(Tentatively Solved) syslog-ng spamming general log once per minute

[mimugmail]

I try to open a bug report at syslog-ng

[Koldnitz]

This morning I decided to try and implement MTR's solution to syslog-ng's spamming of the general log.

I was unable to get it to work (I am sure I copied / pasted something wrong or misunderstood his instructions).

I think you can also just add "message('Destination timeout has elapsed, closing connection; fd=')" at the end of the exclude line.

I saw this piece of advice, and looked at the config file a bit.

Through trial and error I seem to have gotten his suggestion to work.

/usr/local/opnsense/service/templates/OPNsense/Syslog/syslog-ng-local.conf

Code: [Select]

################################################################################
# not captured elsewhere, but relevant, send to system[__].log
################################################################################
filter f_local_system {
    not filter({{ all_filters|join(') and not filter(') }})
    and level(notice..emerg)
    and not message('Destination timeout has elapsed, closing connection; fd=')
};

destination d_local_system {
    file(
        "/var/log/system/system_${YEAR}${MONTH}${DAY}.log"
        create-dirs(yes)
    );
};

log {
    source(s_all);
    filter(f_local_system);
    destination(d_local_system);
};

{% endif %}

Please note the line: and not message('Destination timeout has elapsed, closing connection; fd=')

Everything seems to work (not seeing any of these annoying messages for 20 minutes and counting).

I had to start and stop the syslog-ng service to get these changes to take effect (I believe MTR noted the same thing).

I hope this helps someone.

Cheers,

[AlexAchileus]

/usr/local/opnsense/service/templates/OPNsense/Syslog/syslog-ng-local.conf

Code: [Select]

################################################################################
# not captured elsewhere, but relevant, send to system[__].log
################################################################################
filter f_local_system {
    not filter({{ all_filters|join(') and not filter(') }})
    and level(notice..emerg)
    and not message('Destination timeout has elapsed, closing connection; fd=')
};

destination d_local_system {
    file(
        "/var/log/system/system_${YEAR}${MONTH}${DAY}.log"
        create-dirs(yes)
    );
};

log {
    source(s_all);
    filter(f_local_system);
    destination(d_local_system);
};

{% endif %}

I hope this helps someone.

Cheers,

Yes, it did! Many thanks

[dinguz]

If this works, please consider taking this upstream with the project, and/or with the OPNsense team for inclusion. It would make logs so much more readable.

[ivwang]

The exclusion configuration line works for me, wish I had known or figured out the trick earlier
Now my log finally makes sense again, and SSD’s life expectancy is not wasted on these spams
And yes Opnsense team please make it into the next release, even it’s just a stopgap rather than fix.

Cheers,
Ivan

[mimugmail]

syslog-ng will fix this in next version, unsure when it arrives (also in OPNsense):
https://github.com/syslog-ng/syslog-ng/issues/3506

[franco]

Good to know... 3.30 is already queued up for 20.7.6.


Cheers,
Franco