May 2004 - syslog-ng - lists.balabit.hu

RE : [syslog-ng]solaris 9 problem, no logging
by Le_Duy.Tam＠hydro.qc.ca 26 May '04

26 May '04

Have to check your path to syslog-ng.conf And you must use option -f when starting syslog-ng, For ex. /etc/init.d/syslog-ng -f $PATH_TO_SYSLOG_CONF/syslog-ng.conf Good luck. -----Message d'origine----- De : Oscar Knight [mailto:knightod@appstate.edu] Envoyé : 26 mai, 2004 16:58 À : syslog-ng(a)lists.balabit.hu Objet : [syslog-ng]solaris 9 problem, no logging Hello All, Running Solaris 9. I installed syslog-ng. I kill solaris syslogd and then start syslog-ng. I get nothing. I even tried "syslog-ng -d -d" It says it started, nothing else. I use logger to test, nothing. Any suggestions? Some details: I've installed syslog-ng from sunfreeware.com packages: libol-0.3.13-sol9-sparc-local.gz syslogng-1.6.4-sol9-sparc-local.gz /etc/syslog-ng/syslog-ng.conf: # # Syslog-ng example configuration file for Solaris # # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.solaris,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Solaris 2.5.1 and below uses the STREAMS driver, above extends it # with doors. For 2.5.1 remove the door() option from the source declaration. # source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; #destination all { file("/var/log/messages"); }; destination all { file("/var/log/syslog"); }; log { source(local); destination(all); }; Thanks in advance, odk -- Oscar D. Knight knightod at appstate dot edu Voice: 828-262-6946 Appalachian State University, Boone, NC 28608 FAX: 828-262-2236 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Error compiling 1.6.4 on OpenBSD 3.5-stable
by Steven J. Surdock 25 May '04

25 May '04

$ ./configure ... $ make ... gcc -DHAVE_CONFIG_H -I. -I/home/ssurdock/syslog-ng-1.6.4/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c macros.c macros.c: In function `format_tzofs': macros.c:118: error: `tm' undeclared (first use in this function) macros.c:118: error: (Each undeclared identifier is reported only once macros.c:118: error: for each function it appears in.) *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4/src. *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4/src (line 253 of Makefile). *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4/src (line 418 of Makefile). *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4 (line 168 of Makefile). $ Which seems to stem from the GLOBAL_TIMEZONE not being detected and tm not being defined in the "else" part of the #if: format_tzofs(char *dest, size_t left) { size_t length; #if HAVE_GLOBAL_TIMEZONE length = snprintf(dest, left - 1, "%c%02ld%02ld", timezone > 0 ? '-' : '+', (timezone < 0 ? -timezone : timezone) / 3600, (timezone % 3600) / 60); #else length = strftime(dest, left -1, "%z", tm); #endif return length; } And possibly the relevant config.log ... configure:1876: checking for global timezone variable configure:1895: gcc -c -g -O2 conftest.c 1>&5 configure: In function `foo': configure:1889: error: invalid lvalue in assignment configure: failed program was: #line 1881 "configure" ... Interestingly the following seems to work: #else length = strftime(dest, left -1, "%z", localtime(time(NULL))); #endif

5 12

Changes..
by Kaans 25 May '04

25 May '04

1 0

MacOS (Darwin) problem with dynamic file naming
by Cary, Kim 21 May '04

21 May '04

Thanks to the schooling (particulars and tools) from Jeremy Mates we now have syslog-ng running. Thanks Jeremy! destination std { file("/Volumes/syslog/syslog-ng/$HOST/$YEAR/$MONTH/$DAY/ $FACILITY_$HOST_$YEAR_$MONTH_$DAY" create_dirs(yes) owner("root") group("secsyslogs") perm(0640) dir_perm(0750) ); Produces files name after the DAY only; all the directories are present and autocreated, but facilty, host, year, month are missing from the file name. As this seems to be a common example, I'm wondering if there is a problem with the system or something in the context of the conf file that I have set wrong. May I have a pointer to investigate from the list members? Regards, Kim

2 1

syslog-ng & Directory Creation
by Philip Webster 21 May '04

21 May '04

Hello, I've just changed the owner for new files created by syslog-ng to be someone other than root, but new directories are still owned by root. The relevant configuration is: destination dst_hosts { file("/path/to/logs/$HOST/$YEAR-$MONTH-$DAY" template("$FULLDATE $FULLHOST $FACILITY.$PRIORITY $MSG\n") owner(loguser) group(loguser) perm(0600) dir_perm(0700) create_dirs(yes)); I've tried placing the create_dirs() directive before the owner() directive, but with no change in the result. The owner of the top-level directory (/path/to/logs) is also loguser. All files are created with the correct owner and group. syslog-ng version is 1.6.3. Is there anything I am doing wrong? Thanks Phil

2 2

Regex on destination/template
by Gehring, Andrew x66132 20 May '04

20 May '04

Hello, I've been looking around, and can't seem to find anything related to this... Is it possible to do a regex on a template within a destination? For example: My $MSG = "this is foo bar yadda yadda" All I want passed to the destination is the foo and anything beyond it (foo bar yadda yadda). If not in the template, with another filter? Anywhere? Thanks, Andrew _ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

1 0

RE: [syslog-ng]Problem with "kill -HUP" on syslog-ng
by Andy Kirkpatrick 20 May '04

20 May '04

Hi, I get that too, running syslog-ng 1.5.15 on debian woody with kernel 2.4.18 SMP. I did a quick check of the source some months ago and if I recall correctly, the signal handler was quite simple and didn't mask any signals so if another one arrives while its handling the first signal, the process will terminate. This frequently happened when logrotate went to work, rotating logfiles and sending a quick volley of signals to syslog-ng. I was in a rush so rather than patch and build a custom package for our systems, I wrote a postrotate script to start syslog-ng if it wasn't running already. Let me know if I was off base with my diagnosis... Andy Kirkpatrick -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Stephane OMNES Sent: Thursday, 6 May 2004 9:17 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Problem with "kill -HUP" on syslog-ng Hi, I need some help because I encountered a problem when trying to make some automatic logrotate script with syslog-ng. My "logrotate script" is the following : /var/log/*.log { sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true endscript } The syslog-ng daemon never restarts when you type "kill -HUP <syslog-ng.pid>" I tried also "kill -SIGUP ..." same result (the daemon is stopped but never restarts...). Did someone ever encountered this problem ? Is there any "proper" solution ? I'm currently workin under RedHat Enterprise v3.0 Thanks in advance to answer my question. Regards. Stéphane OMNES Security Engineer ************************************************************ The contents of this email and any attachments are confidential. They are intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to anyone or make copies. * email scanned for viruses, vandals and malicious content * ************************************************************ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Most efficient way of "dropping" garbage ?
by Rich Armstrong 19 May '04

19 May '04

We have a syslog-ng server, with many clients. One of these clients is suffering from DoS attacks. Since these are being logged, the syslog-ng server is also suffering ! I have created the following, temporarily :- destination d_null { file("/dev/null"); }; filter f_null { host("dummy.name.host.net"); }; log { source(net); filter(f_null); destination(d_null); flags(final); }; This solves the problem with disk usage, but there is still some significant CPU load. So, the question is, "Is there a more efficient method of ignoring/dropping messages ?" Should I be using pipe(), instead of file() ? -- Richard Armstrong

1 1

Error compiling 1.6.4 on OpenBSD 3.5-stable
by Steven J. Surdock 18 May '04

18 May '04

$ ./configure ... $ make ... gcc -DHAVE_CONFIG_H -I. -I/home/ssurdock/syslog-ng-1.6.4/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c macros.c macros.c: In function `format_tzofs': macros.c:118: error: `tm' undeclared (first use in this function) macros.c:118: error: (Each undeclared identifier is reported only once macros.c:118: error: for each function it appears in.) *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4/src. *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4/src (line 253 of Makefile). *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4/src (line 418 of Makefile). *** Error code 1 Stop in /home/ssurdock/syslog-ng-1.6.4 (line 168 of Makefile). $ Which seems to stem from the GLOBAL_TIMEZONE not being detected and tm not being defined in the "else" part of the #if: format_tzofs(char *dest, size_t left) { size_t length; #if HAVE_GLOBAL_TIMEZONE length = snprintf(dest, left - 1, "%c%02ld%02ld", timezone > 0 ? '-' : '+', (timezone < 0 ? -timezone : timezone) / 3600, (timezone % 3600) / 60); #else length = strftime(dest, left -1, "%z", tm); #endif return length; } And possibly the relevant config.log ... configure:1876: checking for global timezone variable configure:1895: gcc -c -g -O2 conftest.c 1>&5 configure: In function `foo': configure:1889: error: invalid lvalue in assignment configure: failed program was: #line 1881 "configure" ...

1 0

unparseable log message error
by Senga, Gene 18 May '04

18 May '04

hello, anyone familiar with this message? It seems to go in cycles in the syslog file until /var is full. unparseable log message: "<2048032048204803, 204803, 204803, 204803, 204803, b_blockn204803, 20480204803,204803, b_blocknr=42949672204803,204803, b_blocknr204803, b_blocknr=429496204803 , 204803204803, 204803, 204803, 204803, 204803, 204803, b_blockn204803,204803, b_blocknr=42949672204803, 2048 03, 204803, 204803, b_204803, 204803, b_block204803, 204803, 204803, 204803, 204803, 204803, 204803, 204803,2 04803, b204803, b_blocknr204803, 204803, 204803, 204803, b_blocknr204803, b_blocknr=4294967204803, 204803, 20 4803, 204803, b_blocknr204803, 204803, b_b204204803, 204803, 204803,204803, b_blocknr204803, 204803,204204803 , b_blocknr204803, b_blocknr204803,204803, b204803, b_204803, e=0x00000000, b_size=1024" Linux kernel 2.6.1-5 any help is appreciated. thanks, gene

1 0