April 2003 - syslog-ng - lists.balabit.hu

Hostname - IP Address
by Chris Paalman 08 Apr '03

08 Apr '03

I am trying to log using the IP address only, yet I get the hostname instead. I would like to be able to send the syslog from multiple machines to a central server which will then log to a database. Ultimately I would like to be able to search by IP address. I have all the pieces of this working just fine, all except the hostname problem. All of the computers report the hostname instead of the IP address, even with the following options. use_dns (no); use_fqdn (no); chain_hostnames(no); keep_hostname (yes); <- I have tried no also, to no avail. long_hostnames (off); I have tried various combinations of the above with no success. Thanks in advance for any help. Chris Paalman

1 0

syslog-ng 1.6.0 insists on log files with 600 permissions
by nate 08 Apr '03

08 Apr '03

I upgraded to freebsd 4.8 from 4.7 last week and portupgrade reported it upgraded syslog-ng from syslog-ng-1.4.17 to syslog-ng-1.6.0.r1 and libol-0.2.23 to libol-0.3.9 (libol is required by syslog-ng) and while syslog-ng is working I cannot get it to store files that are group readable. In the past this has been no problem, but now syslog-ng seems to insist upon permissions of 600. I even went sofar as to set a umask of 137, in the syslog-ng init script, which sets permissions on newly created files to 640, but that seems to have no effect, syslog-ng randomly(?) changes permissions back to 600 even after I set them to 640 myself. I have logrotate run weekly and create files that are 640: /var/log-ng/* { create 0640 root wheel notifempty errors my(a)email.address rotate 26 weekly compress delaycompress olddir /var/log-ng/archive missingok } but syslog-ng again changes it back to 600. driving me crazy :) I don't see anything in the syslog-ng manpage that can set file permissions..so I'm at a loss! I have been running syslog-ng on freebsd 4.7 with no problems since about september 2002. anyone else experience this? thanks nate

1 0

RE: [syslog-ng]Redhat 8 problem
by Hamilton, Andrew 08 Apr '03

08 Apr '03

What is really strange is that I go back and do a make distclean and rerun the script just like it came out of the box and it worked. Why it didn't work before and does now is beyond me. Regards, Drew -----Original Message----- From: Carl Davis [mailto:cdavis@technology-specialists.com] Sent: Tuesday, April 08, 2003 2:10 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Redhat 8 problem I could not get what you described to work, but I did change these, which seemed to make it work: LIBOL_REQ_MAJOR=0 LIBOL_REQ_MINOR=3 LIBOL_REQ_PATCH=9 Thanks for the help!! On Tue, 2003-04-08 at 12:53, Hamilton, Andrew wrote: > That reminded me of what I had to do to get it to compile on Redhat 8.0. I > had completely forgotten. I edited the configure script and set these > vaules: > > LIBOL_MAJOR="0" > LIBOL_MINOR="3" > LIBOL_PATCH="9" > > There a some lines that actually set them using a sed command that doesn't > seem to work on RH8.0 Not sure why and I haven't had time to figure it out. > I just commented those lines out and set these and Voila! it worked. > > Regards, > > Drew > > -----Original Message----- > From: Carl Davis [mailto:cdavis@technology-specialists.com] > Sent: Tuesday, April 08, 2003 1:42 PM > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]Redhat 8 problem > > > Well, I was trying to run it to determine what the problem was. I came > to that conclusion because I cannot get syslog-ng to compile. It keeps > failing at: > > checking libol version >= 0.2.23... no > configure: error: Required libol version not found > > But I have ./configure, make, make install, for libol-0.3.9. > > Carl > > On Tue, 2003-04-08 at 09:12, Hamilton, Andrew wrote: > > You aren't trying to run the make_class utility are you? I'm running > > syslog-ng on a dozen RH8 boxes without problem. I had no problems > building > > it either. > > > > -----Original Message----- > > From: cdavis(a)technology-specialists.com > > [mailto:cdavis@technology-specialists.com] > > Sent: Tuesday, April 08, 2003 8:59 AM > > To: syslog-ng(a)lists.balabit.hu > > Subject: Re: [syslog-ng]Redhat 8 problem > > > > > > I did not modify the files at all. I simply untared, ./configure, make. > > Then ./utils/make_class gives me the error described. > > > On Mon, Apr 07, 2003 at 10:14:03PM -0500, > > > cdavis(a)technology-specialists.com wrote: > > >> I cannot seem to get things to work correctly on my system. I think > > >> the problem is with the make_class file. I don't get any errors when > > >> I configure or make libol-0.3.9. But when trying to run make_class I > > >> get ./make_class > > >> -bash: ./make_class: \: bad interpreter: No such file or directory > > > > > > if you modify files in libol itself you will need scsh to rebuild the > > > .x files. if you did not modify them you should be just fine without > > > scsh. > > > > > >> > > >> I am no programmer so I don't know what else you may need to see. I > > >> tried searching through the list archives, but that is quite a task > > >> considereing it is just big NASTY file. > > > > > > the archives can be searched using google: > > > > > > site:lists.balabit.hu <search expression> > > > > > > -- > > > Bazsi > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Redhat 8 problem
by Hamilton, Andrew 08 Apr '03

08 Apr '03

That reminded me of what I had to do to get it to compile on Redhat 8.0. I had completely forgotten. I edited the configure script and set these vaules: LIBOL_MAJOR="0" LIBOL_MINOR="3" LIBOL_PATCH="9" There a some lines that actually set them using a sed command that doesn't seem to work on RH8.0 Not sure why and I haven't had time to figure it out. I just commented those lines out and set these and Voila! it worked. Regards, Drew -----Original Message----- From: Carl Davis [mailto:cdavis@technology-specialists.com] Sent: Tuesday, April 08, 2003 1:42 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Redhat 8 problem Well, I was trying to run it to determine what the problem was. I came to that conclusion because I cannot get syslog-ng to compile. It keeps failing at: checking libol version >= 0.2.23... no configure: error: Required libol version not found But I have ./configure, make, make install, for libol-0.3.9. Carl On Tue, 2003-04-08 at 09:12, Hamilton, Andrew wrote: > You aren't trying to run the make_class utility are you? I'm running > syslog-ng on a dozen RH8 boxes without problem. I had no problems building > it either. > > -----Original Message----- > From: cdavis(a)technology-specialists.com > [mailto:cdavis@technology-specialists.com] > Sent: Tuesday, April 08, 2003 8:59 AM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Redhat 8 problem > > > I did not modify the files at all. I simply untared, ./configure, make. > Then ./utils/make_class gives me the error described. > > On Mon, Apr 07, 2003 at 10:14:03PM -0500, > > cdavis(a)technology-specialists.com wrote: > >> I cannot seem to get things to work correctly on my system. I think > >> the problem is with the make_class file. I don't get any errors when > >> I configure or make libol-0.3.9. But when trying to run make_class I > >> get ./make_class > >> -bash: ./make_class: \: bad interpreter: No such file or directory > > > > if you modify files in libol itself you will need scsh to rebuild the > > .x files. if you did not modify them you should be just fine without > > scsh. > > > >> > >> I am no programmer so I don't know what else you may need to see. I > >> tried searching through the list archives, but that is quite a task > >> considereing it is just big NASTY file. > > > > the archives can be searched using google: > > > > site:lists.balabit.hu <search expression> > > > > -- > > Bazsi > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]Redhat 8 problem
by Hamilton, Andrew 08 Apr '03

08 Apr '03

You aren't trying to run the make_class utility are you? I'm running syslog-ng on a dozen RH8 boxes without problem. I had no problems building it either. -----Original Message----- From: cdavis(a)technology-specialists.com [mailto:cdavis@technology-specialists.com] Sent: Tuesday, April 08, 2003 8:59 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Redhat 8 problem I did not modify the files at all. I simply untared, ./configure, make. Then ./utils/make_class gives me the error described. > On Mon, Apr 07, 2003 at 10:14:03PM -0500, > cdavis(a)technology-specialists.com wrote: >> I cannot seem to get things to work correctly on my system. I think >> the problem is with the make_class file. I don't get any errors when >> I configure or make libol-0.3.9. But when trying to run make_class I >> get ./make_class >> -bash: ./make_class: \: bad interpreter: No such file or directory > > if you modify files in libol itself you will need scsh to rebuild the > .x files. if you did not modify them you should be just fine without > scsh. > >> >> I am no programmer so I don't know what else you may need to see. I >> tried searching through the list archives, but that is quite a task >> considereing it is just big NASTY file. > > the archives can be searched using google: > > site:lists.balabit.hu <search expression> > > -- > Bazsi > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Redhat 8 problem
by cdavis＠technology-specialists.com 08 Apr '03

08 Apr '03

I cannot seem to get things to work correctly on my system. I think the problem is with the make_class file. I don't get any errors when I configure or make libol-0.3.9. But when trying to run make_class I get ./make_class -bash: ./make_class: \: bad interpreter: No such file or directory I am no programmer so I don't know what else you may need to see. I tried searching through the list archives, but that is quite a task considereing it is just big NASTY file.

2 2

Problem with syslog-ng-1.6.0rc1 configure script on Solaris 8
by John Caruso 07 Apr '03

07 Apr '03

FYI, I just ran into a problem with the syslog-ng-1.6.0rc1 configure script on Solaris 8. The problem is this set of sed commands: LIBOL_MAJOR=`echo $LIBOL_VERSION | sed -e 's/^$[0-9]\+$\.[0-9]\+\.[0-9]\+$+[0-9]*$\?$/\1/'` LIBOL_MINOR=`echo $LIBOL_VERSION | sed -e 's/^[0-9]\+\.$[0-9]\+$\.[0-9]\+$+[0-9]*$\?$/\1/'` LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/^[0-9]\+\.[0-9]\+\.$[0-9]\+$$+[0-9]*$\?$/\1/'` These do not work correctly with stock Solaris sed--they simply leave LIBOL_VERSION unchanged, so that LIBOL_MAJOR/_MINOR/_PATCH are all set to 0.3.9. Of course, this causes the subsequent version test to fail, and the configure script to stop. These sed commands work fine with GNU sed, however, so I was able to work around this by installing GNU sed into /usr/local/bin and putting /usr/local/bin before /usr/bin on the PATH. So this appears to be just a hidden dependency on GNU sed. This dependency should probably either be 1) removed in a future release by altering the sed commands, 2) documented in the INSTALL file, or at least 3) mentioned in the configure script error message. - John

1 0

Losing 25% of messages using UDP
by Bill Graham 07 Apr '03

07 Apr '03

I have syslog-ng-1.6.0rc1 compiled on Solaris 9 and I am intend to use the system as a central log server and I need to log every message that makes it to the system. I am testing it out with Kiwi Syslog Message generator with bursts of 100 messages every 10 seconds. Syslog-ng is only logging about 20-25% of the messages. I have verified that the messages are getting to the system. Is there some additional tuning that I have to do to get this to work. Here is a copy of my syslog-ng: options { use_fqdn(yes); keep_hostname(yes); use_dns(no); long_hostnames(off); sync(0); gc_idle_threshold(5000); gc_busy_threshold(1000); log_fifo_size(10240); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { udp();}; destination all { file("/var/log/messages"); }; log { source(local); destination(all); }; log { source(network); destination(all); }; Thanks, Bill

1 0

Expression match problem in filters
by Rodrigo Borges Pereira 06 Apr '03

06 Apr '03

Hello, I can't match anything with parenthesis, for use in my filters. I tried escaping, but same result. My filter looks something like: filter f_xpto { match("something") and not match("other(xyz)"); }; I get that "other(xyz)" logged anyway.. "other$xyz$" does not work either. Is this an issue with syslog-ng or am i missing something? I'm using syslog-ng 1.5.23. Thanks in advance

3 2

syslog-ng 1.6 - how to preserve the sender's IP address
by Brian C. Hill 06 Apr '03

06 Apr '03

I am having a strange problem. Events that come from A through B finally to C, get labeled with A's address, but events that come from A to C directly get labeled with C's address. I always want the address to be A's address. Note that B is running syslog-ng 1.4 (not for any good reason - it is just the state of things right now). Is there something wrong with my options? Brian ====================================================================== options { dir_perm(0755); perm(0644); sync(1); use_dns(no); use_fqdn(no); chain_hostnames(yes); long_hostnames(no); keep_hostname(yes); };

1 0