January 2001 - syslog-ng - lists.balabit.hu

another documentation error (or bug?)
by Wiktor Wodecki 11 Jan '01

11 Jan '01

Hello, I'm not quite sure whether this is a bug or another documentation fault. I tried to use sync_freq() in the global options block, but I couldn't succeed. The following line gives an error: options { long_hostnames(yes); sync(0); sync_freq(3); time_reap(10); use_time_recvd(yes); use_dns(yes); create_dirs(yes); log _fifo_size(3000); chain_hostnames(yes);}; ganga:/var# syslog-ng parse error at 3 Parse error reading configuration file, exiting. ganga:/var# However if I remove the sync_freq setting, it reads the line correctly: options { long_hostnames(yes); sync(3); time_reap(10); use_time_recvd(yes); use_dns(yes); create_dirs(yes); log_fifo_size(3000); chain_hostnames(yes);}; ganga:/var# syslog-ng ganga:/var# Please correct me if I'm wrong, but this seems somehow strange to me. -- Regards, Wiktor Wodecki Unix-Administration Wapme Systems AG

2 1

wrong documentation
by Wiktor Wodecki 11 Jan '01

11 Jan '01

hello folks, I just started to configure syslog-ng for the first time and I found a small error in the documentation shipped with it (also on homepage). I use current version 1.4.10. The problem is: written in the docs: source s_tcp { tcp(ip(127.0.0.1) port(1999);max-connections(10)); }; correct syntax: source s_tcp { tcp(ip(127.0.0.1) port(1999) max-connections (4)); }; please somebody fix this, took me a while to fiddle through all those semicolons and brackets.. -- Regards, Wiktor Wodecki Unix-Administration Wapme Systems AG

1 0

RE: [syslog-ng]destination problem
by Ohrberg, Mick 10 Jan '01

10 Jan '01

[snip] > source src { sun-streams("/dev/log" > door("/etc/.syslog_door")); internal(); }; > destination logserver { udp(ip(10.1.2.3) port(10514)); }; > log { source(src); destination(logserver); }; > > I consistently get a parse error on that destination line. Yet > everything I read in the docs looks that way, and the remote syslog > server (running the same version) has the same entry has a source > parameter and works fine. Try destination logserver { udp("10.1.2.3" port(10514)); }; /Mick

2 1

destination problem
by William Yodlowsky 10 Jan '01

10 Jan '01

I'm sure I'm missing something simple here... I've got a 3 line config file for a syslog client. This is 1.4.10. source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination logserver { udp(ip(10.1.2.3) port(10514)); }; log { source(src); destination(logserver); }; I consistently get a parse error on that destination line. Yet everything I read in the docs looks that way, and the remote syslog server (running the same version) has the same entry has a source parameter and works fine. I've tried twiddling with semicolons and parentheses, tcp and udp, no port number and just a port number. It refuses to work for me... Have I been staring at this for too long or is there a glaring error? Thanks in advance!

1 0

Solaris 2.6 compile failure
by William Yodlowsky 10 Jan '01

10 Jan '01

Hi folks. I hadn't had a problem building syslog-ng until today, when I tried to build 1.4.10/libol-0.2.20 on Solaris 2.6-patched. Why do I get the feeling this is a Sun header file problem... it builds fine on Solaris 8. ... gcc -DHAVE_CONFIG_H -I. -I/build/syslog-ng/syslog-ng-1.4.10/src -I. -O2 -Wall -I/build/syslog-ng/libol-0.2.20/src -D_GNU_SOURCE -c afstreams.c In file included from /usr/include/stropts.h:22, from afstreams.c:37: /usr/include/sys/stropts.h:315: parse error before `t_uscalar_t' /usr/include/sys/stropts.h:315: warning: no semicolon at end of struct or union /usr/include/sys/stropts.h:334: parse error before `t_uscalar_t' /usr/include/sys/stropts.h:334: warning: no semicolon at end of struct or union /usr/include/sys/stropts.h:337: parse error before `}' *** Error code 1 make: Fatal error: Command failed for target `afstreams.o' Current working directory /build/syslog-ng/syslog-ng-1.4.10/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /build/syslog-ng/syslog-ng-1.4.10/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /build/syslog-ng/syslog-ng-1.4.10/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive'

1 1

Garbage Collection
by Brian E. Seppanen 08 Jan '01

08 Jan '01

I'm trying to determine the optimal setting for garbage collection. I'm running a box that is logging info from other hosts, and my previous settings appeared to run too frequently and drop messages. I started syslog-ng with the verbose argument, and my objects were approximately 316 so I set it close to that. However, this number of objects seems to increase. At first garbage collection was running at least twice a minute and that was using the suggestion of close to the minimal number of allocated objects. I've doubled the idle threshhold to twice my number of objects and it seems to run every 5 minutes now. What is the risk of the garbage collector not running frequently enough? Does anyone have any tweaks they've found helpful? TIA Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

1 0

Garbage characters in syslog.log on HP-UX
by Mike Scheidler 05 Jan '01

05 Jan '01

I'm seeing stuff like this in my syslog file: Jan 5 15:35:14 kopt0308 syslog: su : + 2 c23mts-root Jan 5 15:35:14 kopt0308 { Jan 5 15:35:14 kopt0308 L{ Jan 5 15:35:14 kopt0308 L^TC Jan 5 15:35:14 kopt0308 { Jan 5 15:35:14 kopt0308 L{ [...] Jan 5 16:00:57 kopt0308 ^L^GK<38>Jan 5 16:00:57 DTSESSION: pamauthenticate status=0 Jan 5 16:00:58 kopt0308 XL<38>Jan 5 16:00:57 DTSESSION: pam_acct_status status=0 I'm new to syslog-ng, but have read through the mail archives, so I know that this is not a new problem for folks on HP-UX systems. I didn't find a definitive solution, though. Is this really something that has no known fix or workaround? P.S. No, I'm not related to Balazs, unless it's very remotely. -- Mike Scheidler c23mts(a)eng.delcoelect.com Unix System Administration (KAT Team) Delphi Delco Electronics Systems Kokomo, IN 46904-9005

1 0

Unaligned Access
by Michael Senn 05 Jan '01

05 Jan '01

I have just compiled the source code on Tru64. When I go to run the binary a message displays as follows: Unaligned access pid=63911 <syslog-ng> va=0x1400133dc pc=0x12001c1d0 ra=0x12001c 1b8 inst=0xb4200010 Unaligned access pid=63911 <syslog-ng> va=0x1400133d4 pc=0x120017bc4 ra=0x12001c 1e0 inst=0xb6110008 Unaligned access pid=63911 <syslog-ng> va=0x1400133cc pc=0x120017bc8 ra=0x12001c 1e0 inst=0xb4510000 Unaligned access pid=63911 <syslog-ng> va=0x1400133cc pc=0x120017bd0 ra=0x12001c 1e0 inst=0xa4510000 Has anyone else tried to compile and run on this platform and if so how did you fix the above. Michael

1 0

Multiple configuration files.
by Scott A. McIntyre 05 Jan '01

05 Jan '01

Hi, I'm looking in to using syslog-ng as a syslog-sink for a number of nodes, but am concerned that the configuration file may become somewhat cluttered and unwieldy. Is there any way to have syslog-ng read it's configuration information in the increasingly popular "everything in this directory is a configuration file to be read" manner? The examples I'm thinking of include xinetd and logrotate... It would be useful to have all of the host-specific filters, destinations and sources all in one file, but only for that host in question, rather than having to build what could eventually be a very large single file. Thanks. Scott

2 2