June 2002 - syslog-ng - lists.balabit.hu

io.c:263: failed assertion `i == nfds'
by Doug Winter 24 Jun '02

24 Jun '02

Hi syslog-ng people, I've just installed syslog-ng 1.4.15, using libol 0.2.23 as directed in the INSTALL instructions. I am running it on a: SunOS 5.7 Generic_106541-11 sun4u sparc SUNW,Ultra-250 When I run syslog-ng with the attached configuration file, it runs for a short period (< 10 minutes) and exits. When it exits, I get this message in one of the output files: syslog:io.c:263: failed assertion `i == nfds' which file it appears in varies, which is presumably down to a file descriptor mixup. line 263 of io.c in libol is indeed: assert(i == nfds); When I run syslog-ng in debugging mode (with the -d -v switches), this problem does not occur (I have run for two days without the fault). I assume this is because in debugging mode fds 0,1 & 2 are kept open, whereas they are closed when syslog-ng becomes a daemon (note many assumptions :). I have tried to find reference to this problem on the web without success - the archives of this list aren't searchable as far as I can find, so apologies if this is a known and fixed problem. Many Thanks, Doug Winter -- 020 79610341 / 07879 423002 / dwinter(a)icpeurope.net 3 Waterhouse Square, Holborn Bars, 142 Holborn, London EC1N 2NX www.businesseurope.com www.icpeurope.net www.venturedome.com 1024D/1AB26B8C C88E DC6D A578 DEFB C493 A44D 0156 0479 1AB2 6B8C

1 0

Well, I use the last version of Syslog-ng (1.5.18). Well it looks as if syslog-ng was crashing itself and then all programsthat are usually logged via syslog-ng are unable to perform their ownactions (that's why ssh doesn't work anymore)... In some words, it looks like syslog-ng was becoming blocking for allapplications.On Fri, 2002-06-21 at 10:28, Balazs Scheidler wrote:> On Fri, Jun 21, 2002 at 10:23:24AM +0200, Yan DENET wrote:> > Hi all,> > > > Some quite strange things have happened in my ne
by Yan DENET 24 Jun '02

24 Jun '02

Well, I use the last version of Syslog-ng (1.5.18). Well it looks as if syslog-ng was crashing itself and then all programs that are usually logged via syslog-ng are unable to perform their own actions (that's why ssh doesn't work anymore)... In some words, it looks like syslog-ng was becoming blocking for all applications. On Fri, 2002-06-21 at 10:28, Balazs Scheidler wrote: > On Fri, Jun 21, 2002 at 10:23:24AM +0200, Yan DENET wrote: > > Hi all, > > > > Some quite strange things have happened in my network since i set up my > > syslog-ng as a log centralizer... > > Actually, when launched, my syslog-ng ends up to grab all resources of > > the machine on which it's installed. Then, no way to ssh to it... > > It's really strange cause normally, syslog-ng should use only very few > > resources... like syslog ! > > Whereas with syslog, everything goes well.. > > > > Don't know what's happening. Could somebody help me ? > > we can't help you unless you provide more information. which version are you > using, and what do you mean it ate up all resources? > > does it eat memory, or use all cpu cycles or? > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 --

2 1

CONGRATULATIONS: FINAL NOTICE!!!
by werken.bij.delotto＠HotPOP.com 23 Jun '02

23 Jun '02

WERKEN BIJ DE LOTTO, 41132, NL-1007 DB AMSTERDAM, THE NETHERLANDS. FROM: THE DESK OF THE DIRECTOR PROMOTIONS, INTERNATIONAL PROMOTIONS/PRIZE AWARD DEPARTMENT, REF: WBL/67-AO91657984 ATTENTION: AWARD NOTIFICATION; FINAL NOTICE We are pleased to inform you of the announcement today, 23RD JUNE 2002, of winners of the WERKEN BIJ DE LOTTO/ INTERNATIONAL PROGRAMS held on 1ST JUNE 2002. Your company, attached to ticket number 013-2316-2002-477, with serial number A025-09 drew the lucky numbers 37-13-34-85-56-42, and consequently won in category C. You have therefore been approved for a lump sum pay out of US$1,500,000.00 in cash credited to file REF NO. REF: WBL/67-AO91657984. This is from total prize money of US$22,500,000.00 shared among the fifteen international winners in the category C. All participants were selected through a computer ballot system drawn from 30,000 names from Australia, New Zealand, America, Asia, Europe and North America as part our International Promotions Program, which is conducted annually. CONGRATULATIONS! Your fund is now deposited with a Finance and Security House insured in your name. Due to the mix up of some numbers and names, we ask that you keep this award strictly from public notice until your claim has been processed and your money remitted to your account. This is part of our security protocol to avoid double claiming or unscrupulous acts by participants of this program. We hope with a part of you prize, you will participate in our end of year high stakes US$1.3 billion International lotto. To begin your claim, please contact your claims officer immediately: JANSEN DAVIS FOREIGN SERVICE MANAGER, EUROLITE BV, TEL: 31 205241592 FAX: 31 205241597 EMAIL: eurolitebv(a)poboxes.com For due processing and remittance of your prize money to a designated account of your choice. Remember, you must contact your claims officer not later than 29TH of JUNE 2002. After this date, all funds will be returned as unclaimed. NOTE: In order to avoid unnecessary delays and complications, please remember to quote your reference number in every one of your correspondences with your officer. Furthermore, should there be any change of your address, do inform your claims officer as soon as possible. Congratulations again from all our staff and thank you for being part of our promotions program. Sincerely, THE DIRECTOR PROMOTIONS, WERKEN BIJ DE LOTTO. www.werken-bij-delotto.net N.B. Any breach of confidentiality on the part of the winners will result to disqualification. Please do not reply this mail.

1 0

problems building 1.5.18 on solaris
by Bret Watson 23 Jun '02

23 Jun '02

Hi All, things don't seem to build on solaris 8 for 1.5.18.. here are the errors.. Making all in src make[1]: Entering directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' cd /home/bret/syslog-ng-beta/syslog-ng-1.5.18 && autoheader make all-recursive make[2]: Entering directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' Making all in . make[3]: Entering directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c main.c main.c: In function `main': main.c:437: warning: passing arg 2 of `resolve_user_group' from incompatible pointer type main.c:437: warning: passing arg 3 of `resolve_user_group' from incompatible pointer type main.c:441: warning: passing arg 2 of `resolve_group' from incompatible pointer type gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c sources.c gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c center.c center.c: In function `do_distribute_log': center.c:157: warning: deprecated use of label at end of compound statement gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c filters.c filters.c: In function `do_filter_call': filters.c:342: warning: implicit declaration of function `memcmp' gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c destinations.c gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c log.c gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c cfgfile.c gcc -DHAVE_CONFIG_H -I. -I/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOUR CE -c cfg-grammar.c cfg-grammar.y: In function `yyerror': cfg-grammar.y:703: warning: implicit declaration of function `fprintf' cfg-grammar.y:703: `stderr' undeclared (first use in this function) cfg-grammar.y:703: (Each undeclared identifier is reported only once cfg-grammar.y:703: for each function it appears in.) make[3]: *** [cfg-grammar.o] Error 1 make[3]: Leaving directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/home/bret/syslog-ng-beta/syslog-ng-1.5.18/src' make: *** [all-recursive] Error 1 Don't know if this is fixed in cvs?... Bret Technical Incursion Countermeasures www.ticm.com The Insider www.ticm.com/info/insider

1 0

syslog-ng and Redhat 7.3
by Kai Backhaus 22 Jun '02

22 Jun '02

Hello List, I tried to install/compile syslog-ng vers. 15.18 on to my RH 7.3 System. My System is using glibc vers. 2.5.5 While compiling a lot of errors occurred, so I could not run syslog-ng. Is syslog-ng vers. 15.18 not compatible with RH 7.3 and libc vers. 2.5.5? Does any body has any answer for that question? It is my intention to setup an win-nt40-eventlog-messages collecting linux server which keeps all NT-Eventlog from my network send by EventReporter. I just want to use the enhanced features of syslog-ng for that project. Thanx for helping in advance Kai

1 0

Syslog-ng makes my server crash.
by Yan DENET 21 Jun '02

21 Jun '02

Hi all, Some quite strange things have happened in my network since i set up my syslog-ng as a log centralizer... Actually, when launched, my syslog-ng ends up to grab all resources of the machine on which it's installed. Then, no way to ssh to it... It's really strange cause normally, syslog-ng should use only very few resources... like syslog ! Whereas with syslog, everything goes well.. Don't know what's happening. Could somebody help me ? -- Yan DENET

2 1

Re: ERROR...
by Balazs Scheidler 21 Jun '02

21 Jun '02

First of all the mysql howto was not written by me, second template() destinations are only supported by the 1.5.x releases. please ask these kind of questions on the mailing list. Thanks. On Fri, Jun 21, 2002 at 02:38:05PM +0800, shan tenorio wrote: > i follwed the step-step procedures on the mysql-log but i do get a parse error when starting syslog-ng. > > this is the line where i get the parsing error... > > ## Log syslog-ng to mysql database > ## > destination d_mysql { > pipe("/tmp/mysql.pipe" > this line ----> template("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); > }; > log { source(net); destination(d_mysql); > }; > > > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

What's the diffrence in internal() between 1.5.15 and 1.5.18
by Andreas Schulze 20 Jun '02

20 Jun '02

Hi Batzi, we switched from 1.5.15 to 1.5.18 and observed the following difference in handling logging 'STATS' and daemon start/stop to the internal() source: 1.5.15: works fine for us. STATS and daemon start/stop are logged to a file attached to internal() 1.5.18: seems nothing is logged to internal(). Where are we wrong. We don't changed the config file. Thanks for hints. -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | | sh# cat>$$.c<<EOT | main(l,a,n,d)char**a;{for(d=atoi(a[1])/10*80-atoi(a[2])/5-596;n="@NK\ | ACLCCGZAAQBEAADAFaISADJABBA^SNLGAQABDAXIMBAACTBATAHDBANZcEMMCCCCAAhE\ | IJFAEAAABAfHJETBdFLDAANEfDNBPHdBcBBBEA_AL H E L L O, W O R L D! " | [l++-3];)for(;n-->64;)putchar(!d+++33^l&1);} | EOT | gcc -o$$ $$.c;clear;./$$ 52 8;rm -f $$*

1 0

Pb with messages contain '\n'
by Jerome Peducasse 20 Jun '02

20 Jun '02

Hello, When a message contains 2 chunks (or more) separated by '\n', next message losts its facility.level because it contains end of previous log. For example: jerome@peducasse:~/> logger -psyslog.debug "Test #1 > Test #2" jerome@peducasse:~/> logger -psyslog.debug "Test #3" Result is: Jun 20 12:54:42 peducasse [syslog.debug] jerome jerome: Test #1 Jun 20 12:54:45 peducasse [user.notice] Test Test #2<47>Jun 20 12:54:45 jerome: Test #3 ^^^^^^^^^^^->end of previous message Thanks for your help. -- Jerome Peducasse Wanadoo Portails - Sophia Antipolis

1 0

Some missunderstanding in filter
by Serge Leschinsky 19 Jun '02

19 Jun '02

Dear sirs. I'm newbie in syslog-ng therefore I beg you to treat my question with indulgence if it is primitive. I'm very sorry for an attached conf but I think I can't explain my problem without this. I have linux (RH) box with syslog-ng-1.4.10 (it's some outdated package but I haven't enough knowledge for its rebuilding). My problem is following: the log from MTA comes to /var/log/messages. So I have duplicate MTA log in mail.log and messages. As far as I understand the problem point is in following filters: > filter f_messages { level(info, emerg, debug, notice, warn, crit, err); }; >log { source(src); filter(f_messages); destination(messages); }; There was an attempt to "log anything (except mail) of level info or higher". But mail is logging to /var/log/messages anyway. How should I modify the filters for resolving this? I will be very appreciate for your kind help. -- Yours sincerely Serge Leschinsky mailto:fish@artlife.tomsknet.ru Wednesday, June 19, 2002

3 2