- syslog-ng - lists.balabit.hu

STATS: dropped 59
by Thomas Kaehn 02 Nov '01

02 Nov '01

Hi, syslog-ng seems to drop log-messages (syslog-ng[16854]: STATS: dropped 59). How can I avoid this, besides from using syslog-ng and TCP on all hosts? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

3 2

RE: [syslog-ng]Re: Level/Priority of 'none'
by Denis Doublet 02 Nov '01

02 Nov '01

-----Message d'origine----- De : Brad Stockdale [mailto:bradsprt@greenepa.net] Envoyé : vendredi 2 novembre 2001 02:09 À : syslog-ng(a)lists.balabit.hu Objet : [syslog-ng]Re: Level/Priority of 'none' Hello all, I'm a newbie to syslog-ng, and am trying to convert our local servers from sysklogd to syslog-ng... I'm having a bit of a problem, though... I might just be blind to the answer of this question, though... It seems pretty simple... In the syslog.conf file that is currently in place (the default redhat one), there's a line that reads: >*.info;mail.none;news.none;authpriv.none /var/log/messages Seems logical... How do I do the same thing in syslog-ng? Try destination d_local { file("/var/adm/messages/"); }; filter no_mail { not facility(mail); }; filter no_news { not facility(news); }; filter no_authpriv { not facility(authpriv); }; filter info { level(info .. emerg); }; log { source(s_local); filter no_mail; filter no_news; filter no_authpriv; filter info; destination(d_local); }; The syslog.conf manpages state: >The keyword none stands for no priority of the given facility. So, if I'm understanding this right, syslog was receiving a facility name, but no level/priority setting? And this mapped to "none." i.e : filter f_critical { level(crit .. emerg) or facility(syslog); }; Does this help you? Does syslog-ng provide a similar thing? Or do these daemons really send out the facility and level/priority, but it's some default one? Thanks for any help in advance... I'm sure this is an easy thing to fix, but just don't know the internals of syslog or syslog-ng very well yet... I've always just used the default configuration and left things alone... Thanks in advance, Brad _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: Level/Priority of 'none'
by Brad Stockdale 02 Nov '01

02 Nov '01

Hello all, I'm a newbie to syslog-ng, and am trying to convert our local servers from sysklogd to syslog-ng... I'm having a bit of a problem, though... I might just be blind to the answer of this question, though... It seems pretty simple... In the syslog.conf file that is currently in place (the default redhat one), there's a line that reads: >*.info;mail.none;news.none;authpriv.none /var/log/messages Seems logical... How do I do the same thing in syslog-ng? The syslog.conf manpages state: >The keyword none stands for no priority of the given facility. So, if I'm understanding this right, syslog was receiving a facility name, but no level/priority setting? And this mapped to "none." Does syslog-ng provide a similar thing? Or do these daemons really send out the facility and level/priority, but it's some default one? Thanks for any help in advance... I'm sure this is an easy thing to fix, but just don't know the internals of syslog or syslog-ng very well yet... I've always just used the default configuration and left things alone... Thanks in advance, Brad

1 0

$HOST Variable in syslog-ng.conf
by Mike Kelland 30 Oct '01

30 Oct '01

When syslog-ng recieves a tcp syslog from another host, it tags the front of the message with '127.0.0.1/127.0.0.1/' before the host ip that the message actually came from. It also makes the host variable for that message '127.0.0.1' instead of the host the message actually came from. So if I'm logging all messages from syslog-ng to a file called $HOST.txt, all of my tcp syslog messages (ie messages coming from another syslog-ng) are logged to 127.0.0.1.txt . Does anyone know of a workaround to this problem? Thanks, Mike

1 0

syslog-ng's matching vs a perl-regex match
by Seth Vidal 30 Oct '01

30 Oct '01

Hi all, I am using syslog-ng version 1.4.12 on red hat linux 7.1. I have been doing some matches to get certain events out of my logs and have certain programs react to them. I was wondering if it would be faster to pipe ALL output to a perl script and have it do its own regex matching. I'm not sure how fast syslog-ng's matching is and if I take a performance hit by using it. thanks -sv

3 2

Chroot syslog-ng
by Jerome Poggi 29 Oct '01

29 Oct '01

Did somebody have any experiences of chroot syslog-ng on Linux or other operating system ? Thanks, -- Jerome POGGI Jerome.Poggi(a)hsc.fr Herve Schauer Consultants -=- Consultant en sécurité informatique http://www.hsc.fr/ Tel : +33 141 409 700

2 1

Linelength problems..
by Robert Glad 29 Oct '01

29 Oct '01

Hello all, I have a problem with syslog-ng that is quite strange. We have been running syslog-ng for a while now, it has worked fine but today i noticed one thing that is not that good at all. It seems like when loglines get too long, syslog-ng just truncates them. I looked around in the sources and found a define in syslog-ng.h, MAX_LOG_LINE. I boosted it up to 4096, recompiled, deployed the new binary but the problem remains.. Any ideas? Regards.. Robert

2 1

Syslog-ng's memory footprint growing constantly on DEC alpha
by Wim-Jan Hilgenbos 29 Oct '01

29 Oct '01

Hi, I have quite a lot of trouble with syslog-ng. More specific with the memory footage. It grows within a day to a size of over 130M after which it stops logging except for its own internal messages and then a short time later it dies. I have tried all kinds of combinations of compilers/compiler options. motivated in part by the unaligned messages and the former emails on this list. I'm able to get rid of the analigned access messages by using the native compiler, but I can't get a stable memory-size. My idea is that log messages are only partially freed. When I look at the core I see a lot of 'tails of logmessages' varying in length from 2 to 15 chars. The whole application becomes more stable and grows slower when I use the '-taso' option of the native compiler, which directs the loader to load the modules in 31-bit address space. Debug output shows a stable number of Objects in memory, around 290. I've used serveral versions: 1.4.8, 1.4.12, 1.4.13, 1.5.7, 1.5.10, 1.5.11 and probably some more (I'm not at my workstation now ;-< We use Compaq True64. The message load of the appl. we're develloping is rather high so we use syslog-ng exclusively for that application. We don't use NIS+. Does anyone have any solutions? Thnx in advance. Wim-Jan Hilgenbos

2 2

Syslog-ng Log Files
by Denis Doublet 29 Oct '01

29 Oct '01

Hi, With syslog-ng, is there anyway to take the facility, level,date,hostname in the log message ? We log in a fifo file, and without facility end level, the message log can't be sorted, every messages have the same form. We tried many syntaxes, like destination probe_netcool { pipe("/var/adm/netcool_pipe"); "$LEVEL" }; or destination probe_netcool { pipe("/var/adm/netcool_pipe"); '$LEVEL' }; and many others, but every syntax we tried generated a "Syntax error reading config file, using old configuration" message. I must avoid syntax like : destination probe_netcool { file("/var/adm/$HOST.log"); }; because only one fifo can be scanned (question of licences..) Thank you Denis

1 0

solaris 8 x86 errors
by Nate Campi 26 Oct '01

26 Oct '01

I'm running syslog-ng 1.4.14 on a solaris 8 x86 box, logging over TCP to another syslog-ng loghost. I'm getting this error sporadically: pkt_buffer::do_flush(): Error flushing data Is this anything to worry about? All I see on this is a patch from 1999: http://lists.balabit.hu/pipermail/syslog-ng/1999-December/000376.html -- Nate Campi <nate(a)campin.net> www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 A mathematician is an engine for converting coffee into theorems.

2 2