- syslog-ng - lists.balabit.hu

Small log entries are discarded in 1.4.0
by Jeffrey W. Baker 09 Mar '00

09 Mar '00

Hi there, I have found another serious bug in the 1.4.0 syslog-ng code. Actually the bug is in libol. The log is configured to read log entries from a named pipe, write them to a local file, and forward them to a remote machine which writes them to a file. The input testing program is writing log entries which are four bytes: three bytes of integers and a carraige return. The problem is that syslog-ng is throwing away most of these entries. It reads 1024 bytes from the input pipe. 1024 bytes is 256 log entries. It then takes 100 of these entries and puts them in the log queue. These 100 are logged properly, and then another 1024 bytes are read from the pipe. The remaining 156 log entries from the original read are simply overwritten. I believe the solution would be to write log entries into the queue until the input buffer is empty. Any other way will result in the loss of log entries. Perhaps I will have a patch for this later. Also, I found another small bug in src/sources.c. On line 128, memcpy is used to copy memory between overlapping regions. At least on Linux, memcpy should not be used to copy between overlapping regions. memmove() should be used instead. Cheers, Jeffrey

2 1

no kernel messages
by Martin Krejcirik 09 Mar '00

09 Mar '00

I'm new to syslog-ng, maybe this question was asked before, but I do not get logged any messages from kernel (packet logger for example). Tried both 1.2.4 and 1.4.0. For some reason logger -p kern.info works. Klogd is running. If I stop it, kernel logs to console. config file: # Global Options options { sync(0); }; # Source dirvers source src_int { internal(); }; source src { unix-stream("/dev/log"); }; # log everything to a console tty destination d_tty { file("/dev/tty12"); }; log { source("src"); source("src_int"); destination("d_tty"); }; _____________________________ Martin Krejcirik <mk(a)krej.cz>

2 1

RE: syslog-ng digest, Vol 1 (Cu)166 - 5 msgs
by Nick Hindley 09 Mar '00

09 Mar '00

This message has been automatically generated. I am out of the office from 6 March 2000 for approximately two weeks. To contact me before my return, please resend your message to nick.hindley(a)ukgateway.net

1 0

RE: [syslog-ng] syslog-ng & forwarding
by Hamilton, Andrew Mr. 08 Mar '00

08 Mar '00

> > I am using syslog-ng 1.4.0rc3 at this time (I do have 1.4.0 but haven't > > implemented it yet), on Solaris 7 from a Sun SPARC machine. I am trying > to > > forward my logs from one machine through another and log them on a third > > machine. There is a reason I do this and it is necessary that I do it > this > > way. However, my question is this: > > I assume your logs are transferred to a loghost behind a chain of > firewalls. [Hamilton, Andrew] Yes they are. > > > How do I keep it from putting the middle machine's hostname on it? > > > > I assumed that chain_hostnames(no) option would do it but it doesn't > work > > the way I would have expected. When I used chain_hostnames(no) I got > > something like: > > > > "Mar 8 08:35:41 mhost host hamilton: Testing..." > > Why is there 3 names? there should be only "mhost hamilton: testing..." [Hamilton, Andrew] The final destination is using regular syslogd which it won't when I am done testing. > > > > > When I used chain_hostnames(yes) I got something like: > > > > "Mar 8 08:38:17 mhost host/host hamilton: Testing..." > > > > Any ideas? Or is this just not possible? > > Are all your hosts using syslog-ng, or some of them use the native > syslogd? [Hamilton, Andrew] Yes the last one is using syslogd until I get done testing. They will all use syslog-ng when I am done. > > The proper behaviour is: > > 1) chain_hostnames(off) > the hostname the message was received from is put in the hostname part > of > the message (if it contained one it is replaced) so on your inner > loghost > you'll find the name of your last hop. > 2) chain_hostnames(on) > hostnames are chained, which means that on each hop the hostname the > message was received from is appended to the chain. The first hostname > is > the originator. So a hostname like this: > bzorp/bzorp/balabit > > [Hamilton, Andrew] That is the behavior I expected but didn't quite get. It just didn't dawn on me that the syslogd would add another hostname. > means, that the message was generated on bzorp, was received from bzorp > to > balabit, and it was received from balabit at its final destination. > > A keep_hostname() option would be a useful addition, but it's not > implemented yet. > [Hamilton, Andrew] That would be useful and thanks for the prompt response. Drew

1 0

syslog-ng & forwarding
by Hamilton, Andrew Mr. 08 Mar '00

08 Mar '00

I am using syslog-ng 1.4.0rc3 at this time (I do have 1.4.0 but haven't implemented it yet), on Solaris 7 from a Sun SPARC machine. I am trying to forward my logs from one machine through another and log them on a third machine. There is a reason I do this and it is necessary that I do it this way. However, my question is this: How do I keep it from putting the middle machine's hostname on it? I assumed that chain_hostnames(no) option would do it but it doesn't work the way I would have expected. When I used chain_hostnames(no) I got something like: "Mar 8 08:35:41 mhost host hamilton: Testing..." When I used chain_hostnames(yes) I got something like: "Mar 8 08:38:17 mhost host/host hamilton: Testing..." Any ideas? Or is this just not possible? Andrew Hamilton mailto:hamiltona@hq.5sigcmd.army.mil

2 1

RE: syslog-ng digest, Vol 1 (Cu)165 - 9 msgs
by Nick Hindley 08 Mar '00

08 Mar '00

This message has been automatically generated. I am out of the office from 6 March 2000 for approximately two weeks. To contact me before my return, please resend your message to nick.hindley(a)ukgateway.net

1 0

Can I use destinate to all user?
by Tomohiro Yamauchi 07 Mar '00

07 Mar '00

Hi, I am running syslog-ng 1.4.0rc3 on Solaris7 (SPARC). Solaris's syslog can use '*' action. e.g. kern.emerg * This means "Kernel emergency messages are forwarded to all logged-in users." I want to use the same action. Please tell me how to do it. -- Tomohiro Yamauchi handy(a)nid.co.jp

3 4

Re: [syslog-ng] syslog-ng dropping log messages forwarded w/TCP
by Jeffrey W. Baker 07 Mar '00

07 Mar '00

You wrote: >Probably the speed of your network is less than required. How fast are >you >sending those messages? syslog-ng can do with quite high loads (2G logs >a >day), but it still cannot widen your network bandwidth. Note that log >connections in syslog-ng (e.g. a log statement) is not flowcontrolled. >This >means that messages are continously read even if they have not yet been >flushed to the destination. The reason behind this is to prevent >syslog-ng >to become the bottleneck. > I don't think we have been quite clear on the nature of the problem. We are sending messages at a very high rate over a named pipe to the local syslog-ng, and these messages are being forwarded via tcp to a remote machine, and also are logged in a local file. Our network is switched 100 Mbps, and the machines at each end are 450 MHz and 600 MHz Intel Pentium III with 3Com 3c905B NICs. It seems unlikely that our network is the problem. The exact sequence of events is that our program is started which makes 100000 log entries in a tight loop. After the program exits, the local log file has all 100000 entries, but the remote log file has only about 25000 entries. No amount of waiting increases the number of entries in the remote log. The entries in the remote log are not sequentially numbered. For example, they skip from 95432 to 96109. The intervening log entries are simply dropped. This is why we believe the problem is in syslog-ng. At any rate it is possible that James has found the problem. Apparently the return value of write is not being corretly interpreted when zero bytes were written. Perhaps James will have a patch soonish. Regards and thanks for your software, Jeffrey Baker >I may add an option to log statements to stop reading from the source if >the >destination fifo is full. This is however not trivial, since several >sources >can log to the same destination. I plan something like this: > >log { source(src); options(flow_control(yes)); destination(dst); };

3 2

RE: syslog-ng digest, Vol 1 (Cu)164 - 4 msgs
by Nick Hindley 07 Mar '00

07 Mar '00

This message has been automatically generated. I am out of the office from 6 March 2000 for approximately two weeks. To contact me before my return, please resend your message to nick.hindley(a)ukgateway.net

1 0

missing syslog-ng.conf
by Sebastian Sanchez 06 Mar '00

06 Mar '00

Hi list: I' ve just compiled syslog-ng in a Linux box running RedHat 6.0. Everything worked fine, except for one thing: there is no /etc/syslog-ng directory and no syslog-ng.conf file. Where can I find a sample configuration file ? Thank you very much. Sebastian Sanchez Security Operator se_sanchez(a)crm.com.ar

4 3