July 2001 - syslog-ng - lists.balabit.hu

Eliminating certain keyword from the "all" directive?
by Stephen C Burns 24 Jul '01

24 Jul '01

Hi all, I have a question regarding the redirection of certain log messages to files. I currently have the "all" directive sending every syslog message into /var/log/messages, via: destination all { file("/var/log/messages"); }; And that is great, except I don't want my mail messages getting sent into the messages file as well as this takes up a lot of space. So I basically need some way to say "send all messages except for mail messages into /var/log/messages" Is there such a way? Thank you for any help!!

1 0

conflict with redhat init scripts
by Michael Stenner 24 Jul '01

24 Jul '01

I'm using syslog-ng 1.4.11 on a redhat 7.1 machine and have discovered a conflict involving the way syslog-ng forks and exits, and the way redhat starts its daemons. I don't think either end is really doing anything wrong here, but I think some things could be tidied up a bit. Basically, I think it comes from the fact that when syslog-ng forks, the parent waits for the child to send it a SIGTERM, and then dies with exit code 0. Unfortunately, I think that initlog (the redhat tool for starting daemons and logging the results) is thinking that the daemon was sent an uncaught SIGTERM and is dying. Let me give you some examples of what I mean. When you use bash to start syslog-ng and then print the "exit status", $?, bash reports 143. From the bash manpage: When a command terminates on a fatal signal N, bash uses the value of 128+N as the exit status. 143 - 128 = 15 = SIGTERM When you use initlog to start syslog-ng, initlog returns 15 directly. It also logs (via syslog-ng, humorously) that syslog-ng failed to start. Consequently, the init script reports failure. I'm still confused about a couple of things. 1) I've trolled through the syslog-ng source, and It's clear that the TERM signal _should_ be caught, so why are bash and initlog detecting this? 2) I've trolled through the initlog source, and I can't find where initlog tries to detect the type of signal a program received, or even that it cares. As far as I can tell, it just looks for the exit value of the program. As you can see, I'm already hip-deep in both programs, so I'm certainly willing to try and help "fix" this. I'm just wondering about these last two points, and which end it would be best to fix it on. (the fact that bash reports as it does leads me to lean toward changing this behavior in syslog-ng) Thanks, Michael P.S. If anyone is interesting in doing the same source-diving that I've been doing, you can get the same things I've been using from: http://mirror.dulug.duke.edu/ mirror/dulug/dulug-7.1/SRPMS/dulug/syslog-ng-1.4.11-3.src.rpm http://mirror.dulug.duke.edu/ mirror/redhat/redhat-7.1/en/os/i386/SRPMS/initscripts-5.83-1.src.rpm source rpms can be unpacked to an arbitrary tmpdir with the following commands: SRCDIR=$HOME/tmp mkdir -p $SRCDIR/usr/src/redhat rpm --root $SRCDIR --install syslog-ng-1.4.11-3.src.rpm cd $SRCDIR/usr/src/redhat/SOURCES/ The rest should be obvious. -- Michael Stenner Office Phone: 919-660-2513 Duke University, Dept. of Physics mstenner(a)phy.duke.edu Box 90305, Durham N.C. 27708-0305

4 7

Problem with libol-0.2.23 syslog-ng 1.4.12
by James Eborall 20 Jul '01

20 Jul '01

Thanks for the patch to afstreams.c Now it works but I cannot use the 'door' source (this is Solaris 2.7). If I add source s_door { door ("/etc/.syslog_door"); }; to my syslog-ng.conf then I get a parse error, but door support is compiled in so is there something else I should check?. Thanks james

1 0

filter match usage
by Ravi Malghan 20 Jul '01

20 Jul '01

Hello: I want to use filter messages which begin with a string (for example RDP). Can I use match("^RDP") . Thanks Ravi

1 0

Problem compiling libol-0.2.23 and syslog-ng-1.4.12
by James Eborall 20 Jul '01

20 Jul '01

I have a problem compiling syslog-ng on Sol 2.7. libol compiles and installs ok. syslog-ng won't compile, afstreams.c: In function `io_stream_get'; afstreams.c:167: too few arguments to function `init_file' I've checked and the proto in libol/src/io.h has 4 arguments whereas the usage in afstreams.c is with 3, anyone have a fix? james

1 0

RE: [syslog-ng]Problem with libol-0.2.23 syslog-ng 1.4.12
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 20 Jul '01

20 Jul '01

look in the doc directory for the correct syntax. There is an example. Your syntax here is incorrect. Regards, Drew -----Original Message----- From: James Eborall [mailto:james.eborall@mci.co.uk] Sent: Friday, July 20, 2001 8:47 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Problem with libol-0.2.23 syslog-ng 1.4.12 Thanks for the patch to afstreams.c Now it works but I cannot use the 'door' source (this is Solaris 2.7). If I add source s_door { door ("/etc/.syslog_door"); }; to my syslog-ng.conf then I get a parse error, but door support is compiled in so is there something else I should check?. Thanks james

1 0

RE: [syslog-ng]Problem compiling libol-0.2.23 and syslog-ng-1.4.1 2
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 20 Jul '01

20 Jul '01

--- Balazs Scheidler <bazsi(a)balabit.hu> wrote: > try this patch: > > diff -u -r1.10.2.1 afstreams.c > --- afstreams.c 2001/02/25 12:30:22 1.10.2.1 > +++ afstreams.c 2001/07/16 08:26:55 > @@ -164,7 +164,7 @@ > { > NEW(stream_fd, f); > > - init_file(backend, &f->super, fd); > + init_file(backend, &f->super, fd, NULL); > f->super.prepare = prepare_stream_fd; > f->super.read = stream_read_callback; > f->super.want_read = 1; -----Original Message----- From: James Eborall [mailto:james.eborall@mci.co.uk] Sent: Friday, July 20, 2001 5:08 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Problem compiling libol-0.2.23 and syslog-ng-1.4.12 I have a problem compiling syslog-ng on Sol 2.7. libol compiles and installs ok. syslog-ng won't compile, afstreams.c: In function `io_stream_get'; afstreams.c:167: too few arguments to function `init_file' I've checked and the proto in libol/src/io.h has 4 arguments whereas the usage in afstreams.c is with 3, anyone have a fix? james

1 0

using perl module with syslog-ng
by Ravi Malghan 19 Jul '01

19 Jul '01

Hello: I have configured syslog-ng on solaris 2.7 and can see syslog messages logged into the /var/adm directory when I use the logger command. The perl module which I use in syslogd does not seem to working with syslog-ng the source line in syslog-ng server machine is source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; my perl lines are as follows openlog ($ident, 'ndelay', 'user'); syslog ("user.alert", "PingStatus change: Host %s is down\n", $host); Is there anything else I need to do to make this happen? Thanks Ravi

3 3

$HOST trouble.
by Alex Goldberg 18 Jul '01

18 Jul '01

Hi. I did a simple setup of syslog-ng 1.4.10 to log all remote messages based on hostname/facility.priority.: source s_udp { udp(); }; destination d_all { file("/var/logng/$HOST/$FACILITY.$PRIORITY"); }; log { source(s_sys) ; source(s_udp) ; destination(d_all); }; The problem is that when some progs log in non-stnadart format , I get a directory structure that looks like: >ls Thanks ?<Quantum ?<Sony ?Cmd ?Disconnected ?Generic ?Rev. ?SCSI ?pkt_flags=0x0 ?pkt_scbp=0x0 > CU Copyright Covered In Other San _ > and inside there will be a file with correct facility.priority name containing the remaining part of a message. Is there any way to use IP address of a source with DNS lookups , and not what source computers sends in a log message?

1 0

problem with make_class
by Matt Okeson-Harlow 18 Jul '01

18 Jul '01

this is the error i am getting when i try to build syslog-ng 1.4.12 make_class <afstreams.c >afstreams.c.xT /bin/sh: make_class: not found make[3]: *** [afstreams.c.x] Error 1 make[3]: Leaving directory `/export/home/mharlow/syslog-ng-1.4.12/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/export/home/mharlow/syslog-ng-1.4.12/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/export/home/mharlow/syslog-ng-1.4.12/src' make: *** [all-recursive] Error 1 any ideas? does make_class require another package installed? thanks! -- matt okeson-harlow matt at technomage.net http://www.technomage.net ($do || !$do) && undef($try) ; # Master of Perl, Yoda is. Hmmmm? http://shellforce.com <- shell accounts - web hosting -> http://cyberius.net send icbm here =--> 43°3'11'N-89°28'52"W

3 2