- syslog-ng - lists.balabit.hu

Unaligned trap errors on Alpha-Linux
by Jon Stearley 28 Sep '01

28 Sep '01

has a fix been found to the "unaligned trap" messages alpha users have been seeing? http://lists.balabit.hu/pipermail/syslog-ng/2000-May/000609.html http://lists.svlug.org/pipermail/svlug/2000-October/004209.html http://pusa.uv.es/~ulisses/kernelnewbies/kernelnewbies.25Jul00 i've got tons of them i'd like to eliminate from my alpha/linux-2.2.18/redhat6.2/syslog-ng-1.4.12/libol-0.2.23 clusters. it looks like an internal message, but it still occurs when i take internal() out of my source definition (?). thx for any pointers. -- +--------------------------------------------------------------+ | Jon Stearley (505) 845-7571 (FAX 844-2067) | | Compaq Federal LLC High Performance Solutions | | Sandia National Laboratories Scalable Systems Integration | +--------------------------------------------------------------+ here's one of my hosts, it keeps repeating: Sep 23 17:43:35 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005278: 00000001201249cc 2d 0 Sep 23 17:43:35 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 000000012000527c: 00000001201249f4 29 1 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 00000001200051d8: 00000001201249f4 2d 0 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005220: 00000001201249f4 29 16 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005278: 00000001201249cc 2d 0 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 000000012000527c: 00000001201249f4 29 1 Sep 23 17:44:12 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 00000001200051d8: 00000001201249f4 2d 0 Sep 23 17:44:12 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005220: 00000001201249f4 29 16

2 2

Thanks.
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 28 Sep '01

28 Sep '01

All, Thanks for all your help and advice over the last couple of years. I have tried to give back some of the help I have gotten as well as some of the experience I have gained using the software. This has been an outstanding piece of software and has been very helpful to the organization for which I work. But my contract here is up and I am moving on to a straight programming job, (no more sysadmin work). Anyway, best of luck to all of you. Bazsi, thanks for the hard work and support. Andrew Hamilton

2 1

perm() bug in 1.4.13?
by Michael D. (Mick) Bauer 27 Sep '01

27 Sep '01

If I define a logfile with perms "-rw-r------" using the following in syslog.conf: destination d_micklog { file("/var/log/micklog" owner(mick) group(wheel) perm(0640)); }; a file is created that looks like this (ls -l output): -rw------- 1 mick wheel 57 Sep 27 10:03 /var/log/micklog Why aren't the "group" bits being set? At first I thought maybe I needed to "invert" the mode a là umode, but that isn't it. Ideas? TIA, Mick Bauer /=============================\ | Michael D.(Mick) Bauer | | Network Security Consultant | | St. Paul, Minnesota (USA) | | mick<at>visi.com | \=============================/

2 1

Losing events with syslog-ng and netfilter
by Jerome Poggi 27 Sep '01

27 Sep '01

Hi, I use syslog-ng 1.5.10 with Linux kernel 2.4.10 and netfilter 1.2.3 When Netfilter log 8 events, syslog-ng log only the half. Did you see this thinks before ? -- Jerome POGGI

1 0

RE: [syslog-ng]Does syslog-ng support remote logging?
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 27 Sep '01

27 Sep '01

You should have a source set up that receives UDP packets. Just include it in your source statement. Regards, Drew -----Original Message----- From: A. Dumas [mailto:a.dumas@snet.net] Sent: Thursday, September 27, 2001 4:15 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Does syslog-ng support remote logging? I've had syslog-ng on a Linux 7.1 box for a couple months and it's been running great. I'm attempting to setup remote logging on the various Cisco routers on my network and have them point to syslog-ng. I think the Cisco configurations are set up correctly since I have a sniffer on the network and I can see the packets going to the Linux box, but nothing shows up in syslog-ng that I can see. What should I be using in the syslog-ng configuration to isolate the relevant data? I've unsuccessfully tried several.

1 0

Does syslog-ng support remote logging?
by A. Dumas 27 Sep '01

27 Sep '01

Ive had syslog-ng on a Linux 7.1 box for a couple months and its been running great. Im attempting to setup remote logging on the various Cisco routers on my network and have them point to syslog-ng. I think the Cisco configurations are set up correctly since I have a sniffer on the network and I can see the packets going to the Linux box, but nothing shows up in syslog-ng that I can see. What should I be using in the syslog-ng configuration to isolate the relevant data? Ive unsuccessfully tried several.

1 0

[aaron@schrab.com: Bug#78445: syslog-ng: The included libol uses va_list incorrectly.]
by Balazs Scheidler 26 Sep '01

26 Sep '01

----- Forwarded message from Aaron Schrab <aaron(a)schrab.com> ----- From: Aaron Schrab <aaron(a)schrab.com> To: 78445(a)bugs.debian.org Cc: control(a)bugs.debian.org Reply-To: Aaron Schrab <aaron(a)schrab.com>, 78445(a)bugs.debian.org Subject: Bug#78445: syslog-ng: The included libol uses va_list incorrectly. Date: Sat, 22 Sep 2001 10:47:33 -0500 tags 78445 patch thanks The msg_vformat function from libol passes the same va_list to two different functions, expecting that the first won't affect the second. This assumption isn't true on powerpc, so when the second function gets it, there aren't any arguments left to read. The included patch fixes this by making a copy of the va_list before passing it for the first time. I checked for other occurences of this problem, but this seems to be the only one. My patched copy has been handling my logging for a few hours now and it seems to work fine. The unpatched one died immediately. *** /tmp/syslog-ng.diff diff -Pur syslog-ng-1.5.9/debian/libol.patch syslog-ng-1.5.9.ats/debian/libol.patch --- syslog-ng-1.5.9/debian/libol.patch Wed Dec 31 18:00:00 1969 +++ syslog-ng-1.5.9.ats/debian/libol.patch Sat Sep 22 06:06:43 2001 @@ -0,0 +1,37 @@ +diff -ur libol-0.2.24.orig/src/format.h libol-0.2.24/src/format.h +--- libol-0.2.24.orig/src/format.h Sat Jul 10 08:23:09 1999 ++++ libol-0.2.24/src/format.h Sat Sep 22 05:56:59 2001 +@@ -28,6 +28,12 @@ + + #include <stdarg.h> + ++#ifndef va_copy ++# ifdef __va_copy ++# define va_copy __va_copy ++# endif ++#endif ++ + struct ol_string *c_format(const char *format, ...); + UINT32 c_format_length(const char *format, ...); + UINT32 c_format_write(const char *format, UINT32 length, UINT8 *buffer, ...); +diff -ur -x configure libol-0.2.24.orig/src/werror.c libol-0.2.24/src/werror.c +--- libol-0.2.24.orig/src/werror.c Fri Feb 4 13:02:04 2000 ++++ libol-0.2.24/src/werror.c Sat Sep 22 05:58:41 2001 +@@ -117,9 +117,16 @@ + { + UINT8 errorbuf[BUF_SIZE]; + int length; +- ++#ifdef va_copy ++ va_list args_copy; ++ va_copy (args_copy, args); ++#endif ++ + length = c_vformat_length(f, args); + if (length <= BUF_SIZE) { ++#ifdef va_copy ++ va_copy (args, args_copy); ++#endif + c_vformat_write(f, sizeof(errorbuf), errorbuf, args); + MSG_WRITE(level, length, errorbuf); + } diff -Pur syslog-ng-1.5.9/debian/rules syslog-ng-1.5.9.ats/debian/rules --- syslog-ng-1.5.9/debian/rules Sat Sep 22 06:08:56 2001 +++ syslog-ng-1.5.9.ats/debian/rules Sat Sep 22 06:09:13 2001 @@ -17,7 +17,7 @@ rm $(LIBOLDIR)/ltmain.sh $(LIBOLDIR)/config.sub $(LIBOLDIR)/config.guess \ $(LIBOLDIR)/aclocal.m4 $(LIBOLDIR)/missing \ $(LIBOLDIR)/ltconfig $(LIBOLDIR)/mkinstalldirs - (cd $(LIBOLDIR); ./autogen.sh; ./configure --prefix=/usr/lib; $(MAKE) ) + (cd $(LIBOLDIR); patch -p1 < ../debian/libol.patch; ./autogen.sh; ./configure --prefix=/usr/lib; $(MAKE) ) echo "libol: Done" # mv -f ltmain.sh ltmain.sh.save # mv -f config.sub config.sub.save -- System Information Debian Release: testing/unstable Architecture: powerpc Kernel: Linux frell 2.4.10-pre10-ben0 #1 Thu Sep 20 00:45:23 CDT 2001 ppc Locale: LANG=C, LC_CTYPE=en_US Versions of packages syslog-ng depends on: ii libc6 2.2.4-1 GNU C Library: Shared libraries an ----- End forwarded message ----- -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

1.4.13 HUP issues
by Nathan Wertman 26 Sep '01

26 Sep '01

While trying to parse my logs for some pppd information about connect times and such I noticed a really wierd problem. When software uses an openlog to open a 'channel' to the log, and when syslog-ng is HUP'ed (during my logrotate script) the process that was writing to the log no longer puts any information into the log. This bug has been fixed in the unstable tree but I would rather not use the unstable tree on my server, especially for something as important as system logging. Has anyone else seen this? Is there a patch for it? I have just begun hacking on syslog-ng so this patch is a little out of my league until I figure out how the code works, but I would like to get syslog-ng up and running as soon as possible. If you need more information please let me know and I will be happy to provide you with it. Nathan Wertman "Those who will not reason, are bigots, those who cannot, are fools, and those who dare not are slaves." - George Gordon Noel Byron (1788 - 1824) (Lord Byron)

2 1

no logging with udp()
by MagerValp 26 Sep '01

26 Sep '01

I just spent an hour trying to figure out why our clients couldn't log to the syslog-ng server anymore. To make a long story short, a patch had replaced the original syslogd start script so both daemons were started. syslogd started first and managed to bind to udp port 514 so syslog-ng never even saw the messages. It didn't complain over not being able to bind the port though -- I would have expected it to say "failed to bind udp port 514" or something like that. Think you could make syslog-ng whine more if it can't bind the port? OK, now all I have left to fix is the raid system, the backbone switch, our two printers on this floor, and the backup system. I won't be going to bed early tonight... -- ___ . . . . . + . . o _|___|_ + . + . + . . Per Olofsson, konstnär o-o . . . o + MagerValp(a)cling.gu.se - + + . http://www.cling.gu.se/~cl3polof/

1 0

2 problems: Max connections and connection lost
by Jasper Jans 26 Sep '01

26 Sep '01

Hi all - first of all could you please reply to this email address as well since I'm not subscribed on this list: jjans(a)bio.vu.nl current setup: Syslog-ng compiled and running on one machine as a syslog master server and syslog-ng running on several other machines that forward their messages to the master machine. problem 1: Sep 26 11:41:13 umbriel syslog-ng[65195]: Error accepting AF_INET connection from: 10.100.2.100:1049, opened connections: 10, max: 10 The master server (umbriel) states it is out of connections? Is this a configuration option that can be set, do I need to hack the source code and recompile - or is it not doable at all over one connection and is all I can do fire off a second syslog-ng process on a different port and use that for 10 more hosts (in total I'm looking into supporting about 80 hosts). problem 2: Sep 26 06:37:04 umbriel syslog-ng[65195]: AF_INET client connected from 10.4.129.8, port 36539 Sep 26 08:35:04 ariel syslog-ng[27849]: io.c: do_write: write() failed (errno 32), Broken pipe Sep 26 08:35:04 ariel syslog-ng[27849]: pkt_buffer::do_flush(): Error flushing data Sep 26 08:35:04 ariel syslog-ng[27849]: Connection broken, reopening in 60 seconds I'm seeing *a lot* of these kinda of messages in the log file. Is there something that can be done about this? Like timeout settings that can be increased etc, etc? Thanks, Jasper

3 3