December 2002 - syslog-ng - lists.balabit.hu

Parse error on line 1
by Wes Hall 06 Dec '02

06 Dec '02

It has to be something very simple, anyone have an idea why I'm receiving this error? Thanks wes ------------------ [root@EARTH syslog-ng]# /usr/local/sbin/syslog-ng -v parse error at 1 Parse error reading configuration file, exiting. [root@EARTH syslog-ng]# ------------------- syslog-ng.conf: [root@EARTH syslog-ng]# cat syslog-ng.conf options { sync(0); }; source src { udp(); internal(); }; destination misc{file("/var/log/misc");}; log{source(src); destination (misc);}; [root@EARTH syslog-ng]#

2 1

SEGV when parsing localip - version 1.5.23
by Nigel Metheringham 05 Dec '02

05 Dec '02

I'm getting the same SEGV when a localip is specified as was described at the bottom of this message:- http://lists.balabit.hu/pipermail/syslog-ng/2002-September/003853.html Having looked at it further, looks like this function in afinet.c is the culprit void inet_address_setip(struct address_info **a, const char *ip) { CAST(inet_address_info, addr, *a); if (addr) { *a = &make_inet_address_c(ip, NULL)->super; } else { ol_string_free(addr->ip); addr->ip = c_format("%z", ip); } } The if (addr) tests if addr is NULL, and if it *is* it is then addr->ip is dereferenced causing a SEGV. Looks to me as though the if and else parts are swapped over. I'm going to experiment with that as a fix. Nigel. -- [ Nigel Metheringham Nigel.Metheringham(a)InTechnology.co.uk ] [ - Comments in this message are my own and not ITO opinion/policy - ]

1 0

RE: [syslog-ng]about syslog-ng please
by Hamilton, Andrew 05 Dec '02

05 Dec '02

That should be libol-0.3.x Drew -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Thursday, December 05, 2002 10:28 AM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]about syslog-ng please You also need libol-3.x. You don't have to install it but you do have to download and build it. If you don't install it in a place in your path you must tell configure when you build syslog-ng where to find libol. Regards, Drew -----Original Message----- From: sncl-hz [mailto:sncl-hz@sohu.com] Sent: Thursday, December 05, 2002 8:09 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]about syslog-ng please Sir: Just now ,i install syslog-ng-1.5.0 in my redhat 7.2 professional .i completely follow the INSTALL documents, but i can not success. and the directory /etc/syslog-ng does not be created . below is the fact: ---------------------------------------------------------------------------- ---- Making all in src make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' make all-recursive make[2]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' Making all in . make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.0/src -I. -O2 -Wall -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make: *** [all-recursive] Error 1 [root@ syslog-ng-1.5.0]# -------------------------------------------------------------------------- i don't know the reason ,just that time my syslog are working. what should i do to cover the question ? thanks best regard. david ?%?��?-?%?��+-��i��m��?�X��ڕ��?-�w��̬��'�Zު秶\��G��?'�� a��0q��y޷?�Z ?�j�m _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]about syslog-ng please
by Hamilton, Andrew 05 Dec '02

05 Dec '02

You also need libol-3.x. You don't have to install it but you do have to download and build it. If you don't install it in a place in your path you must tell configure when you build syslog-ng where to find libol. Regards, Drew -----Original Message----- From: sncl-hz [mailto:sncl-hz@sohu.com] Sent: Thursday, December 05, 2002 8:09 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]about syslog-ng please Sir: Just now ,i install syslog-ng-1.5.0 in my redhat 7.2 professional .i completely follow the INSTALL documents, but i can not success. and the directory /etc/syslog-ng does not be created . below is the fact: ---------------------------------------------------------------------------- ---- Making all in src make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' make all-recursive make[2]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' Making all in . make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.0/src -I. -O2 -Wall -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make: *** [all-recursive] Error 1 [root@ syslog-ng-1.5.0]# -------------------------------------------------------------------------- i don't know the reason ,just that time my syslog are working. what should i do to cover the question ? thanks best regard. david ?%?��?-?%?��+-��i��m��?�X��ڕ��?-�w��̬��'�Zު秶\��G��?'�� a��0q��y޷?�Z ?�j�m

1 0

syslog-ng fails to start if attempting to forward to unrouteable ip
by Nigel Metheringham 05 Dec '02

05 Dec '02

I have a box I am testing syslog-ng v1.5.23 on - its basically a stripped Red Hat 7.3 box with a 2.4.20 kernel. This box talks to other stuff via an IPSec (FreeS/WAN) link. At boot up time, when the interfaces are originally bought up, the box has almost no routes at all - it definitely has no default route. Following the syslog-ng startup the ipsec startup script runs and brings up the tunnels incidentally providing a default route. The syslog-ng config includes remote logging of some of the information to a central server - seen over the IPSec links. The destination part of this is set as udp("1.2.3.4"); However the syslog-ng startup fails with an error - from memory it is:- Error creating AF_INET socket - Network is unreachable I'm not sure if a failing destination - especially where its a network/udp one - should kill the complete daemon startup. Also can people suggest a route round this? So far the best that comes to mind is to make the remote logging run via a program which buffers anything it receives and tries repeatedly to send it until it manages to successfully sent it - but thats quite a hack. Nigel. -- [ Nigel Metheringham Nigel.Metheringham(a)InTechnology.co.uk ] [ - Comments in this message are my own and not ITO opinion/policy - ]

1 0

about keyserver
by sncl-hz 05 Dec '02

05 Dec '02

Sir: Just now i want to run this command for pgp key: gpg --keyserver keyserver.pgp.com --recv-keys 9AF8D0A9 but it's timeout many times. i know before tar the tar.gz, i must run the command ,and make syslog-ng working. where is the wrong? Thanks. david

1 0

about syslog-ng please
by sncl-hz 05 Dec '02

05 Dec '02

Sir: Just now ,i install syslog-ng-1.5.0 in my redhat 7.2 professional .i completely follow the INSTALL documents, but i can not success. and the directory /etc/syslog-ng does not be created . below is the fact: -------------------------------------------------------------------------------- Making all in src make[1]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' make all-recursive make[2]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' Making all in . make[3]: Entering directory `/usr/local/src/syslog-ng-1.5.0/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng-1.5.0/src -I. -O2 -Wall -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng-1.5.0/src' make: *** [all-recursive] Error 1 [root@ syslog-ng-1.5.0]# -------------------------------------------------------------------------- i don't know the reason ,just that time my syslog are working. what should i do to cover the question ? thanks best regard. david

1 0

2.4.20 & dgram
by Rain＠home.ro 05 Dec '02

05 Dec '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 i've been messing around with syslog-ng for some time and i've recently upgraded to the 2.4.20 kernel as soon as it appeared in fact... it ran without any problem on 2.4.18/2.4.19. on the new kernel however it bails out with an unrecognised socket error from io.c... i've managed to make it work though by changing from unix-dgram to unix-stream in syslog-ng.conf. in case somebody has the same problems and syslog-ng bails out with: io.c: sockaddr2info(): Unsupported address family 63472. or something similar on the 2.4.20, i suggest the above mentioned "workaround" (change to unix-stream("/dev/log"))... if this is wrong, or somebody can explain to me.. why unix-dgram doesn't work... i'd be pleased to know :) thanks -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE97niD/cQLO9Sg2gARAoMvAJ0Wo/jHsX2NEX2wXJ3MYT6Sfhj8EwCfXpy8 PhBOYzOU6ZOYx6HeifIaxd0= =qoU6 -----END PGP SIGNATURE-----

2 1

chown
by David Rohleder 04 Dec '02

04 Dec '02

Hello, is it necessary to change owner, group and file permissions on log files? Syslog-ng does this every time daemon is reloaded. Or can i control this behavior by some command? -- ------------------------------------------------------------------------- David Rohleder davro(a)ics.muni.cz Institute of Computer Science, Masaryk University Brno, Czech Republic -------------------------------------------------------------------------

1 0

RE: [syslog-ng]centralized syslog-server.
by Jon Hofstad 04 Dec '02

04 Dec '02

aha.. Thanks! It isn`t necessery to set up local logging, is it? I only wants everything to be sent out via UPD and nothing to be stored locally.. /Jon > -----Original Message----- > From: Nate Campi [mailto:nate@campin.net] > Sent: 4. desember 2002 16:40 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]centralized syslog-server. > > > On Wed, Dec 04, 2002 at 04:04:08PM +0100, Jon Hofstad wrote: > > > > So my host-config only pushes out the syslog-messages that > spesifies that it > > wants to be sent to the remote host? > > > > Then my question is, how should I configure the host to send out all > > messages generated, to a remote syslog-server? > > # set up logging to loghost > destination loghost { > udp("10.0.0.1" port(514)); > }; > > # send everything to loghost, too > log { > source(src); > destination(loghost); > }; > > > -- > Nate Campi http://www.campin.net > > To sysadmin or not to sysadmin... that is the question, whether tis > nobler in the minde to suffer the slings and arrowes of outragious > fortune, or climb to the top of the building with a high-power rifle > and scope. > >

2 1