January 2004 - syslog-ng - lists.balabit.hu

Using full hostnames
by Andrew Culver 20 Jan '04

20 Jan '04

I'm trying to use full hostnames such as www.my.domain.com for both inside the log files, and also for the $HOST macro in the config files (for creating directories based on host). What options should I use to achieve this? I've tried a few different options, but I am only able to get either www or src@www inside the log, and the directories are always simply www. TIA, Andrew

2 1

RE: [syslog-ng]funny character is being inserted into each log li ne + perm(-1) n ot working
by Clemson, Chris 20 Jan '04

20 Jan '04

thank you, that fixed it! > > Correct, this has been fixed by a patch posted to this list > > earlier, and > > in the last 1.6.1 syslog-ng release (which has the posted > > patch merged) > > oh, thanks for the reply! > i must have missed that, i'll check it out > > cheers, > > chris > > -- > The content of this e-mail is confidential, may contain > privileged material > and is intended solely for the recipient(s) named above. If > you receive this > in error, please notify Software AG immediately and delete > this e-mail. > > Software AG (UK) Limited > Registered in England & Wales 1310740 > Registered Office: Hudson House, Hudson Way, > Pride Park, Derby DE24 8HS > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

RE: [syslog-ng]syslog-ng-1.6.1 make error.
by Andrews, Glenn J (Glenn) 19 Jan '04

19 Jan '04

Yes that corrected the problem. I installed autoconf-2.1.3 and all it right with the world again :-) Glenn -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Sunday, January 18, 2004 10:15 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng-1.6.1 make error. On Fri, 2004-01-16 at 23:52, Andrews, Glenn J (Glenn) wrote: > I have install libol 0.3.12 and I am trying to install > syslog-ng-1.6.1. > The libol install ok. The syslog-ng "./configured" ok but when I try > to make > I get this error... syslog-ng still uses autoconf2.13 and you probably use a newer, incompatible version. it is also interesting that make wants to rebuild the configure script, it is not normally needed, probably one of the timestamps were bogus. > > cd /tmp/syslog-ng-1.6.1 && autoheader > WARNING: Using auxiliary files such as `acconfig.h', `config.h.bot' > WARNING: and `config.h.top', to define templates for `config.h.in' > WARNING: is deprecated and discouraged. > > WARNING: Using the third argument of `AC_DEFINE' and > WARNING: `AC_DEFINE_UNQUOTED' allows to define a template without > WARNING: `acconfig.h': > > WARNING: AC_DEFINE([NEED_MAIN], 1, > WARNING: [Define if a function `main' is needed.]) > > WARNING: More sophisticated templates can also be produced, see the > WARNING: documentation. > autom4te: need GNU m4 1.4 or later: /usr/ccs/bin/m4 > autoheader: /usr/local/bin/autom4te failed with exit status: 1 > *** Error code 1 > make: Fatal error: Command failed for target > `/tmp/syslog-ng-1.6.1/src/stamp-h.in' > Current working directory /tmp/syslog-ng-1.6.1/src > *** Error code 1 > make: Fatal error: Command failed for target `all-recursive' > > I have m4 1.4 in my path. Is there something I am missing ? > > Glenn Andrews > Data / Voice Networking Services > 1 Robbins Road, Westford, MA 01886 > gjandrews(a)lucent.com <<mailto:gjandrews@lucent.com>> > > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

compiling syslog-ng (latest version) on solaris 9
by Markus Reger 18 Jan '04

18 Jan '04

hello to everybody Made several attempts to compile syslog-ng. Compilation of libol went fine. Whenever I "make" syslog-ng I encounter the error: gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o getopt.o getopt1.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Has anyone ever compiled on Solaris 9 - gcc 3.3. Thanks in advance for every hint. kr

2 1

Configuration file problem
by Laurent Mesuré 18 Jan '04

18 Jan '04

Hi, i've using this in my suslog-ng.conf file: destination d_msgs { file("/var/log/messages" template("$FULLDATE $HOST $FACILITY.$PRIORITY $MSG\n")); }; put syslog-ng give a parse error on the template part. why does it? i can t find any reason :(( can someone help me? Laurent

2 1

syslog-ng 1.6.1 released
by Balazs Scheidler 18 Jan '04

18 Jan '04

Hi, I have released syslog-ng 1.6.1 with the following NEWS entry: News for the 1.6.1 release Fri, 9 Jan 2004 10:27:38 +0100 * added a new macro named "PRI" which inserts the decimal value of the message priority (pri + level value combined) * fixed a problem in PIX timestamp parsing which inserted an unnecessary NUL character to the message Otherwise it is equivalent to 1.6.0rc4. I have also opened the 1.7.x development branch, even though I want to put this implementation of syslog-ng into maintenance mode. This means that the next stable release of syslog-ng will probably be based on my 1.9.x codebase. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

4 4

syslog-ng-1.6.1 make error.
by Andrews, Glenn J (Glenn) 18 Jan '04

18 Jan '04

I have install libol 0.3.12 and I am trying to install syslog-ng-1.6.1. The libol install ok. The syslog-ng "./configured" ok but when I try to make I get this error... cd /tmp/syslog-ng-1.6.1 && autoheader WARNING: Using auxiliary files such as `acconfig.h', `config.h.bot' WARNING: and `config.h.top', to define templates for `config.h.in' WARNING: is deprecated and discouraged. WARNING: Using the third argument of `AC_DEFINE' and WARNING: `AC_DEFINE_UNQUOTED' allows to define a template without WARNING: `acconfig.h': WARNING: AC_DEFINE([NEED_MAIN], 1, WARNING: [Define if a function `main' is needed.]) WARNING: More sophisticated templates can also be produced, see the WARNING: documentation. autom4te: need GNU m4 1.4 or later: /usr/ccs/bin/m4 autoheader: /usr/local/bin/autom4te failed with exit status: 1 *** Error code 1 make: Fatal error: Command failed for target `/tmp/syslog-ng-1.6.1/src/stamp-h.in' Current working directory /tmp/syslog-ng-1.6.1/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' I have m4 1.4 in my path. Is there something I am missing ? Glenn Andrews Data / Voice Networking Services 1 Robbins Road, Westford, MA 01886 gjandrews(a)lucent.com << mailto:gjandrews@lucent.com <mailto:gjandrews@lucent.com> >>

2 1

syslog-ng hanging
by david＠reno2.com 17 Jan '04

17 Jan '04

I have noticed that syslog-ng has been hanging on my 2.6.0 kernel gentoo host. I saw in a previous post that strace was requested, so here is some info: cindy etc # ps -ef |grep syslog-ng root 3381 1 0 15:36 ? 00:00:00 /usr/sbin/syslog-ng root 11416 9238 0 20:34 pts/1 00:00:00 grep syslog-ng cindy etc # cindy etc # strace -f -v -i -t -p 3381 Process 3381 attached - interrupt to quit 20:34:39 [4011e878] read(3, <unfinished ...> Process 3381 detached cindy etc # (The above unfinished part happens after I CTRL-C) Using following version of syslog-ng: [ebuild R ] app-admin/syslog-ng-1.6.0_rc3-r1 I will leave the system in this state until tomorrow morning (Mon, Dec 29, 7AM PST) in case any further diagnostic info is requested by then. I appreciate any help that you can give, Regards, David

2 1

syslog-ng unstable???
by Alexander von Hedenstroem 17 Jan '04

17 Jan '04

Hi, I like the concept of syslog-ng and so I decided to install it. I run a Debian stable (woody), and the version that comes with it is 1.5.15-1.1. I didn't change much on its configuration files, merely adding the udp logging source. That's all, honestly. And it worked pretty stable for a couple of weeks. Some day, I noticed that the server load was constantly around 80% because of rpc.statd and another process. I was wondering why, until I noticed that syslog-ng was not running! So I restarted it, and the load was gone. Why could it happen that syslog-ng terminates? Thanks, _ + mail: hedenstroem(a)pyromedia.de ( ) ASCII Ribbon Campaign + ICQ: #21622350 X - against HTML mail / \ - against MS attachments

2 1

error "Cannot assign requested address"
by Matthew Bassili 17 Jan '04

17 Jan '04

List members, I am trying to setup syslog-ng (Red Hat9, syslog build 1.6.0rc4) with the following syslog-ng.conf file: ############################################################### # First, set some global options # options { keep_hostname(yes); long_hostnames(off); sync(0); log_fifo_size(1024); log_msg_size(8192); }; ############################################################### # # source local { unix-dgram("/dev/log"); internal(); pipe("/proc/kmsg" log_prefix("kernel: ")); }; #source nocpix # { udp(ip("172.31.30.2") port(514)); # }; source nocpix-out { udp(ip("147.76.127.44") port(514)); }; #source mb2-pix # { udp(ip("172.18.1.6") port(514)); # }; source other { udp(); }; # # ############################################################### # # destination local { file("/var/log/syslog-ng/local/local.$YEAR.$MONTH.$DAY"); }; destination other { file("/var/log/syslog-ng/other/other.$YEAR.$MONTH.$DAY"); }; destination nocpix { file("/var/log/syslog-ng/nocpix/nocpix.$YEAR.$MONTH.$DAY"); }; #destination mb2 { file("/var/log/syslog-ng/mb2/mb2.$YEAR.$MONTH.$DAY"); }; # # ############################################################### # # filter f_auth { facility(auth, authpriv); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { facility(daemon, kern, user); }; filter f_news { facility(news); }; filter f_spooler { facility(uucp,news) and level(crit); }; filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; filter f_user { facility(user); }; # # ############################################################### # # log { source(local); destination(local);}; #log { source(nocpix); destination(nocpix);}; log { source(nocpix-out); destination(nocpix);}; #log { source(mb2-pix); destination(mb2);}; log { source(other); destination(other);}; & I get the following error message on startup: "Starting syslog-ng: io.c: bind_inet_socket() bind failed 147.76.127.44:514 Cannot assign requested address" When I comment out the line " source nocpix-out { udp(ip("147.76.127.44") port(514)); };" Everything works fine using udp();, but I really want to separate the sources so I can direct the log files to a different directory. Any help would be GREATLY appreciated. Matthew Bassili Senior Network Engineer NEC Business Solutions P/L 649 Springvale Rd Mulgarve, 3170 AUSTRALIA e-mail: matthew.bassili(a)nec.com.au

2 1