December 2001 - syslog-ng - lists.balabit.hu

What are the installation requirements???
by Krishna 22 Dec '01

22 Dec '01

Hi, I am new to syslog-ng. I wanted to know what are the installation reqirements for this package to install.I tried to install it but got lot of error's. Please Help regards Krishna Shekhar Network Administrator Wiplash.com

1 0

What are the installation requirements???
by Krishna 22 Dec '01

22 Dec '01

Hi, I am new to syslog-ng. I wanted to know what are the installation reqirements for this package to install.I tried to install it but got lot of error's. Please Help regards Krishna Shekhar Network Administrator Wiplash.com

1 0

RE: [syslog-ng]Possible overflow?
by Nicholas Berry 21 Dec '01

21 Dec '01

I too get high ASCII characters, but on a regular basis across multiple systems. I have about 20 hosts logging to two syslog-ng systems. I see this anywhere from a Foundry routers, to Solaris 8, and Lucent Maxes: ..smf-jumpstart A<A0><E1>$<30>Dec 1.. ..smf-modem-01 ^B^D^E<B4><134>ASCEND: slot 2.. ..smf-dist-01 ^B^D^E<B4><14>smf-dist-01, Interface... Thanks, Nicholas Berry Systems Engineer RagingWire Telecommunications, Inc. 2710 Gateway Oaks Dr., Suite 300 South Sacramento, CA 95833 Phone: 916.286.4048 Fax: 916.921.4148 E-mail: nberry(a)ragingwire.com www.ragingwire.com -----Original Message----- From: Thomas Kaehn [mailto:tk@westend.com] Sent: Friday, December 21, 2001 3:04 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Possible overflow? Hi, in some logs I discovered an ascii character with the value 181 instead of a newline: ... D4-RIPE|<181>Dec 20 19:02 ... Unfortunately I can't reproduce this error. But maybe it's a known error? It occured when logging whole mails to syslog. Does anyone know a possible cause? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Possible overflow?
by Thomas Kaehn 21 Dec '01

21 Dec '01

Hi, in some logs I discovered an ascii character with the value 181 instead of a newline: ... D4-RIPE|<181>Dec 20 19:02 ... Unfortunately I can't reproduce this error. But maybe it's a known error? It occured when logging whole mails to syslog. Does anyone know a possible cause? Ciao, Thomas -- Thomas Kähn WESTEND GmbH - Aachen und Dueren Tel 0241/701333-0 tk(a)westend.com Internet & Security for Professionals Fax 0241/911879 WESTEND ist CISCO Systems Partner - Premium Certified

1 0

RE: [syslog-ng]mark() option?
by Todd Snyder 20 Dec '01

20 Dec '01

A bit of an operations question, but one I've never found an answer to .. what is the purpose of ---MARK---? I know it just fills up my logs, but I never really understood why I'd want that ... Suggestions? What do other people use it for? Todd. -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, December 18, 2001 12:04 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]mark() option? On Tue, Dec 04, 2001 at 08:46:00PM -0600, Bradley Hartin wrote: > > I was testing out a configuration as follows: > > options { long_hostnames(off); sync(0); mark(10); }; > source src { unix-stream("/dev/log"); internal(); }; > > destination all { file("/var/log/messages"); }; > log { source(src); destination(all); }; > > While it appears to log everything properly, I have yet (after hours) to > see a single --- MARK --- message in the logs. Is the mark option not > operational, or is there something I'm missing? sorry, mark is not implemented... -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

4 3

HUP'ing syslog-ng causes data loss
by UK 19 Dec '01

19 Dec '01

Greetings, Trying to see what happens when syslog-ng (Version 1.4.14 on Solaris 8) gets HUP'ed, as my logrotate scripts will do, while it's receiving UDP data. Using the stresstes.sh script on another host (which is using the syslog-ng box as a loghost), a stream of messages will be sent. The while loop was changed to: while [ "$i" -lt "1000" ] After the script ran, a "cat messages | wc -l" was done against the log and the results would be approx 995 lines (probably because it's UDP). Then I'd move the file and HUP syslog-ng and retested a few more times. Same results each time. Next, while stresstest.sh was running, syslog-ng would be HUP'ed two or three times. After every test the "cat messages | wc -l" would show between 965 - 975 lines. My questions: How can I prevent messages from being lost when syslog-ng gets HUP'ed? Is it due to a config file error? From reading archived logs I found this wouldn't happen with TCP but I didn't see any information about UDP. My config file: ------------ options { sync(0); create_dirs(yes); use_fqdn(yes); keep_hostname(yes); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); udp(); internal(); }; destination d_cisco { file("/opt/logs/cisco.log"); }; destination d_other { file("/var/log/syslog-ng/$HOST/messages" sync(0) create_dirs(yes)); }; destination d_adm { file("/var/log/syslog-ng/$HOST/sysmsg" sync(0) create_dirs(yes)); }; filter f_cisco { facility(local4); }; # stuff that would go into /var/log/messages filter f_messages { level(info..warn) and not facility(auth, auth, mail, news, local4); }; filter f_daemonlog { facility(daemon) and level (info,warn,notice,err,crit,alert,emerg); }; log { source(src); filter(f_cisco); destination(d_cisco); }; log { source(src); filter(f_messages); destination(d_other); }; log { source(src); filter(f_daemonlog); destination(d_adm); }; ------------ Thanks, UK

2 3

mark() option?
by Bradley Hartin 18 Dec '01

18 Dec '01

I was testing out a configuration as follows: options { long_hostnames(off); sync(0); mark(10); }; source src { unix-stream("/dev/log"); internal(); }; destination all { file("/var/log/messages"); }; log { source(src); destination(all); }; While it appears to log everything properly, I have yet (after hours) to see a single --- MARK --- message in the logs. Is the mark option not operational, or is there something I'm missing? Thanks, -- Bradley Hartin - bhartin(a)straus-frank.com Network and Communications Administrator Straus-Frank Company

2 1

RE: [syslog-ng]Solaris8 64-bit compile
by Ohrberg, Mick 18 Dec '01

18 Dec '01

> -----Original Message----- > From: Wim-Jan Hilgenbos [mailto:wimjan@xs4all.nl] > Sent: Tuesday, December 18, 2001 8:38 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Solaris8 64-bit compile > > > On Tue, Dec 18, 2001 at 07:50:59AM -0600, Ohrberg, Mick wrote: > > Hello all. [snip] > > ld: warning: file /usr/local/lib/libfl.a(libmain.o): wrong ELF class: > > ELFCLASS64Undefined [snip] > > > > That is, I BELIEVE it's related to the libfl.a library and incompatibility > > with 64-bit mode, per above? Libol compiled without a hitch. It seems yywrap > > is missing from libfl.a. Anyone had the same problem and know how to get > > around it? > > > > Any and all help is appreciated. > > Did you rebuild the cfg-lex file from its cfg-lex.l file using flex? > If I remember correctly the one in the distributions is build > using lex. Wim-Jan, No, but what I DID do was get rid of the 64-bit flex and installed a regular 32-bit version, and then it worked fine! Sorry for the newbie-error! "God Jul och Gott Nyttt År!" /Mick

1 0

Solaris8 64-bit compile
by Ohrberg, Mick 18 Dec '01

18 Dec '01

Hello all. I'm having a bit of compilation difficulties, trying to compile syslog-ng 1.4.14 on Solaris 8, 64-bit edition. ----------[snip]---------- gcc -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -lfl -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o utils.o syslog-names.o getopt.o getopt1.o -lpthread -ldoor /usr/local/lib/libol.a -lsocket -lnsl -lxnet ld: warning: file /usr/local/lib/libfl.a(libmain.o): wrong ELF class: ELFCLASS64Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status ----------[snip]---------- That is, I BELIEVE it's related to the libfl.a library and incompatibility with 64-bit mode, per above? Libol compiled without a hitch. It seems yywrap is missing from libfl.a. Anyone had the same problem and know how to get around it? Any and all help is appreciated. Regards, -- Mick Öhrberg Open Systems Administrator, UMB Bank na [NYSE:UMBF] Ph: (816)860-1064 Fax: (816)860-3934

2 1

RE: [syslog-ng]libol version problems
by Todd Snyder 13 Dec '01

13 Dec '01

That fixed it. What can I say, I try too hard. I figured going with the latest and greatest would be bestest. Thanks. Todd. -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Wednesday, December 12, 2001 1:56 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]libol version problems Look on http://www.balabit.hu/en/downloads/syslog-ng/downloads/ See how syslog-ng 1.4.14 is paired with libol 0.2.23 and syslog-ng 1.5.12 is paired with libol 0.3.1? Stable syslog-ng uses the 0.2.x branch and devel syslog-ng uses the 0.3.x branch of libol. On Wed, Dec 12, 2001 at 11:13:20AM -0500, Todd Snyder wrote: > Ok ... I'm really confused ... I just downloaded the most recent version of > syslog-ng, and libol (0.3.1). I got 'required version not found'. so I > went down to 2.9 - still the same thing. > > see output below: > > checking libol version >= 0.2.23... no > configure: error: Required libol version not found > [root@coupland syslog-ng-1.4.14]# libol-config --version > 0.2.9 > > > what do I do ... I need to get this up like TODAY, and I can't get it > compiled. > > I did a quick search of the archives and didn't find anything, so I > apologize if this is a common question. > > TIA > > Todd. > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng -- Nate Campi http://www.campin.net GnuPG key: 0xC17AEF79 Key fingerprint = BF12 722F 8799 E614 33CC FAB7 5A90 C464 C17A EF79 "The percentage of users running Windows NT Workstation 4.0 whose PCs stopped working more than once a month was less than half that of Windows 95 users."-- microsoft.com/ntworkstation/overview/Reliability/Highest.asp _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0