- syslog-ng - lists.balabit.hu

RE: [syslog-ng]file to large error
by Hamilton, Andrew Mr. 06 Sep '00

06 Sep '00

Thought I might add that I can get very large files as well. Well in excess of 100 MB. I don't think syslog-ng is limiting the log size. I'm running on a Solaris 2.7 box and I have very few problems with syslog-ng. Drew > -----Original Message----- > From: Nate Campi [SMTP:nate@campin.net] > Sent: Wednesday, September 06, 2000 3:17 AM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]file to large error > > Just as I'm leaving, I noticed this on my loghost at work (redhat 6.2, UDP > logging for around 50 hosts): > > Sep 5 18:13:04 loghost syslog-ng[24136]: syslog-ng version 1.4.4 starting > Sep 5 18:13:04 loghost syslog: syslog-ng startup succeeded > Sep 5 18:13:04 loghost syslog: klogd startup succeeded > Sep 5 18:13:06 loghost syslog-ng[24136]: io.c: do_write: write() failed > (errno 27), File too large > > Obviously I need to rotate the logs more often on that host, but were you > aware that there is a limit to the file sizes syslog-ng could write to? > > # ls -al /var/log/messages > -rw----r-- 1 root root 9048923 Sep 5 18:15 messages > > Ok, that's a huge logfile, but I just wanted to post that here in case > it's relevant. > > -- > Nate Campi > "If we knew what we were doing, it wouldn't be called research." - > Einstein > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

RE: [syslog-ng]file to large error
by Shawn Davenport 06 Sep '00

06 Sep '00

Hey folks, Just figured I'd add some info to Nate's problem. I'm running syslog-ng-1.4.5 and libol-0.2.18 under solaris 2.7(sparc). One host collects firewall logs, and I've got several files as large if not larger than the one below. -rw------- 1 root root 112629718 Sep 5 17:23 gc-adminfw_all Not sure if this helps narrow down the problem or not. Thanks... Shawn -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Tuesday, September 05, 2000 6:17 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]file to large error Just as I'm leaving, I noticed this on my loghost at work (redhat 6.2, UDP logging for around 50 hosts): Sep 5 18:13:04 loghost syslog-ng[24136]: syslog-ng version 1.4.4 starting Sep 5 18:13:04 loghost syslog: syslog-ng startup succeeded Sep 5 18:13:04 loghost syslog: klogd startup succeeded Sep 5 18:13:06 loghost syslog-ng[24136]: io.c: do_write: write() failed (errno 27), File too large Obviously I need to rotate the logs more often on that host, but were you aware that there is a limit to the file sizes syslog-ng could write to? # ls -al /var/log/messages -rw----r-- 1 root root 9048923 Sep 5 18:15 messages Ok, that's a huge logfile, but I just wanted to post that here in case it's relevant. -- Nate Campi "If we knew what we were doing, it wouldn't be called research." - Einstein _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]Re: syslog-ng digest, Vol 1 #250 - 4 msgs
by Ohrberg, Mick 29 Aug '00

29 Aug '00

2.3.3. program() Selects messages based on the program field. The parameter may be an extended regular expression. Example: program("(sendmail)|(smail)") -----Original Message----- From: Jason Tsai [mailto:jason@nw.leadon.com.tw] Sent: Tuesday, August 29, 2000 12:32 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Re: syslog-ng digest, Vol 1 #250 - 4 msgs On Mon, 28 Aug 2000 07:12:48 +0200 syslog-ng-admin(a)lists.balabit.hu wrote: > > 1. Once my linux box receive a log, how can I redirect this log message to someone's > > mail(someone(a)somewhere.com)? > > You could use the program() destination to send messages to a custom script, > which may send an email or anything you want to. > Can you show me how to use the program() in syslog-ng.conf? And how does the program() pass the message to a custom script? using system environment? Thanks. Best Regards Jason Tsai E-Mail: jason(a)leadon.com.tw Tel: +886-2-23949911#815 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: syslog-ng bug: newlines in messages
by Balazs Scheidler 29 Aug '00

29 Aug '00

> If a syslogged message contains a newline, syslog-ng writes the > message with the newline still embedded. This plays havoc with syslog > parsing. Other syslogd implementations replace the newline with > something else (ie. a space.) bind-8.2.2P5, on startup, logs a > message that contains an embedded newline. The Linux kernel also > occasionally logs messages that contain newlines. I've just comitted a fix, it should be available in the next version, or apply this patch: diff -u -r1.19 log.c --- log.c 2000/03/01 22:02:47 1.19 +++ log.c 2000/08/27 13:39:32 @@ -155,6 +155,9 @@ lm->stamp = now; } + for (oldsrc = src, oldleft = left; oldleft; oldleft--, oldsrc++) { + if (*oldsrc < 32) *oldsrc = '.'; + } lm->msg = c_format_cstring("%s", left, src); } -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

3 2

syslog-ng and syslog
by Rossi Dario 27 Aug '00

27 Aug '00

Hello all, a newbie question.... i have two pcs running linux debian 2.2 System1 is equipped with syslog and Sytem2 with syslog-ng I tried to log the System1 facility daemon on System2 doing so: On System1 (syslog.conf) daemon.* @System2IP On System 2 (syslog-ng.conf) source src { unix-stream("/dev/log"); internal(); udp(); }; destination mydest { file("/var/log/myfile"); }; filter myfilter { facility(daemon) and host("system1"); }; log { source(src); filter(myfilter); destination(mydest); }; options { use-fqdn(yes); }; restarted all daemons and what happened was that daemonlog of system1 was logged on System2-daemonlog instead of System2-myfile. I tried this coexistence with syslog because in a near future i ll have to monitorize some Cis*o logs and i 'd like to do it with syslog-ng, so i need to make it run asap. : O any help? dario

2 1

Filter in syslog-ng
by Jason Tsai 27 Aug '00

27 Aug '00

Hi, I had install syslog-ng on my redhat linux. Can someone tell me.. 1. Once my linux box receive a log, how can I redirect this log message to someone's mail(someone(a)somewhere.com)? 2. Can I filter out some string that I don't want in a single log message line? Best Regards

2 1

ask
by samadi＠linux.ce.sharif.ac.ir 14 Aug '00

14 Aug '00

Hi! I am the computer student. I want to know if I ask question do you answer me? if I have a problem do you solve it me or write it's program? goodlck...

1 0

Re: libol/scsh
by Balazs Scheidler 10 Aug '00

10 Aug '00

> You really should document the fact that libol's class generation stuff > requires scsh for its scripts to run, and syslog-ng uses a libol tool to > rerun on the source files when they change. You might also add a > functioning test to libol configure.in that will fail if scsh is not > present instead of proceeding like it does now. Either and especially > both of these things will save people time ;) scsh is required only to hack on the sources, simply compiling it doesn't require scsh. I may put in some comments though. ... I added this to the README file: Hacking on syslog-ng ==================== Syslog-ng uses a nonblocking I/O, and OO library called libol. Libol uses a preprocessor to generate object definitions and information for the gc to collect garbage. Object definitions are structs and some small functions, and are placed in a file named something.c.x or something.h.x. These .x files are then included in the C source files. This preprocessor is written in Scheme, and requires scsh to run, but is not required to simply compile syslog-ng, since all needed .x files are included in the distribution. If you change a source file though, the .x file needs to be regenerated. By default all generated files are included in the distribution so scsh is only required if you want to change something in the source files. If the change you apply, doesn't change object definitions you don't need to rerun make_class, simply update the date of the .x file using touch: > It might also be a good idea to bundle the OL library with syslog-ng > directly; do you have other programs which use libol ? The reason I > suggest this is because I was really thrown for a loop with the > EINPROGRESS stuff out of connect() that was fixed for .18; I built > syslog-ng with .17 and ended up tracing down the problem with TCP relay > manually only to discover afterwards that it was right in the ChangeLog > for the new libol :) But I did not think libol was involved with respect > to IO in syslog-ng, only with that OO C stuff it seems to be (I can't > tell what it is exactly because there is not any documentation that I > can find). Anyways it might be a good idea to just bundle a stable > libol with syslog-ng and only update that version concurrent with > syslog-ng version upgrades. yes there are other projects that depend on libol (b-wall), though I always suggest distributor maintainers not to create a seperate package. > Now I am not sure about my memory problems, does libol also do > memory allocation for syslog-ng? libol provides the garbage collection framework. syslog-ng uses a mark&sweep garbage collector. libol was forked from lsh's I/O backend, you can read more about its internals in the file /doc/HACKING from the lsh distribution. (ftp://ftp.lysator.liu.se/pub/security/lsh) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: syslog-ng under BSDi
by Balazs Scheidler 10 Aug '00

10 Aug '00

On Wed, Aug 09, 2000 at 04:13:46PM -0400, Rudy Gilson wrote: > > Hello, > > Ive tried compiling v1.4.0 and v1.4.5 under BSDi 4.1. This is the error > during the make. The only version of syslog-ng that will compile is > v1.2.4. Any suggestions?? strptime() is required by syslog-ng. as it seems there are several BSD derivatives which doesn't have it, so I may include a compatibility function in the future. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

syslog-ng death on Debian.
by William Cordis 09 Aug '00

09 Aug '00

I've seen this mentioned several times before in this list but I never saw a fix for it. I'm using libol 0.2.18 and syslog-ng 1.4.5 on a debian woody system doing TCP logging as well as local logging. Syslog will run for many hours just fine and then die like this. --------snip from strace log. opts (-ff -F -i -v -T -x -p 8096 -s 64)------- [400c0574] open("/var/log/heimdall/syslog", O_WRONLY|O_NONBLOCK|O_APPEND|O_CREAT|O_NOCTTY, 0640) = 16 <0.000044> [400c1598] chown("/var/log/heimdall/syslog", 0, 4) = 0 <0.000031> [400c0844] fcntl(16, F_GETFL) = 0xc01 (flags O_WRONLY|O_NONBLOCK|O_APPEND) <0.000019> [400c0844] fcntl(16, F_SETFL, O_WRONLY|O_NONBLOCK|O_APPEND) = 0 <0.000015> [400c0844] fcntl(16, F_SETFD, FD_CLOEXEC) = 0 <0.000015> [400a490d] time(NULL) = 965816705 <0.000017> [400a490d] time(NULL) = 965816705 <0.000015> [400c05ed] close(7) = 0 <0.000106> [400c0674] write(2, "syslog-ng: io.c:172: io_iter: Assertion `i < nfds\' failed.\n", 59) = 59 <0.000038> [4004e8b8] rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 <0.000031> [400ad797] getpid() = 8076 <0.000014> [4004e931] kill(8076, SIGABRT) = 0 <0.000019> [4004e931] --- SIGABRT (Aborted) --- ----------end snip----------------------------------------------------------- The hex in brackets the print instruction pointer at time of syscall. If there's anything I can do to help you diagnose the problem let me know. William Cordis

1 0