- syslog-ng - lists.balabit.hu

Re: syslog-g and bsdi
by Balazs Scheidler 11 Apr '01

11 Apr '01

> I was wondering if anyone has a compatible function to replace strptime. > this is a function that is not included in BSDI (4.0+ a least) > if no one has coded a replacement, i would be willing to add another patch > to fix it. > otherwise, you should take off "this has been compiled for bsdi" on the I was wondering if you tried compiling syslog-ng 1.5 which included such a compatibility strptime() function. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 2

Linux boxes periodically stop logging?
by James Snow 10 Apr '01

10 Apr '01

I apologize for the lack of technical detail in this post, but, for the moment I'm just trying to ascertain if I or my syslog-ng config are on drugs. Basically, I have a mixed array of Linux (RedHat 6.2 & 7) and FreeBSD (4.2-S) machines on which I'm running syslog-ng and logging to a central host. (FreeBSD 4.2-S) The problem is that the Linux boxes periodically stop logging. If I send the daemon a HUP, it comes back to life and data starts flowing again, but any log messages that would have appeared while the daemon was hosed are gone. Has anyone experienced anything like this before? Thanks in advance, -Snow

4 4

odd problem
by jon＠dumbo.pobox.com 10 Apr '01

10 Apr '01

i noticed yesterday that syslog-ng won't log to anything in a destination() section if one of them fails. we have a remote logging machine colocated somewhere...here is its config(just the useful stuff) destination macrogenerateddaily { tcp(208.210.124.50 port(514)); file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY" dir_per m(0755) perm(0644)); }; destination macrogeneratedhourly { tcp(208.210.124.50 port(514)); file("/var/log/ng/$HOST/$YEAR$MONTH$DAY/$FACILITY.$PRIORITY.$HOUR" d ir_perm(0755) perm(0644)); }; now....we lost internet connectivity (so the tcp link failed) unfortunately, it also stopped logging to the disk. does it log to destinations, then just die as soon as one fails?

4 6

error connecting to hosts
by Mariusz Bogumil 09 Apr '01

09 Apr '01

My syslog-ng generates me a lot of errors: Error connecting to remote host ( xxx.xxx.xxx.xxx) reatempting in 60 seconds Everything to be OK - only these starnge arrors. All generated massages are handled. I send then to remote host via TCP. I use Sol.2.6 Any suggestions??? Regards marbo

1 0

Re: [syslog-ng]perm and dir_perm not working?
by John_Delisle＠ceridian.ca 06 Apr '01

06 Apr '01

I should mention I've tried this running syslog-ng 1.4.10, 1.4.11, 1.5.5a. On linux kernel 2.4.1, gcc 2.95.2, glibc 2.2. Any help would be greatly appreciated!! John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 |--------+--------------------------------> | | John_Delisle(a)ceridian.| | | ca | | | Sent by: | | | syslog-ng-admin(a)lists.| | | balabit.hu | | | | | | | | | 2001/04/06 10:49 AM | | | Please respond to | | | syslog-ng | | | | |--------+--------------------------------> >-----------------------------------------------------------------------------------------------------------| | | | To: syslog-ng(a)lists.balabit.hu | | cc: | | Subject: [syslog-ng]perm and dir_perm not working? | >-----------------------------------------------------------------------------------------------------------| Hi all, I've been trying without any luck to have syslog-ng create dirs with 755 and files with 644 permissions. I've used the following line: destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) create_dirs(yes) dir_perm(0755)); }; But they are created with the permissions from my umask (022). ie files are 600, not 644. Is this a known issue? Is there a workaround? Any ideas?? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

perm and dir_perm not working?
by John_Delisle＠ceridian.ca 06 Apr '01

06 Apr '01

Hi all, I've been trying without any luck to have syslog-ng create dirs with 755 and files with 644 permissions. I've used the following line: destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) create_dirs(yes) dir_perm(0755)); }; But they are created with the permissions from my umask (022). ie files are 600, not 644. Is this a known issue? Is there a workaround? Any ideas?? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

2 1

Syslog Logging Delay
by Brian E. Seppanen 06 Apr '01

06 Apr '01

Here it stops again at approx 10:44 a.m. EST. Again UDP:514 is 65550. Packets are still coming. No logging. Tried logging via logger and no messages. 10:53 a.m. EST it starts again. vmstat doesn't indicate much disk activity blocking either in or out either before or after. After it picks up again the messages I logged via logger are logged. Utilization on the box is pretty steady. Swap neither grows, nor diminishes. Memory is used for the most part, maybe about 10MB free. Lots of shared memory. Graphs show loopback at 10:45 is quite active comparitively. This is from a dump of an rrdtool database monitoring loopback utilization. This doesn't correlate to other times when I've seen the problem though, specifically when it stopped logging at 10:10 p.m. EST. Normall readings for the graph are around 2.e+01.  <row><v> 2.8297444075e+01 </v><v> 2.8297444075e+01 </v></row>  <row><v> 5.7677917503e+01 </v><v> 5.7677917503e+01 </v></row>  <row><v> 9.0888004719e+01 </v><v> 9.0888004719e+01 </v></row> POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN, revents=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 6000) = 1 recvfrom(5, "<133>559901: 4w3d: %UBR7200-5-MA"..., 1024, 0, {sin_family=AF_INET, sin_port=htons(49364), sin_addr=inet_addr("24.247.48.35")}}, [16]) = 163 time(NULL) = 985880402 time(NULL) = 985880402 time(NULL) = 985880402 time(NULL) = 985880402 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=POLLOUT, revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 1 write(7, "Mar 29 10:40:02 24.247.48.35 559"..., 188) = 188 time(NULL) = 985880402 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 0 poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10, events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13, events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15, events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN}, {fd=3, events=POLLIN, revents=POLLIN}], 17, 4000) = 1 read(3, I don't know. Nothing to correlate it to stopping at 10:10:00 p.m. EST last night though... I'm just not seeing anything that sticks out to indicate where a problem might be. Can someone who is running a central logging server indicate how they have configured syslog-ng, as far as log_fifo_size, garbage collection options, number of objects alive at any one time after running for a while, sync options? I would appreciate it, greatly. Thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

3 12

RE: [syslog-ng]Cisco Logging
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 06 Apr '01

06 Apr '01

Richard, syslog-ng does a considerably better job at filtering than does syslogd. This can cause you problems if you are not looking at it correctly. syslogd will log up to a priority for a facility in the syslog.conf. syslog-ng will log only that facility given in the syslog-ng.conf. Cisco devices log at the info level by default. So only if you are getting something from the Cisco devices at the debug level. If you want the same behavior as in syslogd you need to set your filter to "priority(info..debug)". Regards, Drew > -----Original Message----- > From: Shaw, Richard W [SMTP:Richard.W.Shaw@team.telstra.com] > Sent: Friday, April 06, 2001 9:50 AM > To: 'syslog-ng(a)lists.balabit.hu' > Subject: [syslog-ng]Cisco Logging > > Hi Guys > > I've just found syslog-ng and am testing/comparing it to our current > syslogd > so I can match the logging then push everything to a syslog server. > > My problem is that I'm getting no logs for Cisco devices, I don't even get > anything in the sys.log file(see below): > > syslogd.conf file : > local7.debug /var/log/cisco.log > > syslog-ng.conf file: > source src { > udp(); > tcp(); > sun-streams("/dev/log" door("/etc/.syslog_door")); > internal(); > }; > destination d_mail { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/mail.log" > create_dirs(yes) > ); }; > destination d_cisco { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/cisco.log" > create_dirs(ye > s)); }; > destination d_sshd { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sshd.log" > create_dirs(yes > )); }; > destination d_tac { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/tacplus.log" > create_dirs(y > es)); }; > > destination d_sys { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sys.log" > create_dirs(yes)) > ; }; > > filter f_mail { facility(mail); }; > filter f_cisco { facility(local7) and priority(debug); }; > filter f_sshd { match("sshd"); }; > filter f_tac { facility(local6); }; > > log { source(src); filter(f_mail); destination(d_mail); }; > log { source(src); filter(f_cisco); destination(d_cisco); }; > log { source(src); filter(f_sshd); destination(d_sshd); }; > log { source(src); filter(f_tac); destination(d_tac); }; > > > log { source(src); destination(d_sys); }; > > > Thanks in advance for any help > > Regards > Richard Shaw > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Cisco Logging
by Shaw, Richard W 06 Apr '01

06 Apr '01

Hi Guys I've just found syslog-ng and am testing/comparing it to our current syslogd so I can match the logging then push everything to a syslog server. My problem is that I'm getting no logs for Cisco devices, I don't even get anything in the sys.log file(see below): syslogd.conf file : local7.debug /var/log/cisco.log syslog-ng.conf file: source src { udp(); tcp(); sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination d_mail { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/mail.log" create_dirs(yes) ); }; destination d_cisco { file("/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/cisco.log" create_dirs(ye s)); }; destination d_sshd { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sshd.log" create_dirs(yes )); }; destination d_tac { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/tacplus.log" create_dirs(y es)); }; destination d_sys { file( "/tmp/ng/$HOST/$YEAR/$MONTH/$DAY/sys.log" create_dirs(yes)) ; }; filter f_mail { facility(mail); }; filter f_cisco { facility(local7) and priority(debug); }; filter f_sshd { match("sshd"); }; filter f_tac { facility(local6); }; log { source(src); filter(f_mail); destination(d_mail); }; log { source(src); filter(f_cisco); destination(d_cisco); }; log { source(src); filter(f_sshd); destination(d_sshd); }; log { source(src); filter(f_tac); destination(d_tac); }; log { source(src); destination(d_sys); }; Thanks in advance for any help Regards Richard Shaw

1 0

perm() and dir_perm()
by John_Delisle＠ceridian.ca 04 Apr '01

04 Apr '01

Hi everyone! I'm having issues getting perm() and dirperm() working. Here is my destination line: destination d_devices { file("/var/log/devices/$HOST/$PRIORITY" perm(0644) create_dirs(yes) dir_perm(0755)); }; The files are created with 600, and dirs with 700. Any ideas? My umask is 022. I've tried adjusting the above values (I added 22 to them) and it didn't make a difference. John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 This e-mail and any files transmitted with it are considered confidential and are intended solely for the use of the individual or entity to whom they are addressed (intended). This communication is subject to agent/client privilege.If you are not the intended recipient (received in error) or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited.If you have received this e-mail in error please notify the sender immediately.

1 0