May 2002 - syslog-ng - lists.balabit.hu

1.5.18/bison-1.32/stdio.h problem
by Borsenkow Andrej 30 May '02

30 May '02

Obviously new bison includes stdio.h only when debugging is enabled. Without it fails miserably in yyerror: /* Enable debugging if requested. */ #if YYDEBUG # ifndef YYFPRINTF # ifdef __cplusplus # include <cstdio> /* INFRINGES ON USER NAME SPACE */ # else # include <stdio.h> /* INFRINGES ON USER NAME SPACE */ # endif # define YYFPRINTF YYSTD (fprintf) # endif (this is not the original cfg-grammar.c but regenerated locally). The following patch is bandaid but I am not sure how to do it portably enough (meaning - accounting for earlier bison versions). One possibility is of course move yyerror out of cfg-grammar.y to avoid confusion. -andrej --- syslog-ng-1.5.18/src/cfg-grammar.y.orig Thu May 30 11:39:06 2002 +++ syslog-ng-1.5.18/src/cfg-grammar.y Thu May 30 11:39:52 2002 @@ -698,6 +698,8 @@ extern int linenum; +#include <stdio.h> + void yyerror(char *msg) { fprintf(stderr, "%s at %d\n", msg, linenum);

2 1

syslog-ng 1.5.18 released
by Balazs Scheidler 30 May '02

30 May '02

Hi, I've released syslog-ng 1.5.18 with the folowing NEWS entry: News for the 1.5.18 release Wed, 29 May 2002 12:23:45 +0200 Changes: * fixed a crash bug when an UDP destination was unreachable In addition to this you can now specify log_prefix() for pipe sources. It can be downloaded from the usual places: http://www.balabit.hu/en/downloads/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

Re: Fwd: [syslog-ng]Logging Remotely from Solaris to Linux
by Ron Braley 29 May '02

29 May '02

Bazsi I'll try this right away!! I really appreciate you and all you do for the people asking syslog questions regularly. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 05/29/02 06:47AM >>> On Tue, May 28, 2002 at 11:44:22AM -0500, Ron Braley wrote: > Hi bazsi > > Yes, I'm running syslog-ng on both platforms. > > I've attached the configuration files from the Linux box used to record > logs, and from the Solaris box sending logs. I hope this helps. > > Please keep in mind that I've only configured cron to send to the > source s_tcp destination for testing. I've used the logger command > "logger -p cron.crit TEST FROM JUB" to test things. Also, I'm new to > syslogging (as I'm sure you can tell). > > Thanks again, and have a great day! Are you sure that the facility code for cron matches on Solaris and Linux? Try to create a bare bone configuration like: (solaris) source s_all { internal(); sun-streams("/dev/log" door("/etc/.syslog_door"); }; destination d_tcp { tcp("1.2.3.4"); }; log { source(s_all); destination(d_tcp); }; (linux) source s_all { internal(); unix-stream("/dev/log"); tcp(); }; destination d_messages { file("/var/log/messages"); }; log { source(s_all); destination(d_messages); }; And as soon as it works, try playing with filters and the rest. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: Fwd: [syslog-ng]Logging Remotely from Solaris to Linux
by Balazs Scheidler 29 May '02

29 May '02

On Tue, May 28, 2002 at 11:44:22AM -0500, Ron Braley wrote: > Hi bazsi > > Yes, I'm running syslog-ng on both platforms. > > I've attached the configuration files from the Linux box used to record > logs, and from the Solaris box sending logs. I hope this helps. > > Please keep in mind that I've only configured cron to send to the > source s_tcp destination for testing. I've used the logger command > "logger -p cron.crit TEST FROM JUB" to test things. Also, I'm new to > syslogging (as I'm sure you can tell). > > Thanks again, and have a great day! Are you sure that the facility code for cron matches on Solaris and Linux? Try to create a bare bone configuration like: (solaris) source s_all { internal(); sun-streams("/dev/log" door("/etc/.syslog_door"); }; destination d_tcp { tcp("1.2.3.4"); }; log { source(s_all); destination(d_tcp); }; (linux) source s_all { internal(); unix-stream("/dev/log"); tcp(); }; destination d_messages { file("/var/log/messages"); }; log { source(s_all); destination(d_messages); }; And as soon as it works, try playing with filters and the rest. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

stresstest
by Sangbutsarakum, Patai 29 May '02

29 May '02

I'm going to implement central log server in my datacenter to accept many tons of log from many servers and equipments. I'm newbies in syslog-ng, I've run stresstest.sh on my solaris 2.6 [ 2SPARCs, 1 GB RAM] [I've use version 1.4.15] after run just a moment. It show "Segmentation Fault". What does it means for syslog-ng [can't tolerate] or my machine is suck? Should I concern about this? what should i do ? Please suggest Patrick

2 1

"fifo" and "file" source difference?
by Borsenkow Andrej 28 May '02

28 May '02

I needed a source that takes input from a FIFO so I made an obvious "fifo" source. Then I realized I needed log_prefix (that is not supported by fifo) so I changed it to "file". So far I cannot see any real difference. When should "fifo" and when "file" be used? Or are they exactly the same, just under different name? TIA -andrej

2 1

Logging Remotely from Solaris to Linux
by Ron Braley 28 May '02

28 May '02

Greetings! I'm having trouble getting my Solaris servers to log remotely to a Linux 7.1 server. The other Linux boxes log remotely to it OK, and the Solaris boxes will log to a Solaris server configured to listen (source s_tcp { tcp(); };). However, the Linux boxes won't log to a Solaris server, nor will the Solaris boxes log to a Linux server. What am I missing? Is there a format problem or something I need to overcome? Thanks in advance for helping me save the rest of my hair!! rb

1 0

RE: [syslog-ng]syslog-ng survey
by Ohrberg, Mick 27 May '02

27 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bazsi, Do you have any preliminary results for the survey? I'm very curious to see how popular syslog-ng really is! /Mick | -----Original Message----- | From: Balazs Scheidler [mailto:bazsi@balabit.hu] | Sent: Wednesday, May 15, 2002 5:58 AM | To: syslog-ng(a)lists.balabit.hu | Subject: [syslog-ng]syslog-ng survey | | | Hi, | | Please find the time to fill out the survey below to help us | to further | improve syslog-ng. You can either fill it out in this mail message | by entering the appropriate marks in the brackets, or on-line by | pointing your | browser to this url: | | http://www.balabit.hu/en/downloads/syslog-ng/survey/ | | Thanks in advance, [snip] | -- | Bazsi | PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD | 804E C82C 8EB1 | | _______________________________________________ | syslog-ng maillist - syslog-ng(a)lists.balabit.hu | https://lists.balabit.hu/mailman/listinfo/syslog-ng | -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA/AwUBPO5bUueVnE5KiyKKEQKHMQCeLlhisonB112W6+3nrUoKn1+sOBwAoLNB RbMXeluositTHLBtN9x1+kIQ =x5iJ -----END PGP SIGNATURE-----

2 1

Re: [syslog-ng]Problem with HP-UX 11.0
by dcntrnoc＠cmp.com 23 May '02

23 May '02

Thanks for the info - I did try a number of different source statements, none of which gave me anything useful. I'll deal with syslogd on the HP boxes until we're able to upgrade. Thanks, Sharon. Balazs Scheidler <bazsi(a)balabit.hu> To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists bcc: .balabit.hu Subject: Re: [syslog-ng]Problem with HP-UX 11.0 05/17/2002 03:51 AM Please respond to syslog-ng On Thu, May 16, 2002 at 12:53:33PM -0600, Brad Arlt wrote: > On Thu, May 16, 2002 at 02:16:58PM -0400, dcntrnoc(a)cmp.com wrote: > > Hi all, > > > > I have been running syslog-ng on a handful of Solaris boxes for some time > > now with no problems, and am attempting to get it running on HP-UX. > > I have compiled (with gcc) and installed syslog-ng 1.5.16 and libol 0.3.2 on > > a system running HP-UX 11.00. I am using the following source statement > > in my config file: > > > > source s_sys { pipe("/dev/log"); internal(); }; > > Err... Ah, are you sure that opening a pipe from /dev/log will yeild > what you want? /dev/log is usually a Unix domain socket, which might > put more in the stream asside from ASCII. I'd turn off any syslog > daemons you have and just cat /dev/log | od Sorry, but HP-UX's /dev/log is really a pipe and not a socket. The problem seems to be that programs sending messages to /dev/log write a whole 2048 bytes block regardless the real length of the message. As syslog-ng reads _lines_ from a pipe, the rest of the 2048 bytes block is also read, which is what you see there. Currently my development branch of syslog-ng 2.0 supports this, but 1.5.x doesn't. A temporary solution would be to use both original syslogd from HP-UX and have it send messages to localhost where a syslog-ng is listening. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Christopher Leonardos/Triumph is out of the office.
by Christopher_Leonardos＠interliant.com 23 May '02

23 May '02

I will be out of the office starting 05/22/2002 and will not return until 05/28/2002. If you need immediate assistance please send email too either scott_tobias(a)interliant.com or mitchell_hryckowian(a)interliant.com Thank You

1 0