- syslog-ng - lists.balabit.hu

RE: [syslog-ng] Destination systax fail ??
by Hamilton, Andrew Mr. 17 Jun '00

17 Jun '00

Yes, there is a problem the line should read destination remotenet { udp("10.0.0.10" port(514)); }; The port statement goes inside the parentheses since it is a function of udp for a destination. sources are a little different. Hope this helps. Drew > -----Original Message----- > From: Leonardo Marques de Souza [SMTP:leo@conectiva.com.br] > Sent: Wednesday, June 14, 2000 10:19 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] Destination systax fail ?? > > > Helo, > > I would like to know what's happen with syslog-ng.conf systax in this > part of confiruration: > > # --------8<------------- > > # Leitura da porta UDP do syslog padrao (514) > # > # Por padrao, ele nao esta ligado na instalacao > # Para inicia-lo, basta descomentar a linha abaixo > > source net { udp(ip("10.0.2.4") port(514)); }; > > # --------------------------- > # Destino dos dados Filtrados > # --------------------------- > > destination remotenet {udp(ip("10.0.0.10") port(514)); }; <-------(this > part have errors ????) > destination console { pipe("/dev/console"); }; > destination messages { file("/var/log/messages"); }; > destination secure { file("/var/log/secure"); }; > destination maillog { file("/var/log/maillog"); }; > destination spooler { file("/var/log/spooler"); }; > destination boot { file("/var/log/boot.log"); }; > > # -------8<------------------ > > [root@patolino syslog-ng-1.4.4]# /usr/sbin/syslog-ng -d -v -f > /etc/syslog-ng/syslog-ng.conf > parse error at 33 > Parse error reading configuration file, exiting. > [root@patolino syslog-ng-1.4.4]# > > (line 33 refers to destination remotenet ...) > > i tryed this syntaxes: > **** > destination remotenet { udp(ip("10.0.0.10") port(514)); }; > destination remotenet { udp(ip(10.0.0.10) port(514)); }; > destination remotenet { udp(ip("10.0.0.10") port(514);); }; > destination remotenet { udp(ip("10.0.0.10"); port(514)); }; > destination remotenet { udp(ip("10.0.0.10"); port(514);); }; > destination remotenet { udp(ip("10.0.0.10")); }; > destination remotenet { tcp(ip("10.0.0.10") port(514)); }; > destination remotenet { udp(ip(10.0.0.10) port(514);); }; > destination rtteste { udp(ip("10.0.0.10") port(514)); }; > destination remote_net { udp(ip("10.0.0.10") port(514) ); }; > ** > > no sucess.. :( > > egcs-1.1.2 > glibc 2.1.3~ 2.1.2 > libol-0.2.17 > syslog-ng-1.4.4 > kernel-2.2.16 > > > Any one can help me?? > who can i increase de Debug?? What i can do to fix that (in source font)? > thanks.. > > PS.: > > This program have any restriction?? Its realy 100% GPL?? > We are thinking to put this program in our distribution here, in Brazil. > I built a RPM package, but i trying to a log of tests in our servers (430 > servers)... > syslog fails to do that :(( > lose data, do not restart veri well, use a lot os CPU... :(( > > i trying syslog-ng to eliminate (or decrese) this problems.. > > Thank's in advanced!! > > > Leonardo Marques de Souza > +--------------------------+ > | Conectiva S/A | > |Curitiba - Parana - Brazil| > | Suporte Interno | > +--------------------------+ > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > http://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

subscription detail
by rajesh 16 Jun '00

16 Jun '00

1 0

RE: [syslog-ng] Still Having Troubles..
by Mike Novak 08 Jun '00

08 Jun '00

no syslogd is not running on the client -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, June 08, 2000 11:23 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Still Having Troubles.. > i am running syslog-ng on a central log host or try'en to > i am having problums with the client's conf file.. > > <~~~ Client's Conf file ~~~~~> > > source src { unix-dgram("/var/run/log"); udp(); internal(); }; > > destination loghost { tcp("loghost" ip("10.151.94.24") port(1000)); }; > > log { source(src); destination(loghost); }; > > <~~~~~~~~~~~~~~~~~~> > > with this conf, the machine still logs messages in to > /var/log/messages and /var/log/security > > why? > > Any Direction would be dope! isn't the native syslogd running in addition to syslog-ng? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Still Having Troubles..
by Mike Novak 08 Jun '00

08 Jun '00

hey, i am running syslog-ng on a central log host or try'en to i am having problums with the client's conf file.. <~~~ Client's Conf file ~~~~~> source src { unix-dgram("/var/run/log"); udp(); internal(); }; destination loghost { tcp("loghost" ip("10.151.94.24") port(1000)); }; log { source(src); destination(loghost); }; <~~~~~~~~~~~~~~~~~~> with this conf, the machine still logs messages in to /var/log/messages and /var/log/security why? Any Direction would be dope! Novak

2 1

Problems with TCP connection
by Andriy Anokhin 08 Jun '00

08 Jun '00

Hello ! I am running syslog-ng 1.4.4 on Linux RedHat 6.1. I use one syslog-ng server where I collect all syslog messages from 10 systems with syslog-ng connected with TCP. I have problems with reconnection. Syslog-ng on client systems does not reestablish connection with server if connection is broken for long time ( around 2-3 hours). I need only restart syslog-ng daemon on client system. Does anybody have ideas about it ??? Thank you in advance.

2 1

leak problems
by Balazs Scheidler 08 Jun '00

08 Jun '00

Hi, for those experiencing high memory loads on behalf of syslog-ng, please try the attached patch, and check whether memory usage changes. diff -urN syslog-ng-1.4.4/src/affile.c syslog-ng-1.4.5/src/affile.c --- syslog-ng-1.4.4/src/affile.c Fri Jun 2 20:14:02 2000 +++ syslog-ng-1.4.5/src/affile.c Sat Jun 3 12:24:30 2000 @@ -110,12 +110,6 @@ make_log_reader(0, c), NULL); res = REMEMBER_RESOURCE(cfg->resources, &self->src->super.super); -#if 0 - if (self->flags & AFFILE_PIPE) { - self->src->super.close_callback = - make_driver_reinit_on_close(c, res, 0, cfg); - } -#endif return ST_OK | ST_GOON; } else { diff -urN syslog-ng-1.4.4/src/afinet.c syslog-ng-1.4.5/src/afinet.c --- syslog-ng-1.4.4/src/afinet.c Tue Feb 22 18:50:29 2000 +++ syslog-ng-1.4.5/src/afinet.c Sat Jun 3 15:01:10 2000 @@ -242,8 +242,9 @@ self->super.num_connections = 0; { FOR_OBJECT_QUEUE(p, n) { - CAST_SUBTYPE(log_handler, h, n); - append_log_handler(h, self->super.super.super.next); + CAST_SUBTYPE(afsocket_source_connection, h, n); + h->owner = &self->super; + append_log_handler(&h->super, self->super.super.super.next); self->super.num_connections++; } } @@ -392,6 +393,7 @@ struct persistent_config *persistent) { CAST(afinet_dest, self, c); + struct connect_fd *conn_fd; int fd; self->cfg = cfg; @@ -410,11 +412,13 @@ } if (!self->dest_buf) self->dest_buf = make_pkt_buffer(self->super.super.log_fifo_size); - - if (io_connect(cfg->backend, - fd, - self->super.dest_addr, - make_afsocket_dest_connected(cfg->backend, &self->super))) { + conn_fd = io_connect(cfg->backend, + fd, + self->super.dest_addr, + make_afsocket_dest_connected(cfg->backend, &self->super)); + + if (conn_fd) { + REMEMBER_RESOURCE(cfg->resources, &conn_fd->super.super); return ST_OK | ST_GOON; } else { @@ -430,6 +434,10 @@ CAST(afinet_dest, self, c); struct resource_node *n; + if (!self->cfg->living) { + werror("Connection established for an old configuration, dropping...\n"); + return ST_CLOSE | ST_OK; + } if (self->dest) self->dest->buffer = NULL; if (server) { diff -urN syslog-ng-1.4.4/src/afunix.c syslog-ng-1.4.5/src/afunix.c --- syslog-ng-1.4.4/src/afunix.c Tue Feb 22 18:50:29 2000 +++ syslog-ng-1.4.5/src/afunix.c Sat Jun 3 15:01:15 2000 @@ -201,8 +201,9 @@ self->super.num_connections = 0; { FOR_OBJECT_QUEUE(p, n) { - CAST_SUBTYPE(log_handler, h, n); - append_log_handler(h, self->super.super.super.next); + CAST_SUBTYPE(afsocket_source_connection, h, n); + h->owner = &self->super; + append_log_handler(&h->super, self->super.super.super.next); self->super.num_connections++; } } @@ -357,6 +358,8 @@ make_afsocket_dest_connected(cfg->backend, &self->super)); if (conn_fd) { + REMEMBER_RESOURCE(cfg->resources, &conn_fd->super.super); + return ST_OK | ST_GOON; } else { @@ -375,6 +378,10 @@ CAST(afunix_dest, self, c); struct resource_node *n; + if (!self->cfg->living) { + werror("Connection established for an old configuration, dropping...\n"); + return ST_CLOSE | ST_OK; + } if (self->dest) self->dest->buffer = NULL; if (server) { diff -urN syslog-ng-1.4.4/src/cfgfile.c syslog-ng-1.4.5/src/cfgfile.c --- syslog-ng-1.4.4/src/cfgfile.c Fri Mar 10 12:35:26 2000 +++ syslog-ng-1.4.5/src/cfgfile.c Sat Jun 3 14:30:03 2000 @@ -197,6 +197,7 @@ struct log_dest_group *d; struct log_source_group *s; + self->living = 1; for (s = self->sources; s; s = s->next_source_group) { if (s->super.super.destroy) LOG_HANDLER_DESTROY(s, self, persistent); @@ -228,6 +229,7 @@ self->init = do_init_config; self->destroy = do_destroy_config; self->backend = backend; + self->living = 1; self->sync_freq = 0; self->mark_freq = 1200; /* 20 minutes */ self->chain_hostnames = 1; diff -urN syslog-ng-1.4.4/src/cfgfile.h syslog-ng-1.4.5/src/cfgfile.h --- syslog-ng-1.4.4/src/cfgfile.h Fri Mar 24 11:57:28 2000 +++ syslog-ng-1.4.5/src/cfgfile.h Sat Jun 3 14:00:56 2000 @@ -43,6 +43,7 @@ (destroy method int "struct persistent_config *") (resources object resource_list) (backend object io_backend) + (living simple int) ; global options (chain_hostnames simple UINT32) (keep_hostname simple UINT32) diff -urN syslog-ng-1.4.4/src/cfgfile.h.x syslog-ng-1.4.5/src/cfgfile.h.x --- syslog-ng-1.4.4/src/cfgfile.h.x Fri Mar 24 11:59:45 2000 +++ syslog-ng-1.4.5/src/cfgfile.h.x Sat Jun 3 14:04:46 2000 @@ -6,6 +6,7 @@ int (*(destroy))(struct syslog_config *self, struct persistent_config *); struct resource_list *resources; struct io_backend *backend; + int living; UINT32 chain_hostnames; UINT32 keep_hostname; UINT32 mark_freq; diff -urN syslog-ng-1.4.4/src/main.c syslog-ng-1.4.5/src/main.c --- syslog-ng-1.4.4/src/main.c Fri Mar 10 12:35:27 2000 +++ syslog-ng-1.4.5/src/main.c Sat Jun 3 14:29:55 2000 @@ -28,6 +28,7 @@ #include "afinter.h" #include "format.h" #include "werror.h" +#include "queue.h" #include <sys/types.h> #include <sys/wait.h> @@ -84,7 +85,6 @@ self->backend->newconfig = self->backend->oldconfig; self->backend->oldconfig = NULL; io_callout(&self->backend->super, 0, c); - } break; case 3: @@ -150,8 +150,14 @@ break; if (sighuprecvd && !restarting) { + FOR_QUEUE(&backend->super.callouts, struct ol_queue_node *, n) { + ol_queue_remove(n); + ol_space_free(n); + } + notice("SIGHUP received, restarting syslog-ng\n"); restarting = 1; + backend->newconfig = make_syslog_config(cfgfilename, &backend->super); if (backend->newconfig) { static struct reread_config r = -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 1

Syslog-ng Dies - core dump
by John Wingenbach 07 Jun '00

07 Jun '00

I just installed and configured syslog-ng 1.4.3 on a Solaris 2.6 system. It cores out on startup. It apparently doesn't like part of my configuration. Debug output is: #> /opt/syslog-ng/sbin/syslog-ng -d -v binding fd 5, inetaddr: 0.0.0.0, port: 514 io.c: Preparing fd 5 for reading syslog-ng version 1.4.3 starting Segmentation Fault(coredump) My configuration is (Note below the comments regarding code which if removed allows it to live): source s_all { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); }; # Level Filters filter f_info { level(info .. emerg); }; filter f_warning { level(warning .. emerg); }; filter f_debug { level(debug .. emerg); }; filter f_crit { level(crit .. emerg); }; filter f_err { level(err .. emerg); }; filter f_emerg { level(emerg); }; # Facility Filters filter f_user { facility(user); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon); }; filter f_auth { facility(auth); }; filter f_lpr { facility(lpr); }; filter f_news { facility(news); }; filter f_kern { facility(kern); }; filter f_uucp { facility(uucp); }; filter f_cron { facility(cron); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # Complex Filters filter f_mailerror { filter (f_mail) and filter (f_err); }; filter f_axsyslog { filter (f_info) or filter(f_mailerror); }; ------ It would seem that the following filters used to build a summary syslog cause the problem. ------ filter f_errsanuser { filter (f_err) and not facility(user); }; filter f_kerndebug { filter (f_kern) and filter (f_debug); }; filter f_mailwarning { filter (f_mail) and filter (f_warning); }; filter f_summary { filter (f_errsanuser) or filter (f_kerndebug) or filter (f_daemon) or filter (f_mailwarning); }; destination d_all { file("/var/log/messages"); }; destination d_ttys { usertty("*"); }; destination d_console { file ("/dev/console"); }; destination d_kernfile { file ("/var/log/kern"); }; destination d_syslogfile { file ("/var/log/syslog"); }; destination d_userfile { file ("/var/log/user"); }; destination d_mailfile { file ("/var/log/mail"); }; destination d_mailcritfile { file ("/var/log/mail.crit"); }; destination d_mailwarnfile { file ("/var/log/mail.warning"); }; destination d_daemonfile { file ("/var/log/daemon"); }; destination d_daemonwarningfile { file ("/var/log/daemon.warning"); }; destination d_authfile { file ("/var/log/auth"); }; destination d_lprfile { file ("/var/log/lpr"); }; destination d_newsfile { file ("/var/log/news"); }; destination d_uucpfile { file ("/var/log/uucp"); }; destination d_cronfile { file ("/var/log/cron"); }; destination d_local0file { file ("/var/log/local0"); }; destination d_local1file { file ("/var/log/local1"); }; destination d_local2file { file ("/var/log/local2"); }; destination d_local3file { file ("/var/log/local3"); }; destination d_local4file { file ("/var/log/local4"); }; destination d_local5file { file ("/var/log/local5"); }; destination d_local6file { file ("/var/log/local6"); }; destination d_local7file { file ("/var/log/local7"); }; destination d_axentsyslog { file ("/axent/ita/system/falcon/syslog"); }; destination d_axentmail { file ("/axent/ita/system/falcon/syslog.mdbg"); }; log { source(s_all); filter (f_kern); filter (f_debug); destination (d_kernfile); }; log { source(s_all); filter (f_user); filter (f_debug); destination (d_userfile); }; log { source(s_all); filter (f_mail); filter (f_debug); destination (d_mailfile); }; log { source(s_all); filter (f_mail); filter (f_crit); destination (d_mailcritfile); }; log { source(s_all); filter (f_mail); filter (f_warning); destination (d_mailwarnfile); }; log { source(s_all); filter (f_daemon); filter (f_debug); destination (d_daemonfile); }; log { source(s_all); filter (f_daemon); filter (f_warning); destination (d_daemonwarningfile); }; log { source(s_all); filter (f_auth); filter (f_debug); destination (d_authfile); }; log { source(s_all); filter (f_lpr); filter (f_debug); destination (d_lprfile); }; log { source(s_all); filter (f_news); filter (f_debug); destination (d_newsfile); }; log { source(s_all); filter (f_uucp); filter (f_debug); destination (d_uucpfile); }; log { source(s_all); filter (f_cron); filter (f_debug); destination (d_cronfile); }; log { source(s_all); filter (f_local0); destination (d_local0file); }; log { source(s_all); filter (f_local1); filter (f_debug); destination (d_local1file); }; log { source(s_all); filter (f_local2); destination (d_local2file); }; log { source(s_all); filter (f_local3); destination (d_local3file); }; log { source(s_all); filter (f_local4); filter (f_debug); destination (d_local4file); }; log { source(s_all); filter (f_local5); filter (f_debug); destination (d_local5file); }; log { source(s_all); filter (f_local6); filter (f_debug); destination (d_local6file); }; log { source(s_all); filter (f_local7); filter (f_debug); destination (d_local7file); }; log { source(s_all); filter (f_axsyslog); destination (d_axentsyslog); }; log { source(s_all); filter (f_mail); filter (f_debug); destination (d_axentmail); }; log { source(s_all); filter (f_summary); destination (d_syslogfile); }; -- John C. Wingenbach Pliant Systems, Inc. Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544

4 19

bit of an issue with logging
by John 05 Jun '00

05 Jun '00

Hi All, A bit of an issue here. I'm having syslog-ng create directories when a new host starts logging to it, which is all well and good. But, when I look in the servers directory there are some directories with logs in them which surely can't be right! ? ?James ?Oliver ?Rev. "Iona "James "Jane > Jacqueline balloon-kite.co.uk boundary="Boundary-=_pHqghUmeaYlNlfdXfircvsCxgGBw" virgin.net hotmail.com, Is this something I should be worried about? It does worry me!! Any ideas why this is happening? It caused a problem with my newsyslog when it tried to rotate the logs in the > directory causing my disk to get rather full quickly within a few days of not rotating. Cheers, John

2 1

owner and group of create dirs
by Tomohiro Yamauchi 02 Jun '00

02 Jun '00

Hi, My syslog-ng.conf is destination std { file("/var/log/$HOST/$FACILITY.debug/$YEAR$MONTH/$FACILITY.debug$YEAR$MONTH$DAY" owner(admin) group(admin) perm(0600) dir_perm(0700) create_dirs(yes)); }; If /var/log/$HOST/$FACILITY.debug/$YEAR$MONTH is not exist, make that dirs. But that's owner is root:other. I think because daemon's effective user ID is root. I want to change dir's owner. Is this possible? -- Tomohiro Yamauchi handy(a)nid.co.jp

2 3

RE: [syslog-ng] Ignoring previously handled/filtered messages
by Ohrberg, Mick 02 Jun '00

02 Jun '00

IMHO, I WANT the messages to go to several logfiles. For instance, I want a message mail.fatal to go to the fatal logfile as well as the mail logfile. This way I can trigger on messages in the fatal logfile, look in the mail logfile and see if there were any messages in from mail that lead up to the fatal situation. However, when you do the same thing loggin to a remote host, this procedure results in four (!) messages being generated. A better way to handle 'double' messages would be very very nice. : -----Original Message----- : From: John Goggan [mailto:jgoggan@dcg.com] : Sent: Wednesday, May 24, 2000 4:46 PM : To: syslog-ng(a)venus.terrasoft.hu : Subject: Re: [syslog-ng] Ignoring previously handled/filtered messages : : : : ger wrote: : > try : > filter f_daemon { facility(daemon) and not program(name);}; : > : > where "name" is whatever program you're trying to filter out. : : Thanks to Ger and Ilya for their responses. While this does : work, it really : seems like a poor way to do it to me -- and, I believe, is : also quite a bit : different from the way standard syslog handles things. The : problem is that it : should just be easy to make it so that messages are handled : only ONCE and then : not sent to additional logs unless specifically desires. How : many people : really want the same syslog message sent to multiple logs : most of the time? : It just seems that the default (which does this) is the : opposite of what most : would want. : : Plus, what needs to be done to get around this just doesn't : make any sense. : This means that if I want separate logs for imapd, named, : telnetd, and ftpd : (to name just a few common daemons) -- and I want any other : daemons that pop : up to still go to a daemon.log, I have to do this in my : filter section: : : filter f_imapd { program("imapd"); }; : filter f_named { program("named"); }; : filter f_telnetd { program("telnetd"); }; : filter f_ftpd { program("ftpd"); }; : filter f_auth { facility(auth) : and not program("imapd") : and not program("named") : and not program("telnetd") : and not program("ftpd"); }; : filter f_daemon { facility(daemon) : and not program("imapd") : and not program("named") : and not program("telnetd") : and not program("ftpd"); }; : filter f_messages { level(info..warn) : and not facility(auth, authpriv, mail, news); : and not program("imapd") : and not program("named") : and not program("telnetd") : and not program("ftpd"); }; : : That just seems like a really bad design! I have to make : sure that I keep all : of the names updated in several different locations. If I : want to add a log : for just one more daemon, I have to add it to at least 3 : other filters besides : its own filter! : : Aren't other people experiencing such problems? Or is no one : out there using : syslog-ng to filter out specific daemons while still catching : the unlisted : daemons in a daemon.log file? : : There must be a better way... : : - John... : : _______________________________________________ : syslog-ng maillist - syslog-ng(a)lists.balabit.hu : http://lists.balabit.hu/mailman/listinfo/syslog-ng :

5 10