[syslog-ng] Diagnosing patterndb load errors

[Martin Holste]

I'm sure I've seen that before as well, but I still have no idea what
they mean.  I think they only occurred on the first loading of a new
xml file, so I ignored it as everything appeared to be operating
correctly.  I'd be interested in knowing if it's something to pay
attention to.

On Tue, Oct 12, 2010 at 8:41 PM, Matthew Hall <mhall at mhcomputing.net> wrote:
> I am getting the following sequence of load errors for my patterndbs.
>
> Duplicates eliminated, timestamps zeroed out, host info anonymized.
>
> Has anybody else gotten these and learned how to fix them?
>
> I'm having a hard time figuring out what 'type', 'name', and 'value' mean,
> to track them down in the XML files.
>
> Thanks,
> Matthew Hall.
>
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Name-value pairs cannot have a zero-length name; value=''
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate key in radix tree; key='Neighbor Down: Dead timer expired', value='19'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate key in radix tree; key=' packet', value='26'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate key in radix tree; key='s', value='28'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate key in radix tree; key=' packet', value='34'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate key in radix tree; key='s', value='36'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate key in radix tree; key=' packet', value='39'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate key in radix tree; key=' packet', value='40'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate key in radix tree; key='s', value='41'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate key in radix tree; key='s', value='44'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Log pattern database reloaded; file='switch-db.xml', version='3', pub_date='2010-08-25'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate key in radix tree; key=', domain = <not specified>', value='8'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='0', name='user', value='12'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='0', name='user', value='13'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='20'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='21'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='22'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='23'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='24'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='25'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='26'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='27'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='28'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='29'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='30'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='31'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='32'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='33'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='34'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='5', name='reason', value='35'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='4', name='None', value='38'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Log pattern database reloaded; file='vpn-db.xml', version='3', pub_date='2010-08-25'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Log pattern database reloaded; file='load-db.xml', version='3', pub_date='2010-08-25'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Log pattern database reloaded; file='firewall-db.xml', version='3', pub_date='2010-08-25'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate parser node in radix tree; type='0', name='group', value='32'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Duplicate key in radix tree; key='.  Please check authentication server radius/ldap/tacacs logs.', value='50'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Log pattern database reloaded; file='wireless-db.xml', version='3', pub_date='2010-08-25'
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: Termination requested via signal, terminating;
> Jan 01 00:00:00 s_internal at host syslog-ng[23005]: syslog-ng shutting down; version='3.1.1'
> Jan 01 00:00:00 s_internal at host syslog-ng[23379]: Log pattern database reloaded; file='wireless-db.xml', version='3', pub_date='2010-08-25'
> Jan 01 00:00:00 s_internal at host syslog-ng[23379]: Log pattern database reloaded; file='vpn-db.xml', version='3', pub_date='2010-08-25'
> Jan 01 00:00:00 s_internal at host syslog-ng[23379]: Log pattern database reloaded; file='switch-db.xml', version='3', pub_date='2010-08-25'
> Jan 01 00:00:00 s_internal at host syslog-ng[23379]: Log pattern database reloaded; file='load-db.xml', version='3', pub_date='2010-08-25'
> Jan 01 00:00:00 s_internal at host syslog-ng[23379]: Log pattern database reloaded; file='firewall-db.xml', version='3', pub_date='2010-08-25'
> Jan 01 00:00:00 s_internal at host syslog-ng[23379]: syslog-ng starting up; version='3.1.1'
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>