- syslog-ng - lists.balabit.hu

R: [syslog-ng]Syslog-ng dies unexpectedly
by Rossi Dario 12 Oct '00

12 Oct '00

Sorry i cant answer to your question, but could i know the name of the nt logging program? Thnx Dario > -----Messaggio originale----- > Da: jmad [mailto:than@wwa.com] > Inviato: mercoledì 11 ottobre 2000 19.15 > A: syslog-ng(a)lists.balabit.hu > Oggetto: [syslog-ng]Syslog-ng dies unexpectedly > > > I recently replaced my syslogd with syslog-ng on HP-UX 11.00. > > It was running great for about a week. > > I began adding more remote clients logging to it. > > Within the last day or so now it dies without explaination every few > minutes (3-15min). Where does syslog-ng default log to so I > can try to > figure out what's going wrong (or have any of you had this and fixed > it)? > > Also, I'm running a program that logs NT-events in syslog format and I > want to create a separate SINGLE "error" log from multiple machines. > What would the format for that be? Does a simple filter and log match > statement work? > > destination ntlog { file("/var/log/ntlog.log"); }; > filter f_error { match("[ERR]"); }; > #( [ERR] is the common statement in the NT log statement for error > logs) > > log { source(net); filter(f_error); destination(ntlog); }; > > Thanks for any help, > JonM > City of Evanston > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > ******************************************************************************************************** COLT Telecom SpA Sede Legale: Viale Jenner, 56 - 20159 Milano Tel. 02-303331 CF e P.IVA: 12286350157 - Reg.Imp. Milano n. 309043 - REA n. 154763 Il presente messaggio non costituisce un impegno contrattuale tra COLT Telecom S.p.A., le proprie Consociate od Affiliate ("COLT") ed il destinatario. Le opinioni ivi espresse sono quelle dell'autore. COLT non assume alcuna responsabilita riguardo al contenuto del presente messaggio. Il messaggio e destinato esclusivamente al destinatario. Il contenuto e gli allegati sono da considerarsi di natura confidenziale. Nel caso abbiate ricevuto il presente messaggio per errore, siete pregati di telefonare al numero indicato sopra. *********************************************************************************************************

2 1

RE: [syslog-ng]syslog-ng and Solaris
by Hamilton, Andrew Mr. 12 Oct '00

12 Oct '00

Depending on what you are using to log on the client, you can use the existing syslogd or syslog-ng for your client. I do a little of both. You can do a man of syslogd and syslogd.conf and that will give you pretty much all the format for the file and the way it works. Basically to forward logging to a loghost you just do something like: local0.info @loghost.mydomain.com That will send facility local0, level info messages to the loghost. And you do similar things for the other facilities you want to forward. For syslog-ng you just set up a destination with a hostname: destination d_loghost {host("loghost.mydomain.com"); }; then your log statement: log { source(src); filter(f_local0); filter(f_info); destination(d_loghost); }; Hope that helps. Drew > -----Original Message----- > From: dwarf(a)solarisresources.com [SMTP:dwarf@solarisresources.com] > Sent: Wednesday, October 11, 2000 1:36 AM > To: bazsil(a)balabit.hu > Cc: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]syslog-ng and Solaris > > Hi There, > > I've managed to compile up syslog-ng on a Solaris 8 box and have a few > questions I hope you can answer: > > 1. I assume that I can kill the script that starts Solaris Syslogd with > no ill effects? > > 2. Can I set a startup script that runs syslog-ng as a daemon process. > > 3. I've got most of the options setup the way that I want them but can't > seem to figure out how to setup one or two machines as syslog servers and > a few dozen machines to forward all syslog messages to both of the syslog > servers. > > If you could pass along info on the above, that would be greatly > appreciated. > > thanks in advance, > alan > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Syslog-ng dies unexpectedly
by Ohrberg, Mick 11 Oct '00

11 Oct '00

[snip] > Also, I'm running a program that logs NT-events in syslog format and I > want to create a separate SINGLE "error" log from multiple machines. > What would the format for that be? Does a simple filter and log match > statement work? > > destination ntlog { file("/var/log/ntlog.log"); }; > filter f_error { match("[ERR]"); }; > #( [ERR] is the common statement in the NT log statement for error logs) > > log { source(net); filter(f_error); destination(ntlog); }; [snip] Jon, Does your NT logger use one of the facility/priority pairs available? I know we do a lot of logging using the different user-facilities. If your NTlogger uses that, you can filter by facility as well. /Mick

1 0

Syslog-ng dies unexpectedly
by jmad 11 Oct '00

11 Oct '00

I recently replaced my syslogd with syslog-ng on HP-UX 11.00. It was running great for about a week. I began adding more remote clients logging to it. Within the last day or so now it dies without explaination every few minutes (3-15min). Where does syslog-ng default log to so I can try to figure out what's going wrong (or have any of you had this and fixed it)? Also, I'm running a program that logs NT-events in syslog format and I want to create a separate SINGLE "error" log from multiple machines. What would the format for that be? Does a simple filter and log match statement work? destination ntlog { file("/var/log/ntlog.log"); }; filter f_error { match("[ERR]"); }; #( [ERR] is the common statement in the NT log statement for error logs) log { source(net); filter(f_error); destination(ntlog); }; Thanks for any help, JonM City of Evanston

1 0

syslog-ng vs (of all things) Win2k + IIS
by matthew.copeland＠honeywell.com 11 Oct '00

11 Oct '00

This afternoon I was in a debate with another one of the software engineering guys here were I work. He has made the claim that for 300 machines each logging a message at least every 10 seconds (probably more like once every other second.) that encapsultaing the message in an XML tag and then sending that to a windblows 2000 box via HTTP running IIS, where it has to process the message using a CGI or ASP script, is more scalable than using syslog-ng, and that syslog-ng can't even handle this load. Now, I would beg to differ on this assesment, but I need to find some numbers to backup my claim. Can anyone help? (Ohh.. and you don't have to necessarily use an Intel box for the main server) Matthew M. Copeland Software Engineer matthew.copeland(a)honeywell.com

7 17

syslog-ng and Solaris
by dwarf＠solarisresources.com 11 Oct '00

11 Oct '00

Hi There, I've managed to compile up syslog-ng on a Solaris 8 box and have a few questions I hope you can answer: 1. I assume that I can kill the script that starts Solaris Syslogd with no ill effects? 2. Can I set a startup script that runs syslog-ng as a daemon process. 3. I've got most of the options setup the way that I want them but can't seem to figure out how to setup one or two machines as syslog servers and a few dozen machines to forward all syslog messages to both of the syslog servers. If you could pass along info on the above, that would be greatly appreciated. thanks in advance, alan

2 1

PTR lookups; leak/crash fixes
by Scott McDermott 10 Oct '00

10 Oct '00

Why does syslog-ng do a PTR lookup for EVERY message? It uses them for $HOST stuff? But why not cache these and avoid the lookup? At first I thought, the caching belongs in the libc, possibly in nscd. But despite nscd running (this is Linux with glibc-2.1), gethostbyaddr() still does a full name server PTR lookup for every single message. I started running a slave name server on the localhost just to avoid the bandwidth hit doing all these queries :) But now there is a bunch of extra CPU usage (syslog-ng has accumulated 600 minutes of CPU time after running for just one day; this is a 333Mhz machine and there are only a couple dozen logging hosts, most of which comes relayed through other syslog-ngs anyways). If I were to set use_dns to `no' this would probably make the problem go away. Is there any reason not to do this? Would I then get IPs for $HOST instead of names? Incidentally, the assert fix definitely got rid of the crashing, and the string free definitely fixed some memory leakage. But I have only been running it for one day and it's up to 6 meg VSZ so far (would have been 30 by now before the fix) ...hopefully this is just some data structures which will plateau out once it's been running for some time (xinetd does this in a big way ;)

3 2

HP-UX 11.0 configuration
by Mertz, Richard 03 Oct '00

03 Oct '00

I have compiled syslog-ng on my HP-UX 11.0 box. Now I could really use some help configuring it. Any pointers? Richard Mertz City of Evanston

1 0

Answer to the reliability problem
by Jeffrey W. Baker 30 Sep '00

30 Sep '00

Well, I have found the answer to the reliability problem! The flaw is in this code in pkt_buffer.c: static int do_write_str(struct abstract_write *c, struct ol_string *string) { CAST(pkt_buffer, self, c); debug("do_write_str\n"); if (self->super.closed) { ol_string_free(string); return ST_FAIL | ST_CLOSE; } if (self->queue_size == self->queue_max) { /* fifo full */ ol_string_free(string); return ST_FAIL | ST_OK; } So you can see that when the queue is full, the messages simply get dropped. That's bad! The solution is to flush the queue when it is full, and then continue looping over the available input. The question is, what code should be responsible for doing this flushing? Shouldn't some piece of code be checking for the ST_FAIL return code? Cheers, Jeffrey

2 2

Doubt !!
by Kleyson Rios 29 Sep '00

29 Sep '00

The expression : log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; write for destination(mailinfo) the messages where " filter(f_mail) AND filter(f_info) " is true or " filter(f_mail) OR filter(f_info) " is true ? Because in my syslog-ng.conf I have : destination mailinfo { file("/var/log/syslog-ng/gandalf/mail.info"); }; destination mailwarn { file("/var/log/syslog-ng/gandalf/mail.warn"); }; filter f_mail { facility(mail); }; filter f_info { level(info); }; filter f_warn { level(warn); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; and my logs "mailinfo" and "mailwarn" are same . Kleyson Rios. Brazil.

2 1