- syslog-ng - lists.balabit.hu

Logging console?
by Erich Reitz 09 Dec '99

09 Dec '99

Hi, I would like to know if it is possible/wise to log messages sent to the console? Unattended machines without monitors usually report messages during bootup that I never see since they are exclusively directed to the console. During normal operations I believe there are messages that can be sent exclusively to the console (ie: perl -w warning messages when the perl script process is run/forked from a background process without a controlling terminal) and these messages are never seen/logged. I am wondering if I can set the console up as a source for syslog-ng on these machines without monitors?

2 1

RE: [syslog-ng] SIGHUP kills syslog-ng on FreeBSD 3-STABLE
by Lowkrantz, Goran 09 Dec '99

09 Dec '99

Yes, this worked. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, December 09, 1999 7:01 PM To: syslog-ng(a)venus.terrasoft.hu Subject: Re: [syslog-ng] SIGHUP kills syslog-ng on FreeBSD 3-STABLE On Wed, Dec 08, 1999 at 03:38:42AM +0100, Lowkrantz, Goran wrote: > Hi, > > No, it didn't help. Now it just dies silently, not even a work on the > console. > > The only thing I can see is that if I start the old syslogd immediately > after syslog-ng died on HUP, I get the following on the console: > syslogd: cannot create /var/run/log: Address already in use I have yet another patch which should really fix your problems under BSD. Touch afinet.c.x and afunix.c.x before rebuilding, if you don't have scsh installed. diff -urN syslog-ng-1.3.6/src/afinet.c syslog-ng.bsd/src/afinet.c --- syslog-ng-1.3.6/src/afinet.c Tue Nov 23 20:45:45 1999 +++ syslog-ng.bsd/src/afinet.c Thu Dec 9 16:31:34 1999 @@ -269,11 +269,15 @@ case AFSOCKET_DGRAM: { struct afsocket_source_connection *conn; struct io_fd *client = make_io_fd(cfg->backend, fd); + int res; self->super.num_connections = 1; conn = make_afinet_source_connection(client, NULL, &self->super, self->super.super.super.next); - LOG_HANDLER_INIT(conn, cfg, NULL); - + res = LOG_HANDLER_INIT(conn, cfg, NULL); + if ((res & ST_FAIL) == 0) { + conn->queue_node = + object_queue_add_tail(self->super.connections, &conn->super.super.super); + } break; } default: diff -urN syslog-ng-1.3.6/src/afunix.c syslog-ng.bsd/src/afunix.c --- syslog-ng-1.3.6/src/afunix.c Tue Nov 23 20:32:37 1999 +++ syslog-ng.bsd/src/afunix.c Thu Dec 9 16:33:15 1999 @@ -241,11 +241,16 @@ case AFSOCKET_DGRAM: { struct afsocket_source_connection *conn; struct io_fd *client = make_io_fd(cfg->backend, fd); - + int res; + self->super.num_connections = 1; conn = make_afunix_source_connection(client, NULL, &self->super, self->super.super.super.next); - LOG_HANDLER_INIT(conn, cfg, NULL); - + res = LOG_HANDLER_INIT(conn, cfg, NULL); + + if ((res & ST_FAIL) == 0) { + conn->queue_node = + object_queue_add_tail(self->super.connections, &conn->super.super.super); + } break; } default: -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

3 2

syslog-ng keeps dying on sol 2.6/2.7
by Jacob Zehnder 09 Dec '99

09 Dec '99

on my earlier post i forgot to include which version i was running of syslog-ng. 1.2.2 on all machines * * * * * * * * * * * * * * * * * * Jacob Zehnder * * * * * * * * * Grill Master * * * * * * * * "The dude abides." * * * * 'The Big Lebowski' * * * * * * * * * * * * * *

1 0

syslog-ng 1.3.7 released
by Balazs Scheidler 09 Dec '99

09 Dec '99

Hi, I've released syslog-ng 1.3.7, which fixes the remaining SIGHUP bugs, and adds two global configuration options: * use_dns() yes/no enables or disables DNS lookups * use_fqdn() yes/no enables or disables FQDN usage Note that these are not too well tested (tm). Since there's a major bug in syslog-ng 1.2.x, which is fixed by 1.3.x, and is cannot be easily backported, I am thinking about releasing 1.4.0 before adding further features. (the bug is that all AF_UNIX and AF_INET connections are dropped when syslog-ng is reinitialized) So please _test_ this release as much as you can, and I'll release 1.4.0 before christmas. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

RE: [syslog-ng] SIGHUP kills syslog-ng on FreeBSD 3-STABLE
by Lowkrantz, Goran 09 Dec '99

09 Dec '99

Hi, No, it didn't help. Now it just dies silently, not even a work on the console. The only thing I can see is that if I start the old syslogd immediately after syslog-ng died on HUP, I get the following on the console: syslogd: cannot create /var/run/log: Address already in use Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, December 07, 1999 10:52 PM To: syslog-ng(a)venus.terrasoft.hu Subject: Re: [syslog-ng] SIGHUP kills syslog-ng on FreeBSD 3-STABLE On Tue, Dec 07, 1999 at 09:37:44PM +0100, Lowkrantz, Goran wrote: > Hi, > > Here it is. This patch should solve the problem with SIGHUP, because it drops messages while the configuration is initialized. The real problem is not solved though, the error message says that for some reason syslog-ng cannot bind to 0.0.0.0:514. I'll check that out too later. diff -u -r1.18 sources.c --- sources.c 1999/11/22 18:26:16 1.18 +++ sources.c 1999/12/07 13:19:22 @@ -182,7 +182,10 @@ CAST(log_source_group, self, c); struct ol_string *name = get_source_hostname(logmsg->saddr); - assert(self->super.next); + if (!self->super.next) { + log_info_free(logmsg); + return; + } logmsg->source = c; if (self->long_hostnames) { if (logmsg->flags & LF_LOCAL) { -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 2

Config file size and performance
by ger 09 Dec '99

09 Dec '99

Hi, I'm configuring syslog-ng for use on a central log server, processing logs from 60 busy syslog clients, and I've realised that without hostname macro expansion in the config file I'm going to end up with a file >600 lines long. Is this likely to cause performance problems with syslog-ng when it's trying to compare each syslog packet against this kind of filter/action list, and has anyone else used it in a similar environment? Thanks, Ger. -- Ger Mulcahy, Technical Consultant, Harvard Business School

3 3

Host Seperation
by Nigel Bovey 09 Dec '99

09 Dec '99

Hi, We run a rather large network, and are looking at running a secured machine for syslog, running syslog-ng hopefully. Obviously, we want to seperate out the log files for each host. Due to the number of hosts, this looks most easily done with the latest beta having the $HOST variable. So its syslog-ng 1.3.6 on debian running 2.2.12 . I made a rough fast configuration (see below). The idea is that the files end up in /syslog/hostname/file. Now, I've turned long_hostnames(on) which I guessed (docs are rather vague on most things) would make it use long host names for comparisons. To test, I didn't create the /syslog/name directories, and ran syslog-ng -d -v and it came up with "unable to open /syslog/max1/debug". Obviously this is incorrect as I wanted it to have a long host name. I thought the obvious method here, is to just remove hostnames all together, and use ip addresses (we use ip's for all radius related stuff, to stop dns dependency). So I remove resolv.conf and restart it with syslog-ng -d -v, this time it comes up with "unable to open /syslog/1.1.1.1/debug" which is fine. So I create the directory 1.1.1.1 and restart the daemon, now it comes up with "unable to write to /syslog/1.1.1.1/debug, its a directory". I switch the names back on and try, and it writes the file fine under /syslog/max1/debug. Turn names off again, and once again it will not write the file. Any ideas ? or is this a bug that may be fixed soon =) The program looks great from where I am standing, if I could sort out this problem. My other annoyance, is that it does partial name matches, unless there is some way to turn this off that I havn't come across. Even with ip addresses, using host(1.1.1.1) matches 1.1.1.1 and 1.1.1.10,100,101 etc etc. Any help greatly appreciated. --- Nigel Bovey IHUG Network Operations Team -------------------------------------------------------------------------- options { long_hostnames(on); sync(0); }; source src { unix-stream("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; # filters filter f_auth { facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn); }; filter f_emergency { level(emerg); }; # destinations destination auth { file("/syslog/$HOST/auth"); }; destination cron { file("/syslog/$HOST/cron"); }; destination daemon { file("/syslog/$HOST/daemon"); }; destination kern { file("/syslog/$HOST/kern"); }; destination lpr { file("/syslog/$HOST/lpr"); }; destination mail { file("/syslog/$HOST/mail"); }; destination user { file("/syslog/$HOST/user"); }; destination uucp { file("/syslog/$HOST/uucp"); }; destination news { file("/syslog/$HOST/news"); }; destination debug { file("/syslog/$HOST/debug"); }; destination emergency { file("/syslog/$HOST/emergency"); }; destination messages { file("/syslog/$HOST/messages"); }; # log statements log { source(src); filter(f_auth); destination(auth); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_news); destination(news); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(emergency); };

3 6

RE: [syslog-ng] SIGHUP kills syslog-ng on FreeBSD 3-STABLE
by Lowkrantz, Goran 07 Dec '99

07 Dec '99

Hi, Here it is. Cheers, GLZ -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, December 07, 1999 2:21 PM To: syslog-ng(a)venus.terrasoft.hu Subject: Re: [syslog-ng] SIGHUP kills syslog-ng on FreeBSD 3-STABLE Hi, Could you please send me your configuration file? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

source syntax
by Chris Scheller 07 Dec '99

07 Dec '99

I just upgraded to 1.3.6 and i am getting a syntax error on my source line. this is what i have in my conf source s_all { unix-stream("/dev/log" max-connections(10)); udp(); tcp(); }; did something change and i missed it? or did i fubar this source line? Chris Scheller Network One Internet, inc. http://www.networkone.net/ System/Network Administration 1.888.GOT-NET1

3 3

SIGHUP kills syslog-ng on FreeBSD 3-STABLE
by Lowkrantz, Goran 07 Dec '99

07 Dec '99

Hi again, I rebuilt it with debug and here is the full backtrace. > gdb -c syslog-ng.core src/syslog-ng GNU gdb 4.18 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"... Core was generated by `syslog-ng'. Program terminated with signal 6, Abort trap. Reading symbols from /usr/lib/libc.so.3...done. Reading symbols from /usr/libexec/ld-elf.so.1...done. #0 0x280a546c in kill () from /usr/lib/libc.so.3 (gdb) bt #0 0x280a546c in kill () from /usr/lib/libc.so.3 #1 0x280d9818 in abort () from /usr/lib/libc.so.3 #2 0x280b53ba in __assert () from /usr/lib/libc.so.3 #3 0x804a284 in do_add_source_name (c=0x8069448, logmsg=0x806d30c) at sources.c:185 #4 0x8051c48 in write_internal_message (level=3, length=71, data=0xbfbfd498 "io.c: bind_inet_socket() bind failed 0.0.0.0:514 Address already in use\n\\b\005\b\204Ú¿¿L\001") at afinter.c:55 #5 0x8055229 in msg_vformat () #6 0x805525e in werror () #7 0x80549cd in bind_inet_socket () #8 0x8054eb4 in io_open_socket () #9 0x80514f9 in do_init_afinet_source (c=0x805e908, cfg=0x805e608, persistent=0x805c668) at afinet.c:246 #10 0x804a3e8 in do_init_group (c=0x8069448, cfg=0x805e608, persistent=0x805c668) at sources.c:222 #11 0x804bd88 in do_init_config (self=0x805e608, p=0x805c668) at cfgfile.c:149 #12 0x8049716 in do_reread_config (c=0x805a014) at main.c:71 #13 0x8053fd9 in io_iter () #14 0x80498b1 in main_loop (backend=0x805d008) at main.c:139 #15 0x8049d13 in main (argc=1, argv=0xbfbfdabc) at main.c:292 #16 0x8049555 in _start () Cheers, GLZ --- Goran Lowkrantz Email : goran.lowkrantz(a)infologigruppen.se Infologigruppen Alfa AB Telephone: Nat 070-587 8782 Fax: Nat 070-615 8782 Box 202 Int +46 70-587 8782 Int +46 70-615 8782 941 25 Pitea, Sweden

2 2