Robin Blanchard | 28 Mar 01:18 2015

[filter] unable to squelch annoying spam

Hi List,

I've got some Solaris machines emitting some particularly annoying spam that I cannot seem to squelch.
I've tried filtering on just about every MACRO that I can think might catch it, all to no avail.

Here's the snippet from running syslog-ng in debug/foreground:

# syslog-ng -Fdve 2>&1 |grep alloc_extra_sgl_frame
Incoming log entry; line='<4>Mar 27 19:00:55    alloc_extra_sgl_frame failed'

And here's the relevant filter bit (the other strings are doing their job).

filter solaris_alloc {
   not (
       match('alloc_extra_sgl_frame' value("MESSAGE")) or
       match('alloc_extra_sgl_frame' value("MSGHDR")) or
       match('alloc_extra_sgl_frame' value("FACILITY")) or
       match('alloc_extra_sgl_frame' value("PRIORITY")) or
       match('alloc_extra_sgl_frame' value("MSGID")) or
       match('ext-arq alloc fail.' value("MESSAGE")) or
       match('ext-arq alloc fail.' value("MSGHDR")) or
       match('/pci <at> 0,0/pci8086,3c06 <at> 2,2/pci1000,3080 <at> 0' value("MESSAGE")) or
       match('/pci <at> 0,0/pci8086,3c06 <at> 2,2/pci1000,3080 <at> 0' value("MSGHDR"))

# syslog-ng --version
syslog-ng 3.5.6
Installer-Version: 3.5.6
(Continue reading)

Matt Zagrabelny | 27 Mar 17:44 2015

interrogate daemon for parameter values?


Is there a way to interrogate the running daemon to find out what the
*effective* value is for things?

For instance, I'd like to know what the effective value of so_rcvbuf
is for a udp source.

cat /proc/sys/net/core/rmem_default

syslog-ng.conf: udp(); # uses default value of 0

service syslog-ng start

echo 512 > /proc/sys/net/core/rmem_default

Here is where I'd like to interrogate the running daemon and find that
the udp driver is using a value of 1024 for so_rcvbuf.

Any chance of doing that?


Member info:

(Continue reading)

Matt Zagrabelny | 27 Mar 17:38 2015

so_rcvbuf default value of 0


Just looking for confirmation about the so_rcvbuf parameter for the
udp() source driver.

The default is 0. Does that mean that syslog-ng uses the default value
from the kernel?


cat /proc/sys/net/core/rmem_default

If that is true, then perhaps the syslog-ng admin docs could mention
that. I've scanned "man 7 socket" and don't seen anything that
suggests that a value of 0 for so_rcvbuf means that the socket will
inherit the value.

Thanks for the help!

Member info:

Max Timchenko | 27 Mar 04:15 2015

GSoC proposal: Python connector (maxvt)

Dear all,

I’ve posted a proposal for the Python connector at:

Any comments are welcome. There are a few questions at the bottom; repeating them here for convenience:

1. Python 3, Python 2, or both? Supporting only 3 allows using nifty idioms and language features, but there
are still users who prefer to speak 2. Constrained platforms may not have enough resources to run both.

2. Are there any priorities among the different components in the project? A total of 5 components are specified.

3. Viability of one-component-at-a-time approach — whether you would prefer to see each part as it is
done to completion, or proceed in parallel for all components (eg., wrapper APIs for all, then Python APIs
for all, then completed documentation and examples for all).

Member info:

Garmine 42 | 25 Mar 07:12 2015

GSoC 2015: Java Language Binding


I started coding coding around 6 years ago, first using Java and later
extending my knowledge to many other languages including C, Python,
FORTH, Active Oberon and Bash just to name a few of many. Right now
I'm a student at Budapest University of Technology and looking for a
challenge for the summer.

Recently a friend of mine drew my attention to syslog-ng and so I
started exploring the project. Not only because it's an important Unix
application but also because I developed some logging utilities of my
own and as a OSS user I would love to start paying back to the
community using the knowledge I learnt from them.

I am working on issue 257 at the moment and I study the code and
infrastructure above all to truly understand what I'm doing rather
than just copying functionality. (And sometimes figuring out
configuration issues as Arch Linux doesn't seem to be the most popular
development platform for syslog-ng :))

As I have significant experience in C and Java* I believe I could do
the most if I worked to enable Java-Syslog interoperability.

* I wrote OpenGL&CL experiments, an overly complicated BrainF# <at> k
interpreter and contributed to a game called ScrumbleShip in C.
I also developed a primitive web browser resembling the Line Mode
Browser from scratch using an own HTML parser, a JSON parser,
contributed to a Minecraft server's code and wrote many other smaller
and larger programs in Java.
Due to my interest in OpenGL I also gathered knowledge about JNI.
(Continue reading)

Mohammadi, Mahmoud | 25 Mar 04:04 2015

GSoC Syslog-ng WebSocket question

Dear WebSocket  Mentors,


This is Mahmoud Mohammadi, a graduate student in UNC Charlotte, USA. Currently I am researching on GSoC syslog-ng ideas. In the WebSocket protocol, as you know there are different tasks and issues to consider  such as initial handshaking, data exchange, data formats and  ping/pong communication commands. So is it required to write a library for implementing the WebSocket protocol in C or  C++ or just use an existing library( recommended by you or the programmer) to integrating it with syslog-ng for the required functionalities? And also can you please is there  a rough estimation( if possible) about the variety of different data formats or  commands  exchanging between the server and client or they would be determined during the project?





Member info:

krish k | 22 Mar 15:36 2015

[GSoC - 2015 Proposal] - Project: syslog-ng server monitoring with mobile app

Hi all,

I would like to propose a project. Mobile applications for server monitoring starting with Android and extending it to windows and iOS.
I would like to discuss about the project with the mentor and would like to take this forward. Can someone kindly guide me in a correct 
direction to take this project forward. 

I am graduate student doing my Master of Computing at National University of Singapore - School of Computing.

I have experience in Java, C, C#, Python. I have developed many android applications and published it in Google Play Store. Currently published apps can be found here

I have worked with Verizon Inc before joining my masters, there I was working on a tablet application. I am very much thrilled about the idea 
of working with Syslog-ng community and be an active member. Looking forward to work on this project.     


Member info:

Roland Lukács | 22 Mar 04:09 2015

GSoC 2015 WebSocket for syslog-ng


My name is Roland Lukács and I am a third-year Computer Engineering 
student at Budapest University of Technology and Economics.
I have experience in C, C++, Python programming languages. I'm system 
administrator in Schönherz dorm so I use often syslog-ng.

I heard about GSoC from my friend who was part of it last year.
I am interested in Websocket for syslog-ng project. I have already 
talked to László Mészáros, who told me about the project.

Best regards,
Roland Lukács
Member info:

Máté Eckl | 20 Mar 08:37 2015

GSoC 2015: syslog-ng as a command line tool


I'm Máté Eckl and I study IT engineering at the BME (I'm in my second semester). I studied C in the first semester, but I had prior experience with it. I also have experience on different programming languages, basics of networking (eg.: building a secondary DNS server for the college this spring), I use Linux (Ubuntu and Arch) and I'm familiar with getopt and the mechanism of command-line arguments.

Earlier this semester I needed to prepare a basic syslog-ng configuration on a logging server, so I have slight knowledge about the system, but in the college I have great opportunity to get deeper inside it until the end of the semester.

I'm really interested in this project, but the functionality is not really clear for me. What should the log messages be transformed to? Do you mean it to be a sort of debug session, where you can test the rules you want to apply in the config files? Or something else? Could you describe it to me a bit more precisely?

Best regards,
Máté Eckl
Member info:

Botond Borsits | 20 Mar 00:00 2015

GSoC 2015 Python Language Binding


My name is Botond Borsits and I am studying at Budapest University of Technology and Economics. I heard about the GSoC from my friend, who is a syslog-ng open source contributor. I am familiar with C and Python, so I would like to apply to the syslog-ng Python language binding project.

Best regards,
Botond Borsits
Member info:

C. L. Martinez | 19 Mar 20:21 2015

How to use <at> EMAIL <at> parser in patterndb

Hi all,

 I have a situation like described in syslog-ng's docs
about email addresses.

 I have tried to use " <at> EMAIL:email:"[<]> <at>  " in my patterndb to catch
all possible email address combinations like <user <at>>,
[user <at>], "user <at>", as described in docs, but
without luck. Every time that I check some log with pdbtool returns me
errors about " [<]>" characters.

 I have tried to subsitute <> with &lt; and &gt;, for example, but nothing ....

 Any sample about how to use  <at> EMAIL <at>  parser inside patterndb?

 I am using syslog-ng 3.5.x.

Member info: