June 2001 - syslog-ng - lists.balabit.hu

have the priority field in the log
by Kai Wang 13 Jun '01

13 Jun '01

Hi, Our network group found that they can view log messages with the priority field on the routers. But after the logs arrive the unix syslog server, the priority field is gone. They prefer to have such a field in their log. Is there a way to have the priority field in the log message by syslog-ng? Kai

2 1

newbie Solaris question
by T. Esting 12 Jun '01

12 Jun '01

I've been trying to get both 1.4.11 and 1.5.7 to run on my Solaris system, and have met with limited success. Compiling and installing were fairly easy, as was creating a configuration file. I understand from the docs that the mark() feature still doesn't work, and from the mailing list that sync_freq() should actually be sync(). I am having trouble, however, with flushing output in low-volume scenarios. Here is the configuration file I am using: options { use_dns(no); log_fifo_size(XXX); gc_idle_threshold(YYY); gc_busy_threshold(ZZZ); use_time_recvd(yes); }; source sun { sun-streams ( "/dev/log" door("/etc/.syslog_door")); internal(); }; destination testout { file ( "/var/adm/testout.txt" sync(WWW)); } ; log { source (sun); destination (testout); }; I've tried various values for WWW, XXX, YYY, and ZZZ, even setting WWW to 1. I have not been able to influence syslog-ng to write out every message it receives. Does anyone have any pointers on what I might want to try next to get syslog-ng to more reliably receive and log messages on Solaris? Thanks. _______________________________________________________ Send a cool gift with your E-Card http://www.bluemountain.com/giftcenter/

1 0

syslogd core on garbage-collect filter
by jamie rishaw 11 Jun '01

11 Jun '01

Greetings all, Hope this isn't FAQ.. I'm trying to filter all of the "garbage collect" messages into /dev/null (but for initial testing, a file). syslog-ng is coring, tho, after startup with code (below). operation without the bad code, however, is fine. I am running syslog-ng 1.4.11 on FreeBSD 4.3-STABLE. bad code: -- start -- # I dont want garbage collecting messages log { source("s_int"); filter("f_isgarbage"); destination("d_garbage"); }; filter f_isgarbage { match("garbage collect"); }; destination d_garbage { file("/logs/garbage"); }; -- end -- related code (does not affect): --start-- source s_int { internal(); }; --end-- startup: noc# /usr/local/sbin/syslog-ng -v binding fd 3, inetaddr: 0.0.0.0, port: 514 binding fd 4, unixaddr: /var/run/log within 60 seconds: -rw------- 1 root wheel 380928 Jun 11 11:16 syslog-ng.core noc# gdb /usr/local/sbin/syslog-ng syslog-ng.core GNU gdb 4.18 (no debugging symbols found)... Core was generated by `syslog-ng'. Program terminated with signal 6, Abort trap. Reading symbols from /usr/lib/libc.so.4...(no debugging symbols found)...done. Reading symbols from /usr/libexec/ld-elf.so.1...(no debugging symbols found)... done. #0 0x280af8e0 in kill () from /usr/lib/libc.so.4 (gdb) bt #0 0x280af8e0 in kill () from /usr/lib/libc.so.4 #1 0x280eb62e in abort () from /usr/lib/libc.so.4 #2 0x280c83cf in __assert () from /usr/lib/libc.so.4 #3 0x805203a in io_iter () #4 0x8049ace in main_loop () #5 0x8049de3 in main () #6 0x80496f9 in _start () Thanks in advance for any advice/help, jamie -- jamie rishaw <jrishaw(a)playboy.com> sr. wan/unix engineer/ninja // playboy enterprises inc. opinions stated are mine, and are not necessarily those of the bunny.

1 0

sending alerts to phones
by foob＠return0.net 10 Jun '01

10 Jun '01

Maybe a bit off topic - but the syslog-ng feature to pipe logs to programs got me thinking: does anyone know of a provider or service that will allow me to send mobile SMS messages from the command line? I like the idea of getting alerts if, say, login fails for root and other such naughtyness :) - foob

4 4

destination { program(); } failures...
by David Douthitt 08 Jun '01

08 Jun '01

I've been trying to use: destination { program("/usr/bin/notify"); }; ...and it doesn't work. No error messages. No log messages. No nothing at all. Then I had a flash, and tried checking my hypothesis against the documentation - nothing there. Then I tried checking my hypothesis in the example *.conf files - nothing there. Then I tried it in practice: destination { program(/usr/bin/notify); }; This works better, but only seems to work when it starts up, but not thereafter. /usr/bin/notify is a /bin/sh script. Does this just not work in v1.4.10?? It's getting rather frustrating. I'm running in Red Hat Linux 6.2 without all the bells and whistles (like X). I'd *REALLY* like to get this to work - it's one of the big draws to syslog-ng for me.

6 12

Re: [syslog-ng]SNMP source and destination
by todd.glassey＠att.net 07 Jun '01

07 Jun '01

The nice thing about SNMP style traffic logs is that you can process them with MRTG and generate good graphical content for reports and the like. I suggest that you look at http://www.mrtg.org for more details on this. T. -- Regards, Todd > I don't know if anyone has answered this, and I'm too lazy to look in > the archive. But here it goes: > > On Tue, Jun 05, 2001 at 01:44:30PM -0400, Mark W. Alexander wrote: > > I just installed syslog-ng as a syslog concentrator for multiple > > network management applications that feed off syslog. I need to do the > > same thing with SNMP traps. I tried simple source and destination on > > the SNMP udp ports and it does grab and forward but not in any manner > > that makes sense to SNMP listeners on the detinations. > > Assuming you were using syslog-ng this make sense. Syslog and SNMP > Trap are very different protocols. > > > Has anyone done any work on SNMP specific sources or destinations? If > > not, is anyone else interested and can anyone give me a gentle push > > into the sources (like where the udp source/destination code is)? > > I have, but since I am not a big fan of SNMP I used an SNMP Trap > daemon that turned everything into syslog traffic (decoding what it > could of those nasty SNMP OIDs). This has worked well for me, as it > unifies logging into one resource. > > http://net-snmp.sourceforge.net/ > > Another package, Scotty, is also quite good, and is written in TCL/Tk. > I don't have the URL handy. > ---------------------------------------------------------------------------- > __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ > _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ > (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_) > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Question on using syslog-ng
by Heeres, Ken 07 Jun '01

07 Jun '01

I am looking for a package that will provide application level logging and it looks to me like syslog-ng has the capabilities I am looking for. I am not quite sure that I would want to replace syslogd with syslog-ng. Would it be possible to have syslog-ng coexist with syslogd by having it listen on a different port? I would have write a version of syslog to communicate using the alternate port. Correct? Thanks, Ken ---------------------------------------------- Kenneth J. Heeres Johns Hopkins University Group Supervisor Applied Physics Laboratory Ground Applications Group (SIG) Johns Hopkins Road Laurel, MD 20723-6099 Wash.: 240-228-5853 Balt: 443-778-5853 kenneth.heeres(a)jhuapl.edu

4 3

RE: [syslog-ng]Feature Request
by Andrew Fort 07 Jun '01

07 Jun '01

David, I guess you dont need this badly enough to hack it yourself :-) But if anyone is interested in adding this functionality for a patch, start here-- main.c main_loop() for the config file parsing debug output. center.c do_distribute_log() for the core of the filter matching. Also, do_distribute_log() could benefit from some sort of accelerated matching to (possibly) improve performance in heavy-filtering configurations, at the moment it's O(n) n~= number of rules. >Let me say first that this is a fantastic piece of software - I'm >starting to implement it in our UNIX environment. It's almost TOO >powerful :-) But that is a Good Thing. > >I don't THINK this is in the current sources, but anyway.... > >I'd like to have some serious debugging available in the logs ... for >example, right now we get: > >syslog-ng[99]: Syntax error reading config file, using old >configuration > >...and this is all you know. To actually find out the error, you have >to run syslog-ng from the command line. Then testing gets complicated >as you attempt to restart the active syslog-ng while finding out what >the syntax errors are by running it at the command line. Wouldn't be >better to do the following: > >syslog-ng[99]: Syntax error in configuration file /etc/syslog-ng.conf >at line 45 >syslog-ng[99]: Retaining old configuration > >Also, messages like these would be nice for debugging purposes: > >syslog-ng[99]: Message from source(src) received: level auth.info >syslog-ng[99]: Log #1: filter not matched >syslog-ng[99]: Log #2: filter not matched >syslog-ng[99]: Log #3: filter not matched >syslog-ng[99]: Log #4: filter f_authonly matched >syslog-ng[99]: Log #4: log used >syslog-ng[99]: Log #5: filter not matched >syslog-ng[99]: Log #6: source not matched > >...and so on. > >It would even be nice to be able to send a SIGINT or a SIGUSR1 or a >SIGUSR2 to the running syslog to manipulate the debugging messages >similar to BIND. > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

Feature Request
by David Douthitt 06 Jun '01

06 Jun '01

Let me say first that this is a fantastic piece of software - I'm starting to implement it in our UNIX environment. It's almost TOO powerful :-) But that is a Good Thing. I don't THINK this is in the current sources, but anyway.... I'd like to have some serious debugging available in the logs ... for example, right now we get: syslog-ng[99]: Syntax error reading config file, using old configuration ...and this is all you know. To actually find out the error, you have to run syslog-ng from the command line. Then testing gets complicated as you attempt to restart the active syslog-ng while finding out what the syntax errors are by running it at the command line. Wouldn't be better to do the following: syslog-ng[99]: Syntax error in configuration file /etc/syslog-ng.conf at line 45 syslog-ng[99]: Retaining old configuration Also, messages like these would be nice for debugging purposes: syslog-ng[99]: Message from source(src) received: level auth.info syslog-ng[99]: Log #1: filter not matched syslog-ng[99]: Log #2: filter not matched syslog-ng[99]: Log #3: filter not matched syslog-ng[99]: Log #4: filter f_authonly matched syslog-ng[99]: Log #4: log used syslog-ng[99]: Log #5: filter not matched syslog-ng[99]: Log #6: source not matched ...and so on. It would even be nice to be able to send a SIGINT or a SIGUSR1 or a SIGUSR2 to the running syslog to manipulate the debugging messages similar to BIND.

1 0

Problems with "nscache.c" on Solaris 7
by Stefano Pasquale 06 Jun '01

06 Jun '01

Hi, I tried to compile syslog-ng. I downloaded libol-0.2.22, configured, compiled, made and made-install, and then I downloaded syslog-ng-1.5.6, configured and compiled. An error occurred with "nscache.c". I used gcc 2.8.1: sp87286@shine->/tmp/syslog-ng-1.5.6 > gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.7/2.8.1/specs gcc version 2.8.1 Beware I didn't modify anything in any config/Make-files May someone help me? Thanks Here is the relevant output of what I did. root@shine:/ # cd /tmp/libol-0.2.22 root@shine:/tmp/libol-0.2.22 # make install Making install in utils /bin/sh /tmp/libol-0.2.22/mkinstalldirs /usr/local/bin .././install-sh -c make_class /usr/local/bin/make_class Making install in src /bin/sh /tmp/libol-0.2.22/mkinstalldirs /usr/local/lib /bin/sh ../libtool --mode=install .././install-sh -c libol.la /usr/local/lib/libol.la .././install-sh -c .libs/libol.so.0.0.0 /usr/local/lib/libol.so.0.0.0 (cd /usr/local/lib && rm -f libol.so.0 && ln -s libol.so.0.0.0 libol.so.0) (cd /usr/local/lib && rm -f libol.so && ln -s libol.so.0.0.0 libol.so) chmod +x /usr/local/lib/libol.so.0.0.0 .././install-sh -c .libs/libol.lai /usr/local/lib/libol.la .././install-sh -c .libs/libol.a /usr/local/lib/libol.a ranlib /usr/local/lib/libol.a chmod 644 /usr/local/lib/libol.a ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - use the `-RLIBDIR' linker flag See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- /bin/sh /tmp/libol-0.2.22/mkinstalldirs /usr/local/include/libol mkdir /usr/local/include/libol .././install-sh -c -m 644 abstract_io.h /usr/local/include/libol/abstract_io.h .././install-sh -c -m 644 alist.h /usr/local/include/libol/alist.h .././install-sh -c -m 644 format.h /usr/local/include/libol/format.h .././install-sh -c -m 644 gc.h /usr/local/include/libol/gc.h .././install-sh -c -m 644 io.h /usr/local/include/libol/io.h .././install-sh -c -m 644 jpoll.h /usr/local/include/libol/jpoll.h .././install-sh -c -m 644 list.h /usr/local/include/libol/list.h .././install-sh -c -m 644 objbase.h /usr/local/include/libol/objbase.h .././install-sh -c -m 644 objects.h /usr/local/include/libol/objects.h .././install-sh -c -m 644 objtypes.h /usr/local/include/libol/objtypes.h .././install-sh -c -m 644 pkt_buffer.h /usr/local/include/libol/pkt_buffer.h .././install-sh -c -m 644 queue.h /usr/local/include/libol/queue.h .././install-sh -c -m 644 read_line.h /usr/local/include/libol/read_line.h .././install-sh -c -m 644 resource.h /usr/local/include/libol/resource.h .././install-sh -c -m 644 stream_buffer.h /usr/local/include/libol/stream_buffer.h .././install-sh -c -m 644 werror.h /usr/local/include/libol/werror.h .././install-sh -c -m 644 xalloc.h /usr/local/include/libol/xalloc.h .././install-sh -c -m 644 command.h /usr/local/include/libol/command.h .././install-sh -c -m 644 io_commands.h /usr/local/include/libol/io_commands.h .././install-sh -c -m 644 abstract_io.h.x /usr/local/include/libol/abstract_io.h.x .././install-sh -c -m 644 alist.h.x /usr/local/include/libol/alist.h.x .././install-sh -c -m 644 io.h.x /usr/local/include/libol/io.h.x .././install-sh -c -m 644 list.h.x /usr/local/include/libol/list.h.x .././install-sh -c -m 644 read_line.h.x /usr/local/include/libol/read_line.h.x .././install-sh -c -m 644 resource.h.x /usr/local/include/libol/resource.h.x .././install-sh -c -m 644 io_commands.h.x /usr/local/include/libol/io_commands.h.x .././install-sh -c -m 644 command.h.x /usr/local/include/libol/command.h.x .././install-sh -c -m 644 queue.h.x /usr/local/include/libol/queue.h.x .././install-sh -c -m 644 olconfig.h /usr/local/include/libol/olconfig.h /bin/sh /tmp/libol-0.2.22/mkinstalldirs /usr/local/bin ./install-sh -c libol-config /usr/local/bin/libol-config root@shine:/tmp/libol-0.2.22 # root@shine:/tmp/libol-0.2.22 # root@shine:/tmp/libol-0.2.22 # sp87286@shine->/tmp/syslog-ng-1.5.6 > echo $LD_LIBRARY_PATH /usr/dt/lib:/usr/local/lib:/usr/dt/lib:/usr/local/lib: sp87286@shine->/tmp/syslog-ng-1.5.6 > ./configure loading cache ./config.cache checking for a BSD compatible install... ./install-sh -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... (cached) yes checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking whether build environment is sane... yes checking for gcc... (cached) gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ANSI C... (cached) none needed checking for bison... (cached) bison -y checking how to run the C preprocessor... (cached) gcc -E checking for flex... (cached) flex checking for flex... (cached) flex checking for yywrap in -lfl... (cached) yes checking lex output file root... (cached) lex.yy checking whether yytext is a pointer... (cached) yes checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... (cached) yes checking for malloc.h... (cached) yes checking for unistd.h... (cached) yes checking for door.h... (cached) yes checking for stropts.h... (cached) yes checking for sys/strlog.h... (cached) yes checking for stdarg.h... (cached) yes checking for sys/klog.h... (cached) no checking for working const... (cached) yes checking whether time.h and sys/time.h may both be included... (cached) yes checking for modern utmp... (cached) yes checking whether to compile klogctl... no checking size of short... (cached) 2 checking size of int... (cached) 4 checking size of long... (cached) 4 checking for I_CONSLOG... (cached) yes checking for working alloca.h... (cached) yes checking for alloca... (cached) yes checking for vprintf... (cached) yes checking for door_create in -ldoor... (cached) yes checking for select... (cached) yes checking for snprintf... (cached) yes checking for vsnprintf... (cached) yes checking for strerror... (cached) yes checking for inet_aton... (cached) no checking for strncpy... (cached) yes checking for getutent... (cached) yes checking for getopt_long... (cached) no checking for strcasecmp... (cached) yes checking for strptime... (cached) yes checking for pthread.h... (cached) yes checking for pthread_create in -lpthread... (cached) yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking libol version >= 0.2.22... ok creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating utils/Makefile creating syslog-ng.spec creating src/config.h src/config.h is unchanged sp87286@shine->/tmp/syslog-ng-1.5.6 > sp87286@shine->/tmp/syslog-ng-1.5.6 > make Making all in src make all-recursive Making all in . gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.6/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c nscache.c nscache.c: In function `nscache_new': nscache.c:112: `INADDR_NONE' undeclared (first use in this function) nscache.c:112: (Each undeclared identifier is reported only once nscache.c:112: for each function it appears in.) *** Error code 1 make: Fatal error: Command failed for target `nscache.o' Current working directory /tmp/syslog-ng-1.5.6/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /tmp/syslog-ng-1.5.6/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /tmp/syslog-ng-1.5.6/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' sp87286@shine->/tmp/syslog-ng-1.5.6 > -- Stefano Pasquale

2 1