<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p>Hi Laszlo,</p>
<p>Have you been able to get this to work? I am in exactly the same position as Simon - I need the ability to parse Linux audit logs in syslog-ng.
<br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> syslog-ng <syslog-ng-bounces@lists.balabit.hu> on behalf of Laszlo Budai <laszlo.budai@outlook.com><br>
<b>Sent:</b> Saturday, November 5, 2016 1:59:09 PM<br>
<b>To:</b> Syslog-ng users' and developers' mailing list<br>
<b>Subject:</b> Re: [syslog-ng] unable to install syslog-ng ubuntu 16.04</font>
<div> </div>
</div>
<div>
<div id="compose" contenteditable="true" style="padding-left: 16px; padding-right: 16px; padding-bottom: 8px;">
Hi,</div>
<div id="compose" contenteditable="true" style="padding-left: 16px; padding-right: 16px; padding-bottom: 8px;">
in docker it is not working... </div>
<div id="compose" contenteditable="true" style="padding-left: 16px; padding-right: 16px; padding-bottom: 8px;">
I'll try to fix this issue. </div>
<div id="compose" contenteditable="true" style="padding-left: 16px; padding-right: 16px; padding-bottom: 8px;">
<br>
</div>
<div id="compose" contenteditable="true" style="padding-left: 16px; padding-right: 16px; padding-bottom: 8px;">
regards,</div>
<div id="compose" contenteditable="true" style="padding-left: 16px; padding-right: 16px; padding-bottom: 8px;">
Laszlo Budai</div>
<div id="compose" contenteditable="true" style="padding-left: 16px; padding-right: 16px; padding-bottom: 8px;">
<br>
</div>
<div class="gmail_quote">_____________________________<br>
From: Scheidler, Balázs <<a dir="ltr" href="mailto:balazs.scheidler@balabit.com" x-apple-data-detectors="true" x-apple-data-detectors-type="link" x-apple-data-detectors-result="0">balazs.scheidler@balabit.com</a>><br>
Sent: Saturday, November 5, 2016 9:21 AM<br>
Subject: Re: [syslog-ng] unable to install syslog-ng ubuntu 16.04n <br>
To: László Budai <<a dir="ltr" href="mailto:lbudai@balabit.hu" x-apple-data-detectors="true" x-apple-data-detectors-type="link" x-apple-data-detectors-result="1">lbudai@balabit.hu</a>>, Syslog-ng users' and developers' mailing list <<a dir="ltr" href="mailto:syslog-ng@lists.balabit.hu" x-apple-data-detectors="true" x-apple-data-detectors-type="link" x-apple-data-detectors-result="2">syslog-ng@lists.balabit.hu</a>><br>
<br>
<br>
<meta content="text/html; charset=utf-8">
<div dir="ltr">
<div>
<div>
<div>
<div>Indeed, I think the problem is that syslog-ng core depends on syslog-ng-mod-journal, which recursively depends on syslog-ng-core through a Provides line.<br>
<br>
</div>
Hmm.. the funny part that a week ago I successfully installed the same package on one of my servers, but now in a clean docker container I couldn't do that.<br>
<br>
</div>
I have a workaround, attached you'll find an equivs compatible control file, that provides the missing dependency, once that is installed, "apt-get install syslog-ng" works.<br>
<br>
</div>
It goes like this:<br>
</div>
<br>
<div>
<div># dpkg -i syslog-ng-abi-3.8-0_3.8.1-1_all.deb <br>
Selecting previously unselected package syslog-ng-abi-3.8-0.<br>
(Reading database ... 7256 files and directories currently installed.)<br>
Preparing to unpack syslog-ng-abi-3.8-0_3.8.1-1_all.deb ...<br>
Unpacking syslog-ng-abi-3.8-0 (3.8.1-1) ...<br>
Setting up syslog-ng-abi-3.8-0 (3.8.1-1) ...<br>
</div>
<div># apt-get install syslog-ng-core<br>
Reading package lists... Done<br>
Building dependency tree <br>
Reading state information... Done<br>
The following additional packages will be installed:<br>
cron libevtlog0 libffi6 libglib2.0-0 libglib2.0-data libicu55 libivykis0 libnet1 libpopt0 libssl1.0.0 libwrap0 libxml2 logrotate sgml-base<br>
shared-mime-info syslog-ng-mod-journal tcpd xdg-user-dirs xml-core<br>
Suggested packages:<br>
anacron checksecurity exim4 | postfix | mail-transport-agent mailx sgml-base-doc syslog-ng-mod-sql syslog-ng-mod-mongodb syslog-ng-mod-json<br>
syslog-ng-mod-smtp syslog-ng-mod-amqp syslog-ng-mod-geoip syslog-ng-mod-redis syslog-ng-mod-stomp syslog-ng-mod-riemann syslog-ng-mod-graphite<br>
syslog-ng-mod-python syslog-ng-mod-java syslog-ng-mod-java-common-lib syslog-ng-mod-elastic syslog-ng-mod-hdfs syslog-ng-mod-kafka syslog-ng-mod-http<br>
syslog-ng-mod-curl syslog-ng-mod-kvformat syslog-ng-mod-add-contextual-data debhelper<br>
The following NEW packages will be installed:<br>
cron libevtlog0 libffi6 libglib2.0-0 libglib2.0-data libicu55 libivykis0 libnet1 libpopt0 libssl1.0.0 libwrap0 libxml2 logrotate sgml-base<br>
shared-mime-info syslog-ng-core syslog-ng-mod-journal tcpd xdg-user-dirs xml-core<br>
0 upgraded, 20 newly installed, 0 to remove and 11 not upgraded.<br>
Need to get 11.9 MB of archives.<br>
After this operation, 49.5 MB of additional disk space will be used.<br>
Do you want to continue? [Y/n] <br>
<br>
</div>
<div><br>
</div>
<div>The "syslog-ng-core" package only contains a subset of the syslog-ng package, pulling in a smaller set of dependencies, whereas syslog-ng is the full set.<br>
<br>
</div>
<div>The abi package here is just a fake one, I'll make sure this packaging issue gets fixed.<br>
</div>
<div><br>
</div>
</div>
</div>
<div class="gmail_extra"><br>
<div>
<div class="gmail_signature">
<div dir="ltr">-- <br>
Bazsi<br>
</div>
</div>
</div>
<br>
<div class="gmail_quote">On Thu, Nov 3, 2016 at 10:25 PM, Simon Smith <span dir="ltr">
<<a href="mailto:simonsmith5521@gmail.com">simonsmith5521@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">Hi All
<div><br>
</div>
<div>has anyone been able to install syslog-ng 3.8 successfully on ubuntu 16.04 ?</div>
<div><br>
</div>
<div>I’m using the link from the mailing list a few months ago but again no luck - <a href="http://lists.balabit.hu/pipermail/syslog-ng/2016-August/023150.html">http://lists.balabit.hu/<wbr>pipermail/syslog-ng/2016-<wbr>August/023150.html</a></div>
<div><br>
</div>
<div>no matter what packages i try to install it just won’t work</div>
<div><br>
</div>
<div>any ideas?</div>
<div><br>
</div>
<div>
<div>root@syslog:~# apt-get install syslog-ng</div>
<div>Reading package lists... Done</div>
<div>Building dependency tree </div>
<div>Reading state information... Done</div>
<div>Some packages could not be installed. This may mean that you have</div>
<div>requested an impossible situation or if you are using the unstable</div>
<div>distribution that some required packages have not yet been created</div>
<div>or been moved out of Incoming.</div>
<div>The following information may help to resolve the situation:</div>
<div><br>
</div>
<div>The following packages have unmet dependencies:</div>
<div> syslog-ng : Depends: syslog-ng-core (>= 3.8.1) but it is not going to be installed</div>
<div> Depends: syslog-ng-mod-sql but it is not going to be installed</div>
<div> Depends: syslog-ng-mod-mongodb but it is not going to be installed</div>
<div> Depends: syslog-ng-mod-json but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-journal but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-smtp but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-amqp but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-geoip but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-redis but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-stomp but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-riemann but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-graphite but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-python but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-java but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-java-common-lib but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-elastic but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-hdfs but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-kafka but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-http but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-curl but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-kvformat but it is not going to be installed</div>
<div> Recommends: syslog-ng-mod-add-contextual-<wbr>data but it is not going to be installed</div>
<div>E: Unable to correct problems, you have held broken packages.</div>
<div>root@syslog:~# apt-get install syslog-ng-core</div>
<div>Reading package lists... Done</div>
<div>Building dependency tree </div>
<div>Reading state information... Done</div>
<div>Some packages could not be installed. This may mean that you have</div>
<div>requested an impossible situation or if you are using the unstable</div>
<div>distribution that some required packages have not yet been created</div>
<div>or been moved out of Incoming.</div>
<div>The following information may help to resolve the situation:</div>
<div><br>
</div>
<div>The following packages have unmet dependencies:</div>
<div> syslog-ng-core : Depends: syslog-ng-mod-journal but it is not going to be installed</div>
<div>E: Unable to correct problems, you have held broken packages.</div>
<div>root@syslog:~# apt-get install syslog-ng-mod-journal</div>
<div>Reading package lists... Done</div>
<div>Building dependency tree </div>
<div>Reading state information... Done</div>
<div>Some packages could not be installed. This may mean that you have</div>
<div>requested an impossible situation or if you are using the unstable</div>
<div>distribution that some required packages have not yet been created</div>
<div>or been moved out of Incoming.</div>
<div>The following information may help to resolve the situation:</div>
<div><br>
</div>
<div>The following packages have unmet dependencies:</div>
<div> syslog-ng-mod-journal : Depends: syslog-ng-abi-3.8-0 but it is not installable</div>
<div>E: Unable to correct problems, you have held broken packages.</div>
<div>root@syslog:~# apt-get install syslog-ng syslog-ng-core syslog-ng-mod-sql syslog-ng-mod-mongodb syslog-ng-mod-json syslog-ng-mod-journal</div>
</div>
<div>
<div>Reading package lists... Done</div>
<div>Building dependency tree </div>
<div>Reading state information... Done</div>
<div>Some packages could not be installed. This may mean that you have</div>
<div>requested an impossible situation or if you are using the unstable</div>
<div>distribution that some required packages have not yet been created</div>
<div>or been moved out of Incoming.</div>
<div>The following information may help to resolve the situation:</div>
<div><br>
</div>
<div>The following packages have unmet dependencies:</div>
<div> syslog-ng-mod-journal : Depends: syslog-ng-abi-3.8-0 but it is not installable</div>
<div> syslog-ng-mod-json : Depends: syslog-ng-abi-3.8-0 but it is not installable</div>
<div> syslog-ng-mod-mongodb : Depends: syslog-ng-abi-3.8-0 but it is not installable</div>
<div> syslog-ng-mod-sql : Depends: syslog-ng-abi-3.8-0 but it is not installable</div>
<div>E: Unable to correct problems, you have held broken packages.</div>
<div>root@syslog:~# </div>
</div>
<div><br>
</div>
<div>regards</div>
<div><br>
</div>
<div>Simon - Hestor Ltd</div>
</div>
<br>
______________________________<wbr>______________________________<wbr>__________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/<wbr>mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">
http://www.balabit.com/<wbr>support/documentation/?<wbr>product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/<wbr>syslog-ng-faq</a><br>
<br>
<br>
</blockquote>
</div>
<br>
</div>
<br>
<br>
</div>
</div>
</body>
</html>