- syslog-ng - lists.balabit.hu

Syslog-ng should have a companion "logger-ng"
by Russo, Ben 17 May '02

17 May '02

Colleagues, When testing NetCool or other monitoring triggers it is very handy to be able to test things with "logger". However logger doesn't have the ability to test all of the things that syslog-ng can do. I don't know that much about the network protocol for syslog, or the system library calls in the various OS's that support local syslog delivery. However the standard "logger" command has the following limitations: 1. I can't specify the DESTINATION other than the default local system (e.g. @somehost(tcp#|udp#) ) without changing my local syslog configuration. 2. I can't spoof the source IP address or source Hostname. 3. I can't spoof the source messages time-stamp. Could I ask (pretty please) that the kind and generous gods of syslog programming make a little tiny version of syslog-ng called logger-ng that can accept command line arguments like the standard logger command does (with the addition of the above two options)? I would be willing to trade some work doing documentation of it and making man pages in exchange? I am a very good writer. -Ben.

1 0

Problem with HP-UX 11.0
by dcntrnoc＠cmp.com 17 May '02

17 May '02

I sent this to the list last week, but didn't get a response. Can anyone help with this issue? Thanks - Hi all, I have been running syslog-ng on a handful of Solaris boxes for some time now with no problems, and am attempting to get it running on HP-UX. I have compiled (with gcc) and installed syslog-ng 1.5.16 and libol 0.3.2 on a system running HP-UX 11.00. I am using the following source statement in my config file: source s_sys { pipe("/dev/log"); internal(); }; The filters are based on facility. It seems that the only readable output in the destination files come from either the internal source (ex. May 7 17:47:24 myhost syslog-ng[5675]: SIGHUP received, restarting syslog-ng), or from a message I sent via logger. The rest of the output looks like this: May 7 17:48:22 myhost ^F May 7 17:48:22 myhost ^B May 7 17:48:22 myhost ^B May 7 17:48:22 myhost À^_'^SÀ^_'^S^?|Fä May 7 17:48:22 myhost ^?~^U` May 7 17:48:22 myhost ^?|Fä May 7 17:48:22 myhost ^?|Fä^?|FäÀ^Ve{À^XAW May 7 17:48:22 myhost ^?|Ç@ May 7 17:48:22 myhost >@^?{à May 7 17:48:22 myhost ^O May 7 17:48:22 myhost ^A May 7 17:48:22 myhost ^?|Fä^?|FäÀ^_Î^[À^X¯^_ May 7 17:48:22 myhost ^D^?~^U`^?{à May 7 17:48:22 myhost May 7 17:48:22 myhost ^A May 7 17:48:22 myhost ^?|Fä^?|FäÀ^_Õs May 7 17:48:22 myhost ^?|Fä May 7 17:48:22 myhost À^XD» May 7 17:48:22 myhost @ May 7 17:48:22 myhost >@^?|¿À^?{à May 7 17:48:22 myhost À^XA May 7 17:48:22 myhost ^A^?|¡À May 7 17:48:22 myhost ^B^?|¡ÔÀ^S«H May 7 17:48:22 myhost ^?|Fä May 7 17:48:22 myhost À^X^[wÀ E¯ May 7 17:48:22 myhost ^?|¿ÀÀ^Wåp Any ideas? I don't know quite what to make of this. Thanks, Sharon. __________________________________________________________________________________________ Any views or opinions are solely those of the author and do not necessarily represent those of CMP Media. The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this message please do not read, copy, use or disclose this communication and notify the sender immediately. It should be noted that any review, retransmission, dissemination or other use of, or taking action or reliance upon, this information by persons or entities other than the intended recipient is prohibited. __________________________________________________________________________________________

3 2

RE: [syslog-ng]syslog-ng dying randomly?
by Russo, Ben 17 May '02

17 May '02

I too had a problem with syslog-ng 1.4.14 dying randomly on my RedHat Linux 7.2 box. I did a number of things and now it runs reliably. (at least for the last few weeks it hasn't had any problems) I don't know what fixed the problem but I will tell you what steps I took... I stoped using v1.4.14 and started using 1.5.17 In the config file options I added the following: time_reap(12); gc_busy_threshold(768); because in my particular environment I found that syslog-ng would have thousands of open files, this fixed that and lsof only shows hundreds of open files. I also started logging to a ReiserFS filesystem rather than ext2fs because I found that the directory scan performance on ext2fs slows to a crawl if you are constantly adding and removing files from a directory. (even when the directory was empty it was hundreds of KB) BTW, you might be interested in this: syslog-ng to SQL database HOWTO http://www.umialumni.com/~ben/SYSLOG-DOC.html -Ben.

2 1

syslog-ng survey
by Balazs Scheidler 16 May '02

16 May '02

Hi, Please find the time to fill out the survey below to help us to further improve syslog-ng. You can either fill it out in this mail message by entering the appropriate marks in the brackets, or on-line by pointing your browser to this url: http://www.balabit.hu/en/downloads/syslog-ng/survey/ Thanks in advance, -------------------------------------------------------------------------- Dear syslog-ng users, Syslog-ng as a free software has been a tremendous success. It's been in wide use for almost four years now as the first release was made back in 1998. As syslog-ng is a free software product it is very difficult to estimate the number of users of syslog-ng. Nevertheless we had over 40000 downloads in six months, and we have over 500 subscribers on our mailing list. These numbers are not exact either as syslog-ng is included in several GNU/Linux distributions like Debian. According to the Debian package popularity contest (12th May 2002) syslog-ng was used on 3% of all Debian boxes (based on 1587 submissions). To support the continous development of syslog-ng we plan to create a commercial branch, and add related services to our portfolio (consulting, training and support). Please help us to improve syslog-ng and related services, and fill the enclosed survey and send it back to syslog-ng-survey(a)balabit.hu. Which features do you think important to add into syslog-ng? Give importance of each feature as a number between 1 (least important) and 5 (most important). [ ] cryptographically protected logfiles stored on the local disk [ ] cryptographically protected network transmission of log information [ ] disk based message buffering to avoid losing messages [ ] flow controlled message path to avoid losing messages (cause sending programs to stop responding if log events cannot be stored) [ ] integrated support for database backends (PostgreSQL, MySQL, Oracle) [ ] integrated support for log analysis (event correlation, statistics, suspicious events) [ ] integrated support for e-mail/pager alerts [ ] integrated support for log rotation/compression [ ] support for more platforms [ ] binary distributions for different platforms with installation program [ ] graphical user interface (GUI) for syslog-ng configuration [ ] integration tools for non-UNIX platforms (NT EventLog) What platforms are you using/plan to use syslog-ng on? Check all that apply! [ ] Linux [ ] FreeBSD/OpenBSD/NetBSD [ ] AIX [ ] HP-UX [ ] Solaris [ ] Irix [ ] Tru64 [ ] SCO Unix [ ] Other, please specify: Are you using a central syslog server? [ ] yes, we use syslog-ng on our central syslog server [ ] yes, we use a central syslog server, but it is not syslog-ng based [ ] no, we have no central syslog server, but we plan to install one [ ] no, we don't have central syslog server, and have no plans on installing one How many hosts are you running syslog-ng on? [ ] 1-10 [ ] 11-25 [ ] 26-50 [ ] 51-100 [ ] 101-250 [ ] 251-500 [ ] Other, please specify: How many devices are you logging to syslog-ng used as log host? [ ] 1-10 [ ] 11-25 [ ] 26-50 [ ] 51-100 [ ] 101-250 [ ] 251-500 [ ] 501-1000 [ ] Other, please specify Would you or your company be willing to provide syslog-ng related services to third parties? [ ] yes [ ] no Would you or your company pay for syslog-ng licenses if there was no important difference between the GPLd and non-GPLd version? [ ] yes [ ] no Would you or your company pay for syslog-ng licenses if there were important differences between the GPLd and non-GPLd version? [ ] yes [ ] no Would you or your company pay for consulting services related to syslog-ng? [ ] yes [ ] no Would you or your company pay for training services related to syslog-ng? [ ] yes [ ] no Would you or your company pay for support services related to syslog-ng? [ ] yes [ ] no -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

4 6

syslog-ng dying randomly?
by John Morrissey 16 May '02

16 May '02

[warning: really long post follows] I'm running syslog-ng 1.4.14 on a number of Red Hat 7.1/7.2 systems. It's configured fairly simply, writing logs to /var/log/programname.$YEAR$MONTH$DATE and also forwards logs via UDP to a central syslog-ng hub. client config: options { use_fqdn(on); chain_hostnames(off); sync(0); }; source s_local { internal(); unix-stream("/dev/log"); }; source s_kmsg { file("/proc/kmsg"); }; destination d_sort_program { file("/var/log/$PROGRAM.$MONTH$DAY$YEAR" group("logs") perm(0640) create_dirs(yes) dir_group("logs") dir_perm(0750) ); }; destination d_syslog_hub { udp(172.16.1.4 port(514)); }; log { source(s_local); source(s_kmsg); destination(d_sort_program); destination(d_syslog_hub); }; The problem is that syslog-ng seems to die on a fairly regular basis. I can't say for sure if it's because our syslog hub wasn't available for an extended period of time or if it's due to some sort of problem with the code. I'm doing some testing to see if the availability of the hub makes any difference and I'll make a follow-up in a few days. Anyway, I was curious if anyone had an idea on what might be going on. An strace of syslog-ng on one of the machines before it died is very interesting. poll([{fd=6, events=0}, {fd=5, events=0, revents=POLLERR}, {fd=2, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 1 time(NULL) = 1021313163 getpid() = 17061 time(NULL) = 1021313163 open("/var/log/syslog-ng.05132002", O_WRONLY|O_NONBLOCK|O_APPEND|O_CREAT|O_NOCTTY, 0640) = 0 chown32("/var/log/syslog-ng.05132002", 0, 6000) = 0 fcntl64(0, F_GETFL) = 0xc01 (flags O_WRONLY|O_NONBLOCK|O_APPEND) fcntl64(0, F_SETFL, O_WRONLY|O_NONBLOCK|O_APPEND) = 0 fcntl64(0, F_SETFD, FD_CLOEXEC) = 0 time(NULL) = 1021313163 time(NULL) = 1021313163 time(NULL) = 1021313163 close(5) = 0 poll([{fd=0, events=0}, {fd=6, events=0}, {fd=2, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 5, 100) = 0 getpid() = 17061 time(NULL) = 1021313163 getpid() = 17061 time(NULL) = 1021313163 getpid() = 17061 time(NULL) = 1021313163 getpid() = 17061 time(NULL) = 1021313163 And so on, alternating between getpid() and time() until it finally segfaults and dies. A backtrace is also interesting; it seems like syslog-ng might be getting caught in an infinite loop: #0 0x400b49c9 in chunk_alloc (ar_ptr=0x0, nb=0) at malloc.c:2843 #1 0x400b4818 in __libc_malloc (bytes=88) at malloc.c:2811 #2 0x08053b22 in debug_malloc () #3 0x08053bdd in xalloc () #4 0x08053da0 in ol_string_alloc () #5 0x08051203 in c_format_cstring () #6 0x0804b98b in make_internal_message () #7 0x080503e6 in write_internal_message () #8 0x08053291 in msg_vformat () #9 0x0805339c in fatal () #10 0x08053e3d in ol_object_check () #11 0x0804a7c6 in do_add_source_name () #12 0x080503fc in write_internal_message () #13 0x08053291 in msg_vformat () #14 0x0805339c in fatal () #15 0x08053e3d in ol_object_check () #16 0x0804a7c6 in do_add_source_name () #17 0x080503fc in write_internal_message () #18 0x08053291 in msg_vformat () #19 0x0805339c in fatal () #20 0x08053e3d in ol_object_check () #21 0x0804a7c6 in do_add_source_name () #22 0x080503fc in write_internal_message () #23 0x08053291 in msg_vformat () #24 0x0805339c in fatal () Calls #20 - #24 repeat over and over. The entire backtrace is huge, almost 35,000 calls. Here's the beginning of it: #34475 0x08053e3d in ol_object_check () #34476 0x0804a7c6 in do_add_source_name () #34477 0x080503fc in write_internal_message () #34478 0x08053291 in msg_vformat () #34479 0x0805339c in fatal () #34480 0x08053e3d in ol_object_check () #34481 0x0804a7c6 in do_add_source_name () #34482 0x080503fc in write_internal_message () #34483 0x08053291 in msg_vformat () #34484 0x0805339c in fatal () #34485 0x080544d7 in dont_free_live_resource () #34486 0x080543f3 in do_resource_free () #34487 0x08053961 in gc_sweep () #34488 0x08053a5b in gc () #34489 0x08053aea in gc_maybe () #34490 0x080515df in io_iter () #34491 0x0804a095 in main_loop () #34492 0x0804a3d1 in main () #34493 0x40050647 in __libc_start_main (main=0x804a1c8 <main>, argc=2, ubp_av=0xbffff754, init=0x8049664 <_init>, fini=0x8054620 <_fini>, rtld_fini=0x4000dcd4 <_dl_fini>, stack_end=0xbffff74c) at ../sysdeps/generic/libc-start.c:129 It looks like it's getting caught in an infinite loop which finally exhausts its stack space and causes it to segfault(?). If you need any more information, let me know. I also still have the core if anybody wants it. Any ideas would be much appreciated! thanks, john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 6

bug in "template"?
by Gehring, Andrew x66132 16 May '02

16 May '02

On AIX 4.3.3... When I specify a template for a destination as follows: destination d_mesg { file("/var/log/messages" template("$DATE $HOST $PROGRAM [$FACILITY $LEVEL] $MSG)); }; send a logger messages logger -p user.notice -t TEST "This is a test" what ends up in the log file is: May 15 08:42:51 LEWIS TEST: [USER NOTICE] TEST: This is a test So in what I'm seeing, and I've tried a few different 'templates', is that $PROGRAM is included in $MSG. Is that the way it is supposed to be? Thanks, Andrew

2 1

log option "final" question
by Jason Price 15 May '02

15 May '02

When I use the "final" flag in a log statement, does that mean: 1) All log statements listed later will not be used at all or 2) All log messages matching all the filters in that log statement will not be processed by log statements listed later ? The documentation isn't quite clear (from logpath.html): This flag means that the processing of log statements ends here. Note that this doesn't necessarily mean that matching messages will be stored once, as they can be matching log statements processed prior the current one. It seems to imply the second definition, and the first one makes little sense at all. This really is just a request for clarification in the docs I guess. Jason

1 0

Re: syslog-ng dying randomly?
by Balazs Scheidler 15 May '02

15 May '02

On Tue, May 14, 2002 at 07:34:37PM -0400, John Morrissey wrote: > [warning: really long post follows] > > I'm running syslog-ng 1.4.14 on a number of Red Hat 7.1/7.2 systems. It's > configured fairly simply, writing logs to > /var/log/programname.$YEAR$MONTH$DATE and also forwards logs via UDP to a > central syslog-ng hub. It seems to be a memory corruption problem. As I fixed one in 1.4.15 please try that version first (a single byte at random memory address could be decremented by one). If the problem persists, I might need some more information. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

How to get logs from firewall through syslog-ng
by Krishna 15 May '02

15 May '02

Hi, Wednesday, May 15, 2002 1:02:10 PM I am using syslog-ng 1.4.14 . I want to know how I should configure syslog-ng to get logs from firewall. I am using RedHat6.0 Please Help -- regards, Krishna mailto:Krishna_shekhar@gmx.net Krishna Shekhar Network Administrator Wiplash.Net ___ __________________________________________ __ __ | / /___ _/__ __ \__ /___ |_ ___/__ / / / __ | /| / / __ / __ /_/ /_ / __ /| |____ \__ /_/ / __ |/ |/ / __/ / _ ____/_ /___ ___ |___/ /_ __ / ____/|__/ /___/ /_/ /_____/_/ |_/____/ /_/ /_/ http://Wiplash2000.com

1 0

syslog-ng doesn't re-open the TCP connection - resolved
by Rosenberg, Relu (Exchange) 14 May '02

14 May '02

This was an OS patching issue, not related with syslog-ng Relu Rosenberg *********************************************************************** Bear Stearns is not responsible for any recommendation, solicitation, offer or agreement or any information about any transaction, customer account or account activity contained in this communication. ***********************************************************************

1 0