November 2004 - syslog-ng - lists.balabit.hu

syslog-ng freezes under FreeBSD
by Jost Menke 29 Nov '04

29 Nov '04

Hi all, I have installed syslog-ng-1.6.5 on a FreeBSD 5.3 release system with 3 remote machines logging to it. Logging works fine for several hours, but after some time it completely freezes without a clear reason. The process can only be stopped with kill -9. Any ideas? Regards, Jost Menke -- NEU +++ DSL Komplett von GMX +++ http://www.gmx.net/de/go/dsl GMX DSL-Netzanschluss + Tarif zum superg�nstigen Komplett-Preis!

2 3

hello list. problem : remote logging with syslog-ng
by petre daniel 29 Nov '04

29 Nov '04

hello, i need to log from several locations/devices (cisco switches/linux routers) to a central syslog-ng into a certain file for each. where do i read about this or how its done? thx a lot. Petre Daniel System & Network Administrator Romania Data Systems Pitesti http://www.rdspt.ro <http://www.rdspt.ro/> Phone: +40-348-400401 ---------------------------------------------------------------------- Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such a case, you should destroy this message and kindly notify the sender by reply e-mail. ----------------------------------------------------------------------

1 0

Needed features: include statements and greater-than/less-than options for log level/priorities
by Jesse Molina 27 Nov '04

27 Nov '04

Greetings! I have looked for this information elsewhere but have not found it, thus I bring it to the community. I have two questions regarding the syslog-ng configuration file; #1.) Is there an "include" statement to grab additional configuration parameters, similar to httpd.conf or named.conf? I suspect the answer is no. I am responsible for a couple of syslog-ng implementations that have gotten to be huge and working with a single file is getting to be a problem. #2.) I would like to state functions such as "greater than" and "less than" for logging levels/priorities. This functionality is available in the BSD syslogd and some others, but I am not aware of any such thing in syslog-ng. I can't imagine that this hasn't come up before. To get around this, I made a an ugly 55-line syslog-ng configuration with filters to which I can reference, but I really don't want them all in my syslog-ng.conf, thus question number 1. I did google around and found these articles, in reference to question number 1; http://citadelle.intrinsec.com/mailing/current/HTML/ml_syslogng/0307.html http://citadelle.intrinsec.com/mailing/current/HTML/ml_syslogng/0304.html But that's about it. Thanks for reading. Flog me if I need to RTFM. -- # Jesse Molina # Mail = jesse(a)opendreams.net # Page = page-jesse(a)opendreams.net # Cell = 1.407.970.0280 # Web = http://www.opendreams.net/jesse/

2 2

Antw: [syslog-ng]Problem generating syslog-ng on HP-UX 11i v1 (PA-RISC 2.0)
by Stephan Hendl 26 Nov '04

26 Nov '04

Hi, it might be there is a problem with the sources section in your confg file. I think that you cannot use the /dev/log device twice for sourcing the syslog data. >source stdlog { pipe("/dev/log" pad_size(2048)); }; >source s_sys { pipe("/dev/log"); internal(); }; I use (with 11.0 PA RISC 2.0) source s_sys { pipe(/dev/log pad_size(2048)); internal(); }; This works fine in a productive environment. One of our central syslog server runs syslog-ng-1.6.4 on 11.0. Stephan >>> jsianes(a)grupohispatec.com 24.11.2004 20:01:12 >>> I have a lot of problems trying to create a syslog-ng binary in HP-UX 11i v1 for PA-RISC 2.0 architecture: HP-UX asterix B.11.11 U 9000/810 2013576237 unlimited-user license All compilation issues goes right, but when I try to run it create a core. This is all the test I have made: root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> /usr/local/sbin/syslog-ng -dv Memory fault(coredump) root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> gdb /usr/local/sbin/syslog-ng HP gdb 3.3 for PA-RISC 1.1 or 2.0 (narrow), HP-UX 11.00. Copyright 1986 - 2001 Free Software Foundation, Inc. Hewlett-Packard Wildebeest 3.3 (based on GDB) is covered by the GNU General Public License. Type "show copying" to see the conditions to change it and/or distribute copies. Type "show warranty" for warranty/support. .. (gdb) r -dv Starting program: /usr/local/sbin/syslog-ng -dv Program received signal SIGSEGV, Segmentation fault. 0x197dc in c_vformat_length () at format.c:178 178 format.c: No such file or directory. (gdb) bt #0 0x197dc in c_vformat_length () at format.c:178 #1 0x1c4f4 in msg_vformat () at werror.c:132 #2 0x1c5b4 in werror () at werror.c:152 #3 0xc224 in make_syslog_config (name=0x40001220 "/usr/local/etc/syslog-ng/syslog-ng.conf", backend=0x40006a80) at cfgfile.c:344 #4 0x71bc in main (argc=2, argv=0x7f7f0814) at main.c:479 (gdb) quit The program is running. Exit anyway? (y or n) y root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> I have try with both, stable an snapshot versions. The result is the same, a crash at the beginning. This is my configuration file: root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> cat /etc/syslog-ng/syslog-ng.conf # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (2048); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source stdlog { pipe("/dev/log" pad_size(2048)); }; source s_sys { pipe("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/syslog-ng/syslog.log"); }; destination d_mail { file("/var/adm/syslog-ng/mail.log"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(mail) and level(debug); }; filter f_filter2 { (facility(mail) and level(debug)) or level(info); }; filter f_filter3 { level(alert); }; filter f_filter4 { level(emerg); }; log { source(s_sys); filter(f_filter1); destination(d_mail); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_cons); destination(d_mlrt); }; log { source(s_sys); filter(f_filter4); destination(d_mlal); }; root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> Here is the configure output: root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> ./configure --with-debug checking for a BSD-compatible install... /opt/imake/bin/install -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... no checking for nawk... no checking for awk... awk checking whether make sets $(MAKE)... yes checking whether build environment is sane... yes checking for gcc... no checking for cc... cc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... no checking whether cc accepts -g... yes checking for cc option to accept ANSI C... none needed checking for style of include used by make... GNU checking dependency style of cc... hp checking for cc option to accept ANSI C... none needed checking for bison... bison -y checking for flex... flex checking for yywrap in -lfl... no checking for yywrap in -ll... yes checking lex output file root... lex.yy checking whether yytext is a pointer... yes checking whether make sets $(MAKE)... (cached) yes checking how to run the C preprocessor... cc -E checking for egrep... grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... no checking for unistd.h... yes checking malloc.h usability... yes checking malloc.h presence... yes checking for malloc.h... yes checking for unistd.h... (cached) yes checking door.h usability... no checking door.h presence... no checking for door.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... yes checking sys/strlog.h presence... yes checking for sys/strlog.h... yes checking stdarg.h usability... yes checking stdarg.h presence... yes checking for stdarg.h... yes checking sys/klog.h usability... no checking sys/klog.h presence... no checking for sys/klog.h... no checking arpa/nameser.h usability... yes checking arpa/nameser.h presence... yes checking for arpa/nameser.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking for an ANSI C-conforming const... yes checking whether time.h and sys/time.h may both be included... yes checking for modern utmp... no checking for global timezone variable... no checking for short... yes checking size of short... 2 checking for int... yes checking size of int... 4 checking for long... yes checking size of long... 4 checking for I_CONSLOG... no checking for O_LARGEFILE... yes checking for res_init in <resolv.h>... checking for working alloca.h... yes checking for alloca... yes checking for vprintf... yes checking for _doprnt... yes checking for res_init in -lresolv... no checking for __res_init in -lresolv... no checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for gethostbyname in -lnsl... yes checking for select... yes checking for snprintf... yes checking for vsnprintf... yes checking for strerror... yes checking for inet_aton... yes checking for strncpy... yes checking for getutent... yes checking for getopt_long... no checking for strcasecmp... yes checking for strptime... yes checking for TCP wrapper library... checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.14... ok configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/tests/Makefile config.status: creating doc/Makefile config.status: creating doc/sgml/Makefile config.status: creating contrib/Makefile config.status: creating syslog-ng.spec config.status: creating src/config.h config.status: src/config.h is unchanged config.status: executing depfiles commands root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> In compilation time, here is the output: root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> make No suffix list. Making all in src make all-recursive Making all in . source='main.c' object='main.o' libtool=no \ depfile='.deps/main.Po' tmpdepfile='.deps/main.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'main.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`main.c source='sources.c' object='sources.o' libtool=no \ depfile='.deps/sources.Po' tmpdepfile='.deps/sources.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'sources.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`sources.c source='center.c' object='center.o' libtool=no \ depfile='.deps/center.Po' tmpdepfile='.deps/center.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'center.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`center.c source='filters.c' object='filters.o' libtool=no \ depfile='.deps/filters.Po' tmpdepfile='.deps/filters.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'filters.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`filters.c source='destinations.c' object='destinations.o' libtool=no \ depfile='.deps/destinations.Po' tmpdepfile='.deps/destinations.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'destinations.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`destinations.c source='log.c' object='log.o' libtool=no \ depfile='.deps/log.Po' tmpdepfile='.deps/log.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'log.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`log.c source='cfgfile.c' object='cfgfile.o' libtool=no \ depfile='.deps/cfgfile.Po' tmpdepfile='.deps/cfgfile.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'cfgfile.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`cfgfile.c source='cfg-grammar.c' object='cfg-grammar.o' libtool=no \ depfile='.deps/cfg-grammar.Po' tmpdepfile='.deps/cfg-grammar.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'cfg-grammar.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`cfg-grammar.c source='cfg-lex.c' object='cfg-lex.o' libtool=no \ depfile='.deps/cfg-lex.Po' tmpdepfile='.deps/cfg-lex.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'cfg-lex.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`cfg-lex.c source='affile.c' object='affile.o' libtool=no \ depfile='.deps/affile.Po' tmpdepfile='.deps/affile.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'affile.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`affile.c source='afsocket.c' object='afsocket.o' libtool=no \ depfile='.deps/afsocket.Po' tmpdepfile='.deps/afsocket.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afsocket.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afsocket.c source='afunix.c' object='afunix.o' libtool=no \ depfile='.deps/afunix.Po' tmpdepfile='.deps/afunix.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afunix.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afunix.c source='afinet.c' object='afinet.o' libtool=no \ depfile='.deps/afinet.Po' tmpdepfile='.deps/afinet.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afinet.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afinet.c source='afinter.c' object='afinter.o' libtool=no \ depfile='.deps/afinter.Po' tmpdepfile='.deps/afinter.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afinter.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afinter.c source='afuser.c' object='afuser.o' libtool=no \ depfile='.deps/afuser.Po' tmpdepfile='.deps/afuser.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afuser.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afuser.c source='afstreams.c' object='afstreams.o' libtool=no \ depfile='.deps/afstreams.Po' tmpdepfile='.deps/afstreams.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afstreams.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afstreams.c source='afprogram.c' object='afprogram.o' libtool=no \ depfile='.deps/afprogram.Po' tmpdepfile='.deps/afprogram.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afprogram.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afprogram.c source='afremctrl.c' object='afremctrl.o' libtool=no \ depfile='.deps/afremctrl.Po' tmpdepfile='.deps/afremctrl.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afremctrl.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afremctrl.c cc: "afremctrl.c", line 58: warning 604: Pointers are not assignment-compatible. cc: "afremctrl.c", line 58: warning 563: Argument #1 is not the correct type. cc: "afremctrl.c", line 58: warning 604: Pointers are not assignment-compatible. cc: "afremctrl.c", line 58: warning 563: Argument #2 is not the correct type. source='nscache.c' object='nscache.o' libtool=no \ depfile='.deps/nscache.Po' tmpdepfile='.deps/nscache.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'nscache.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`nscache.c source='utils.c' object='utils.o' libtool=no \ depfile='.deps/utils.Po' tmpdepfile='.deps/utils.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'utils.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`utils.c source='syslog-names.c' object='syslog-names.o' libtool=no \ depfile='.deps/syslog-names.Po' tmpdepfile='.deps/syslog-names.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'syslog-names.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`syslog-names.c source='macros.c' object='macros.o' libtool=no \ depfile='.deps/macros.Po' tmpdepfile='.deps/macros.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'macros.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`macros.c source='getopt.c' object='getopt.o' libtool=no \ depfile='.deps/getopt.Po' tmpdepfile='.deps/getopt.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'getopt.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`getopt.c source='getopt1.c' object='getopt1.o' libtool=no \ depfile='.deps/getopt1.Po' tmpdepfile='.deps/getopt1.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'getopt1.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`getopt1.c cc -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o getopt.o getopt1.o -lnsl -ll /usr/local/lib/libol.a -lnsl -lxnet /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file (main.o) was detected. The linked output may not run on a PA 1.x system. Making all in tests source='test_nscache.c' object='test_nscache.o' libtool=no \ depfile='.deps/test_nscache.Po' tmpdepfile='.deps/test_nscache.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src/tests -I../../src -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'test_nscache.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/tests/'`test_nscache.c cc -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o test_nscache test_nscache.o ../nscache.o -lnsl -ll /usr/local/lib/libol.a -lnsl -lxnet /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file (test_nscache.o) was detected. The linked output may not run on a PA 1.x system. Making all in doc No suffix list. Making all in sgml No suffix list. No suffix list. Making all in contrib No suffix list. No suffix list. root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> At the end, the installation process: root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> make install No suffix list. Making install in src Making install in . /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/mkinstalldirs /usr/local/sbin /opt/imake/bin/install -c syslog-ng /usr/local/sbin/syslog-ng Making install in tests Making install in doc No suffix list. Making install in sgml No suffix list. No suffix list. No suffix list. No suffix list. /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/mkinstalldirs /usr/local/man/man5 /opt/imake/bin/install -c -m 644 /root/syslog/syslog-ng-1.6.5+20041124/doc/syslog-ng.conf.5 /usr/local/man/man5/syslog-ng.conf.5 /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/mkinstalldirs /usr/local/man/man8 /opt/imake/bin/install -c -m 644 /root/syslog/syslog-ng-1.6.5+20041124/doc/syslog-ng.8 /usr/local/man/man8/syslog-ng.8 Making install in contrib No suffix list. No suffix list. No suffix list. No suffix list. root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> Anyone have an idea what this coredump is happends and how to solve it? Thanks for all your help. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog-ng mysql syntax error
by Lopez Fernandez, Jose 25 Nov '04

25 Nov '04

hi, thats nice to know :-) well... someone out there who has a compiled version 1.6.5 for solaris 8 / sparc? ;-) i have no possibility to compile it till next week :-( regards, Jose Lopez ------------------------------------------------------------------------ ----------- =20 I was having exactly the same problem with syslog-ng 1.6.4, upgrading to 1.6.5 fixed the problem. Regards James Masson ________________________________ From: syslog-ng-admin(a)lists.balabit.hu [mailto:HYPERLINK "mailto:syslog-ng-admin@lists.balabit.hu"syslog-ng-admin(a)lists.balabit.h u <mailto:HYPERLINK > ] On Behalf Of Lopez Fernandez, Jose Sent: 25 November 2004 11:29 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng mysql syntax error =09 =09 Hi,=20 since some days i get errors in like this:=20 ERROR 1064 at line 4: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'ws-61078', 'kern', 'crit', 'crit', '02', '2004-11-24', '10:55:=20 It seems, that the Quotes after the MSG-Tag are missing. so the insert-command for MySql isn`t complete.=20 I can`t see any fault in my config.=20 This is my config (syslog-ng 1.6.4):=20 options {stats(28800); long_hostnames(on); sync(0); log_fifo_size(2000); use_dns(on); };=20 2 #=20 3 ## Log syslog-ng to mysql database=20 4 ##=20 5 destination d_mysql {=20 6 pipe("/tmp/mysql.pipe"=20 7 template("INSERT INTO logs (host, facility, priority, level, tag, date,=20 8 time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG',=20 9 '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes));=20 10 };=20 11 source local { sun-streams("/dev/log") ; internal();};=20 12 source net { udp(); };=20 13 log { source(net); destination(d_mysql);};=20 14 log { source(local); destination(d_mysql);};=20 I have read, that someone had this problem too in the mailingslist, but i didn`t find any suggestion for a workaorund=20 or a solution. I`m now analysing this problem 2 days an didn`t find any workaround / solution. Hope someone could=20 help me :-)=20 thanks,=20 Jose Lopez=20 =09 =09 Dieses Dokument ist vertraulich und ausschliesslich fuer den Adressaten bestimmt. Falls Sie diese E-Mail versehentlich bekommen haben, informieren Sie uns bitte unverzueglich und loeschen Sie diese Nachricht von Ihrem Computer. Jegliche Art von Reproduktion, Verbreitung, Vervielfaeltigung, Modifikation, Verteilung und/oder Publikation dieser E-Mail Nachricht ist untersagt.=20 Die in dieser E-Mail enthaltenen Angaben und Erklaerungen sind unverbindlich. Haftungsansprueche des Empfaengers jeglicher Art werden ausgeschlossen. Die GZS schliesst ausser fuer den Fall von Vorsatz oder grober Fahrlaessigkeit die Haftung fuer jeglichen Verlust oder Schaeden durch virenbefallene Software oder E-Mails aus. =09 ------------------------------------------------------------------------ ----------------------------------- This message contains confidential information and is intended only for the named individual. If you are not the named addressee, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this message in error and delete this e-message from your system. No reliance may be placed on this message without written confirmation of its contents from an authorized representative. GZS accepts no liability for loss or damage caused by software viruses except in case of gross negligence or willful behaviour. =09

1 0

Change slash to other char in variable PROGRAM
by Jozef Drahovsky 25 Nov '04

25 Nov '04

Hello, I have small problem. In experimental pc have universal configuration: destination logex { file( "/var/log-ng/$YEAR-$MONTH-$DAY/$HOST-$PROGRAM.txt" perm(0664) dir_owner(www) dir_perm(0775) create_dirs(yes) ); }; All function is right. (syslog-ng-1.6.0.r3 .... syslog-ng-1.6.5) Problem accured when variable $PROGRAM contains slash "/" How change slash and other notprinted charactres to "_" Example: TASK: 92 ?? Is 0:01.76 /usr/sbin/cron LOGFILE: /var/log-ng/2004-11-25/test-/usr/sbin/cron.txt ---> /var/log-ng/2004-11-25/test-usr_sbin_cron.txt Jozef Drahovsky

2 1

RE: [syslog-ng]syslog-ng mysql syntax error
by James Masson 25 Nov '04

25 Nov '04

I was having exactly the same problem with syslog-ng 1.6.4, upgrading to 1.6.5 fixed the problem. Regards James Masson ________________________________ From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Lopez Fernandez, Jose Sent: 25 November 2004 11:29 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng mysql syntax error Hi, since some days i get errors in like this: ERROR 1064 at line 4: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'ws-61078', 'kern', 'crit', 'crit', '02', '2004-11-24', '10:55: It seems, that the Quotes after the MSG-Tag are missing. so the insert-command for MySql isn`t complete. I can`t see any fault in my config. This is my config (syslog-ng 1.6.4): options {stats(28800); long_hostnames(on); sync(0); log_fifo_size(2000); use_dns(on); }; 2 # 3 ## Log syslog-ng to mysql database 4 ## 5 destination d_mysql { 6 pipe("/tmp/mysql.pipe" 7 template("INSERT INTO logs (host, facility, priority, level, tag, date, 8 time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', 9 '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); 10 }; 11 source local { sun-streams("/dev/log") ; internal();}; 12 source net { udp(); }; 13 log { source(net); destination(d_mysql);}; 14 log { source(local); destination(d_mysql);}; I have read, that someone had this problem too in the mailingslist, but i didn`t find any suggestion for a workaorund or a solution. I`m now analysing this problem 2 days an didn`t find any workaround / solution. Hope someone could help me :-) thanks, Jose Lopez Dieses Dokument ist vertraulich und ausschliesslich fuer den Adressaten bestimmt. Falls Sie diese E-Mail versehentlich bekommen haben, informieren Sie uns bitte unverzueglich und loeschen Sie diese Nachricht von Ihrem Computer. Jegliche Art von Reproduktion, Verbreitung, Vervielfaeltigung, Modifikation, Verteilung und/oder Publikation dieser E-Mail Nachricht ist untersagt. Die in dieser E-Mail enthaltenen Angaben und Erklaerungen sind unverbindlich. Haftungsansprueche des Empfaengers jeglicher Art werden ausgeschlossen. Die GZS schliesst ausser fuer den Fall von Vorsatz oder grober Fahrlaessigkeit die Haftung fuer jeglichen Verlust oder Schaeden durch virenbefallene Software oder E-Mails aus. ------------------------------------------------------------------------ ----------------------------------- This message contains confidential information and is intended only for the named individual. If you are not the named addressee, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this message in error and delete this e-message from your system. No reliance may be placed on this message without written confirmation of its contents from an authorized representative. GZS accepts no liability for loss or damage caused by software viruses except in case of gross negligence or willful behaviour.

1 0

syslog-ng mysql syntax error
by Lopez Fernandez, Jose 25 Nov '04

25 Nov '04

Hi, since some days i get errors in like this: ERROR 1064 at line 4: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'ws-61078', 'kern', 'crit', 'crit', '02', '2004-11-24', '10:55: It seems, that the Quotes after the MSG-Tag are missing. so the insert-command for MySql isn`t complete. I can`t see any fault in my config. This is my config (syslog-ng 1.6.4): options {stats(28800); long_hostnames(on); sync(0); log_fifo_size(2000); use_dns(on); }; 2 # 3 ## Log syslog-ng to mysql database 4 ## 5 destination d_mysql { 6 pipe("/tmp/mysql.pipe" 7 template("INSERT INTO logs (host, facility, priority, level, tag, date, 8 time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', 9 '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); 10 }; 11 source local { sun-streams("/dev/log") ; internal();}; 12 source net { udp(); }; 13 log { source(net); destination(d_mysql);}; 14 log { source(local); destination(d_mysql);}; I have read, that someone had this problem too in the mailingslist, but i didn`t find any suggestion for a workaorund or a solution. I`m now analysing this problem 2 days an didn`t find any workaround / solution. Hope someone could help me :-) thanks, Jose Lopez Dieses Dokument ist vertraulich und ausschliesslich fuer den Adressaten bestimmt. Falls Sie diese E-Mail versehentlich bekommen haben, informieren Sie uns bitte unverzueglich und loeschen Sie diese Nachricht von Ihrem Computer. Jegliche Art von Reproduktion, Verbreitung, Vervielfaeltigung, Modifikation, Verteilung und/oder Publikation dieser E-Mail Nachricht ist untersagt. Die in dieser E-Mail enthaltenen Angaben und Erklaerungen sind unverbindlich. Haftungsansprueche des Empfaengers jeglicher Art werden ausgeschlossen. Die GZS schliesst ausser fuer den Fall von Vorsatz oder grober Fahrlaessigkeit die Haftung fuer jeglichen Verlust oder Schaeden durch virenbefallene Software oder E-Mails aus. ----------------------------------------------------------------------------------------------------------- This message contains confidential information and is intended only for the named individual. If you are not the named addressee, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this message in error and delete this e-message from your system. No reliance may be placed on this message without written confirmation of its contents from an authorized representative. GZS accepts no liability for loss or damage caused by software viruses except in case of gross negligence or willful behaviour.

1 0

Sending source IP from syslog-ng
by Michael Gehrmann 25 Nov '04

25 Nov '04

Hi All, I have seen a number of queries on a number of lists in regards to sending the source ip address of messages that are forwarded from a syslog-ng server. I have found a solution! You need to do the following: Enter the option --enable-spoof-source when running ./configure (This requires libnet, use RPM for RedHat) 'make' and 'make install' syslog-ng In your syslog-ng config add the spoof-source(yes) option to your destination (UDP only) e.g. destination log_host { udp("10.0.0.1" port(514) spoof_source(yes)); }; On a syslogd server (Solaris, Standard *nix) you should see the originating host ip after the timestamp. Hope this helps. -- Michael Gehrmann Security Administrator CITEC www.citec.com.au, Your business solutions partner

2 1

Problem generating syslog-ng on HP-UX 11i v1 (PA-RISC 2.0)
by Jose Javier Sianes Ruiz 24 Nov '04

24 Nov '04

1 0