February 2003 - syslog-ng - lists.balabit.hu

Loggin Server
by Iulian Topliceanu 17 Feb '03

17 Feb '03

Hej, I've installed syslog-ng-1.4.17 on RedHat 8.0 everything works OK till I try to set it to get logs from other machines which are running RedHat 8.0 too but are using syslogd (and are logging remote) I am using this line(s) on the syslo-ng machine: source src { unix-stream("/dev/log"); internal(); }; source remote { tcp(ip("0.0.0.0") port(514) keep-alive(yes)); }; But it doesn't work! I don't want to use stunnel, what did I set wrong? Syslogd is getting the remote logs, why doesn't syslog-ng? Could anyone send me a conf file? Iulian Topliceanu

1 0

Betr.: Re: Betr.: Re: [syslog-ng]yywrap
by EDL.Essed＠belastingdienst.nl 17 Feb '03

17 Feb '03

I tried it, but still the same problem. But you're right about configure not able to find the flex library (that's the error I see in config.log). I should have written LIBPATH (instead of LIBDIR), that is what is set to /usr/local/lib, where libfl.a is located. But I don't know if that is enough. Actually, that was my question, is LIBPATH enough to set? (obviously not as it doesn't work, it is exported). Thanks, Esteban. ___________________________________________ Esteban Essed B/CICT, Sector Continuiteit MPS/Midrange WBC-F305 Tel: (055 - 528) 3586 ___________________________________________ wok, n.: Something to thwow at a wabbit. ___________________________________________ |---------+--------------------------------> | | "Achim Gsell" | | | <achim(a)cybercity.ch> | | | Verzonden door: | | | syslog-ng-admin@lists| | | .balabit.hu | | | | | | | | | 14-02-2003 19:34 | | | Antwoord a.u.b. aan | | | syslog-ng | | | | |---------+--------------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | Aan: syslog-ng(a)lists.balabit.hu | | cc: | |Onderwerp: Re: Betr.: Re: [syslog-ng]yywrap | >-------------------------------------------------------------------------------------------------------------------------------| On Friday 14 February 2003 09:46, EDL.Essed(a)belastingdienst.nl wrote: > LEXLIB in src/Makefile is set to nothing (empty). Set LEXLIB=-lfl in src/Makefile by hand and try to compile it. If this works, the configure script has a problem in finding the flex library. > Checking output of configure gives me: > > checking for flex... flex > checking for flex... (cached) flex > checking for yywrap in -lfl... no > > Checking config.log, I see libfl.a can not be found. > libfl.a is installed in /usr/local/lib > LIBDIR=/lib:/usr/local/lib > > Any other env variable I should set? I'm not familiar with AIX, but are you shure it's enough to set the env. variable LIBDIR (at least: you should export it)??? Achim _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

1 0

syslog-ng 1.4.17 crash
by Elad Levy 16 Feb '03

16 Feb '03

Hello, I have a few linux servers with syslog-ng 1.4.17 logging to a central syslog-ng 1.4.17 logserver. Whenever I disconnect the client the server crash and vice versa. can anyone verify ? thanks in advance, Elad. -- http://fastmail.fm - The way an email service should be

1 0

Logcheck/LogSentry doesn't work right with syslog-ng! How fix...(thinks all is an emergency)
by seberino＠spawar.navy.mil 15 Feb '03

15 Feb '03

LogCheck aka LogSentry look for strange behavior in log files. I just tried syslog-ng for first time and noticed now LogCheck thinks everything is an emergency. How make them like each other??? Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-0804 Email: seberino(a)spawar.navy.mil _______________________________________

2 3

Betr.: Re: [syslog-ng]yywrap
by EDL.Essed＠belastingdienst.nl 14 Feb '03

14 Feb '03

LEXLIB in src/Makefile is set to nothing (empty). Checking output of configure gives me: checking for flex... flex checking for flex... (cached) flex checking for yywrap in -lfl... no Checking config.log, I see libfl.a can not be found. libfl.a is installed in /usr/local/lib LIBDIR=/lib:/usr/local/lib Any other env variable I should set? Thanks, Esteban Essed. On Friday 14 February 2003 08:21, EDL.Essed(a)belastingdienst.nl wrote: > To compile syslog-ng on AIX I need to add "%option noyywrap" to cfg-lex.l, > otherwise ld complains about "Undefined symbol: .yywrap". > > Is there something I'm missing, as this turns up everytime I try to build a > new source distribution. > I'm using gcc 2.9 and flex 2.5.4 "yywrap()" should be a function in the flex library "libfl.{a,so}". Check whether "LEXLIB" is set to "-lfl" in "src/Makefile" or not. Otherwise check the output of the configure script for the following lines: checking for flex... flex checking for yywrap in -lfl... yes Achim ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

2 1

Betr.: [syslog-ng]??? Parse error reading configuration file, exiting.
by EDL.Essed＠belastingdienst.nl 14 Feb '03

14 Feb '03

internel -> internal ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

2 1

yywrap
by EDL.Essed＠belastingdienst.nl 14 Feb '03

14 Feb '03

Hi, To compile syslog-ng on AIX I need to add "%option noyywrap" to cfg-lex.l, otherwise ld complains about "Undefined symbol: .yywrap". Is there something I'm missing, as this turns up everytime I try to build a new source distribution. I'm using gcc 2.9 and flex 2.5.4 Thanks, Esteban Essed ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

2 1

??? Parse error reading configuration file, exiting.
by seberino＠spawar.navy.mil 14 Feb '03

14 Feb '03

Please help... this /etc/syslog-ng/syslog-ng.conf looks fine to me. I cannot find why syslog-ng barfs on it... source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internel();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; thanks! Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-0804 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

Re: [syslog-ng]syslog-ng - crond
by Ted_Rule＠flextech.co.uk 13 Feb '03

13 Feb '03

There is probably another caveat/clarification which should be added here.... On old glibc systems, which don't fix the issue for EITHER unix-dgram or unix-stream sockets, my partial fix has been to ensure keepalive(yes) on /dev/log and use unix-stream sockets instead of syslogd's default unix-dgram. This ensures the problem doesn't occur on a SIGHUP, only on a complete restart of syslog-ng which is fortunately very rare. By reverting to unix-dgram, on old glibc machines, the issue will resurface for both SIGHUP and restart of syslog-ng I believe as syslog-ng closes all unix-dgram on SIGHUP, so any update to FAQ et al needs to make clear that this fix should only be applied on glibc >2.2.? For glibc < 2.2 one probably has to revert to unix-stream and nasty kludges to the boot scripts of various daemons such as sendmail whose parent process never cleans up the "orphaned" /dev/log connection. Ted Achim Gsell <achim(a)cybercity.ch> on 13/02/2003 14:25:44 Please respond to syslog-ng(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu cc: (bcc: Ted Rule/160GPS/Flextech/UK) Subject: Re: [syslog-ng]syslog-ng - crond On Thursday 13 February 2003 15:06, Peter Bieringer wrote: > source local { > + unix-stream("/dev/log"); ^??? > + unix-stream("/dev/log" keep-alive(yes) max-connections(512)); > - udp(ip(0.0.0.0) port(514)); > + #udp(ip(0.0.0.0) port(514)); > internal(); > }; On Thursday 13 February 2003 14:38, Balazs Scheidler wrote: > sysklogd uses a unix-dgram source by default, Try: unix-dgram("/dev/log") Achim _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1

syslog-ng unknown messages in my syslog.log file(HP-UX)
by daniel＠waku-2.com 13 Feb '03

13 Feb '03

Hello everyone, I've just received syslog messages that I completely don't understand. Does anybody know why this messages have been sent to syslog.log file. And also if there is any problem with my server machine. And what I should do to solve the problem. Feb 13 16:21:23 hpd002 syslog: libtt[18108]: ttdt_Xt_input_handler(): tttk_message_receive(): TT_ERR_NOMP^INo ttsession pr ocess is running, probably because tt_open() has not been called yet. If this code is returned from tt_open() it means tts ession could not be started, which generally means ToolTalk is not installed on this system. Feb 13 16:21:23 hpd002 syslog: libtt[18117]: ttdt_Xt_input_handler(): tttk_message_receive(): TT_ERR_NOMP^Ittsession ^Cv^C ^M^CZ^CX^B*^S.^Ml^B5^BD^B"^B\^B9^Bq^AB^Q=^U*^AAtt_open() ^B*^LD^BQ^Oo^B3^Bj^BD^B"^BH^B"^B1^BF^B*^L4^Hv^BE^B7^ABtt_open() ^ B)^Bg^B1^BL^CR^A[^Ch^B*^UT^B3^Bj^B=^Oj^M^G^BM^AAttsession ^B*^KN^S.^BE^B+^BH^B"^BF^B"^B$^HS^V!^BE^B ^Bh^AA^RJ^Om^BM ToolTa lk ^B*^B1^BL^CV^CX^Ce^C Thanks in advance Daniel

2 1