headers
Balazs Scheidler | 2 Jul 2007 08:56
Picon

Re: error compiling syslog-ng-2.0.2 and syslog-ng-2.0.4+20070626

On Fri, 2007-06-29 at 13:11 -0400, Valdis.Kletnieks <at> vt.edu wrote:
> On Tue, 26 Jun 2007 14:18:01 +0400, Serge Torop said:
> > then I compiling the syslog-ng-2.0.2 on RedHat Enterpise Linux 4 (kernel
> > 2.6.9-42.ELsmp) I see the message:
> 
> > if gcc -DHAVE_CONFIG_H -I. -I. -I..   -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include
> 
> Why are you looking at a glib-2.0 that's in /usr/local, when RedHat ships a
> reasonably functional glib2 and glib2-devel RPM?

This might really be a problem, you posted glib RPM versions, while you
were using another glib version from /usr/local

The question is why you are not getting warnings while compiling
syslog-ng. Did you redirect the error messages of the compilation output
as well? (e.g. something like 2>&1) ?

--

-- 
Bazsi

_______________________________________________
syslog-ng maillist  -  syslog-ng <at> lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
Permalink | Reply | 0 comments |
headers
Balazs Scheidler | 2 Jul 2007 09:01
Picon

Re: AF_INET client dropped connection

On Thu, 2007-06-28 at 12:42 +0200, Pol Moal wrote:
> Hi,
> 
> when I restart syslog-ng on a client, the loghost prints these lines:
> 
> Jun 28 12:28:38 loghost syslog-ng[7068]: AF_INET client dropped connection from w.x.y.z, port 38171
> 
> Jun 28 12:28:39 loghost syslog-ng[7068]: AF_INET client connected from w.x.y.z, port 38040
> 
> Do I lose some information from the client? If yes, what can I do?

If you restart syslog-ng, then 

1) some messages might arrive while syslog-ng itself is stopped. These
messages are lost. 

2) the messages that had been been accumulated in syslog-ng's output
buffers can also be lost.

I don't really see solutions for item 1) above, item 2) is solved by
Premium Edition's disk buffer feature.

You should not periodically trigger a restart, use  the 'reload'
functionality instead, that's much better in this regard.

--

-- 
Bazsi

_______________________________________________
syslog-ng maillist  -  syslog-ng <at> lists.balabit.hu
(Continue reading)

Permalink | Reply | 2 comments |
headers
Balazs Scheidler | 2 Jul 2007 09:05
Picon

Re: Static compilation

On Fri, 2007-06-29 at 11:24 +0200, Nicolas de Marqué - Fromentin wrote:
> Hello, 
>  
> I have problems with compilation of syslog-ng on a solaris 5.8 :
>  
> After Syslog-ng Configuration :
>         ./configure --prefix=/tmp/local --disable-spoof-source
>         --enable-static-linking
> => i have this error :
>         checking for static GLib libraries... no
>         configure: error: static GLib libraries not found (a file
>         named libglib-2.0.a), either link GLib dynamically using the
>         --enable-dynamic-linking or install a static GLib
> => but i have the correct file :
>         ls -la /tmp/local/lib/libglib-2.0.a
>         -rw-r--r--   1 outils   dinb     2096104 Jun 28
>         15:51 /tmp/local/lib/libglib-2.0.a
> Have you an idea about this problem?

You need to pass an LDFLAGS environment variable which contains the
library path as a linker option like this:

-L/tmp/local/lib

--

-- 
Bazsi

_______________________________________________
syslog-ng maillist  -  syslog-ng <at> lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
(Continue reading)

Permalink | Reply | 0 comments |
headers
Balazs Scheidler | 2 Jul 2007 09:07
Picon

Re: Log messages looping back infinitely

On Fri, 2007-06-29 at 01:19 -0700, Christopher Cowart wrote:
> Hello,
> 
> I've had a recent problem where my dhcpd logs appear to be arriving and
> rearriving until /var fills up. 
> 
> My log traffic looks like this (all over udp/syslog and IPSec):
> 
> ------------+ all logs  +----------+ dhcpd logs  +------------+
> dhcp servers|---------->|log server|------------>|other server|----|
> ------------+           +----------+             +------------+    |
>                               ^                                    |
>                               |             all logs except dhcpd  |
>                               -------------------------------------|
> 
> This configuration has been in effect and working as expected for about
> 11 months now.
> 
> Approximately 2 weeks ago, I was reviewing my morning cronspam and
> discovered that /var had filled up on my log server. The dhcpd log was
> the obvious culprit, expanded to fill my entire log partition. I'm
> attaching sample entries so you can take a look if you are so inclined;
> I apologize for sanitizing out the data in the messages, but they're
> both protected data and not important to the discussion at hand.
> 
> There should be *no* dhcpd log messages originating on the log server.
> When logging is working properly, the host field in the entries properly
> reflect their dhcp servers of origin. When logging becomes fubar'd, I
> see a lot of messages with localhost in that field, all with increasing
> amounts of whitespace in them. syslog-ng spins the CPU to 100% and
(Continue reading)

Permalink | Reply | 0 comments |
headers
Hari Sekhon | 2 Jul 2007 12:11

One destination stopped logging?

Hi,

I've got syslog-ng on my mail server and today I noticed while trying to 
debug something else that there was nothing in the maillog. I thought 
this was very odd as there should be lots of stuff, so I checked 
syslog-ng was running. It was but I decided to restart it and then the 
maillog started to fill up again.

Now it's been several days since it's written anything to the mail log, 
but it has continued writing to the /var/log/messages destination during 
that time.

Here is my config:

options {
    chain_hostnames(off);
    sync(0);
    stats(43200);
    log_fifo_size(30000);
};
source src { unix-stream("/dev/log" max-connections(1000)); internal(); 
pipe("/proc/kmsg"); };
destination messages { file("/var/log/messages"); };
destination d_net { tcp("ip_to_logserver" port(logserver_port) ); };
destination maillog { file("/var/log/maillog"); };
destination mailerr { file("/var/log/mail.err"); };
filter f_mail { facility(mail); };
filter f_mailerr { facility(mail) and level(err); };
filter f_notmailjunk { not (program("postfix/*") and not level(err)); };
log { source(src); filter(f_mail); destination(maillog); };
(Continue reading)

Permalink | Reply | 5 comments |
headers
Balazs Scheidler | 2 Jul 2007 12:25
Picon

Re: One destination stopped logging?

On Mon, 2007-07-02 at 11:11 +0100, Hari Sekhon wrote:
> Hi,
> 
> I've got syslog-ng on my mail server and today I noticed while trying to 
> debug something else that there was nothing in the maillog. I thought 
> this was very odd as there should be lots of stuff, so I checked 
> syslog-ng was running. It was but I decided to restart it and then the 
> maillog started to fill up again.
> 
> Now it's been several days since it's written anything to the mail log, 
> but it has continued writing to the /var/log/messages destination during 
> that time.
> 
> Here is my config:
> 
> options {
>     chain_hostnames(off);
>     sync(0);
>     stats(43200);
>     log_fifo_size(30000);
> };
> source src { unix-stream("/dev/log" max-connections(1000)); internal(); 
> pipe("/proc/kmsg"); };
> destination messages { file("/var/log/messages"); };
> destination d_net { tcp("ip_to_logserver" port(logserver_port) ); };
> destination maillog { file("/var/log/maillog"); };
> destination mailerr { file("/var/log/mail.err"); };
> filter f_mail { facility(mail); };
> filter f_mailerr { facility(mail) and level(err); };
> filter f_notmailjunk { not (program("postfix/*") and not level(err)); };
(Continue reading)

Permalink | Reply | 2 comments |
headers
Hari Sekhon | 2 Jul 2007 13:16

Re: One destination stopped logging?

Yes I appreciate that you need debug info, but like I said it started 
working again after I restarted syslog-ng so there isn't really any 
opportunity for me strace the actual problem.

I know about getting logs from chroots, but this service is not 
chrooted, it should use the same logging socket as everything else.

Is it possible that one blocked destination could affect another, last I 
heard from you on this was that each destination was a separate line and 
if one blocked it would only block that one destination, ie each 
destination is independent, is that right?

If I can make this error reproducable then I'll try to get you some 
straces etc. and possibly a core dump.

Thanks

-h

Hari Sekhon

Balazs Scheidler wrote:
> On Mon, 2007-07-02 at 11:11 +0100, Hari Sekhon wrote:
>   
>> Hi,
>>
>> I've got syslog-ng on my mail server and today I noticed while trying to 
>> debug something else that there was nothing in the maillog. I thought 
>> this was very odd as there should be lots of stuff, so I checked 
>> syslog-ng was running. It was but I decided to restart it and then the
(Continue reading)

Permalink | Reply | 1 comment |
headers
Balazs Scheidler | 2 Jul 2007 15:04
Picon

Re: One destination stopped logging?

On Mon, 2007-07-02 at 12:16 +0100, Hari Sekhon wrote:
> Yes I appreciate that you need debug info, but like I said it started 
> working again after I restarted syslog-ng so there isn't really any 
> opportunity for me strace the actual problem.
> 
> I know about getting logs from chroots, but this service is not 
> chrooted, it should use the same logging socket as everything else.
> 
> Is it possible that one blocked destination could affect another, last I 
> heard from you on this was that each destination was a separate line and 
> if one blocked it would only block that one destination, ie each 
> destination is independent, is that right?

I don't really remember the context where I said that. Destinations are
really somewhat independent (they use a different transport state), but
otherwise I never saw one destination to stall while all the others
work.

> 
> If I can make this error reproducable then I'll try to get you some 
> straces etc. and possibly a core dump.

thanks.

--

-- 
Bazsi

_______________________________________________
syslog-ng maillist  -  syslog-ng <at> lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
(Continue reading)

Permalink | Reply | 0 comments |
headers
anthony lineham | 2 Jul 2007 23:22
Picon
Favicon

Re: AF_INET client dropped connection

When you say "use the reload functionality" are you refering to SIGHUP?
Or,
is there another method of triggering a reload.

Thanks 
Anthony

>>> Balazs Scheidler <bazsi <at> balabit.hu> 07/02/07 7:01 PM >>> 
On Thu, 2007- 06- 28 at 12:42 +0200, Pol Moal wrote:
> Hi,
> 
> when I restart syslog- ng on a client, the loghost prints these
lines:
> 
> Jun 28 12:28:38 loghost syslog- ng[7068]: AF_INET client dropped
connection from w.x.y.z, port 38171
> 
> Jun 28 12:28:39 loghost syslog- ng[7068]: AF_INET client connected
from w.x.y.z, port 38040
> 
> Do I lose some information from the client? If yes, what can I do?

If you restart syslog- ng, then 

1) some messages might arrive while syslog- ng itself is stopped.
These
messages are lost. 

2) the messages that had been been accumulated in syslog- ng's output
buffers can also be lost.
(Continue reading)

Permalink | Reply | 1 comment |
headers
Evan Rempel | 3 Jul 2007 02:05
Picon
Picon
Favicon

Re: One destination stopped logging?

In the syslong-ng 1.6.x series, there is no "reopen" mchanism for disk based files
that become closed. The question is how they get closed.

If they are closed due to an idle timeout (all syslog destinations do this I think),
then when a new message to that destination is processed, the destination will be reopened,
even disk files.

If the disk file was closed due to an error (IO error of some kind), then the file is
never reopened, unless the destination goes through an idle timeout and reopen sequence.

In all cases a reload/restart of syslog-ng causes all destinations to be closed and reopened.

I have seen cases where a busy destination (ours was mail, just like yours) becomes closed due
to a full filesystem. No other destinations became closed because they did not have messages
processed during the interval when the filesystem was full. Something occurs to free up some space
on the filesystem, so new messages all get processed correctly, however, the mail destination never
became idel, but was never opened again.

I would really like to have file destinations handled just like network destination and
adhere to the reopen configuration setting.

I am not sure how the syslog-ng 2.0.x series behaves in these circumstances.

Evan Rempel.

Hari Sekhon wrote:
> Hi,
> 
> I've got syslog-ng on my mail server and today I noticed while trying to 
> debug something else that there was nothing in the maillog. I thought
(Continue reading)

Permalink | Reply | 1 comment |

Gmane