[SOLVED] Query global values of syslog-ng

linxbee · 01-17-2021, 09:46 AM

I am new to syslog, but i know we can specify some global parameters for syslog-ng using

Code:

options {  };

log-msg-size option is used to specify maximum length of a message in bytes

I would like to know what is the default value that is set in my system.

How do i query syslog-ng for the value log-msg-size

Is there any way using either in C program or Python to query the log-msg-size

One more question, Is there any way to restart the syslog-ng from its global options in case if it crashes?

shruggy · 01-19-2021, 02:26 AM

How about

Code:

sudo syslog-ng-ctl config -p|
  sed -n '/^\s*#/d;/options\s*{/,/}/{
    s/.*log_msg_size\s*(\(\w*\));.*/\1/p;T;q};$s/.*/65536/p'

or (provided log_msg_size is a global option only) just

Code:

sudo syslog-ng-ctl config -p|
  grep -Po '[^#]*log_msg_size\s*\(\K\d+'||echo 65536

If you have syslog-ng 3.23 or newer, you may replace

Code:

sudo syslog-ng-ctl config -p

with

Code:

syslog-ng --preprocess-into=/dev/stdout

Quote:

Originally Posted by linxbee

Is there any way to restart the syslog-ng from its global options in case if it crashes?

I don't quite understand the question. If your distro uses systemd then syslog-ng ships with a service unit:

Code:

$ systemctl list-unit-files syslog-ng\*
UNIT FILE         STATE
syslog-ng.service enabled

1 unit files listed.

Otherwise, it probably has an init script (/etc/init.d/syslog-ng).

To just reload config, run syslog-ng-ctl reload. Or send the HUP signal.

linxbee · 01-19-2021, 11:36 PM

Hi Shruggy,
I have tried the commands you suggested, but looks like the command is not supported or enabled.
My syslog-ng version is 3.5.4.1.

Code:

root@TGT:~# syslog-ng-ctl config
Unknown command
Syntax: syslog-ng-ctl <command> [options]
Possible commands are:
    stats                Get syslog-ng statistics in CSV format
    verbose              Enable/query verbose messages
    debug                Enable/query debug messages
    trace                Enable/query trace messages
    stop                 Stop syslog-ng process
    reload               Reload syslog-ng
    reopen               Re-open of log destination files
    query                Query syslog-ng statistics. Possible commands: list, get, get --sum
    show-license-info    Show information about the license
    credentials          Credentials manager

may be the version does not support the command , is there anyway i can still get the config info in this version.

And regarding my question about restarting the syslog-ng upon crash, yes you are right.
I have "/etc/init.d/syslog-ng" script in which "start|stop|reload|restart" are handled.

But the problem is :
I have to run them manually(as /etc/init.d/syslog-ng reload) to restart or reload syslog. I am looking for a way to restart as soon as it gets killed.

we can do that from inittab respawn, but is there any way from syslog itself.
In syslog global options there is an option time-reopen(), what exactly it is used for?

shruggy · 01-20-2021, 03:59 AM

Quote:

Originally Posted by linxbee

is there anyway i can still get the config info in this version.

Code:

#!/bin/sh

[ 0 = "$(id -u)" ] ||
  { echo You need to be root to perform this. >&2; exit 1;}

pipe="$(mktemp -u ${TMPDIR:-/tmp}/pipe.XXXXXX)"
trap "rm -f '$pipe'" EXIT HUP INT QUIT TERM
mkfifo "$pipe"
sed -n '$s/.*/8192/p;/^\s*#/d;/options\s*{/,/}/{
  s/.*log_msg_size\s*(\(\w*\));.*/\1/p;T;q}' "$pipe" &
syslog-ng --preprocess-into="$pipe" 2>/dev/null

Quote:

Originally Posted by linxbee

I am looking for a way to restart as soon as it gets killed.

With SysVInit, respawning from inittab is the right thing to do.

What distro are you using? syslog-ng 3.5.4.1 is from around 2014. One common distribution that shipped with this version is Ubuntu 14.10 (Utopic Unicorn), long discontinued, BTW. That was the last Ubuntu release using Upstart. Around that time many major Linux distros started to adopt systemd. Otherwise, I can only think of specialized distros like Endian Firewall 3.3.2. DigitalOcean has an excellent tutorial describing how to do this for all common init systems.

Aside from the init systems, there are several tools capable of doing this: supervise from daemontools, monit, restartd.

Quote:

Originally Posted by linxbee

In syslog global options there is an option time-reopen(), what exactly it is used for?

From the Administration Guide:

Quote:

The time to wait in seconds before a dead connection is reestablished.

This is for version 3.16, but seriously, you ought to download the Guide for your version and read it up.

linxbee · 01-21-2021, 11:24 AM

Shruggy, sorry for the late reply.

I have tried the script you posted and got output as 8192, but I don't understand how its working and not sure that's correct value.

If 8192 is replaced by some other value , then the replaced value is coming as output.

About the restart, I actually have a problem where syslog-ng is not starting on boot sometimes.

The reason, I believe for that problem is , syslog-ng by default making use of "/var/lib/syslog-ng/syslog-ng.ctl" path as its control_path, in my configuration i could not find out when that path("/var/lib/syslog-ng") is getting created.

So my guess is syslog-ng is working in case if the path is available by the time syslog starts, not working if it does not, so i created the path manually before launching syslog-ng, i can see this is working always, but not really sure that's the cause.

That is the main reason i wanted a way to restart in case if syslog-ng fails to start on boot-up.

Below is the error i see, when it does not start, any idea about the error?

Quote:

syslog-ng[1762]: Error opening control socket, bind() failed; socket='/var/lib/syslog-ng/syslog-ng.ctl', error='Permission denied (13)'

shruggy · 01-21-2021, 12:00 PM

Quote:

Originally Posted by linxbee

If 8192 is replaced by some other value , then the replaced value is coming as output.

8192 is the default value for log_msg_size taken from The syslog-ng OSE 3.5 Administrator Guide. The script outputs it if log_msg_size was not redefined in /etc/syslog-ng/syslog-ng.conf or any files included from it.

Quote:

Originally Posted by linxbee

any idea about the error?

You didn't answer my question about your distribution. Does it use SELinux? See RHBZ#675032.

linxbee · 01-21-2021, 08:44 PM

My distribution details:
Its Yocto based Linux

Code:

# cat /etc/issue
Poky (Yocto Project Reference Distro) 2.0 \n \l
# uname -a
Linux CHB 3.2.48 #1 SMP Tue Mar 14 15:52:38 CET 2017 i686 GNU/Linux

shruggy · 01-22-2021, 04:52 AM

Check if SELinux is enabled:

Code:

sestatus

If it is, see the bug report I linked above.

linxbee · 01-27-2021, 02:00 AM

I don't have

Code:

sestatus

enabled on my target.

The link you referred to looks like very old.

In that it is mentioned

Quote:

1. install a recent syslog-ng (like 3.1.1

we are already on 3.5

nevertheless, all the information you provided is very use full to me.

Going forward, I have already shared you some info regarding my problem of syslog not generating logs some times on boot because of its standard path (/var/lib/syslog-ng)(not knowing when that is getting created before/after syslog-ng sometimes).

As a remedy, I am using my own path for ".ctl" and ".pid" creation and problem is resolved now.

But I have some other problem, since you are the only the one responding for syslog-ng issues, I am gonna request you and ask few more questions.

So, Shall I mark this solved and raise a new question or shall I ask here.

Please let me know.

shruggy · 01-27-2021, 02:43 AM

Open a new thread then. But actually, I'm not in position to answer anything about syslog-ng as I don't use it.

linxbee · 01-27-2021, 02:53 AM

Thanks shruggy, I will check my luck here, you have been so helpfull.