- syslog-ng - lists.balabit.hu

Re: [syslog-ng]AIX compatability issue?
by John_Delisle＠ceridian.ca 23 Feb '01

23 Feb '01

Would it be easier to replace the AIX syslogd with syslog-ng? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Brad Arlt <arlt(a)cpsc.ucalgary.ca To: syslog-ng(a)lists.balabit.hu > cc: Sent by: Subject: Re: [syslog-ng]AIX compatability issue? syslog-ng-admin@lists. balabit.hu 2001/02/23 04:06 PM Please respond to syslog-ng On Fri, Feb 23, 2001 at 01:11:30PM -0600, John_Delisle(a)ceridian.ca wrote: > > Thanks for the response. Sorry to sound ignorant, but what do you mean by > truss or a strace? Is that a type of bracket? Below is the output I get strace and truss log to stderror (or a file) all the system call a process makes. I took a look at the AIX box we have kicking around and the only strace on it is for tracing STREAMS. This is not what you want. I looked at the strace homepage, and as far as I can tell, AIX is *not* one of the supported platforms. AIX seems to have a tracing utility called trace(1). It looks kinda odd, but should do the job. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_) \(_) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]AIX compatability issue?
by John_Delisle＠ceridian.ca 23 Feb '01

23 Feb '01

Thanks for the response. Sorry to sound ignorant, but what do you mean by truss or a strace? Is that a type of bracket? Below is the output I get to /var/log/messages: Feb 21 21:41:25 Message forwarded from ppsvrwasprd2: pskavins: testing using local1.notice John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Balazs Scheidler <bazsi(a)balabit.hu> To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]AIX compatability issue? balabit.hu 2001/02/23 05:34 AM Please respond to syslog-ng Hi, > I'm running a central syslog-ng server with the following syslog-ng.conf: > > options { sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (off); > use_dns (yes); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > }; > > source s_sys { unix-stream ("/dev/log"); internal(); }; > source s_remote { udp(ip(0.0.0.0) port(514)); }; > > destination d_mesg { file("/var/log/messages"); }; > destination d_powerpay { file("/var/log/powerpay"); }; > > filter f_powerpay { facility(local1); }; > > log { source(s_sys); destination(d_mesg); }; > log { source(s_remote); filter(f_powerpay); destination(d_powerpay); }; > log { source(s_remote); destination(d_mesg); }; > > > I have serveral AIX servers that don't seem to get logged. I'm sending > messages with facility set to local1. If I comment out the second log line > above I get messages from the AIX servers to my messages file. When I > enable the second log line as it is above I get nothing. I've tested > sending messages from other platforms with facility set to local1 and they > get logged in the correct file as expected. /var/log/messages should get a copy of each message regardless of the second logline. you should check whether syslog-ng receives the lines correctly with a truss or an strace. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

sync within tcp
by matthew.copeland＠honeywell.com 23 Feb '01

23 Feb '01

I am using the following for my config file. I have been told that you can sync a tcp connection to a certain number of lines, and I thought this was how you do it, but it dies on the first line that has the sync with a parse error. If I move it to its own line, outside of the tcp, it dies parsing there. Can someone please tell me where I am messing up here? Thanks, Matthew M. Copeland options { long_hostnames(off); log_fifo_size(1440000); }; source src { unix-stream("/dev/log"); internal(); }; destination normal_messages { tcp("129.235.66.4" port(999) sync(10)); }; destination immediate_messages { tcp("129.235.66.4" port(999) sync(0)); }; filter f_gs_alert { match("GS_ALERT"); }; log { source (src); filter(f_gs_alert); destination(immediate_messages); }; log { source(src); filter(DEFAULT); destination(normal_messages); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 4

HUP causes a core dump
by Chris Pile 23 Feb '01

23 Feb '01

Balazs Scheidler, I read your message from: http://lists.balabit.hu/pipermail/syslog-ng/2001-January/001147.html and noticed you required a backtrace to help debug the problem where sending SIGHUP to syslog-ng causes a core dump. We have noticed this problem occurs when you send repeated SIGHUP signals within about a second of each other. This can happen either manually or when newsyslog is run and HUPs syslog-ng while it rotates/gzips the logs. (newsyslog -v) quick example of how to core syslog-ng manually: $ ps aux | grep syslog-ng root 14416 0.2 1.0 928 624 ?? Ss 5:07PM 0:00.06 /usr/local/sbin/syslog-ng -p /var/run/syslog.pid $ kill -HUP 14416 $ kill -HUP 14416 bash: kill: (14416) - No such pid $ cat /var/run/syslog.pid 14416 $ ps aux | grep syslog-ng <nothing, process cored> OS: FreeBSD 3.3-RELEASE syslog-ng: 1.4.10 Thanks, Chris Pile -- See below the gdb output: $ gdb syslog-ng -c syslog-ng.core (gdb) bt #0 0x280aa3d0 in kill () from /usr/lib/libc.so.3 #1 0x280de728 in abort () from /usr/lib/libc.so.3 #2 0x8057727 in fatal (format=0x805d2db "Memory corrupted!\n") at werror.c:187 #3 0x8057fa0 in debug_free (m=0x8061a28) at xalloc.c:95 #4 0x805839d in ol_space_free (p=0x8061a2c) at xalloc.c:315 #5 0x80585ae in do_flush (c=0x8071388, w=0xbfbfdaa8) at pkt_buffer.c:101 #6 0x8055fee in write_callback (fd=0x8071408) at io.c:487 #7 0x8055a43 in io_iter (b=0x8062008) at io.c:253 #8 0x8049a58 in main_loop (backend=0x8062008) at main.c:148 #9 0x8049f8f in main (argc=5, argv=0xbfbfdc04) at main.c:317 #10 0x80496b9 in _start () (gdb) bt full #0 0x280aa3d0 in kill () from /usr/lib/libc.so.3 No symbol table info available. #1 0x280de728 in abort () from /usr/lib/libc.so.3 No symbol table info available. #2 0x8057727 in fatal (format=0x805d2db "Memory corrupted!\n") at werror.c:187 args = 0xbfbfda28 "¼^\005\b\004" #3 0x8057fa0 in debug_free (m=0x8061a28) at xalloc.c:95 p = (int *) 0x8061a28 real_size = 16 size = 4 #4 0x805839d in ol_space_free (p=0x8061a2c) at xalloc.c:315 m = (int *) 0x8061a28 #5 0x80585ae in do_flush (c=0x8071388, w=0xbfbfdaa8) at pkt_buffer.c:101 self = (struct pkt_buffer *) 0x8071388 res = 87 item_this = (struct ol_queue_node *) 0x8061a2c item_next = (struct ol_queue_node *) 0x80713b4 item = (struct buffer_node *) 0x8061a2c #6 0x8055fee in write_callback (fd=0x8071408) at io.c:487 self = (struct io_fd *) 0x8071408 res = 134577764 w = {super = {super = {next = 0x0, isa = 0x0, alloc_method = 2 '\002', marked = 0 '\000', dead = 0 '\000'}, write = 0x8055ebc <do_write>, writestr = 0}, fd = 0} #7 0x8055a43 in io_iter (b=0x8062008) at io.c:253 fd = (struct nonblocking_fd *) 0x8071408 i = 0 nfds = 2 nco = 3217021744 fds = (struct pollfd *) 0xbfbfdad4 res = 1 timeout = 0 now = 982946899 #8 0x8049a58 in main_loop (backend=0x8062008) at main.c:148 exit_main_loop = 0 #9 0x8049f8f in main (argc=5, argv=0xbfbfdc04) at main.c:317 do_fork = 1 opt = -1 backend = (struct syslog_backend *) 0x8062008 syslog_ng_options = {{name = 0x8058cc0 "cfgfile", has_arg = 1, flag = 0x0, val = 102}, {name = 0x8058cc8 "pidfile", has_arg = 1, flag = 0x0, val = 112}, {name = 0x8058cd0 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x8058cd6 "verbose", has_arg = 0, flag = 0x0, val = 118}, {name = 0x8058cde "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x8058ce3 "version", has_arg = 0, flag = 0x0, val = 86}, {name = 0x8058ceb "yydebug", has_arg = 0, flag = 0x0, val = 121}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} #10 0x80496b9 in _start () No symbol table info available.

1 0

Re: [syslog-ng] use_fqdn()
by Gabor Kiss 23 Feb '01

23 Feb '01

> > options { use_fqdn(yes); }; > > > > I've tried different options and all numerical ones are excepted ok. > > Options with accepted values described as 'yes' or 'no' in the > > documentation cause the deamon to fail on start-up. > > > > Have I got the syntax wrong? > > Do I need a newer version to enable this feature? > > If so, Is there a different option that will give me the full domain name > > in this version? > > This option is supported only 1.3.x and later. I think you should install > 1.3.15, I intent to release it as a stable version soon. I have 1.4.0rc3 and I cannot configure FQDNs. Current options are: options { long_hostnames(on); chain_hostnames(yes); use_fqdn(yes); sync(0); }; What did I wrong? Gabor

1 0

AIX compatability issue?
by John_Delisle＠ceridian.ca 23 Feb '01

23 Feb '01

Hi, I'm running a central syslog-ng server with the following syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source s_remote { udp(ip(0.0.0.0) port(514)); }; destination d_mesg { file("/var/log/messages"); }; destination d_powerpay { file("/var/log/powerpay"); }; filter f_powerpay { facility(local1); }; log { source(s_sys); destination(d_mesg); }; log { source(s_remote); filter(f_powerpay); destination(d_powerpay); }; log { source(s_remote); destination(d_mesg); }; I have serveral AIX servers that don't seem to get logged. I'm sending messages with facility set to local1. If I comment out the second log line above I get messages from the AIX servers to my messages file. When I enable the second log line as it is above I get nothing. I've tested sending messages from other platforms with facility set to local1 and they get logged in the correct file as expected. Any ideas? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909

2 1

RE: [syslog-ng]Trying to send log over network
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 23 Feb '01

23 Feb '01

Thanks, Bazsi. I wasn't paying attention to what I was writing.... Drew > -----Original Message----- > From: Balazs Scheidler [SMTP:bazsi@balabit.hu] > Sent: Thursday, February 22, 2001 12:13 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Trying to send log over network > > > What is the address of your loghost and the address of the clients? I'm > > looking at your two configs and I want to make sure that the destination > for > > the problem machine is ok. Do you have a 192.168.1.19 host on your > network > > and is it listening for tcp connections on port 514? In the loghost > config > > you reference a source of 192.168.1.1 which tells me that your loghost > is > > 192.168.1.1. If you are trying to establish a connection to a host > using > > the tcp/ip you also need to make sure that the host is listening for > tcp/ip > > connections. The loghost config is listening for tcp/ip on 192.168.1.1 > port > > 10001 and you are trying to make a tcp connection with 192.168.1.19 on > port > > 514. Is this what you are intending, if so this won't work. Change > your > > destination in your client to read destination d_bg > > {tcp("192.168.1.1:10001") }; That should at least let you log to that > > loghost. > > > destination d_bg { tcp("192.168.1.19:514"); }; > > destination tcp drivers should look like this: > > destination d_bg { tcp("192.168.1.19" port(514)); }; > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Destination Not Working
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 23 Feb '01

23 Feb '01

I haven't looked at the docs recently but it is my understanding, and someone here can point it out if I am wrong, but match is used for matching on the message part of the log line. It doesn't match on the host. Instead use filter cisco-ubr2 { host("192.168.1.2); }; Regards, Drew > -----Original Message----- > From: Brian E. Seppanen [SMTP:seppy@chartermi.net] > Sent: Friday, February 23, 2001 2:08 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Destination Not Working > > I have several routers set up to log to a central host. All of them work > without issue. I have the following destination, set up. > > destination blah.cisco { file("/var/log/cisco/blah-cisco.$PRIORITY" > owner("admin") group("apache") perm(0640));}; > > and the following filter > > filter cisco-ubr2 { match("192.168.1.2");}; > > Which is supposed to log as follows > > log { source(udp_src); filter(cisco-ubr2); destination(blah.cisco);}; > > I get no errors, but the following is logging to /var/log/messages which > is my default. > > Feb 22 13:50:05 192.168.1.2 120: 00:18:04: %UBR7200-5-UNREGSIDTIMEOUT: > > the udp_src is working for every other router, as are the filters and > destinations. This is the only one that isn't working. > > This one has confused me for some time, any ideas greatly appreciated. > > > Brian Seppanen > Charter Communications > Regional Data Center 906-228-4226 ext 23 > Marquette, MI seppy(a)chartermi.net > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Destination Not Working
by Brian E. Seppanen 23 Feb '01

23 Feb '01

I have several routers set up to log to a central host. All of them work without issue. I have the following destination, set up. destination blah.cisco { file("/var/log/cisco/blah-cisco.$PRIORITY" owner("admin") group("apache") perm(0640));}; and the following filter filter cisco-ubr2 { match("192.168.1.2");}; Which is supposed to log as follows log { source(udp_src); filter(cisco-ubr2); destination(blah.cisco);}; I get no errors, but the following is logging to /var/log/messages which is my default. Feb 22 13:50:05 192.168.1.2 120: 00:18:04: %UBR7200-5-UNREGSIDTIMEOUT: the udp_src is working for every other router, as are the filters and destinations. This is the only one that isn't working. This one has confused me for some time, any ideas greatly appreciated. Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

1 0

syslog-ng and libol rpms
by Seth Vidal 22 Feb '01

22 Feb '01

Hi folks, I rebuilt the syslog-ng 1.4.10 and libol 0.2.20 rpms under rh 7 - I also added a syslog-ng init script that starts klogd as well. I used some of the default spec that came with syslog-ng and some of my own. Just thought someone might find these useful. i386 and srpms are here: http://www.dulug.duke.edu/~skvidal/syslog-ng/ if anyone has any suggestions on ways to improve the spec files or the init script let me know. thanks -sv -- The old "give 'em a Linux box and they think they're Jean-Luc Picard" syndrome. -A.S.R

1 0