January 2005 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]no logging
by Michael Di Martino 09 Jan '05

09 Jan '05

Thanks for all your help. Syslog-ng is running and collected all my log info. BTW I have been to that bar many times. -----Original Message----- From: Dave Johnson [mailto:davejjohnson@gmail.com] Sent: Saturday, January 08, 2005 5:04 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]no logging Try removing the filter in the log{} line for troubleshooting purposes. Anything logging to udp 514 on that box should be logged to the 60HUDSONST file. Then from there you can spend some time getting the filters just right. Make sure your dirs are setup [/var/syslog-ng/host] as create_dirs is set to no in your optoins. Oh, also FYI--Theres a small dive bar across the street if you start to get too frusterated. ;) (I've spent a few nights in 60 hudson [~7-9 years ago].) On Fri, 7 Jan 2005 17:50:26 -0500, Michael Di Martino <mdm(a)telx.com> wrote: > I was able to get syslog-ng running however nothing is being logged. > I have verified that syslog-ng is running and listing on udp 514 > Here is a copy of my syslog-ng.conf file. > > #----------------------------------------------------------------------- > - > #General > #----------------------------------------------------------------------- > - > options > { > chain_hostnames(no); > create_dirs (no); > dir_perm(0755); > keep_hostname(yes); > log_fifo_size(1024); > long_hostnames(on); > perm(0644); > sync(0); > time_reopen (10); > use_dns(no); > use_fqdn(no); > }; > > #----------------------------------------------------------------------- > #log sources > #----------------------------------------------------------------------- > source network { udp(); }; > #----------------------------------------------------------------------- > #Log Destinations > #----------------------------------------------------------------------- > destination 60HUDSONST > {file("/var/syslog-ng/host/60HUDSONST.log"); }; > > #_______________________________________________________________________ > #host based filters > #----------------------------------------------------------------------- > filter 60HUDSONST { host(192.168.11.1$); }; > > #_______________________________________________________________________ > #put it all together > #----------------------------------------------------------------------- > log { source(network); filter(60HUDSONST); destination(60HUDSONST); > }; > > And Here is a the router syslog commands > logging trap notifications > logging facility local6 > logging 192.168.11.28 > > Any ideas why nothing is being logged on the syslog-ng server > > Any help would be greatly appreciated. > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

no logging
by Michael Di Martino 08 Jan '05

08 Jan '05

I was able to get syslog-ng running however nothing is being logged. I have verified that syslog-ng is running and listing on udp 514 Here is a copy of my syslog-ng.conf file. #----------------------------------------------------------------------- - #General #----------------------------------------------------------------------- - options { chain_hostnames(no); create_dirs (no); dir_perm(0755); keep_hostname(yes); log_fifo_size(1024); long_hostnames(on); perm(0644); sync(0); time_reopen (10); use_dns(no); use_fqdn(no); }; #----------------------------------------------------------------------- #log sources #----------------------------------------------------------------------- source network { udp(); }; #----------------------------------------------------------------------- #Log Destinations #----------------------------------------------------------------------- destination 60HUDSONST {file("/var/syslog-ng/host/60HUDSONST.log"); }; #_______________________________________________________________________ #host based filters #----------------------------------------------------------------------- filter 60HUDSONST { host(192.168.11.1$); }; #_______________________________________________________________________ #put it all together #----------------------------------------------------------------------- log { source(network); filter(60HUDSONST); destination(60HUDSONST); }; And Here is a the router syslog commands logging trap notifications logging facility local6 logging 192.168.11.28 Any ideas why nothing is being logged on the syslog-ng server Any help would be greatly appreciated.

2 1

RE: [syslog-ng]syslog-ng
by Michael Di Martino 08 Jan '05

08 Jan '05

Dave thanks for the response However, I am not sure where to put the path to my syslog-ng.conf file. Below is a copy of my startup script. [root@traffic init.d]# cat syslog-ng init.d script #!/bin/bash # #description: syslog-ng starup script # #process name: syslog-ng #config: /etc/syslog-ng/syslog-ng.conf #pidfile: /var/run/syslog-ng.pid #source function library . /etc/rc.d/init.d/functions RETVAL=0 case "$1" in start) echo -n "Starting syslog-ng: " if [ ! -f /var/run/syslog-ng.pid ] ; then case "`type -type success`" in function) /usr/local/sbin/syslog-ng && success "syslog-ng starup" || \ failure "syslog-ng startup" RETVAL=$? ;; *) /usr/local/sbin/syslog-ng && echo -n "syslog-ng " RETVAL=$? ;; esac [ $RETVAL -eq 0 ] && echo -n "syslog-ng " fi echo ;; stop) echo -n "Shutting down syslog-ng; " if [ -f /var/run/syslog-ng.pid ] ; then killproc syslog-ng fi echo [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/syslog-ng ;; restart) $0 stop $0 start RETVAL=$? ;; status) status syslog-ng RETVAL=$? ;; *) echo "Usage: {start|stop|restart|status}" exit 1 esac [root@traffic init.d]# -----Original Message----- From: Dave Johnson [mailto:davejjohnson@gmail.com] Sent: Friday, January 07, 2005 3:21 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng 1) Does "init.d script" come before #!/bin/bash? 2) before the first case statement modify "RETVAL-0" to be "RETVAL=0" 3) in the lines that have "/usr/local/sbin/syslog-ng" add the "-f" option and give the config file location on your system; because by default its trying to find it "/usr/local/etc/syslog-ng/syslog-ng.conf" and its not there. On Fri, 7 Jan 2005 13:53:07 -0500, Michael Di Martino <mdm(a)telx.com> wrote: > > > > > I have just installed syslog-ng-1.6.5 and was looking forwarded to putting > some of its features to good use. However, I just cannot get this up > according to your install instructions. > > When I try to start "syslog-ng" I get the following errors. I have check the > startup for typos I could not find any. does anyone have any insight to this > error? > > [root@traffic syslog-ng]# /etc/rc.d/init.d/syslog-ng start > /etc/rc.d/init.d/syslog-ng: line 1: init.d: command not found > /etc/rc.d/init.d/syslog-ng: line 14: RETVAL-0: command not found > Starting syslog-ng: Cannot open configuration file > /usr/local/etc/syslog-ng/syslog-ng.conf for reading > Parse error reading configuration file, exiting. (line 1) > [FAILED] > [root@traffic syslog-ng]# > > this is my startup script > > [root@traffic syslog-ng]# vi /etc/rc.d/init.d/syslog-ng > > init.d script > #!/bin/bash > > # > #description: syslog-ng starup script > # > #process name: syslog-ng > #config: /etc/syslog-ng/syslog-ng.conf > #pidfile: /var/run/syslog-ng.pid > > #source function library > . /etc/rc.d/init.d/functions > > RETVAL-0 > > case "$1" in > start) > echo -n "Starting syslog-ng: " > if [ ! -f /var/run/syslog-ng.pid ] ; then > case "`type -type success`" in > function) > /usr/local/sbin/syslog-ng && success "syslog-ng > starup" || \ > failure "syslog-ng startup" > RETVAL=$? > ;; > *) > /usr/local/sbin/syslog-ng && echo -n "syslog-ng " > RETVAL=$? > ;; > esac > [ $RETVAL -eq 0 ] && echo -n "syslog-ng " > fi > echo > ;; > stop) > echo -n "Shutting down syslog-ng; " > if [ -f /var/run/syslog-ng.pid ] ; then > killproc syslog-ng > fi > echo > [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/syslog-ng > ;; > restart) > $0 stop > $0 start > RETVAL=$? > ;; > status) > status syslog-ng > RETVAL=$? > ;; > *) > echo "Usage: {start|stop|restart|status}" > exit 1 > esac > > exit $RETVAL > Thanks in advance. > > > Regards, > Michael DiMartino > Director of MIS > The telx Group, Inc. > 17 State St, 33rd Floor > New York, NY 10004 > T: 212.480.3300 X2022 > C: 646.207.6603 > > > > > Regards, > Michael DiMartino > Director of MIS > The telx Group, Inc. > 17 State St, 33rd Floor > New York, NY 10004 > T: 212.480.3300 X2022 > C: 646.207.6603 > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog-ng
by Michael Di Martino 07 Jan '05

07 Jan '05

I have just installed syslog-ng-1.6.5 and was looking forwarded to putting some of its features to good use. However, I just cannot get this up according to your install instructions. When I try to start "syslog-ng" I get the following errors. I have check the startup for typos I could not find any. does anyone have any insight to this error? [root@traffic syslog-ng]# /etc/rc.d/init.d/syslog-ng start /etc/rc.d/init.d/syslog-ng: line 1: init.d: command not found /etc/rc.d/init.d/syslog-ng: line 14: RETVAL-0: command not found Starting syslog-ng: Cannot open configuration file /usr/local/etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. (line 1) [FAILED] [root@traffic syslog-ng]# this is my startup script [root@traffic syslog-ng]# vi /etc/rc.d/init.d/syslog-ng init.d script #!/bin/bash # #description: syslog-ng starup script # #process name: syslog-ng #config: /etc/syslog-ng/syslog-ng.conf #pidfile: /var/run/syslog-ng.pid #source function library . /etc/rc.d/init.d/functions RETVAL-0 case "$1" in start) echo -n "Starting syslog-ng: " if [ ! -f /var/run/syslog-ng.pid ] ; then case "`type -type success`" in function) /usr/local/sbin/syslog-ng && success "syslog-ng starup" || \ failure "syslog-ng startup" RETVAL=$? ;; *) /usr/local/sbin/syslog-ng && echo -n "syslog-ng " RETVAL=$? ;; esac [ $RETVAL -eq 0 ] && echo -n "syslog-ng " fi echo ;; stop) echo -n "Shutting down syslog-ng; " if [ -f /var/run/syslog-ng.pid ] ; then killproc syslog-ng fi echo [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/syslog-ng ;; restart) $0 stop $0 start RETVAL=$? ;; status) status syslog-ng RETVAL=$? ;; *) echo "Usage: {start|stop|restart|status}" exit 1 esac exit $RETVAL Thanks in advance. Regards, Michael DiMartino Director of MIS The telx Group, Inc. 17 State St, 33rd Floor New York, NY 10004 T: 212.480.3300 X2022 C: 646.207.6603 Regards, Michael DiMartino Director of MIS The telx Group, Inc. 17 State St, 33rd Floor New York, NY 10004 T: 212.480.3300 X2022 C: 646.207.6603

2 1

klogd and syslog-ng
by John Feeney 07 Jan '05

07 Jan '05

Hello, I was wondering if anyone has specifically seen a problem when syslog-ng and klogd are running together and syslog-ng has /proc/kmsg as a source. I know that they should not be configured to access /proc/kmsg at the same time but before I could remove klogd from the startup script, syslog-ng has hung at a customer site and people (my boss) want proof that this is the cause of the situation. I can only speculate. It appears as though syslog-ng is hanging on a read() system call for the file descriptor to /proc/kmsg. Only around half the number of kernel messages are retrieved from the kernel buffer. The apps logging to syslog-ng will eventually hang. If new kernel data is generated (e.g. rmmod a module) at a later time, syslog-ng will wake up and logging is normal. Any proof or experience that klogd will cause syslog-ng to hang would be greatly appreciated. Could you please send mail directly to me (jfeeney(a)broadbus.com) Thank you so much. John Feeney -------------------------------------------------------- This email message and any files transmitted with it contain confidential information intended only for the person(s) to whom this email message is addressed. If you have received this email message in error, please notify the sender immediately by telephone or email and destroy the original message without making a copy. Thank you.

2 1

binary distribution of libol-0.3.13
by Yen, Peter-HK (Hong Kong TS) 07 Jan '05

07 Jan '05

Hi syslog-ng experts, We are currently trying to install the syslog-ng on an HPUX v11.0, and whilst doing so we encountered problems trying to install libol. With reference to this thread in the syslog-ng mailing list https://lists.balabit.hu/pipermail/syslog-ng/2004-July/006249.html We see that you may have a libol-0.3.13 for hpux 11.0 available. Would you mind providing me a copy of such software, or direct me to a URL where this can be obtained? Million thanks! Best regards, Peter Yen Hewlett-Packard HK SAR Limited Tel: (852) 3559 7412 Fax: (852) 2506 3734 email: peter-hk.yen(a)hp.com _______________________________ The information transmitted is intended solely for the individual or entity to which it is addressed and may contain Hewlett-Packard Company confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this email in error please contact the sender and delete the material from any computer.

2 1

unwanted space at the end of each line
by Bernard Brandl 07 Jan '05

07 Jan '05

hi everybody, I've a problem when syslog-ng writes remote logs, each time the log message is sent over the network, syslog-ng add a white space at the end of the line. e.g : [root@keweb01 root]# logger -d -p local3.info "nanard" at the same time, on the central log host : [kelogs01]# strace -p 27431 -s 1500 -e recvfrom,write recvfrom(3, "<158>Jan 6 14:09:45 keweb01.search.test.ke.echo root: nanard\n", 2048, 0, {sa_family=AF_INET, sin_port=htons(33594), sin_addr=inet_addr("10.234.56.130")}, [16]) = 62 write(10, "Jan 6 14:09:45 keweb01.search.test.ke.echo root: nanard \n", 58) = 58 the message "nanard\n" was changed into "nanard \n" I use the same options for all hosts : # template("$DAY/$MONTH/$YEAR $HOUR:$MIN:$SEC $HOST $MSG\n") # template_escape(off) syslog-ng version 1.6.4 any suggestions? thanks -- Bernard Brandl

2 2

RE: [syslog-ng]MYSQL pipe 2
by Robert.COward＠deploymenthealth.osd.mil 06 Jan '05

06 Jan '05

Steven, Thanks for the quick response. here is what my mysql entry looks like in /etc/rc.local: # MYSQL if [ X"${mysql}" == X"YES" ]; then if [ -x /usr/local/bin/mysqld_safe ]; then echo -n " mysql"; /usr/local/bin/mysqld_safe --socket=/var/www/var/run/mysql/mysql.sock & sleep 10 echo -n " syslog-ng2mysql"; /etc/check_syslog-ng2mysql.sh & fi fi and here is the /etc/check_syslog-ng2mysql.sh script i sent in yesterday: #!/bin/sh ps=`ps -ax | grep "\--password=x" | awk '{ print $9 }'` if [[ $ps != "" ]]; then echo "syslog-ng2mysql is alive." else if [ ! -p /tmp/mysql.pipe ]; then mkfifo /tmp/mysql.pipe kill -HUP `cat /var/run/syslog-ng.pid` fi mysql -u root --password=password syslog < /tmp/mysql.pipe fi I don't think the problem is that mysqld is not started when i issue the mysql command in the script. I think it has something to do with how openbsd starts daemons from within /etc/rc.local and /etc/rc. When i reboot this server, the /etc/check_syslog-ng2mysql.sh does nto start at all. Basically I am just looking for other ways to start /etc/check_syslog-ng2mysql.sh or more to the point the "mysql -u root --password=password syslog < /tmp/mysql.pipe" line which just dumps the data from a named pipe created by syslog-ng, over to the mysql db. Thanks for all the help. --- 5 January 2005 "We must learn to welcome and not to fear the voices of dissent. We must dare to think about "unthinkable things" because when things become unthinkable, thinking stops and action becomes mindless." (J. William Fulbright, 1905-1995) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

2 1

Re: [syslog-ng]syslog-ng development release 1.9.2
by Balazs Scheidler 06 Jan '05

06 Jan '05

On Wed, 2005-01-05 at 10:56 -0800, nate(a)campin.net wrote: > Thanks a lot (sorry for the top post, using my webmail from work). > > I have a missing function again: > > test_msgparse.c:66: warning: format argument is not a pointer (arg 3) > test_msgparse.c:67: warning: format argument is not a pointer (arg 3) > test_msgparse.c:68: warning: format argument is not a pointer (arg 3) > gcc -I../src -Wall -g -o test_msgparse test_msgparse.o ../src/logmsg.o > ../src/misc.o ../src/gsockaddr.o -ll -lnsl -lsocket -ldoor -L/opt/csw/lib > -lglib-2.0 -lintl -liconv -levtlog > test_msgparse.o: In function `testcase': > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests/test_msgparse.c:50: > undefined reference to `__STRING' > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests/test_msgparse.c:53: > undefined reference to `__STRING' > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests/test_msgparse.c:54: > undefined reference to `__STRING' > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests/test_msgparse.c:55: > undefined reference to `__STRING' > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests/test_msgparse.c:60: > undefined reference to `__STRING' > test_msgparse.o:/export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests/test_msgparse.c:64: > more undefined references to `__STRING' follow > ./src/gsockaddr.o: In function `g_inet_aton': > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/src/gsockaddr.c:63: undefined > reference to `inet_aton' > ../src/gsockaddr.o: In function `g_sockaddr_inet_new': > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/src/gsockaddr.c:348: undefined > reference to `inet_aton' > ./src/gsockaddr.o: In function `g_sockaddr_inet_range_new': > /export/home/ncampi/syslog-ng-1.9.2+20050105+1302/src/gsockaddr.c:456: undefined > reference to `inet_aton' > collect2: ld returned 1 exit status > make[2]: *** [test_msgparse] Error 1 > make[2]: Leaving directory > `/export/home/ncampi/syslog-ng-1.9.2+20050105+1302/tests' > make[1]: *** [all-recursive] Error 1 > make[1]: Leaving directory `/export/home/ncampi/syslog-ng-1.9.2+20050105+1302' > make: *** [all] Error 2 > > > Isn't that a standard library function? Am I doing something wrong here? that is only a test program and your syslog-ng binary should have been compiled at this phase. inet_aton is a standard symbol, but it is not in stock libc under solaris, it is either in -lsocket or in -lnet. -- Bazsi

1 0

Problems with Netscreen log entries
by Paul Mindeman 06 Jan '05

06 Jan '05

Running sylog-ng 1.6.4 on Solaris 9 Log entries from my UNIX devices log fine. Log entries from my Netscreen devices seem to be missing the end of line terminator, as the entries run together in the log file. The default syslog daemon was able to handle these entries fine. Any ideas on how to fix this? The options in the syslog-ng.conf file are: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; Thanks -- Paul Mindeman BTInet Systems Administrator 701-355-5587 mindeman(a)btinet.net

3 2