February 2001 - syslog-ng - lists.balabit.hu

Mailing alerts
by John_Delisle＠ceridian.ca 27 Feb '01

27 Feb '01

Has anyone had any success getting syslog-ng to send an alert via email? I'd guess you use the program destination, but I'm unsure how to call it etc. Any ideas? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909

1 0

(OT) routers and host matching
by Brian E. Seppanen 27 Feb '01

27 Feb '01

Hi: Sort of off topic, but someone here might be more familiar with this situation. I monitor several routers with syslog-ng on a central host. One problem I'm facing is that I want to redirect logs dependent upon the router to different files. This works well, but I have one problem. We do not use DNS to resolve names, and we match upon host IP's. The problem is that the routers have several possible IP's and I'm finding that more and more often that I don't have a filter defined for certain IP's. My syslog-ng config is already a god awful mess and I'm hoping that I'm being short sighted and that there is a solution to my quandry. Is it possible to have the router log via one interface and therefore guarantee a host IP match? Has anyone found a way to work around this? I'd really appreciate any insight. thanks, Brian Seppanen Charter Communications Regional Data Center 906-228-4226 ext 23 Marquette, MI seppy(a)chartermi.net

2 1

syslog-ng-1.4.11 compile error
by Tony Reed 26 Feb '01

26 Feb '01

Hi: What is yywrap part of? This happens: cfg-lex.o: In function `yylex': cfg-lex.o(.text+0x45e): undefined reference to `yywrap' cfg-lex.o: In function `input': cfg-lex.o(.text+0x9b8): undefined reference to `yywrap' collect2: ld returned 1 exit status make[3]: *** [syslog-ng] Error 1 make[3]: Leaving directory `/STUFF/syslog-ng-1.4.11/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/STUFF/syslog-ng-1.4.11/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/STUFF/syslog-ng-1.4.11/src' make: *** [all-recursive] Error 1 AS far as I know, I have a working flex and flex++. This looks like an interesting project, I'd like to be able to compile it. Thanks. -- Tony Reed <trljc(a)altern.org>

1 0

syslog-ng 1.4.11 and libol 0.2.21 released
by Balazs Scheidler 25 Feb '01

25 Feb '01

Hi, We have released syslog-ng 1.4.11 and the corresponding libol 0.2.21 fixing the long-standing SIGHUP problem which caused crashes upon receipt of the HUP signal. It is available at the usual location: http://www.balabit.hu/en/products/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Re: [syslog-ng]AIX compatability issue?
by John_Delisle＠ceridian.ca 23 Feb '01

23 Feb '01

Would it be easier to replace the AIX syslogd with syslog-ng? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Brad Arlt <arlt(a)cpsc.ucalgary.ca To: syslog-ng(a)lists.balabit.hu > cc: Sent by: Subject: Re: [syslog-ng]AIX compatability issue? syslog-ng-admin@lists. balabit.hu 2001/02/23 04:06 PM Please respond to syslog-ng On Fri, Feb 23, 2001 at 01:11:30PM -0600, John_Delisle(a)ceridian.ca wrote: > > Thanks for the response. Sorry to sound ignorant, but what do you mean by > truss or a strace? Is that a type of bracket? Below is the output I get strace and truss log to stderror (or a file) all the system call a process makes. I took a look at the AIX box we have kicking around and the only strace on it is for tracing STREAMS. This is not what you want. I looked at the strace homepage, and as far as I can tell, AIX is *not* one of the supported platforms. AIX seems to have a tracing utility called trace(1). It looks kinda odd, but should do the job. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_) \(_) _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: [syslog-ng]AIX compatability issue?
by John_Delisle＠ceridian.ca 23 Feb '01

23 Feb '01

Thanks for the response. Sorry to sound ignorant, but what do you mean by truss or a strace? Is that a type of bracket? Below is the output I get to /var/log/messages: Feb 21 21:41:25 Message forwarded from ppsvrwasprd2: pskavins: testing using local1.notice John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Balazs Scheidler <bazsi(a)balabit.hu> To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]AIX compatability issue? balabit.hu 2001/02/23 05:34 AM Please respond to syslog-ng Hi, > I'm running a central syslog-ng server with the following syslog-ng.conf: > > options { sync (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames (off); > use_dns (yes); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > }; > > source s_sys { unix-stream ("/dev/log"); internal(); }; > source s_remote { udp(ip(0.0.0.0) port(514)); }; > > destination d_mesg { file("/var/log/messages"); }; > destination d_powerpay { file("/var/log/powerpay"); }; > > filter f_powerpay { facility(local1); }; > > log { source(s_sys); destination(d_mesg); }; > log { source(s_remote); filter(f_powerpay); destination(d_powerpay); }; > log { source(s_remote); destination(d_mesg); }; > > > I have serveral AIX servers that don't seem to get logged. I'm sending > messages with facility set to local1. If I comment out the second log line > above I get messages from the AIX servers to my messages file. When I > enable the second log line as it is above I get nothing. I've tested > sending messages from other platforms with facility set to local1 and they > get logged in the correct file as expected. /var/log/messages should get a copy of each message regardless of the second logline. you should check whether syslog-ng receives the lines correctly with a truss or an strace. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

sync within tcp
by matthew.copeland＠honeywell.com 23 Feb '01

23 Feb '01

I am using the following for my config file. I have been told that you can sync a tcp connection to a certain number of lines, and I thought this was how you do it, but it dies on the first line that has the sync with a parse error. If I move it to its own line, outside of the tcp, it dies parsing there. Can someone please tell me where I am messing up here? Thanks, Matthew M. Copeland options { long_hostnames(off); log_fifo_size(1440000); }; source src { unix-stream("/dev/log"); internal(); }; destination normal_messages { tcp("129.235.66.4" port(999) sync(10)); }; destination immediate_messages { tcp("129.235.66.4" port(999) sync(0)); }; filter f_gs_alert { match("GS_ALERT"); }; log { source (src); filter(f_gs_alert); destination(immediate_messages); }; log { source(src); filter(DEFAULT); destination(normal_messages); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 4

HUP causes a core dump
by Chris Pile 23 Feb '01

23 Feb '01

Balazs Scheidler, I read your message from: http://lists.balabit.hu/pipermail/syslog-ng/2001-January/001147.html and noticed you required a backtrace to help debug the problem where sending SIGHUP to syslog-ng causes a core dump. We have noticed this problem occurs when you send repeated SIGHUP signals within about a second of each other. This can happen either manually or when newsyslog is run and HUPs syslog-ng while it rotates/gzips the logs. (newsyslog -v) quick example of how to core syslog-ng manually: $ ps aux | grep syslog-ng root 14416 0.2 1.0 928 624 ?? Ss 5:07PM 0:00.06 /usr/local/sbin/syslog-ng -p /var/run/syslog.pid $ kill -HUP 14416 $ kill -HUP 14416 bash: kill: (14416) - No such pid $ cat /var/run/syslog.pid 14416 $ ps aux | grep syslog-ng <nothing, process cored> OS: FreeBSD 3.3-RELEASE syslog-ng: 1.4.10 Thanks, Chris Pile -- See below the gdb output: $ gdb syslog-ng -c syslog-ng.core (gdb) bt #0 0x280aa3d0 in kill () from /usr/lib/libc.so.3 #1 0x280de728 in abort () from /usr/lib/libc.so.3 #2 0x8057727 in fatal (format=0x805d2db "Memory corrupted!\n") at werror.c:187 #3 0x8057fa0 in debug_free (m=0x8061a28) at xalloc.c:95 #4 0x805839d in ol_space_free (p=0x8061a2c) at xalloc.c:315 #5 0x80585ae in do_flush (c=0x8071388, w=0xbfbfdaa8) at pkt_buffer.c:101 #6 0x8055fee in write_callback (fd=0x8071408) at io.c:487 #7 0x8055a43 in io_iter (b=0x8062008) at io.c:253 #8 0x8049a58 in main_loop (backend=0x8062008) at main.c:148 #9 0x8049f8f in main (argc=5, argv=0xbfbfdc04) at main.c:317 #10 0x80496b9 in _start () (gdb) bt full #0 0x280aa3d0 in kill () from /usr/lib/libc.so.3 No symbol table info available. #1 0x280de728 in abort () from /usr/lib/libc.so.3 No symbol table info available. #2 0x8057727 in fatal (format=0x805d2db "Memory corrupted!\n") at werror.c:187 args = 0xbfbfda28 "¼^\005\b\004" #3 0x8057fa0 in debug_free (m=0x8061a28) at xalloc.c:95 p = (int *) 0x8061a28 real_size = 16 size = 4 #4 0x805839d in ol_space_free (p=0x8061a2c) at xalloc.c:315 m = (int *) 0x8061a28 #5 0x80585ae in do_flush (c=0x8071388, w=0xbfbfdaa8) at pkt_buffer.c:101 self = (struct pkt_buffer *) 0x8071388 res = 87 item_this = (struct ol_queue_node *) 0x8061a2c item_next = (struct ol_queue_node *) 0x80713b4 item = (struct buffer_node *) 0x8061a2c #6 0x8055fee in write_callback (fd=0x8071408) at io.c:487 self = (struct io_fd *) 0x8071408 res = 134577764 w = {super = {super = {next = 0x0, isa = 0x0, alloc_method = 2 '\002', marked = 0 '\000', dead = 0 '\000'}, write = 0x8055ebc <do_write>, writestr = 0}, fd = 0} #7 0x8055a43 in io_iter (b=0x8062008) at io.c:253 fd = (struct nonblocking_fd *) 0x8071408 i = 0 nfds = 2 nco = 3217021744 fds = (struct pollfd *) 0xbfbfdad4 res = 1 timeout = 0 now = 982946899 #8 0x8049a58 in main_loop (backend=0x8062008) at main.c:148 exit_main_loop = 0 #9 0x8049f8f in main (argc=5, argv=0xbfbfdc04) at main.c:317 do_fork = 1 opt = -1 backend = (struct syslog_backend *) 0x8062008 syslog_ng_options = {{name = 0x8058cc0 "cfgfile", has_arg = 1, flag = 0x0, val = 102}, {name = 0x8058cc8 "pidfile", has_arg = 1, flag = 0x0, val = 112}, {name = 0x8058cd0 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x8058cd6 "verbose", has_arg = 0, flag = 0x0, val = 118}, {name = 0x8058cde "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x8058ce3 "version", has_arg = 0, flag = 0x0, val = 86}, {name = 0x8058ceb "yydebug", has_arg = 0, flag = 0x0, val = 121}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} #10 0x80496b9 in _start () No symbol table info available.

1 0

Re: [syslog-ng] use_fqdn()
by Gabor Kiss 23 Feb '01

23 Feb '01

> > options { use_fqdn(yes); }; > > > > I've tried different options and all numerical ones are excepted ok. > > Options with accepted values described as 'yes' or 'no' in the > > documentation cause the deamon to fail on start-up. > > > > Have I got the syntax wrong? > > Do I need a newer version to enable this feature? > > If so, Is there a different option that will give me the full domain name > > in this version? > > This option is supported only 1.3.x and later. I think you should install > 1.3.15, I intent to release it as a stable version soon. I have 1.4.0rc3 and I cannot configure FQDNs. Current options are: options { long_hostnames(on); chain_hostnames(yes); use_fqdn(yes); sync(0); }; What did I wrong? Gabor

1 0

AIX compatability issue?
by John_Delisle＠ceridian.ca 23 Feb '01

23 Feb '01

Hi, I'm running a central syslog-ng server with the following syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); }; source s_remote { udp(ip(0.0.0.0) port(514)); }; destination d_mesg { file("/var/log/messages"); }; destination d_powerpay { file("/var/log/powerpay"); }; filter f_powerpay { facility(local1); }; log { source(s_sys); destination(d_mesg); }; log { source(s_remote); filter(f_powerpay); destination(d_powerpay); }; log { source(s_remote); destination(d_mesg); }; I have serveral AIX servers that don't seem to get logged. I'm sending messages with facility set to local1. If I comment out the second log line above I get messages from the AIX servers to my messages file. When I enable the second log line as it is above I get nothing. I've tested sending messages from other platforms with facility set to local1 and they get logged in the correct file as expected. Any ideas? John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909

2 1