syslog-ng-users April 2011 archive
Main Archive Page > Month Archives  > syslog-ng-users archives
syslog-ng-users: Re: [syslog-ng] Solaris 10 UDP overflows, messa

Re: [syslog-ng] Solaris 10 UDP overflows, message drops

From: <sramesh.kumar_at_nospam>
Date: Wed Apr 27 2011 - 07:10:21 GMT
To: <>

Hi All,

Can any body help me. Please?????
I hve configured syslog-ng in X86 server. Bellow is the configuration.
But Logs are not coming under /syslog-ng folder.....if I am wrong in
bellow configuration, can you Please Provide step by step configuration
Procedure to configure the same...

# cat /etc/syslog-ng/syslog-ng.conf
options {
sync (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (yes);
keep_hostname (yes);
source s_sys {
file ("/proc/kmsg" log_prefix("kernel: "));
sun-stream ("/dev/log");

# External Source
source s_ext

# Standard Syslog
udp(); # All interfaces
tcp(); # All interfaces on tcp port
destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/adm/messages"); };
destination d_mail { file("/var/log/syslog"); };
destination d_auth { file("/var/log/authlog"); };
destination d_mlop { usertty("operator"); };
destination d_mlrt { usertty("root"); };
destination d_mlal { usertty("*"); };
destination d_ext
owner(root) group(root) perm(0650) dir_perm(0750) create_dirs(yes));


filter f_filter1 { level(err) or
                     (level(notice) and facility (auth, kern)); };
filter f_filter2 { level(err) or
                     (facility(kern) and level(notice)) or
                     (facility(daemon) and level(notice)) or
                     (facility(mail) and level(crit)); };
filter f_filter3 { level(alert) or
                     (facility(kern) and level(err)) or
                     (facility(daemon) and level(err)); };
filter f_filter4 { level(alert); };
filter f_filter5 { level(emerg); };
filter f_filter6 { facility(kern) and level(notice); };
filter f_filter7 { facility(mail) and level(debug); };
filter f_filter8 { facility(user) and level(err); };
filter f_filter9 { facility(user) and level(alert); };

log { source(s_sys); filter(f_filter1); destination(d_cons); };
log { source(s_sys); filter(f_filter2); destination(d_mesg); };
log { source(s_sys); filter(f_filter3); destination(d_mlop); };
log { source(s_sys); filter(f_filter4); destination(d_mlrt); };
log { source(s_sys); filter(f_filter5); destination(d_mlal); };
log { source(s_sys); filter(f_filter6); destination(d_auth); };
log { source(s_sys); filter(f_filter7); destination(d_mail); };
log { source(s_sys); filter(f_filter8); destination(d_cons);
                                        destination(d_mesg); };

log { source(s_ext); destination(d_ext); };
# isainfo -kv
64-bit amd64 kernel modules
# cat /etc/release
                       Solaris 10 10/08 s10x_u6wos_07b X86
           Copyright 2008 Sun Microsystems, Inc. All Rights Reserved.
                        Use is subject to license terms.
                            Assembled 27 October 2008
# pkginfo -l SMCsyslng
   PKGINST: SMCsyslng
      NAME: syslogng
  CATEGORY: application
      ARCH: x86
   VERSION: 2.0.5
   BASEDIR: /usr/local
    VENDOR: BalaBit IT Ltd
    PSTAMP: Steve Christensen
  INSTDATE: Apr 20 2011 16:24
    STATUS: completely installed
     FILES: 64 installed pathnames
                   3 shared pathnames
                  15 directories
                   2 executables
                2163 blocks used (approx)

-----Original Message-----
[] On Behalf Of Mishou Michael
Sent: Tuesday, April 26, 2011 11:28 PM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] Solaris 10 UDP overflows, message drops


Thanks for any testing you can do. I'm not sure if a SPARC processor is
an important testing component or not, I suppose your VMs will help
determine this since you'll be using x86. If there's any testing I can
do to help things along, please let me know.

Yes, I'm (very) scared of rsyslog as a maintainable solution, the
configs for syslog-ng are *so* much easier to read and understand. I'll
try 3.3 and report back how threading helps things out, I'm glad to hear
that it's been pretty stable for you, that was my major concern in
testing 3.3 since eventually we'll need this to be in production with
our basic (from a config complexity standpoint) requirements.

I'll report back how 3.3 works out for me after I get it compiled and up



-----Original Message-----
[] On Behalf Of Gergely Nagy
Sent: Tuesday, April 26, 2011 12:19 PM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] Solaris 10 UDP overflows, message drops

(A few preliminary answers follow - I'll have another look at this later
tonight from home, once I tested a few things on my local solaris vm)

"Mishou Michael" <> writes:

> I'm going to experiment with syslog-ng and the loggen tool to find a
> point at which a single syslog-ng instance starts dropping inbound UDP
> traffic with a simple configuration writing to disk. Once I have that
> number, I have a few options:
> 1. Experiment with syslog-ng 3.3 and the new threaded code to see if
> have performance gains. I'm hesitant to push Alpha code in
> if anyone has any experience with 3.3 in semi-production environment
> running consistently I'd love to hear it.

I've been running 3.3 on most systems I administer (2 of my own servers
+ a few I administer for friends; and all of my virtual machines). It's
been serving me fine for the past 4 months now.

However, most of my systems are also linux systems, where syslog-ng is
much better tested (and I'm not using UDP at all).

Personally, I'd give it a test run, as current 3.3 is fairly stable.

> 3. Give up on syslog-ng until 3.3, or move to some other solution.
> sure what I could do here, rsyslog is the other major contender I
> not sure what gains I would get. Could also do native syslog server
> post-process to different buckets/relay which is what we mainly use
> syslog-ng for.

I wouldn't consider rsyslog. It's a nightmare to maintain that, and an
even bigger nightmare to get it to perform well in any but the most
trivial situations. (Or it might be just me being too used to good
documentation and readable config files, but I'm fairly sure it's not
just that :P)

-- |8] ________________________________________________________________________ ______ Member info: Documentation: FAQ: ________________________________________________________________________ ______ Member info: Documentation: FAQ: Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. ______________________________________________________________________________ Member info: Documentation: FAQ: