November 2003 - syslog-ng - lists.balabit.hu

Re: Backslash-escaped quotes in message strings
by Jos Vos 09 Nov '03

09 Nov '03

Hi, Earlier I wrote: > When a single (') or double (") quote appears in a syslog message, > this quote gets escaped with a backslash by syslog-ng, which results > in pretty ugly output, different from what the standard Linux > sysklogd does (this doesn't change the message). I have made a patch (attached) to solve this - at least in my specific situation - but the question is: does this maybe break something else? Cheers, -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204 --- syslog-ng-1.6.0rc4/src/macros.c.orig 2003-04-16 12:15:02.000000000 +0200 +++ syslog-ng-1.6.0rc4/src/macros.c 2003-11-09 17:42:54.000000000 +0100 @@ -348,7 +348,7 @@ } case M_MESSAGE: { /* message */ - length = append_string(dest, left, msg->msg->data, msg->msg->length, escape); + length = append_string(dest, left, msg->msg->data, msg->msg->length, 0); break; } default:

2 1

Use template() for Program()
by Kenneth Webber 08 Nov '03

08 Nov '03

I dont want to reinvent the wheal. I like the functionality of the template () function. Is there a way to apply the template () to a program destination or is template only good for file ()? -Ken _________________________________________________________________ From Beethoven to the Rolling Stones, your favorite music is always playing on MSN Radio Plus. No ads, no talk. Trial month FREE! http://join.msn.com/?page=offers/premiumradio

2 1

Logging options in XML?
by Forrest Aldrich 07 Nov '03

07 Nov '03

I understand that the logging function(s) of syslog-ng can be customized/modified, and I saw some mention of enabling syslog-ng to log into XML - is this possible, and if so I'd be interested in the nuances or hearing any experience with it.

1 0

1.6.0rc3 dumps core on gc when listening on TCP?
by Michaelmas 07 Nov '03

07 Nov '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is there a known issue with syslog-ng-1.6.0rc3 dumping core when reaping an idle TCP listener? I've had a high-volume syslog-ng server installed and running fine for a couple of months now with rc3, I just started to install syslog-ng on client hosts recently, so I added TCP listener options on the server. If TCP is enabled, syslog-ng dies (dumps core with signal 6) apparently when doing gc on an idle TCP listener. The problem does not happen if I comment out the TCP line: # source s_tcp { tcp( ip(192.168.192.92)); }; I don't see anything in the ChangeLog for rc4 to suggest upgrading would fix this? $ gdb /usr/local/sbin/syslog-ng ./syslog-ng.core . . . Core was generated by `syslog-ng'. Program terminated with signal 6, Abort trap. Reading symbols from /usr/libexec/ld.so...done. Reading symbols from /usr/lib/libc.so.29.0...done. #0 0x400a4fcf in _thread_sys_kill () (gdb) bt #0 0x400a4fcf in _thread_sys_kill () #1 0x400a48bb in abort () #2 0x11014 in do_object_queue_mark () #3 0x120a5 in dont_free_live_resource () #4 0x11f7c in do_resource_free () #5 0x11625 in gc_sweep () #6 0x116fd in gc () #7 0x117a4 in gc_maybe () #8 0xeebe in io_iter () #9 0x1e1a in main_loop (backend=0x1b000) at main.c:255 #10 0x2b7b in main (argc=2, argv=0xcfbfd994) at main.c:545 (gdb) quit $ exit I run "syslog-ng -F" under DJB's daemontools, so when the application dies I get an alert message and svscan restarts it immediately, but in the interim I lose some (UDP) log data... mas -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.3 wkYEARECAAYFAj+q9O0ACgkQKo6Jkwn+K0gNvQCeNfzvOSzM0aaI+YENoQSTC1dqvwYA njjCWIFA1klWjZHDvyZWFozJr6sm =38xg -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

FW: parse error on Template (
by KELLY,THOMAS (HP-Boise,ex1) 06 Nov '03

06 Nov '03

Attached is my syslog-ng.conf file <<syslog-ng.conf>> _____________________________________________ From: KELLY,THOMAS (HP-Boise,ex1) Sent: Tuesday, November 04, 2003 11:39 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: parse error on Template ( Hello, I am using syslog-ng-1.6.0rc4 on RH 9. I just migrated to using mysql for syslog-ng. After I added in the support for mysql in my syslog-ng.conf, when I try starting syslog-ng is gives me a parse error on the line that specifies the template: template("INSERT INTO logs (host, facility, priority, level, tag, date, Does anyone know how to resolve this error? Thanks, Tom Kelly

2 1

Re: [syslog-ng]FW: parse error on Template (
by Michael Earls 04 Nov '03

04 Nov '03

The only thing i see missing on your config is the " source net { udp(); }; ". I know template version does work on syslog-ng 1.6.0rc1. I would assume it would work on the next version up. Can any one else verify that template versions work on versions 1.6.0rc4. michael PGP Info: KeyID 0x5EB59708 Fingerprint 108B A1D8 76F5 08A8 501A F28C 86F4 4BC5 5EB5 9708 >>> tom.kelly(a)hp.com 11/04/03 03:31PM >>> Attached is my syslog-ng.conf file <<syslog-ng.conf>> _____________________________________________ From: KELLY,THOMAS (HP-Boise,ex1) Sent: Tuesday, November 04, 2003 11:39 AM To: 'syslog-ng(a)lists.balabit.hu' Subject: parse error on Template ( Hello, I am using syslog-ng-1.6.0rc4 on RH 9. I just migrated to using mysql for syslog-ng. After I added in the support for mysql in my syslog-ng.conf, when I try starting syslog-ng is gives me a parse error on the line that specifies the template: template("INSERT INTO logs (host, facility, priority, level, tag, date, Does anyone know how to resolve this error? Thanks, Tom Kelly

1 0

Re: [syslog-ng]parse error on Template (
by Michael Earls 04 Nov '03

04 Nov '03

Can you past the rest of the config. michael >>> tom.kelly(a)hp.com 11/04/03 01:39PM >>> Hello, I am using syslog-ng-1.6.0rc4 on RH 9. I just migrated to using mysql for syslog-ng. After I added in the support for mysql in my syslog-ng.conf, when I try starting syslog-ng is gives me a parse error on the line that specifies the template: template("INSERT INTO logs (host, facility, priority, level, tag, date, Does anyone know how to resolve this error? Thanks, Tom Kelly

1 0

parse error on Template (
by KELLY,THOMAS (HP-Boise,ex1) 04 Nov '03

04 Nov '03

Hello, I am using syslog-ng-1.6.0rc4 on RH 9. I just migrated to using mysql for syslog-ng. After I added in the support for mysql in my syslog-ng.conf, when I try starting syslog-ng is gives me a parse error on the line that specifies the template: template("INSERT INTO logs (host, facility, priority, level, tag, date, Does anyone know how to resolve this error? Thanks, Tom Kelly

1 0