Syslog 3.5 (pipe file issue)
Hi, We have the syslog-ng 3.5 installed on Linux OS. We are trying to use the pipe function (to pipe data to the log file). This pipe file is FIFO. One of the issues we are seeing is that, the file size of this pipe file is always ZERO and never grows and second the timestampe on the file never updates or changes. Though when we do a "cat pipefilename" command we do see contents of the file. Can you please let us know what we could be doing wrong or any feedback on how to resolve the issue? Thanks Jitesh
Hello Jitesh, I am afraid I can not clearly understand your problem. Since OSE 3.0.2, a named pipe destination creates a new pipe object automatically with the predefined filename. ( https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose... ) For me, this is the expected behavior of named pipes (man page: http://man7.org/linux/man-pages/man1/mkfifo.1.html further information on level 3: http://man7.org/linux/man-pages/man3/mkfifo.3.html). Please try to rephrase your question, to give us more understanding about your use case. Br, Laci On Fri, Oct 27, 2017 at 2:42 PM, Amin, Jitesh CTR (US) < jitesh.amin.ctr@mail.mil> wrote:
Hi, We have the syslog-ng 3.5 installed on Linux OS. We are trying to use the pipe function (to pipe data to the log file). This pipe file is FIFO.
One of the issues we are seeing is that, the file size of this pipe file is always ZERO and never grows and second the timestampe on the file never updates or changes.
Though when we do a "cat pipefilename" command we do see contents of the file.
Can you please let us know what we could be doing wrong or any feedback on how to resolve the issue?
Thanks Jitesh
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hi Laci, So we can create named pipe object with filename successfully. But the then the file always shows 0 bytes in size even after data is being written to this file. Additionally the timestamp on this file never changes (as new data get's written and so I would assume that modify date on file would also be updated). Thanks Jitesh ________________________________ From: syslog-ng [syslog-ng-bounces@lists.balabit.hu] on behalf of Szemere, László [laszlo.szemere@balabit.com] Sent: Friday, October 27, 2017 9:46 AM To: Syslog-ng users' and developers' mailing list Subject: [Non-DoD Source] Re: [syslog-ng] Syslog 3.5 (pipe file issue) All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser. ________________________________ Hello Jitesh, I am afraid I can not clearly understand your problem. Since OSE 3.0.2, a named pipe destination creates a new pipe object automatically with the predefined filename. (Caution-https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose... < Caution-https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose... > ) For me, this is the expected behavior of named pipes (man page: Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html < Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html > further information on level 3: Caution-http://man7.org/linux/man-pages/man3/mkfifo.3.html < Caution-http://man7.org/linux/man-pages/man3/mkfifo.3.html > ). Please try to rephrase your question, to give us more understanding about your use case. Br, Laci On Fri, Oct 27, 2017 at 2:42 PM, Amin, Jitesh CTR (US) <jitesh.amin.ctr@mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil > > wrote: Hi, We have the syslog-ng 3.5 installed on Linux OS. We are trying to use the pipe function (to pipe data to the log file). This pipe file is FIFO. One of the issues we are seeing is that, the file size of this pipe file is always ZERO and never grows and second the timestampe on the file never updates or changes. Though when we do a "cat pipefilename" command we do see contents of the file. Can you please let us know what we could be doing wrong or any feedback on how to resolve the issue? Thanks Jitesh ______________________________________________________________________________ Member info: Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng < Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: Caution-http://www.balabit.com/support/documentation/?product=syslog-ng < Caution-http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: Caution-http://www.balabit.com/wiki/syslog-ng-faq < Caution-http://www.balabit.com/wiki/syslog-ng-faq >
Hi, As Laci pointed out, this is an expected behavior. Named pipes are not regular files, the "file size" is always 0 byte.
From https://linux.die.net/man/4/fifo: *When processes are exchanging data via the FIFO, the kernel passes all data internally without writing it to the file system.*
If you are interested in the capacity of named pipes, you can read about this here: https://linux.die.net/man/7/pipe (Chapter name: Pipe capacity) -- László Várady On Fri, Oct 27, 2017 at 4:56 PM Amin, Jitesh CTR (US) < jitesh.amin.ctr@mail.mil> wrote:
Hi Laci, So we can create named pipe object with filename successfully.
But the then the file always shows 0 bytes in size even after data is being written to this file. Additionally the timestamp on this file never changes (as new data get's written and so I would assume that modify date on file would also be updated).
Thanks Jitesh ------------------------------ *From:* syslog-ng [syslog-ng-bounces@lists.balabit.hu] on behalf of Szemere, László [laszlo.szemere@balabit.com] *Sent:* Friday, October 27, 2017 9:46 AM *To:* Syslog-ng users' and developers' mailing list *Subject:* [Non-DoD Source] Re: [syslog-ng] Syslog 3.5 (pipe file issue)
All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser.
------------------------------
Hello Jitesh,
I am afraid I can not clearly understand your problem. Since OSE 3.0.2, a named pipe destination creates a new pipe object automatically with the predefined filename. (Caution- https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose... < Caution- https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose...
)
For me, this is the expected behavior of named pipes (man page: Caution- http://man7.org/linux/man-pages/man1/mkfifo.1.html < Caution- http://man7.org/linux/man-pages/man1/mkfifo.1.html > further information on level 3: Caution-http://man7.org/linux/man-pages/man3/mkfifo.3.html < Caution-http://man7.org/linux/man-pages/man3/mkfifo.3.html > ). Please try to rephrase your question, to give us more understanding about your use case.
Br, Laci
On Fri, Oct 27, 2017 at 2:42 PM, Amin, Jitesh CTR (US) < jitesh.amin.ctr@mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil > > wrote:
Hi, We have the syslog-ng 3.5 installed on Linux OS. We are trying to use the pipe function (to pipe data to the log file). This pipe file is FIFO.
One of the issues we are seeing is that, the file size of this pipe file is always ZERO and never grows and second the timestampe on the file never updates or changes.
Though when we do a "cat pipefilename" command we do see contents of the file.
Can you please let us know what we could be doing wrong or any feedback on how to resolve the issue?
Thanks Jitesh
______________________________________________________________________________
Member info: Caution-https://lists.balabit.hu/
mailman/listinfo/syslog-ng < Caution- https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: Caution-http://www.balabit.com/ support/documentation/?product=syslog-ng < Caution- http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: Caution-http://www.balabit.com/wiki/syslog-ng-faq < Caution- http://www.balabit.com/wiki/syslog-ng-faq >
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Hi Laszlo, Though wouldn't the date/timestamp on the file be updated as the data is flowing through the pipe. Thanks Jitesh ________________________________ From: syslog-ng [syslog-ng-bounces@lists.balabit.hu] on behalf of László Várady [laszlo.varady@balabit.com] Sent: Friday, October 27, 2017 11:27 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] [Non-DoD Source] Re: Syslog 3.5 (pipe file issue) All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser. ________________________________ Hi, As Laci pointed out, this is an expected behavior. Named pipes are not regular files, the "file size" is always 0 byte.
From Caution-https://linux.die.net/man/4/fifo < Caution-https://linux.die.net/man/4/fifo > : When processes are exchanging data via the FIFO, the kernel passes all data internally without writing it to the file system.
If you are interested in the capacity of named pipes, you can read about this here: Caution-https://linux.die.net/man/7/pipe < Caution-https://linux.die.net/man/7/pipe > (Chapter name: Pipe capacity) -- László Várady On Fri, Oct 27, 2017 at 4:56 PM Amin, Jitesh CTR (US) <jitesh.amin.ctr@mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil > > wrote: Hi Laci, So we can create named pipe object with filename successfully. But the then the file always shows 0 bytes in size even after data is being written to this file. Additionally the timestamp on this file never changes (as new data get's written and so I would assume that modify date on file would also be updated). Thanks Jitesh ________________________________ From: syslog-ng [syslog-ng-bounces@lists.balabit.hu < Caution-mailto:syslog-ng-bounces@lists.balabit.hu > ] on behalf of Szemere, László [laszlo.szemere@balabit.com < Caution-mailto:laszlo.szemere@balabit.com > ] Sent: Friday, October 27, 2017 9:46 AM To: Syslog-ng users' and developers' mailing list Subject: [Non-DoD Source] Re: [syslog-ng] Syslog 3.5 (pipe file issue) All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser. ________________________________ Hello Jitesh, I am afraid I can not clearly understand your problem. Since OSE 3.0.2, a named pipe destination creates a new pipe object automatically with the predefined filename. (Caution-Caution-https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose... < Caution-https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose... > < Caution-Caution-https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose... < Caution-https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose... > > ) For me, this is the expected behavior of named pipes (man page: Caution-Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html < Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html > < Caution-Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html < Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html > > further information on level 3: Caution-Caution-http://man7.org/linux/man-pages/man3/mkfifo.3.html < Caution-http://man7.org/linux/man-pages/man3/mkfifo.3.html > < Caution-Caution-http://man7.org/linux/man-pages/man3/mkfifo.3.html < Caution-http://man7.org/linux/man-pages/man3/mkfifo.3.html > > ). Please try to rephrase your question, to give us more understanding about your use case. Br, Laci On Fri, Oct 27, 2017 at 2:42 PM, Amin, Jitesh CTR (US) <jitesh.amin.ctr@mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil > < Caution-Caution-mailto:jitesh.amin.ctr@mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil > > > wrote: Hi, We have the syslog-ng 3.5 installed on Linux OS. We are trying to use the pipe function (to pipe data to the log file). This pipe file is FIFO. One of the issues we are seeing is that, the file size of this pipe file is always ZERO and never grows and second the timestampe on the file never updates or changes. Though when we do a "cat pipefilename" command we do see contents of the file. Can you please let us know what we could be doing wrong or any feedback on how to resolve the issue? Thanks Jitesh ______________________________________________________________________________ Member info: Caution-Caution-https://lists.balabit.hu/ < Caution-https://lists.balabit.hu/ > mailman/listinfo/syslog-ng < Caution-Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng < Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: Caution-Caution-http://www.balabit.com/ < Caution-http://www.balabit.com/ > support/documentation/?product=syslog-ng < Caution-Caution-http://www.balabit.com/support/documentation/?product=syslog-ng < Caution-http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: Caution-Caution-http://www.balabit.com/wiki/ < Caution-http://www.balabit.com/wiki/ > syslog-ng-faq < Caution-Caution-http://www.balabit.com/wiki/syslog-ng-faq < Caution-http://www.balabit.com/wiki/syslog-ng-faq > > ______________________________________________________________________________ Member info: Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng < Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: Caution-http://www.balabit.com/support/documentation/?product=syslog-ng < Caution-http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: Caution-http://www.balabit.com/wiki/syslog-ng-faq < Caution-http://www.balabit.com/wiki/syslog-ng-faq >
No, the inode of the named pipe is not changed after creation. The data itself going through the pipe does not hit the disk, it's completely an in-memory transport. -- Bazsi On Fri, Oct 27, 2017 at 7:55 PM, Amin, Jitesh CTR (US) < jitesh.amin.ctr@mail.mil> wrote:
Hi Laszlo, Though wouldn't the date/timestamp on the file be updated as the data is flowing through the pipe.
Thanks Jitesh ------------------------------ *From:* syslog-ng [syslog-ng-bounces@lists.balabit.hu] on behalf of László Várady [laszlo.varady@balabit.com] *Sent:* Friday, October 27, 2017 11:27 AM *To:* Syslog-ng users' and developers' mailing list *Subject:* Re: [syslog-ng] [Non-DoD Source] Re: Syslog 3.5 (pipe file issue)
All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser.
------------------------------
Hi,
As Laci pointed out, this is an expected behavior. Named pipes are not regular files, the "file size" is always 0 byte.
From Caution-https://linux.die.net/man/4/fifo < Caution-h ttps://linux.die.net/man/4/fifo > : *When processes are exchanging data via the FIFO, the kernel passes all data internally without writing it to the file system.*
If you are interested in the capacity of named pipes, you can read about this here: Caution-https://linux.die.net/man/7/pipe < Caution-https:// linux.die.net/man/7/pipe > (Chapter name: Pipe capacity)
-- László Várady
On Fri, Oct 27, 2017 at 4:56 PM Amin, Jitesh CTR (US) < jitesh.amin.ctr@mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil > > wrote:
Hi Laci, So we can create named pipe object with filename successfully.
But the then the file always shows 0 bytes in size even after data is being written to this file. Additionally the timestamp on this file never changes (as new data get's written and so I would assume that modify date on file would also be updated).
Thanks Jitesh ------------------------------ *From:* syslog-ng [syslog-ng-bounces@lists.balabit.hu < Caution-mailto:sy slog-ng-bounces@lists.balabit.hu > ] on behalf of Szemere, László [ laszlo.szemere@balabit.com < Caution-mailto:laszlo.szemere@balabit.com
] *Sent:* Friday, October 27, 2017 9:46 AM *To:* Syslog-ng users' and developers' mailing list *Subject:* [Non-DoD Source] Re: [syslog-ng] Syslog 3.5 (pipe file issue)
All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser.
------------------------------
Hello Jitesh,
I am afraid I can not clearly understand your problem. Since OSE 3.0.2, a named pipe destination creates a new pipe object automatically with the predefined filename. (Caution-Caution-https://www. balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog- ng-ose-guide-admin/html-single/index.html#configuring-destinations-pipe < Caution-https://www.balabit.com/documents/syslog-ng-ose-3.11- guides/en/syslog-ng-ose-guide-admin/html-single/index.html# configuring-destinations-pipe > < Caution-Caution-https:// www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/ syslog-ng-ose-guide-admin/html-single/index.html# configuring-destinations-pipe < Caution-https://www.balabit. com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose- guide-admin/html-single/index.html#configuring-destinations-pipe > > )
For me, this is the expected behavior of named pipes (man page: Caution-Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html < Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html > < Caution-Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html < Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html > > further information on level 3: Caution-Caution-http://man7. org/linux/man-pages/man3/mkfifo.3.html < Caution-http:/ /man7.org/linux/man-pages/man3/mkfifo.3.html > < Caution-Caution- http://man7.org/linux/man-pages/man3/mkfifo.3.html < Caution-http:/ /man7.org/linux/man-pages/man3/mkfifo.3.html > > ). Please try to rephrase your question, to give us more understanding about your use case.
Br, Laci
On Fri, Oct 27, 2017 at 2:42 PM, Amin, Jitesh CTR (US) < jitesh.amin.ctr@mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil
< Caution-Caution-mailto:jitesh.amin.ctr@mail.mil < Caution-mailto: jitesh.amin.ctr@mail.mil > > > wrote:
Hi, We have the syslog-ng 3.5 installed on Linux OS. We are trying to use the pipe function (to pipe data to the log file). This pipe file is FIFO.
One of the issues we are seeing is that, the file size of this pipe file is always ZERO and never grows and second the timestampe on the file never updates or changes.
Though when we do a "cat pipefilename" command we do see contents of the file.
Can you please let us know what we could be doing wrong or any feedback on how to resolve the issue?
Thanks Jitesh
____________________________________________________________ __________________
Member info: Caution-Caution-https://lists.balabit.hu/ < Caution-https://
lists.balabit.hu/ > mailman/listinfo/syslog-ng < Caution-Caution- https://lists.balabit.hu/mailman/listinfo/syslog-ng < Caution- https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: Caution-Caution-http://www.balabit.com/ < Caution-http:// www.balabit.com/ > support/documentation/?product=syslog- ng < Caution-Caution-http://www.balabit.com/support/ documentation/?product=syslog-ng < Caution-http://www. balabit.com/support/documentation/?product=syslog-ng > > FAQ: Caution-Caution-http://www.balabit.com/wiki/ < Caution-ht tp://www.balabit.com/wiki/ > syslog-ng-faq < Caution-Caution- http://www.balabit.com/wiki/syslog-ng-faq < Caution-http://www.balabit. com/wiki/syslog-ng-faq > >
____________________________________________________________ __________________ Member info: Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng < Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: Caution-http://www.balabit.com/support/documentation/? product=syslog-ng < Caution-http://www.balabit.com/support/ documentation/?product=syslog-ng > FAQ: Caution-http://www.balabit.com/wiki/syslog-ng-faq < Caution- http://www.balabit.com/wiki/syslog-ng-faq >
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
participants (4)
-
Amin, Jitesh CTR (US)
-
László Várady
-
Scheidler, Balázs
-
Szemere, László