Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
syslog-ng-3.7.2 has broken timestamps (again)
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3647
Location: Hamburg

PostPosted: Sun Nov 22, 2015 9:33 pm    Post subject: syslog-ng-3.7.2 has broken timestamps (again) Reply with quote

Damn, now I'm really annoyed that this issue appears again : 2 different time stamps for the same event in 2 different files:
Code:
log # grep SYN *log
kern.log:Nov 20 22:26:29 tor-relay kernel: [2431358.124515] TCP: request_sock_TCP: Possible SYN flooding on port 80. Sending cookies.  Check SNMP counters.
syslog:Nov 20 22:02:34 tor-relay kernel: TCP: request_sock_TCP: Possible SYN flooding on port 80. Sending cookies.  Check SNMP counters.
/me wonders which logger is worth to switch to it ? After running twice into this mess within 1 year I can't now any longer trust into the Balabit company and their software any longer.

I'm looking especially for a logger which have the capability to grep for patterns and write the matching log entries into dedicated files.


Last edited by toralf on Fri Jan 22, 2016 9:13 pm; edited 3 times in total
Back to top
View user's profile Send private message
Anon-E-moose
Advocate
Advocate


Joined: 23 May 2008
Posts: 3690
Location: Dallas area

PostPosted: Sun Nov 22, 2015 9:39 pm    Post subject: Reply with quote

syslog-ng does search for patterns.

From my syslog-ng.conf

destination iptables { file("/var/log/firewall" perm(0640)); };
...
filter f_iptables { match("IPTABLES:" value("MESSAGE")); };
...
log { source(src); filter(f_iptables); destination(iptables); };

filter f_messages { level(info..emerg) and not filter (f_iptables) and not filter (f_smartd) and not facility(cron, mail, auth, authpriv); };
_________________
Asus m5a99fx, FX 8320 - nouveau & radeon, oss4
Acer laptop E5-575, i3-7100u - i965, alsa
---both---
4.14.62 kernel, profile 17.0 (no-pie) amd64-no-multilib
gcc 7.3.0, eudev, openrc, openbox, palemoon
Back to top
View user's profile Send private message
UberLord
Retired Dev
Retired Dev


Joined: 18 Sep 2003
Posts: 6737
Location: Blighty

PostPosted: Mon Nov 23, 2015 5:04 am    Post subject: Reply with quote

To me, it looks like the same event at different times, so it's fine? (From a syslog POV).
For BSD at least, the syslog(3) call is made in libc where the date/time part is formatted before sending to the syslog socket.
If we assume that glibc is the same, then changing the logger will have zero effect.
_________________
Use dhcpcd for all your automated network configuration needs
Use dhcpcd-ui (GTK+/Qt) as your System Tray Network tool
Back to top
View user's profile Send private message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3647
Location: Hamburg

PostPosted: Mon Nov 23, 2015 1:05 pm    Post subject: Reply with quote

UberLord wrote:
To me, it looks like the same event at different times, so it's fine? (From a syslog POV).
For BSD at least, the syslog(3) call is made in libc where the date/time part is formatted before sending to the syslog socket.
If we assume that glibc is the same, then changing the logger will have zero effect.
Well, in this case the timestamps are wrong, upstream confirmed it https://github.com/balabit/syslog-ng/issues/766#issuecomment-158874323

But the origin question is still - which *other* logger fits my needs ?
Back to top
View user's profile Send private message
toralf
Developer
Developer


Joined: 01 Feb 2004
Posts: 3647
Location: Hamburg

PostPosted: Fri Jan 22, 2016 9:07 pm    Post subject: Reply with quote

3.7.2 - same mess : http://www.zwiebeltoralf.de/pub/syslog-ng-3.7.2-mess.txt
/me needs a good logger which has filter capabilities
Back to top
View user's profile Send private message
Syl20
Guru
Guru


Joined: 04 Aug 2005
Posts: 550
Location: France

PostPosted: Mon Jan 25, 2016 5:27 pm    Post subject: Reply with quote

Rsyslog is a little more rustic, but you can set filters too.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum