<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Palatino Linotype";
panose-1:2 4 5 2 5 5 5 3 3 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Hi all,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>We found that the following rewrite caused the issue. We commented this part, and it was not giving any issue. <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>But we need this rewrite option to be available. <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Can somebody let us know if this got changed in </span><b><span style='color:#1F497D'>syslog-ng-3.4.0alpha2 ? Any suggestions ? </span></b><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>#rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));};<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Thanks<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Hithendra<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] <b>On Behalf Of </b>ext anju.raveendrannair@wipro.com<br><b>Sent:</b> Friday, June 08, 2012 5:16 PM<br><b>To:</b> syslog-ng@lists.balabit.hu<br><b>Subject:</b> [syslog-ng] syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance.<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'>We are using syslog-ng-3.4.0alpha2 binary and trying to run the syslog-ng server configuration file, but its not starting the syslog ng server. <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>We are getting the following error incase of f__nonconsole_access filter when we ran the syslog-ng binary in debug mode.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='color:red'>Filter rule evaluation result; result='match', rule='f_nonconsole_access', location='/ne_data/conf/syslogng/syslog-ng_server.conf:58:29'<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:red'>**<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:red'>ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self))<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:red'>Abort (core dumped)<o:p></o:p></span></b></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>PFA the debug.log<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>The server conf is having the following line for the above mentioned filter,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='color:#4F6228'>template ltemgr_msg_template { template("$S_ISODATE $HOST $FACILITY_NUM/$LEVEL_NUM $MSG\n"); };<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'><o:p> </o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'>#To strip of the msg_id introduced by syslogd<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'>rewrite rw_msg{subst("<a href="file:///\\[.*\%5d">\\[.*\\]</a>", "", value("MESSAGE"));};<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'><o:p> </o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'>source s_LTEMGR_SYSLOG_CLIENTS{ tcp (ip (27.132.98.69) port(6515) max-connections(4)<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'> tls(<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'> key_file("/ne_data/conf/certificates/MOCM/MOCM_key.pem")<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'> cert_file("/ne_data/conf/certificates/MOCM/MOCM_SB_server.pem")<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'> ca_dir("/ne_data/conf/certificates/SYSLOGNG")<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'> cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SSLv2")<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'> peer_verify(optional-untrusted)<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'> )<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'> );<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'>};<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'>…….<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'><o:p> </o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'>destination d_ltemgr_nonconsoleaccess_log {file("/ne_data/syslog/ems" perm(0644) template(ltemgr_msg_template)); };<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'>……<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'>filter f_nonconsole_access { level(info..notice) and facility(auth) and ( match("Accepted password for" value("MESSAGE")) or match("Failed password for" value("MESSAGE")) ); };<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'>…..<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:#4F6228'>log { source(s_LTEMGR_SYSLOG_CLIENTS); filter(f_nonconsole_access); rewrite(rw_msg); destination(d_ltemgr_nonconsoleaccess_log); };<o:p></o:p></span></b></p><p class=MsoNormal><b><span style='color:red'><o:p> </o:p></span></b></p><p class=MsoNormal><span style='color:#1F497D'>Without debug mode, we were able to run the server but central logging is not happening when tried with logger command.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Thanks,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Anju<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p><strong><span style='font-size:10.0pt;font-family:"Palatino Linotype","serif";color:green'>Please do not print this email unless it is absolutely necessary. </span></strong><span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p><p>The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. <o:p></o:p></p><p>WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. <o:p></o:p></p><p><a href="http://www.wipro.com">www.wipro.com</a> <o:p></o:p></p></div></body></html>