- syslog-ng - lists.balabit.hu

TCP reliability
by Chris Sibbitt 15 May '01

15 May '01

Greetings. I'm running syslog-ng 1.4.11 and am having trouble getting the tcp destination to work reliably. My major concern is with what happens when the receiving end of the tcp link is reset. In my scenario I have one syslog-ng machine forwarding messages to another syslog-ng machine using a tcp() destination on one end and a tcp() source on the other. All works fine until I interrupt the socket on the receiving machine. Rebooting, HUP'ing syslog-ng, etc all cause the logs to stop coming in. I assume that the sender is simply trying to write the messages to an existing TCP socket and failing. What happens to these messages (are they queued anywhere for later delivery?), and is there anything that I can do to ensure that messages continue to flow when the receiver comes back up? Losing messages while the receiving end if offline is an acceptable loss, but when it comes back up, I would really like it to continue to receive. In the current scenario I have to restart every syslog-ng machine that is forwarding messages to my central logger when I change its configuration, this is definitely not sane. Anyone with hints/tips for setting up TCP based messaging, please contact me. Chris Sibbitt JetNet Internetworking Services Inc. Providing Secure Internet Communications Phone 613-271-6220x228 FAX 613-271-6229 Email csibbitt(a)jetnet.ca Web www.jetnet.ca <http://www.jetnet.ca/>

2 1

RE: [syslog-ng]networking problems
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 15 May '01

15 May '01

Justin, It's hard to really tell what's going on without the entire config file, but it looks like your remote machine isn't logging to the log host machine. There is no log statement with the remote machine as the destination. Also in your loghost machine there is no log statement with the remote source as the source. Understand that the source, destination and filter statements only define your log environment. The log statement does the work. You need a log statement like: log { source(external_source); filter(f_whatever); destination(d_remote); }; or something similar on the loghost. On the client you need: log { source(local_source); filter(f_remote_whatever); destination(remote_john); }; That should work for you. Regards, Drew -----Original Message----- From: Justin Scheiber (98030) [mailto:jscheibe@css.tayloru.edu] Sent: Monday, May 14, 2001 11:09 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]networking problems I checked the archives, but no entries exactly described my problem. It seems as though syslog-ng does not log properly over the network (at least with my configuration). The configuration is supposed to send the data across the network to a centralized logging machine. However, it seems as though the data gets logged only out of random chance. version: syslog-ng-1.4.10 Here is a listing of the logs off the centralized logging machine: SIZE DATE LOG FILES 0 Apr 12 16:02 machine1.automation.log 1760 Apr 18 19:21 machine1.security.log 0 Apr 17 00:01 machine2.automation.log 899 Apr 18 19:13 machine2.security.log 0 Apr 10 17:01 machine3.automation.log 3608 Apr 19 15:20 machine3.security.log 0 Apr 12 15:01 machine4.automation.log 903 Apr 23 04:59 machine4.error.log 14073 Apr 23 10:54 machine4.security.log 4618 Apr 18 19:48 machine5.security.log 0 Apr 10 17:01 machine5.automation.log 0 Apr 12 16:01 machine6.automation.log 1804 Apr 18 19:09 machine6.security.log Here is the configuration file for the log host: options { long_hostnames(off); sync(10); }; ## sources ## source local_src { unix-stream("/dev/log"); internal(); }; ## external source (log messages from other machcines) ## #source external_src { tcp(); }; source external_src { udp(ip(10.0.1.4) port(1800)); }; ## destinations ## destination kernel_dest { file("/var/log/kernel.log"); }; destination automation_dest { file("/var/log/automation.log"); }; destination security_dest { file("/var/log/security.log"); }; destination error_dest { file("/var/log/error.log"); }; destination eternal_peril_dest { file("/dev/null"); }; ## destination for external logs ## destination external_security_dest { file("/export/hda3/log/$HOST.security.log"); }; destination external_automation_dest { file("/export/hda3/log/$HOST.automation.log"); }; destination external_error_dest { file("/export/hda3/log/$HOST.error.log"); }; ## filters ## filter kernel_filter { facility(kern); }; filter security_filter { match("connect") or program("PAM_pwdb") or match("pam") or program("sshd") or program("login") or facility(security) and not program("sendmail"); }; filter error_filter { level(crit..panic); }; filter automation_filter { program("runfixes"); }; filter eternal_peril_filter { program("gpm") or program("talkd") or program("gnome-name-server") or program("automount") or program("sendmail") or program("CMD") and level(debug..error); }; ## log the messages ## log { source(local_src); filter(kernel_filter); destination(kernel_dest); }; log { source(local_src); filter(security_filter); destination(security_dest); }; log { source(local_src); filter(automation_filter); destination(automation_dest); }; log { source(local_src); filter(error_filter); filter(DEFAULT); destination(error_dest); }; log { source(local_src); filter(eternal_peril_filter); destination(eternal_peril_dest); }; The log-client configuration is almost identical, except it for a destination line: and the log lines: destination remote_john { udp("10.0.1.4" port(1800)); }; log { source(local_src); filter(kernel_filter); destination(kernel_dest); } Any help would be appreciated. -justin _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

networking problems
by Justin Scheiber (98030) 14 May '01

14 May '01

I checked the archives, but no entries exactly described my problem. It seems as though syslog-ng does not log properly over the network (at least with my configuration). The configuration is supposed to send the data across the network to a centralized logging machine. However, it seems as though the data gets logged only out of random chance. version: syslog-ng-1.4.10 Here is a listing of the logs off the centralized logging machine: SIZE DATE LOG FILES 0 Apr 12 16:02 machine1.automation.log 1760 Apr 18 19:21 machine1.security.log 0 Apr 17 00:01 machine2.automation.log 899 Apr 18 19:13 machine2.security.log 0 Apr 10 17:01 machine3.automation.log 3608 Apr 19 15:20 machine3.security.log 0 Apr 12 15:01 machine4.automation.log 903 Apr 23 04:59 machine4.error.log 14073 Apr 23 10:54 machine4.security.log 4618 Apr 18 19:48 machine5.security.log 0 Apr 10 17:01 machine5.automation.log 0 Apr 12 16:01 machine6.automation.log 1804 Apr 18 19:09 machine6.security.log Here is the configuration file for the log host: options { long_hostnames(off); sync(10); }; ## sources ## source local_src { unix-stream("/dev/log"); internal(); }; ## external source (log messages from other machcines) ## #source external_src { tcp(); }; source external_src { udp(ip(10.0.1.4) port(1800)); }; ## destinations ## destination kernel_dest { file("/var/log/kernel.log"); }; destination automation_dest { file("/var/log/automation.log"); }; destination security_dest { file("/var/log/security.log"); }; destination error_dest { file("/var/log/error.log"); }; destination eternal_peril_dest { file("/dev/null"); }; ## destination for external logs ## destination external_security_dest { file("/export/hda3/log/$HOST.security.log"); }; destination external_automation_dest { file("/export/hda3/log/$HOST.automation.log"); }; destination external_error_dest { file("/export/hda3/log/$HOST.error.log"); }; ## filters ## filter kernel_filter { facility(kern); }; filter security_filter { match("connect") or program("PAM_pwdb") or match("pam") or program("sshd") or program("login") or facility(security) and not program("sendmail"); }; filter error_filter { level(crit..panic); }; filter automation_filter { program("runfixes"); }; filter eternal_peril_filter { program("gpm") or program("talkd") or program("gnome-name-server") or program("automount") or program("sendmail") or program("CMD") and level(debug..error); }; ## log the messages ## log { source(local_src); filter(kernel_filter); destination(kernel_dest); }; log { source(local_src); filter(security_filter); destination(security_dest); }; log { source(local_src); filter(automation_filter); destination(automation_dest); }; log { source(local_src); filter(error_filter); filter(DEFAULT); destination(error_dest); }; log { source(local_src); filter(eternal_peril_filter); destination(eternal_peril_dest); }; The log-client configuration is almost identical, except it for a destination line: and the log lines: destination remote_john { udp("10.0.1.4" port(1800)); }; log { source(local_src); filter(kernel_filter); destination(kernel_dest); } Any help would be appreciated. -justin

1 0

Syslog-ng and Linux iptables
by Ken Armstrong 14 May '01

14 May '01

Hello, I am having problems getting syslog-ng to work with the iptables logging facility under linux. The iptables rules allow logging and it works fine with the standard klogd/syslogd loggers with RedHat 7.1. I believe that the default kernel messeges use kern.warn as the facility.priority. When I replace syslogd with syslog-ng (and keep using the default klogd) I no longer receive any of the kernel messages. I have tried both of the following filter lines filter f_warn { level(warn); }; and filter f_kern { facility(kern); }; I can get all of the other looging to work, I am only having problems with the kernel messages? Has anyone else had this problem? Thanks Ken

2 2

Aborted
by Brian E. Seppanen 11 May '01

11 May '01

I recently tried instituting $YEAR-$MONTH-$DAY directory creation into my syslogging, due to problems with logrotation. An hour after I got it to work it dropped a core file and died, indicating that it was aborted. Can anyone see if there is a reason from the following info. PIII 500, 512MB, Redhat Linux 7.0. Syslog-ng 1.4.11, libol-0.2.21 Any help appreciated. Thanks, [root@host ~]# gdb syslog-ng core GNU gdb 5.0 Copyright 2000 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux"... Core was generated by `/usr/local/sbin/syslog-ng -p /var/run/syslog-ng.pid -f /usr/local/etc/syslog-ng'. Program terminated with signal 6, Aborted. Reading symbols from /lib/libnsl.so.1...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /lib/libnss_files.so.2...done. Loaded symbols for /lib/libnss_files.so.2 #0 0x40068dd1 in __kill () from /lib/libc.so.6 (gdb) bt #0 0x40068dd1 in __kill () from /lib/libc.so.6 #1 0x40068baa in raise (sig=6) at ../sysdeps/posix/raise.c:27 #2 0x4006a352 in abort () at ../sysdeps/generic/abort.c:88 #3 0x400627fa in __assert_fail () at assert.c:60 #4 0x80510d4 in io_iter () #5 0x8049bf1 in main_loop () #6 0x8049f2d in main () #7 0x40057f31 in __libc_start_main (main=0x8049d24 <main>, argc=6, ubp_av=0xbffff9d4, init=0x8049204 <_init>, fini=0x80535bc <_fini>, rtld_fini=0x4000e274 <_dl_fini>, stack_end=0xbffff9cc) at ../sysdeps/generic/libc-start.c:129 Brian Seppanen Charter Communications seppy(a)chartermi.net Advanced Services Engineer 906-228-4226 ext 23 Therefore, since brevity is the soul of wit and tediousness the limbs and outward flourishes, I will be brief. - Polonius

1 0

$DATE Macro Dir Creation
by Brian E. Seppanen 11 May '01

11 May '01

Can I do the following for a file destination? If I can why won't it work? The documentation leads me to believe it does. I've done something similar using the $PRIORITY macro to break out some messages into diferrent files. I want messages to log into a date specific directory. destination messages { file("/var/log/$DATE/messages" create_dirs(yes) dir_perm(0640));}; The global config likewise specifies create_dirs(yes); Any help greatly appreciated. Brian Seppanen Charter Communications seppy(a)chartermi.net Advanced Services Engineer 906-228-4226 ext 23 Therefore, since brevity is the soul of wit and tediousness the limbs and outward flourishes, I will be brief. - Polonius

2 1

RE: [syslog-ng]Compile error...
by Ohrberg, Mick 11 May '01

11 May '01

Asher, Try this: netinet/in.h:#define INADDR_NONE 0xffffffff /Mick > -----Original Message----- > From: Asher Yanich [mailto:ayanic01@cs.fiu.edu] > Sent: Thursday, May 10, 2001 4:32 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Compile error... > > > > Solaris 2.6 : > gcc -DHAVE_CONFIG_H -I. > -I/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/s > yslog-ng-1.5.6/src > -I. -O2 -Wall > -I/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/l > ibol-0.2.22/src > -D_GNU_SOURCE -c nscache.c > nscache.c: In function `nscache_new': > nscache.c:112: `INADDR_NONE' undeclared (first use in this function) > nscache.c:112: (Each undeclared identifier is reported only once > nscache.c:112: for each function it appears in.) > gmake[3]: *** [nscache.o] Error 1 > gmake[3]: Leaving directory > `/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/sy > slog-ng-1.5.6/src' > gmake[2]: *** [all-recursive] Error 1 > gmake[2]: Leaving directory > `/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/sy > slog-ng-1.5.6/src' > gmake[1]: *** [all-recursive-am] Error 2 > gmake[1]: Leaving directory > `/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/sy > slog-ng-1.5.6/src' > gmake: *** [all-recursive] Error 1 > > Same error with 1.5.5a.. sent message to the list but list > was down a few > weeks ago... > > > Thanks, > Asher > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

Compile error...
by Asher Yanich 10 May '01

10 May '01

Solaris 2.6 : gcc -DHAVE_CONFIG_H -I. -I/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/syslog-ng-1.5.6/src -I. -O2 -Wall -I/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/libol-0.2.22/src -D_GNU_SOURCE -c nscache.c nscache.c: In function `nscache_new': nscache.c:112: `INADDR_NONE' undeclared (first use in this function) nscache.c:112: (Each undeclared identifier is reported only once nscache.c:112: for each function it appears in.) gmake[3]: *** [nscache.o] Error 1 gmake[3]: Leaving directory `/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/syslog-ng-1.5.6/src' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/syslog-ng-1.5.6/src' gmake[1]: *** [all-recursive-am] Error 2 gmake[1]: Leaving directory `/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/syslog-ng-1.5.6/src' gmake: *** [all-recursive] Error 1 Same error with 1.5.5a.. sent message to the list but list was down a few weeks ago... Thanks, Asher

1 0

klogd-less logging
by MURVAI-BUZOGANY Laszlo 10 May '01

10 May '01

Hi! I would like to set up a completely klogd-less logging system, but I couldn't figure out, which program would do the symbol-translating, as it is done now by klogd. Also didn't find these in the documentation, so any help would be appreciated :) Thx, sci -- Murvai-Buzogány László Laszlo.Murvai-Buzogany(a)gt-systems.hu

2 2

Hello !
by claude.brassel＠partner-system.com 10 May '01

10 May '01

Hello, I just try to use syslog-ng, but I have a little configuration problem. If I use a simple configuration file like this : ----------------------------------------------------------- source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/var/adm/messages"); }; log { source(local); destination(all); }; ################################# source net { udp(); }; destination test_dest { file("/var/adm/network.log"); }; log { source(net); destination(test_dest); }; ----------------------------------------------------------- That work great all my network nodes send the messages to /var/adm/network.log But if I use a more complex file like this : -------------------------------------------------------------- ################################################################################ # # Definition pour la recup des infos system # source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/var/adm/messages"); }; log { source(local); destination(all); }; ################################################################################ # # Options ##options { sync(1); }; ################################################################################ # # Definition des equipements reseaux # source net { udp(); }; # Definition des destinations : 1 fichier par projet client destination d_issy_heberg { file("/var/log/issy_heberg"); }; destination d_interxion { file("/var/log/interxion"); }; destination d_filinks { file("/var/log/filinks"); }; destination d_bisax { file("/var/log/bisax"); }; destination d_directmedica { file("/var/log/directmedica"); }; destination d_novacy { file("/var/log/novacy"); }; destination d_achatpro { file("/var/log/achatpro"); }; destination d_easyvoyage { file("/var/log/easyvoyage"); }; destination d_lapeyre { file("/var/log/lapeyre"); }; # Definition des filtres filter f_issy_heberg { host("swi_heberg_issy") and host("swi_heberg_colt") and host("swi_cisco_heberg"); }; filter f_interxion { host("ic2912-2") and host("ic2924-1") and host("ic2924-2") and host ("ia780"); }; filter f_filinks { host("cisco") and host("alteon-int1") and host("alteon-int2") and host ("alteon-dmz1") and host ("alteon-dmz2") and host("switch-dmz1") and host ("switch-dmz2") and host("alteon-local1") and host ("alteon-local2") and host("switch-local1") and host ("switch-local2") and host ("switch-bkp"); }; filter f_bisax { host("alteon-1") and host ("extreme-1") and host ("alteon-3") and host ("ext_bisax1"); }; filter f_directmedica { host("3com_directmedica"); }; filter f_novacy { host("swi_novacy2"); }; filter f_achatpro { host( "swi_achatpro1") and host("alt_achatpro1") and host ("alt_achatpro2") and host ("alt_achatpro3") and host("3com_achatpro1") and host ("3com_achatpro2") and host ("3com_achatpro3"); }; filter f_easyvoyage { host("swi_easyvoyage"); }; filter f_lapeyre { host("alt_lapeyre") and host ("hp_lapeyre"); }; # mise en place des logs log { source(net); filter(f_issy_heberg); destination(d_issy_heberg); }; log { source(net); filter(f_interxion); destination(d_interxion); }; log { source(net); filter(f_filinks); destination(d_filinks); }; log { source(net); filter(f_bisax); destination(d_bisax); }; log { source(net); filter(f_directmedica); destination(d_directmedica); }; log { source(net); filter(f_novacy); destination(d_novacy); }; log { source(net); filter(f_achatpro); destination(d_achatpro); }; log { source(net); filter(f_easyvoyage); destination(d_easyvoyage); }; log { source(net); filter(f_lapeyre); destination(d_lapeyre); }; ################################################################################### # # Definition des serveurs # destination d_serveurs { file("/var/log/serveur_supervision"); }; destination d_postes_l2 { file("/var/log/postes_level2"); }; filter f_serveurs { host("netcool") and host("oracle") and host("remedy") and host("infovista"); }; filter f_postes_l2 { host("brassel") ; }; log { source(net); filter(f_serveurs); destination(d_serveurs); }; log { source(net); filter(f_postes_l2); destination(d_postes_l2); }; --------------------------------------------------------------------------------------- then nothing happens, only the /var/adm/messages work for the local messages, but the no network activity I am trying it on a solaris 2.7(32) system Have someon a great idea ? Thank's for your help .... Best Regards, Claude

2 1