May 2001 - syslog-ng - lists.balabit.hu

$DATE Macro Dir Creation
by Brian E. Seppanen 11 May '01

11 May '01

Can I do the following for a file destination? If I can why won't it work? The documentation leads me to believe it does. I've done something similar using the $PRIORITY macro to break out some messages into diferrent files. I want messages to log into a date specific directory. destination messages { file("/var/log/$DATE/messages" create_dirs(yes) dir_perm(0640));}; The global config likewise specifies create_dirs(yes); Any help greatly appreciated. Brian Seppanen Charter Communications seppy(a)chartermi.net Advanced Services Engineer 906-228-4226 ext 23 Therefore, since brevity is the soul of wit and tediousness the limbs and outward flourishes, I will be brief. - Polonius

2 1

RE: [syslog-ng]Compile error...
by Ohrberg, Mick 11 May '01

11 May '01

Asher, Try this: netinet/in.h:#define INADDR_NONE 0xffffffff /Mick > -----Original Message----- > From: Asher Yanich [mailto:ayanic01@cs.fiu.edu] > Sent: Thursday, May 10, 2001 4:32 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Compile error... > > > > Solaris 2.6 : > gcc -DHAVE_CONFIG_H -I. > -I/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/s > yslog-ng-1.5.6/src > -I. -O2 -Wall > -I/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/l > ibol-0.2.22/src > -D_GNU_SOURCE -c nscache.c > nscache.c: In function `nscache_new': > nscache.c:112: `INADDR_NONE' undeclared (first use in this function) > nscache.c:112: (Each undeclared identifier is reported only once > nscache.c:112: for each function it appears in.) > gmake[3]: *** [nscache.o] Error 1 > gmake[3]: Leaving directory > `/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/sy > slog-ng-1.5.6/src' > gmake[2]: *** [all-recursive] Error 1 > gmake[2]: Leaving directory > `/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/sy > slog-ng-1.5.6/src' > gmake[1]: *** [all-recursive-am] Error 2 > gmake[1]: Leaving directory > `/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/sy > slog-ng-1.5.6/src' > gmake: *** [all-recursive] Error 1 > > Same error with 1.5.5a.. sent message to the list but list > was down a few > weeks ago... > > > Thanks, > Asher > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

Compile error...
by Asher Yanich 10 May '01

10 May '01

Solaris 2.6 : gcc -DHAVE_CONFIG_H -I. -I/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/syslog-ng-1.5.6/src -I. -O2 -Wall -I/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/libol-0.2.22/src -D_GNU_SOURCE -c nscache.c nscache.c: In function `nscache_new': nscache.c:112: `INADDR_NONE' undeclared (first use in this function) nscache.c:112: (Each undeclared identifier is reported only once nscache.c:112: for each function it appears in.) gmake[3]: *** [nscache.o] Error 1 gmake[3]: Leaving directory `/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/syslog-ng-1.5.6/src' gmake[2]: *** [all-recursive] Error 1 gmake[2]: Leaving directory `/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/syslog-ng-1.5.6/src' gmake[1]: *** [all-recursive-am] Error 2 gmake[1]: Leaving directory `/a/mustang.cs.fiu.edu./disk/33/a/depot/syslog-ng/share/src/syslog-ng-1.5.6/src' gmake: *** [all-recursive] Error 1 Same error with 1.5.5a.. sent message to the list but list was down a few weeks ago... Thanks, Asher

1 0

klogd-less logging
by MURVAI-BUZOGANY Laszlo 10 May '01

10 May '01

Hi! I would like to set up a completely klogd-less logging system, but I couldn't figure out, which program would do the symbol-translating, as it is done now by klogd. Also didn't find these in the documentation, so any help would be appreciated :) Thx, sci -- Murvai-Buzogány László Laszlo.Murvai-Buzogany(a)gt-systems.hu

2 2

Hello !
by claude.brassel＠partner-system.com 10 May '01

10 May '01

Hello, I just try to use syslog-ng, but I have a little configuration problem. If I use a simple configuration file like this : ----------------------------------------------------------- source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/var/adm/messages"); }; log { source(local); destination(all); }; ################################# source net { udp(); }; destination test_dest { file("/var/adm/network.log"); }; log { source(net); destination(test_dest); }; ----------------------------------------------------------- That work great all my network nodes send the messages to /var/adm/network.log But if I use a more complex file like this : -------------------------------------------------------------- ################################################################################ # # Definition pour la recup des infos system # source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/var/adm/messages"); }; log { source(local); destination(all); }; ################################################################################ # # Options ##options { sync(1); }; ################################################################################ # # Definition des equipements reseaux # source net { udp(); }; # Definition des destinations : 1 fichier par projet client destination d_issy_heberg { file("/var/log/issy_heberg"); }; destination d_interxion { file("/var/log/interxion"); }; destination d_filinks { file("/var/log/filinks"); }; destination d_bisax { file("/var/log/bisax"); }; destination d_directmedica { file("/var/log/directmedica"); }; destination d_novacy { file("/var/log/novacy"); }; destination d_achatpro { file("/var/log/achatpro"); }; destination d_easyvoyage { file("/var/log/easyvoyage"); }; destination d_lapeyre { file("/var/log/lapeyre"); }; # Definition des filtres filter f_issy_heberg { host("swi_heberg_issy") and host("swi_heberg_colt") and host("swi_cisco_heberg"); }; filter f_interxion { host("ic2912-2") and host("ic2924-1") and host("ic2924-2") and host ("ia780"); }; filter f_filinks { host("cisco") and host("alteon-int1") and host("alteon-int2") and host ("alteon-dmz1") and host ("alteon-dmz2") and host("switch-dmz1") and host ("switch-dmz2") and host("alteon-local1") and host ("alteon-local2") and host("switch-local1") and host ("switch-local2") and host ("switch-bkp"); }; filter f_bisax { host("alteon-1") and host ("extreme-1") and host ("alteon-3") and host ("ext_bisax1"); }; filter f_directmedica { host("3com_directmedica"); }; filter f_novacy { host("swi_novacy2"); }; filter f_achatpro { host( "swi_achatpro1") and host("alt_achatpro1") and host ("alt_achatpro2") and host ("alt_achatpro3") and host("3com_achatpro1") and host ("3com_achatpro2") and host ("3com_achatpro3"); }; filter f_easyvoyage { host("swi_easyvoyage"); }; filter f_lapeyre { host("alt_lapeyre") and host ("hp_lapeyre"); }; # mise en place des logs log { source(net); filter(f_issy_heberg); destination(d_issy_heberg); }; log { source(net); filter(f_interxion); destination(d_interxion); }; log { source(net); filter(f_filinks); destination(d_filinks); }; log { source(net); filter(f_bisax); destination(d_bisax); }; log { source(net); filter(f_directmedica); destination(d_directmedica); }; log { source(net); filter(f_novacy); destination(d_novacy); }; log { source(net); filter(f_achatpro); destination(d_achatpro); }; log { source(net); filter(f_easyvoyage); destination(d_easyvoyage); }; log { source(net); filter(f_lapeyre); destination(d_lapeyre); }; ################################################################################### # # Definition des serveurs # destination d_serveurs { file("/var/log/serveur_supervision"); }; destination d_postes_l2 { file("/var/log/postes_level2"); }; filter f_serveurs { host("netcool") and host("oracle") and host("remedy") and host("infovista"); }; filter f_postes_l2 { host("brassel") ; }; log { source(net); filter(f_serveurs); destination(d_serveurs); }; log { source(net); filter(f_postes_l2); destination(d_postes_l2); }; --------------------------------------------------------------------------------------- then nothing happens, only the /var/adm/messages work for the local messages, but the no network activity I am trying it on a solaris 2.7(32) system Have someon a great idea ? Thank's for your help .... Best Regards, Claude

2 1

syslog network loging problem
by jscheibe＠css.tayloru.edu 10 May '01

10 May '01

1 0

syslog network loging problem
by jscheibe＠css.tayloru.edu 10 May '01

10 May '01

1 0

RE: [syslog-ng]filter() call bug fix
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 08 May '01

08 May '01

I guess it would depend on how important this change is to everyone and if it is the only fix/enhancement in the next prospective version. For me this change alone is not that significant so you could hold off if you wanted. Regards, Drew -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Tuesday, May 08, 2001 10:30 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]filter() call bug fix On Fri, May 04, 2001 at 05:21:56PM -0500, Jon Marks wrote: > Hi, > > I've uncovered a small bug in the filter() call within filter definitions. > Attached is a patch to filters.c against the current stable release > (1.4.11) to fix the bug. Thanks for the fix. This slipped my attention before releasing 1.5.6 so it doesn't contain this fix. I applied to both of my 1.4.x and 1.5.x trees. I don't know whether to release a new versions though. What do you people think? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Syslog-ng v1.4.11, libol 0.2.21, Slackware Linux 7.1, Not Logging
by Jon Todaro 08 May '01

08 May '01

I am trying to get syslog-ng running. I am using the stock syslog-ng.conf.RedHat config file, and syslog-ng starts, but will not autocreate the files, and it also wont log at all. If I run syslog-ng in -d mode. This is some of the output it shows me when I telnet in from another client. [root@bone:/root] syslog-ng -d io.c: listening on fd 3 io.c: listening on fd 4 syslog-ng version 1.4.11 starting io.c: Preparing fd 5 for reading io.c: Preparing fd 6 for reading Read EOF on fd 5. Marking fd 5 for closing. Closing fd 5. io.c: Preparing fd 5 for reading Read EOF on fd 5. Marking fd 5 for closing. Closing fd 5. Read EOF on fd 6. Marking fd 6 for closing. Closing fd 6. io.c: Preparing fd 5 for reading Any help would be greatly appreciated. Note.. libol was configured with no ./configure options specified. And syslog-ng was configured with only -sysconf -sbindir -bindir and -prefix specified. And I have moved the config file all together to make sure it was in the correct place, and when I did, it would not start. Help, I have used earlier versions of this daemon before, just fine. Jon Todaro

2 5

filter() call bug fix
by Jon Marks 08 May '01

08 May '01

Hi, I've uncovered a small bug in the filter() call within filter definitions. Attached is a patch to filters.c against the current stable release (1.4.11) to fix the bug. The following is a description of the problem. Take the following bit of configuration code for illustration: ############################ source local { unix-dgram("/dev/log"); udp(); internal(); }; filter f_test { host("myhost"); }; filter f_test2 { program("something"); }; filter f_test3 { filter("f_test"); }; # <-- ERROR occurs because of this destination d_test { file("/what/ever"); log { source(local); filter(f_test3); destination(d_test); }; ############################ When filters are defined in the configuration file, they're added to a list. If they contain a call to another filter (as in f_test3), the actual filter to which they refer is resolved the first time the former's evaluated against a log message. (So you can refer to a filter in the config file before you define it). The filter call resolution procedure traverses the list, comparing the name of each filter to the name its looking for. The problem is just a little mixup in the logic used to detect when the right filter is found. Here's the code responsible, from filters.c/do_filter_call(): if (!self->call_rule) { struct log_filter *p = rule->prev_filter; while (p && p->name->length != self->name->length && memcmp(p->name->data, self->name->data, self->name->lengt h)) { p = p->prev_filter; } ... } In the while() loop, the previous filter is meant to be chosen until the right one is found. But the condition logic says, "Try the next filter while 1) there IS a next filter AND 2) the filter's name length is different AND 3) the filter's name's contents don't match what we're looking for." But what happens when the length of the present filter doesn't match, but the contents *DO*? This can happen since the code only compares the as many bytes as the target name has. This condition would stop the loop, and choose the wrong filter (as p would be left pointing to the unmatching filter). This (and the other lookup phase, not shown) is fixed by the attached patch, by changing the logic as follows: if (!self->call_rule) { struct log_filter *p = rule->prev_filter; while (p && (p->name->length != self->name->length || memcmp(p->name->data, self->name->data, self->name->length)) ) { p = p->prev_filter; } ... } This should guarantee that the loop ends on p only when p is either NULL, or when it points to a filter with a name of matching length AND matching contents (thank DeMorgan for this explanation of that code). Otherwise, in the configuration snippet above, the filter() call in f_test3 resolves to "f_test2" in the lookup procedure, when "f_test" is the desired referent. That's because, as it traverses the list backwards from itself, it encounters f_test2 first (which is defined AFTER f_test). And f_test2 has unmatching length (good for advancing p) but matching contents up the the length of the string "f_test" which is what's being sought. Thanks. -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

2 1