetaddr: 0.0.0.0, port: 514 > io.c: Preparing fd 3 for reading > io.c: connecting using fd 7 > connecting fd 7 to inetaddr 10.130.230.162, port 514 > io.c: connecting using fd 8 > connecting fd 8 to inetaddr 10.120.230.161, port 514 > syslog-ng version 1.5.17 starting > io.c: Preparing fd 8 for writing > io.c: Preparing fd 7 for writing > io.c: Preparing fd 9 for writing > io.c: sockaddr2info(): Unsupported address family 0. > Abort (core dumped) > > I'm building syslog-ng with gcc 3.1 on Solaris 8 with the following setup: > > syslog-ng 1.5.23 > libol 0.3.5 > CFLAGS -m64 -O3 > > > I'm attaching the core dump just in case. In this particular case, syslog-ng > crashes as soon as spamd (from the spamassassin package) connects. The lines > in spamd are something like: > > if ($log_facility ne 'stderr') { > eval { > setlogsock('unix'); > syslog('debug', 'spamd starting'); # required to actually open the socket > }; > > Is there something in my syslog-ng configuration that may be causing issues? no, as it seems solaris doesn't return a sensible address for unix domain socket peers. btw: solaris does not usually use unix domain sockets for log transport, what driver do you use for /dev/log? (usually it is a STREAMS device) this patch should fix it (touch io.c.x after applying): diff -u -r1.31 io.c --- io.c 14 Oct 2002 08:05:38 -0000 1.31 +++ io.c 12 Nov 2002 07:40:01 -0000 @@ -1024,13 +1024,17 @@ struct sockaddr_un *un = (struct sockaddr_un *) addr; return &make_unix_address(c_format("%z", un->sun_path))->super; } + case AF_UNSPEC: + break; #if 0 case AF_INETv6: break; #endif default: - fatal("io.c: sockaddr2info(): Unsupported address family %i.\n", addr->sa_family); + werror("io.c: sockaddr2info(): Unsupported address family %i (addrlen=%i).\n", addr->sa_family, addr_len); + break; } + return NULL; } #if 0 -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Basic questions
by qian＠x85.com 11 Nov '02

11 Nov '02

I'm new to this mailing list. Here are some basic questions. Any help is appreciated. Q1. If I want to set a centralize log server, do i need to run your version of syslogd (syslog-ng) on log server only or all the clients need that version too? Q2. To save log from differnt host to its file, one needs to specify this: destination host ( file("/var/log/$HOST/....") ) on /etc/syslog.conf only on log server? Q3. If I use a rely server, so log generated from host1, relyed thru host2 to log server, is it recorded as host2 or host1 or host1/host2 depending on the option of keep_hostname/chain_hostname? What I want is to preserve the orinigal host (host1), how to do it? Yonglin Qian

2 1

(no subject)
by Danczi Jozef 11 Nov '02

11 Nov '02

______________________________________________________ Get Paid... With Your Free Email at http://www.zwallet.com/index.html?user=hermes1

1 0

res_init not found on Solaris 9
by joe781＠att.net 11 Nov '02

11 Nov '02

I am using Libol 0.3.5 and syslog-ng 1.5.23. Libol installed without a problem. The make for syslog-ng terminates as follows: gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor -lfl /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file res_init main.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /usr/local/src/syslog-ng-1.5.23/src The ./configure step finds it OK. Where would I find it? TIA. Joe Haggerty

3 2

Error: Changing permissions on special file?
by Joerg Sommer 10 Nov '02

10 Nov '02

Hi, why is the changing of the permissions on a special file an error? This could be an info message or an warning, but not an error. Joerg.

1 0

autoheader error building 1.5.23 under Mandrake 9.0
by Jay Levitt 10 Nov '02

10 Nov '02

On my Mandrake 9.0 box, I get the following error during make: cd /home/jay/syslog-ng-1.5.23 && autoheader /usr/bin/autoheader-2.13: Symbol `HAVE_RES_INIT' is not covered by /usr/share/autoconf/acconfig.h ./acconfig.h I have automake 1.4-p6 and autoconf/autoheader 2.13. I don't really understand the workings of the GNU automake/autoconf tools, but it definitely seems that HAVE_RES_INIT is in config.in but not acconfig.h. This symbol wasn't referenced in 1.5.22, so that builds fine.. Jay Levitt

2 1

RE: [syslog-ng]Information regarding interpreting Syslog messages
by Wrzesinski, Michael 08 Nov '02

08 Nov '02

Hello, maybe have a look at Tina Birds web site (http://www.shmoo.com/~tbird/) There are a few references. regards Michael Wrzesinski > -----Ursprüngliche Nachricht----- > Von: Deepu George [mailto:DEEPUG@mascotsystems.com] > Gesendet: Freitag, 8. November 2002 05:49 > An: syslog-ng(a)lists.balabit.hu > Betreff: [syslog-ng]Information regarding interpreting Syslog messages > > > Hi All, > > Is there any documentation available which can help to > interpret syslog > messages > > Best regards > Deepu

1 0

Information regarding interpreting Syslog messages
by Deepu George 08 Nov '02

08 Nov '02

Hi All, Is there any documentation available which can help to interpret syslog messages Best regards Deepu DISCLAIMER: Information contained and transmitted by this E-MAIL is proprietary to Mascot Systems Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at Mailadmin(a)mascotsystems.com Before opening attachments, please scan for viruses.

1 0