January 2005 - syslog-ng - lists.balabit.hu

php-syslog-ng
by Tales Teixeira 18 Jan '05

18 Jan '05

Dear friends, I have a problem with php-syslog-ng. When my database for a device is big and i try to view the report, it shows the message: Connection time out of 30 secs. Do you know how i fix this? Is there a way to "tunning" the php-syslog-ng? I read something about caching, but i didn't understand very well. Best regards, Tales Teixeira.

1 0

Null Filter?
by Rhugga 18 Jan '05

18 Jan '05

I want a catch-all log destination and can't seem to find out how in the documentation or examples. A log statement needs a filter paramter and a filter statement needs at least 1 parameter as well, so how can this be achived? I want a filter that catches absolutely every possbile thing. Thx, cc

3 3

syslog-ng-1.9.2+20050112+1424 doesn't compile
by Jose Pedro Oliveira 15 Jan '05

15 Jan '05

Balazs, The latest syslog-ng 1.9.2 snapshot (20050112_1424) doesn't compile because of a missing header file (logsource.h). This file doesn't exists in the tarball. Compilation error: ---------- ... logsource.c:24:23: logsource.h: No such file or directory logsource.c:29: error: syntax error before '*' token logsource.c: In function `log_source_msg_ack': logsource.c:31: error: `LogSource' undeclared (first use in this function) logsource.c:31: error: (Each undeclared identifier is reported only once logsource.c:31: error: for each function it appears in.) logsource.c:31: error: `self' undeclared (first use in this function) logsource.c:31: error: syntax error before ')' token ... ---------- Regards, jpo -- José Pedro Oliveira

1 0

trying to compile on a cobalt
by Michael Gargiullo 14 Jan '05

14 Jan '05

I've followed the dependency hell until I reached this: No package 'eventlog' found configure: error: Library requirements (eventlog) not met; consider adjusting the PKG_CONFIG_PATH environment variable if your libraries are in a nonstandard prefix so pkg-config can find them. Where can I find this? What is it a part of?

3 4

RE: [syslog-ng]Problems with Netscreen log entries
by James Masson 12 Jan '05

12 Jan '05

Hi Phil, I had exactly this problem, upgrading to 1.6.5 fixed the problem. Regards James > -----Original Message----- > From: syslog-ng-admin(a)lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Philip Webster > Sent: 06 January 2005 05:59 > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]Problems with Netscreen log entries > > Bazsi, > > Balazs Scheidler wrote: > > On Mon, 2004-08-09 at 15:20, Paul Mindeman wrote: > > > >>Running sylog-ng 1.6.4 on Solaris 9 > >> > >>Log entries from my UNIX devices log fine. Log entries from my > >>Netscreen devices seem to be missing the end of line terminator, as > >>the entries run together in the log file. The default > syslog daemon > >>was able to handle these entries fine. Any ideas on how to > fix this? > >> > >>The options in the syslog-ng.conf file are: > >> > >>options { sync (0); > >> time_reopen (10); > >> log_fifo_size (1000); > >> long_hostnames (off); > >> use_dns (no); > >> use_fqdn (no); > >> create_dirs (no); > >> keep_hostname (yes); > >> }; > > > > > > Can you give me an tcpdump snippet to see how a netscreen > log message > > is formatted? Please make sure that you snap the complete > packet (-s > > option). > > > > tcpdump -xXpeni ethX port 514 and udp > > > > should do the trick. > > > > I'm seeing the same problem as listed above, but did not see > a solution posted. I've included a tcpdump listing of a > sample packet below. All packets seem to be null terminated, > but do not contain a newline. The sending device is a > Netscreen ISG2000 and the receiver is syslog-ng 1.6.3 running > on Red Hat Linux Advanced Server release 2.1AS. > > If the logs are sent from the ISG to a FreeBSD host running > standard syslog, and then forwarded from there to the > syslog-ng host, a newline is present in the logs on both servers. > > Any thoughts? > Phil > > 11:04:03.044944 IP 10.40.44.3.2148 > 10.224.8.2.syslog: UDP, > length 146 > 0x0000: 00d0 b7a8 8008 0010 db86 5e80 0800 4500 > ..........^...E. > 0x0010: 00ae 07b9 0000 4011 297a 0a28 2c03 0ae0 > ......@.)z.(,... > 0x0020: 0802 0864 0202 009a 8108 3c31 3636 3e67 > ...d......<166>g > 0x0030: 702d 6564 6765 2d66 773a 204e 6574 5363 > p-edge-fw:.NetSc > 0x0040: 7265 656e 2064 6576 6963 655f 6964 3d67 > reen.device_id=g > 0x0050: 702d 6564 6765 2d66 7720 205b 526f 6f74 > p-edge-fw..[Root > 0x0060: 5d73 7973 7465 6d2d 696e 666f 726d 6174 > ]system-informat > 0x0070: 696f 6e2d 3030 3736 373a 204c 6f63 6b20 > ion-00767:.Lock. > 0x0080: 636f 6e66 6967 7572 6174 696f 6e20 656e > configuration.en > 0x0090: 6465 6420 6279 2074 6173 6b20 7373 682d > ded.by.task.ssh- > 0x00a0: 636d 643a 3820 2832 3030 352d 3031 2d30 > cmd:8.(2005-01-0 > 0x00b0: 3420 3131 3a30 343a 3033 2900 > 4.11:04:03). > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > >

2 1

libevtlog.so.0: cannot open shared object file
by Shane Presley 11 Jan '05

11 Jan '05

When I try to start syslog-ng (on RedHat ES 3)I get this error: Starting syslog-ng /usr/local/sbin/syslog-ng: error while loading shared libraries: libevtlog.so.0: cannot open shared object file: No such file or directory [FAILED] I have compiled eventlog, and that file is... find / -name libevtlog.so /usr/local/lib/libevtlog.so Is this a path problem or something? I'm new to linux so I assume I'm missing something obvious. But I did try to google this error first and found nothing. Shane

3 3

confusing error message in syslog-ng
by Ed Ravin 11 Jan '05

11 Jan '05

I'm using syslog-ng version 1.6.5 on NetBSD 1.5.4. I added a new output file to my syslog-ng configuration and got this error message: Jan 10 16:16:17 syslogng@localhost[14437]: Cannot open file /syslog/services/filers.udp^(a)2005/01/filers.udp.2005.01.10 for writing (Permission denied) Note the ^@ NULL character in the log in the filename. This confused me no end, wondering if I had somehow corrupted my config file - as the character in that position was another / character. I spent extra time checking my config and running "od -c" looking for the null character. It turned out that /syslog/services was owned by root and syslog-ng was running as a local user, and thus didn't have permission to create a new directory there. Fixing the permissions solved the problem. So the error message was accurate, except for the corrupted filename. Where's that NULL coming from?

1 0

Re: [syslog-ng]Maillog to be split
by JulesF 10 Jan '05

10 Jan '05

Dave have tried your suggestion, but Syslog does not seem to like it. The strange this is, that the statements you have quoted are not dissimilar from the original ones already present. On 20:28:02 January 10, 2005 Dave Johnson <davejjohnson(a)gmail.com> wrote: > For more postfix information; you can check out: > http://logreport.org/doc/gen/email/postfix.php > http://www.onlamp.com/pub/a/onlamp/2004/01/22/postfix.html > > Looking at those docs; you could change the filter f_mailout and > f_mailin previously > suggest to look for match ("postfix/smtp") and match > ("postfix/smtpd") (respectively) and see what happens. > > > On Mon, 10 Jan 2005 18:32:49 +0000, JulesF <julesf(a)the4.co.uk> wrote: > > Thanks Dave. I have not got a clue where to start. I'm running > > Postfix as my MTA. How much more difficult would this be to set up > > than with Sendmail? > > > > On 18:20:20 January 10, 2005 Dave Johnson <davejjohnson(a)gmail.com> > > > wrote: Jules-- > > > > > > This is going to be mta specific. IE: depending on what your > > > running and your requirements are; its possible to have one mta > > > process accept and queue the mail; and another one that > > > send/deliver the mail. If this is the case; it maybe possible > > > for the mta to have different syslog facilities/priorities for > > > each of these processes. Again; this is going to be mta > > > specific. > > > The other option is to regex out the lines your want to be > > > separated. So for example [off the top of my head-- you can try > > > something like this (which I haven't tested:] on sendmail; only > > > logging inbound accepted messages and outbound attempts: > > > (some errors will not be picked up on these regexes): > > > > > > filter f_mailin { facility (mail); match("daemon=MTA"); }; > > > filter f_mailout { facility (mail); match("mailer=esmtp"); }; > > > destination maillogin { file ("/var/log/maillog.in" perm(0644); > > > }; destination maillogout { file ("/var/log/maillog.out" > > > perm(0644); }; log { source(local); filter(f_mailin); > > > destination(maillogin); }; log { source(local); > > > filter(f_mailout); destination(maillogout); }; > > > > > > > > > On Mon, 10 Jan 2005 17:11:07 +0000, JulesF <julesf(a)the4.co.uk> > > > > wrote: How would I go about splitting the maillog to show > > > > both inbound and outbound services in different files; what > > > > amendments need to be made to syslong-ng.conf? > > > > > > > > The current maillog entry: > > > > > > > > destination d_mail { file("/var/log/maillog"); }; > > > > > > > > Thanks. J > > > > > > > > _______________________________________________ > > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > Frequently asked questions at http://www.campin.net/syslog-ng/ > > > > faq.h > > > > tml > > > > > > > > > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at http://www.campin.net/syslog-ng/faq > > > .html > > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.h > > tml > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html >

1 0

Maillog to be split
by JulesF 10 Jan '05

10 Jan '05

How would I go about splitting the maillog to show both inbound and outbound services in different files; what amenedments need to be made to syslong-ng.conf? The current maillog entry: destination d_mail { file("/var/log/maillog"); }; Thanks. J

2 3

'filter(DEFAULT)' depreciated?
by Til Schubbe 09 Jan '05

09 Jan '05

Hi, having this in my config-file (like the FAQ says)... <QUOTE> log { source(s_all); filter(DEFAULT); destination(df_rest); }; </QUOTE> ... I get this: /etc# syslog-ng -d [...] unresolved reference: DEFAULT ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Error initializing configuration, exiting. Is 'filter(DEFAULT)' depreciated? How can I catch the remaining messages? TIA Til

2 2