Evan Rempel | 20 Oct 00:47 2014
Picon
Picon

patterndb will not accept a program containing a $

Technically speaking, any non-alphanumeric character will terminate the 
TAG field at the beginning
of the message. This is usually one of : [ or space as in the examples

program: this is the message
program[123]: this is the message
program this is the message

In practice though, syslog daemons will send TAGs that contain any 
character and the syslog-ng Agent for Windows
will forward the application name as it shows in the Windows Event Log. 
In some cases, this TAG will contain a $ character.

The patterndb-4.xsd definition disallows the $ character in the program 
pattern in pattern database files.

Can this restriction be removed to allow for the $ or is this a larger 
issue that I see?

Thanks again for all of the support.

Evan.
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Davide Alberani | 9 Oct 18:08 2014
Picon

inserts into a sqlite3 database are not delayed

Hi,
I'm using a SQLite 3 database as a destination,
but it seems that the options to delay the insert
of new rows are ignored.

The destination is something like:

destination sqlite_db {
        sql(type(sqlite3)
        flags('explicit-commits')
        flush_timeout(60000)
        log_fifo_size(1000)
        flush_lines(1000)
        retry_sql_inserts(2)
        database("/tmp/logs.db")
        [...table, columns, values, indexes definitions...]
};

Every time a log arrives, it's immediately written into
the database, while I expected to have it delayed accordingly
to flush_timeout and flush_lines.

Currently I'm using syslog-ng OSE 3.4.2, but looking at
the code of the latest version doesn't seem to have
changed much.
SQLite version is 3.8.4.
libdbi 0.8.4
libdbi-drivers 0.8.3
libdbi-dbd-sqlite 0.8.3
libol 0.3.16
(Continue reading)

Richards, James L - DOA | 3 Oct 21:18 2014

Question on parsing

So I have a scenario I am having difficulties with.

 

I have an IDS sensor (suricata), and it is generating a log-file at /log_file_dir/fast.log

 

And I would like to parse this log and send it off to a remote syslog server.

 

I have put the following in my syslog-ng.conf:

 

source s_log_server { file("/log_file_dir/fast.log " program_override("snort")); };

 

added a destination for the remote server:

 

destination d_log_server { udp ("fqdn.of.primary.elsa.box" port(514)); };

 

Then in the log{ section I have put this:

 

Destination (d_log_server);

 

Logs are making it to the remote box, but in an unparsed format…

 

How do I get this to trigger a parser in syslog-ng?

 

Thanks much,

 

 

 

 

 

Jim

 

 

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Jim Hendrick | 3 Oct 02:33 2014

syslog-ng as "shipper" into ELK stack

Hi,

   I am working on configuring Elasticsearch, Logstash & Kibana (ELK) to 
test it as a backend search tool for large volumes of logs.

I decided to put Redis in front of Logstash as a "broker" for the 
incoming logs, and syslog-ng as the "shipper" so it looks like this:

syslog-ng ==> redis ==> logstash ==> elasticsearch ==> apache ==> kibana

It works very well using the redis destination in syslog-ng, although I 
am having performance problems with logstash & elasticsearch default 
configurations keeping up.

(I topped out today sending ~7000 events per second, and saw an insane 
amount of swapping going on)

Not so much a specific question (I'll be working on heap & thread 
settings and am pretty confident I can get it to handle at least this 
moderate load) but I was wondering if anyone else is working in this area.

Also, in this configuration logstash is simply "parsing" the data it 
pulls from redis and sending it into elasticsearch.

Seems like something syslog-ng might be able to do directly.

Is anyone aware of any plans to implement an elasticsearch destination?

Feel free to contact me on or off list if you want to discuss this.

Thanks!!
Jim

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Doug McClure | 2 Oct 23:43 2014
Picon

File Source limits in OSE and PE?

Are there limits to the number of unique files that can be monitored with an installation of OSE or PE?

For example, could I monitor 500 unique log files on a given server?

Tks!

Doug
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

wiskbroom | 30 Sep 20:34 2014
Picon

Syslog-NG.conf to Fork to Two Log Aggregators

Hello;

I have syslog clients that I would like to configure to send log-data to a middle-man/intermediary syslog-NG server.  Once received on the intermediary, I want to immediately fork that data onto a different log-server, not syslog-NG; satisfying a requirement to feed two systems.

The reason for the fork is because the non-syslog-NG-server is running a proprietary logging system, and it must, at least for now, be capable of seeing *most* of my logs.  It, the non-syslog-NG-server, is incapable of retransmitting to my syslog-NG server, nor would I trust it to do so.

My questions to the list are,
1.   Has anyone successfully done something similar?
2.   Any recommendations/gotchas I should be aware of?
3.   Can I also configure syslog-NG to also resend Splunk data?  Or do I have to run a Splunk Univ Forwarder configured similarly to my intermediary syslog-NG server to achieve that?   (Yes, I know, OT question, sorry...)

Thank you in advance,

.vp





______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Justin Kala | 30 Sep 16:29 2014
Picon

Create Pattern-DB rules

Hello
 
 
I am trying to create Pattern-DB for the following Authorization messages coming from O/S.
Can you help on creating a matching rule .
 
Note: I do not have PATTERN-DB parser utility.I am going to create the db-parser.xml manually and put this rules inside the file.
 
2014-09-28T14:12:44-04:00 abcdef01-app/abcdef01-app sshd[11019]: [ID 800047 auth.notice] Failed password for root from 100.200.255.01 port 54438 ssh2
2014-09-28T14:03:46-04:00 abcdef01-app/abcdef01-app sshd[27420]: [ID 800047 auth.notice] Failed publickey for root from 100.200.255.02 port 59219 ssh2
2014-09-28T14:08:28-04:00 abcdef01-app/abcdef01-app sshd[3954]: [ID 800047 auth.notice] Failed keyboard-interactive for root from 100.200.255.03 port 65410 ssh2
2014-09-28T14:10:11-04:00 abcdef01-app/abcdef01-app sshd[5222]: [ID 293258 auth.error] libsldap: Status: 49  Mesg: openConnection: simple bind failed - Invalid credentials


Thanks & Regards
Kaladhar
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

jetjnkr | 29 Sep 21:48 2014
Picon

Continued struggle with getting shell env vars into log statements

Greetings,

I'm trying to get an environment variable (As defined in the shell - take for example "HOSTNAME").  

echo $HOSTAME provides the expected string....  I then would like to append this to a set of messages based upon a specific destination.  I'm using syslog-ng 3.2.5. In this case the 'hostname' is just an example,  I know that the sending hostname is automatically prepended  - used here because it's commonly defined on systems.

I've included the following config lines from my syslog-ng.conf file.

destination d_web_call      { file("/var/log/web_call" template("<$PRI> $DATE $HOST $MSGHDR$MSG host=`HOSTNAME` \n") template_escape(no)); };
filter f_web_call                 { facility(local1) and ( match("^.*apache-call.*$" value("MSGHDR")) );};

log {
        source(s_sys);
        filter(f_web_call);
        destination (d_web_call);
        flags(final,flow-control);
};


Using the following test string:

/usr/bin/logger -t apache-call-tst -p local1.notice "This is a test message 25"

I get the following:

<141> Sep 26 17:21:18 lab.xxxx.com apache-call-tst: This is a test message25 host= 



I've received a few pointers from folks here (including going to 3.5 which can't be completed in the short term....).  If tried things with 'define' and using the '$' but not back-tick for the shell variable.  It is not clear when this value is set (if at all) within the config file.

Thanks,
Jim.


______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Andrew Bell | 26 Sep 15:41 2014

Re: SOLVED: syslog-ng and python program destination constantly being restarted again and again

Hi,. 

Thanks for the feedback. I actually figured out the reason as to why this was happening, and it had to do with
syslog-ng referencing a the default python path on the system instead of the custom python path I've
installed in my home directory ("python" alias pointed to "/usr/bin/python" instead of my
"/home/bin/python" path). The custom python path had all the third-party libraries that my script
depended on for execution, and so that was why syslog-ng kept sending all these /var/log/messages
because it couldn't import the libraries and was using the wrong python instance (Used an strace command
against syslog-ng in order to confirm this). So I specified the fully qualified path to my custom home
python instance and now my script is working and staying up indefinitely as expected. I also f
 ully qualified the one error exception path as well.

~Andrew

-----Original Message-----
From: syslog-ng-bounces <at> lists.balabit.hu [mailto:syslog-ng-bounces <at> lists.balabit.hu] On Behalf
Of Sandor Geller
Sent: Friday, September 26, 2014 3:49 AM
To: syslog-ng <at> lists.balabit.hu
Subject: Re: [syslog-ng] syslog-ng and python program destination constantly being restarted again and again

Hi,

The logs you quoted imply that your custom script keeps dying therefore syslog-ng keeps respawning it.
Without seeing the whole script I'd assume that the original problem occurs in the code path where the
script tries to forward logs and an expection gets raised (BTW not all exceptions are derived from the
Exception class so the exception handler is a bit incomplete but let's put this aside for now).

In the exception handler you're trying to open a file containing '~' 
without using os.path.expanduser() so you end up with an invalid filename which can't get opened. As this
exception isn't handled the interpreter aborts the script. So you should eliminate the root cause why the
script can't forward logs and also improve the exception handling.

hth,

Sandor

On 09/26/2014 01:12 AM, Andrew Bell wrote:
> Hello all,
>
> Wondering if someone could help me with an issue I've run into 
> recently regarding the program destination in syslog-ng and a python 
> script I wrote to automate parsing log events sent over from our Web 
> Application firewall. For some months now, the script and syslog-ng 
> configuration were working swimmingly but then things recently started 
> to stop working and now the script refuses to remain up and forwarding as expected.
>
> First, here is what and destination looks like in my syslog-ng conf. 
> The general flow here being  ASM events are generated on the firewall 
> (for whatever purpose), they get sent over to syslog-ng and my python 
> script then parses these logs and sends them over to another server 
> running ElasticSearch using the python requests library. This takes 
> place within the context of an infinite loop in my script - wait for a 
> log event to come in, execute, go back to waiting, and so forth.
>
> /destination asm_post {/
>
> /                program("python -u /home/data/asm_logs/asmlogPost.py"
> flush_lines(1) flags(no_multi_line));/
>
> /};/
>
> I've specified the following flags based off other help forums that 
> suggested this would help to address the stdin buffer flushing issue 
> sometimes encountered with syslog-ng and python scripts. There are no 
> filters being applied here.
>
> //
>
> /source(sn_asm);/
>
> /destination(asm_post);/
>
> Now, my asmLogPost.py script is setup to always read in standard input 
> through an infinite loop as various best practice syslog-ng sources 
> have recommended. Here's an excerpt of where the reading in happens  - 
> encapsulated within the context of a try/exception clause:
>
> /try:/
>
> /    while 1:/
>
> /        line = sys.stdin.readline()/
>
> /        #...read in line log event, log event parsing and POSTing to
> other box executes in context of infinite loop...after each POST, it 
> should go back and wait to read in the next line/
>
> /Exception, e:/
>
> /      # ...exception handling block to catch any errors, write to a file.../
>
> /      f = open('~/ error.txt','ab')/
>
> /     f.write('Error happened, here are the details - %s\n'% str(e))/
>
> /     f.close()/
>
> As was said earlier, this has all worked out fine and dandy for quite 
> some time (and I haven't made any alterations to my script for about a 
> month or so). But just recently, syslog-ng now appears to be caught in 
> a loop where it constantly stops, starts, and restarts my script 
> continuously such that it can't log anything anymore sufficiently. 
> Also the PID is constantly changing for my script whenever I do a ps 
> -aef command, which would indicate that a new instance is constantly 
> being spun up by syslog-ng.
>
> Not only that, but there apparently appear to be the following 
> messages sprouting up in /var/log/messages constantly as well which I 
> think is due to syslog-ng always restarting my script
>
> /Sep 25 16:28:57 sysa03 abrt: can't communicate with ABRT daemon, is 
> it running? [Errno 2] No such file or directory/
>
> /Sep 25 16:28:57 sysa03 abrt: detected unhandled Python exception in 
> '/home/data/asm_logs/asmlogPost.py'/
>
> /Sep 25 16:28:57 sysa03 abrt: can't communicate with ABRT daemon, is 
> it running? [Errno 2] No such file or directory/
>
> /Sep 25 16:28:57 sysa03 abrt: detected unhandled Python exception in 
> '/home/data/asm_logs/asmlogPost.py'/
>
> /Sep 25 16:28:57 sysa03 abrt: can't communicate with ABRT daemon, is 
> it running? [Errno 2] No such file or directory/
>
> /Sep 25 16:28:57 sysa03 abrt: detected unhandled Python exception in 
> '/home/data/asm_logs/asmlogPost.py'/
>
> /Sep 25 16:28:57 sysa03 abrt: can't communicate with ABRT daemon, is 
> it running? [Errno 2] No such file or directory/
>
> /Sep 25 16:28:57 sysa03 abrt: detected unhandled Python exception in 
> '/home/data/asm_logs/asmlogPost.py'/
>
> /Sep 25 16:28:57 sysa03 abrt: can't communicate with ABRT daemon, is 
> it running? [Errno 2] No such file or directory/
>
> /Sep 25 16:28:57 sysa03 abrt: detected unhandled Python exception in 
> '/home/data/asm_logs/asmlogPost.py'/
>
> /Sep 25 16:28:57 sysa03 abrt: can't communicate with ABRT daemon, is 
> it running? [Errno 2] No such file or directory/
>
> /Sep 25 16:28:58 sysa03 abrt: detected unhandled Python exception in 
> '/home/data/asm_logs/asmlogPost.py'/
>
> /Sep 25 16:28:58 sysa03 abrt: can't communicate with ABRT daemon, is 
> it running? [Errno 2] No such file or directory/
>
> /Sep 25 16:28:58 sysa03 abrt: detected unhandled Python exception in 
> '/home/data/asm_logs/asmlogPost.py'/
>
> /Sep 25 16:28:58 sysa03 abrt: can't communicate with ABRT daemon, is 
> it running? [Errno 2] No such file or directory/
>
> But the thing is, there are no exceptions or error files being 
> generated by my script even though these messages seem to say this 
> happening...if there were, my script should catch this and write it 
> down. Besides, it did used to do this initially as I was developing my 
> script but it would never halt overall execution or cause syslog-ng to 
> tear it down, it would just write out to an error.txt file within the same directory.
>
> //
>
> Can anyone offer any insight here? I'll admit I'm not familiar with 
> how the ABRT daemon functions and if it and syslog-ng are somehow 
> related here or not. And I'm pretty confident that there's nothing 
> wrong with my script as I am able to execute its current version just 
> fine from a shell prompt - it can send over the log event and 
> everything parsed as expected with no errors. I'm kind of at a dead 
> end, going through my script and these log messages, trying to restart 
> syslog-ng to refresh, trying to place debug log statements before the 
> "while 1:" loop, trying to move the while 1: loop to be outside the 
> try/exception clause, but not much of this seems to be helping so far.
>
> Many Thanks,
>
> Andrew
>
>
>
> ______________________________________________________________________
> ________ Member info: 
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: 
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

devel | 26 Sep 15:18 2014
Picon

syslog-ng 3.6.0rc1 has been released

------------------------------------------------------------------------------
PACKAGE             : syslog-ng
VERSION             : 3.6.0rc1
SUMMARY             : new release candidate
DATE                : Sep 26, 2014
------------------------------------------------------------------------------

DESCRIPTION:

  A new release candidate of syslog-ng Open Source Edition (3.6.0rc1) has been
  released.

CHANGES:

3.6.0rc1
========
        Fri, 26 Sep 2014 11:17:31 +0200

This is the first Release Candidate of the syslog-ng OSE 3.6 branch.
Based on our test results this release is almost production ready.

Features
--------

* Added groupset rewrite object.
  Groupset allows the user to modify multiple log message properties at once.
  It also allows referencing the old value of the property as the $_ macro.

Bugfixes
--------

* Fixed a memory leak during configuration parsing when using `rewrite()`.
* Change control socket message from notice to debug
* Fixes for retries() functionality.
  Retry counter incremented by every message write error
  (including network connection errors) which can lead to message lost.

Credits
-------

syslog-ng is developed as a community project, and as such it relies
on volunteers, to do the work necessary to produce syslog-ng.

Reporting bugs, testing changes, writing code or simply providing
feedback are all important contributions, so please if you are a user
of syslog-ng, contribute.

We would like to thank the following people for their contribution:

Balazs Scheidler, Brian De Wolf, Gergely Nagy, Laszlo Budai, Peter Czanik,
Tibor Benke, Viktor Juhasz, Viktor Tusa.

DOWNLOAD:

  You can download the source or binary packages from:

    http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0rc1/

  The documentation of the syslog-ng Open Source Edition is available in
  The syslog-ng Open Source Edition Administrator's Guide at

    http://www.balabit.com/support/documentation/

------------------------------------------------------------------------------
PACKAGE             : syslog-ng
VERSION             : 3.6.0rc1
SUMMARY             : new release candidate
DATE                : Sep 26, 2014
------------------------------------------------------------------------------

DESCRIPTION:

  A new release candidate of syslog-ng Open Source Edition (3.6.0rc1) has been
  released.

CHANGES:

3.6.0rc1
========
        Fri, 26 Sep 2014 11:17:31 +0200

This is the first Release Candidate of the syslog-ng OSE 3.6 branch.
Based on our test results this release is almost production ready.

Features
--------

* Added groupset rewrite object.
  Groupset allows the user to modify multiple log message properties at once.
  It also allows referencing the old value of the property as the $_ macro.

Bugfixes
--------

* Fixed a memory leak during configuration parsing when using `rewrite()`.
* Change control socket message from notice to debug
* Fixes for retries() functionality.
  Retry counter incremented by every message write error
  (including network connection errors) which can lead to message lost.

Credits
-------

syslog-ng is developed as a community project, and as such it relies
on volunteers, to do the work necessary to produce syslog-ng.

Reporting bugs, testing changes, writing code or simply providing
feedback are all important contributions, so please if you are a user
of syslog-ng, contribute.

We would like to thank the following people for their contribution:

Balazs Scheidler, Brian De Wolf, Gergely Nagy, Laszlo Budai, Peter Czanik,
Tibor Benke, Viktor Juhasz, Viktor Tusa.

DOWNLOAD:

  You can download the source or binary packages from:

    http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.6.0rc1/

  The documentation of the syslog-ng Open Source Edition is available in
  The syslog-ng Open Source Edition Administrator's Guide at

    http://www.balabit.com/support/documentation/

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

Andrew Bell | 26 Sep 01:12 2014

syslog-ng and python program destination constantly being restarted again and again

Hello all,

 

Wondering if someone could help me with an issue I’ve run into recently regarding the program destination in syslog-ng and a python script I wrote to automate parsing log events sent over from our Web Application firewall. For some months now, the script and syslog-ng configuration were working swimmingly but then things recently started to stop working and now the script refuses to remain up and forwarding as expected.

 

First, here is what and destination looks like in my syslog-ng conf. The general flow here being  ASM events are generated on the firewall (for whatever purpose), they get sent over to syslog-ng and my python script then parses these logs and sends them over to another server running ElasticSearch using the python requests library. This takes place within the context of an infinite loop in my script – wait for a log event to come in, execute, go back to waiting, and so forth.

 

destination asm_post {

                program("python -u /home/data/asm_logs/asmlogPost.py" flush_lines(1) flags(no_multi_line));

};

I’ve specified the following flags based off other help forums that suggested this would help to address the stdin buffer flushing issue sometimes encountered with syslog-ng and python scripts. There are no filters being applied here.

 

source(sn_asm);

destination(asm_post);

 

Now, my asmLogPost.py script is setup to always read in standard input through an infinite loop as various best practice syslog-ng sources have recommended. Here’s an excerpt of where the reading in happens  - encapsulated within the context of a try/exception clause:

 

try:

    while 1:

        line = sys.stdin.readline()

        #...read in line log event, log event parsing and POSTing to other box executes in context of infinite loop…after each POST, it should go back and wait to read in the next line

Exception, e:

      # …exception handling block to catch any errors, write to a file…

      f = open('~/ error.txt','ab')

     f.write('Error happened, here are the details - %s\n'% str(e))

     f.close()

 

As was said earlier, this has all worked out fine and dandy for quite some time (and I haven’t made any alterations to my script for about a month or so). But just recently, syslog-ng now appears to be caught in a loop where it constantly stops, starts, and restarts my script continuously such that it can’t log anything anymore sufficiently. Also the PID is constantly changing for my script whenever I do a ps –aef command, which would indicate that a new instance is constantly being spun up by syslog-ng.

 

Not only that, but there apparently appear to be the following messages sprouting up in /var/log/messages constantly as well which I think is due to syslog-ng always restarting my script

Sep 25 16:28:57 sysa03 abrt: can't communicate with ABRT daemon, is it running? [Errno 2] No such file or directory

Sep 25 16:28:57 sysa03 abrt: detected unhandled Python exception in '/home/data/asm_logs/asmlogPost.py'

Sep 25 16:28:57 sysa03 abrt: can't communicate with ABRT daemon, is it running? [Errno 2] No such file or directory

Sep 25 16:28:57 sysa03 abrt: detected unhandled Python exception in '/home/data/asm_logs/asmlogPost.py'

Sep 25 16:28:57 sysa03 abrt: can't communicate with ABRT daemon, is it running? [Errno 2] No such file or directory

Sep 25 16:28:57 sysa03 abrt: detected unhandled Python exception in '/home/data/asm_logs/asmlogPost.py'

Sep 25 16:28:57 sysa03 abrt: can't communicate with ABRT daemon, is it running? [Errno 2] No such file or directory

Sep 25 16:28:57 sysa03 abrt: detected unhandled Python exception in '/home/data/asm_logs/asmlogPost.py'

Sep 25 16:28:57 sysa03 abrt: can't communicate with ABRT daemon, is it running? [Errno 2] No such file or directory

Sep 25 16:28:57 sysa03 abrt: detected unhandled Python exception in '/home/data/asm_logs/asmlogPost.py'

Sep 25 16:28:57 sysa03 abrt: can't communicate with ABRT daemon, is it running? [Errno 2] No such file or directory

Sep 25 16:28:58 sysa03 abrt: detected unhandled Python exception in '/home/data/asm_logs/asmlogPost.py'

Sep 25 16:28:58 sysa03 abrt: can't communicate with ABRT daemon, is it running? [Errno 2] No such file or directory

Sep 25 16:28:58 sysa03 abrt: detected unhandled Python exception in '/home/data/asm_logs/asmlogPost.py'

Sep 25 16:28:58 sysa03 abrt: can't communicate with ABRT daemon, is it running? [Errno 2] No such file or directory

 

But the thing is, there are no exceptions or error files being generated by my script even though these messages seem to say this happening…if there were, my script should catch this and write it down. Besides, it did used to do this initially as I was developing my script but it would never halt overall execution or cause syslog-ng to tear it down, it would just write out to an error.txt file within the same directory.

 

Can anyone offer any insight here? I’ll admit I’m not familiar with how the ABRT daemon functions and if it and syslog-ng are somehow related here or not. And I’m pretty confident that there’s nothing wrong with my script as I am able to execute its current version just fine from a shell prompt – it can send over the log event and everything parsed as expected with no errors. I’m kind of at a dead end, going through my script and these log messages, trying to restart syslog-ng to refresh, trying to place debug log statements before the “while 1:” loop, trying to move the while 1: loop to be outside the try/exception clause, but not much of this seems to be helping so far.

 

Many Thanks,

Andrew

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq


Gmane