October 2005 - syslog-ng - lists.balabit.hu

Syslog-ng.conf syntax
by SOLIS, ALEX 19 Oct '05

19 Oct '05

Does a log statement need to all be on one line? I have a log statement with two sources, 4 filters and 2 destinations. It all wont fit on one line. When I try to break it up into a block format logging stops for those destiniations. I am sure I am missing something. Here is the log statement: log { source(net); source(net_tcp); filter (f_not_nmrouter); filter (f_not_non_critical_windows); filter (f_not_non_crit_unix); filter (f_not_uiz_servers); destination(x); destination(y); }; Is this broken up correctly? <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

3 2

messed up permissions on /dev/null destination on solaris
by Nate Campi 18 Oct '05

18 Oct '05

When using /dev/null as a destination on Solaris 8 (sparc) with syslog-ng 1.6.7 the perms of /dev/null get messed up: $ ls -l /dev/null lrwxrwxrwx 1 root other 27 Apr 19 2003 /dev/null -> ../devices/pseudo/mm@0:null $ ls -l /devices/pseudo/mm@0:null crw-r--r-- 1 root root 13, 2 Oct 16 18:27 /devices/pseudo/mm@0:null I thought this was addressed at some point, was that only on Linux perhaps? Thanks, -- Nate "Hardware : The parts of a computer system that can be kicked." - Pesis, Jeff

5 10

program dies
by Jeff DiNisco 17 Oct '05

17 Oct '05

I'm running syslog-ng on solaris 10. I have a destination defined as - destination d_alert { program("/usr/local/admin/syslog-ng/alert.bash"); }; when syslog-ng is started, these processes also start... /bin/bash /usr/local/admin/syslog-ng/alert.bash /bin/sh -c /usr/local/admin/syslog-ng/alert.bash About an hour later, for no apparent reason, the 2 alert.bash processes die but the syslog-ng process continues to run. I've implemented a watchdog script to alert and restart syslog-ng when they die. It's interesting to note that they seem to die exactly 1 hour after being restarted. command used to start syslog-ng - /usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf >> ${logfile} 2>&1 alert.bash script... #!/bin/bash export mailaddr=jeff(a)xxxxxx.com while read input do hostname=`echo ${input} |awk '{print $4}' |sed 's|/.*||'` program=`echo ${input} |awk '{print $5}' |sed 's|[[(].*||'` echo ${input} | mailx -s "${program} alert on ${hostname}" ${mailaddr} done Any help would be greatly appreciated. - Jeff __________________________________ Yahoo! Music Unlimited Access over 1 million songs. Try it free. http://music.yahoo.com/unlimited/

3 3

How does regex work with HOST definitions?
by Jason Haar 17 Oct '05

17 Oct '05

Hi there I have a subset of syslog-ng hosts that use a specific DNS formatted naming convention that I wish to ensure all their data is caught by a particular syslog-ng filter. I have filter f_process_Test { host("^...\-..\-ids\-[0-9]+\...\.our\.net$") and not host("abc-xy-ids-02\.our\.net"); }; i.e. I want abc-12-ids-01.aa.our.net and xyz-12-ids-01.aa.our.net to be caught by this filter, but abc-xy-ids-02\.our\.net not to be. I could explicitly name them all I suppose - but there are 12+ of them and they are growing in number. A regex would be much more efficient. Anyway, it doesn't work. That filter never triggers. I know the hostnames are correct as I have a general catch-all rule that logs to filenames containing the hostname - and those hostnames show up in there. Can anyone explain what I've got wrong? REGEX works fine in my "match" calls... This is syslog-ng-1.6.7-2 under CentOS4.1 Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

6 9

messages on syslog-ng server and locals files
by Atif Munir 17 Oct '05

17 Oct '05

Hi All, How can I have messages on the remote syslog-ng server and on local files? Thanks in advance. Atif

1 0

syslog-ng 1.9.6 released
by Balazs Scheidler 16 Oct '05

16 Oct '05

Hi, I've released yet another version in the syslog-ng development series targeted at the stable 2.0, dubbed 1.9.6. It has the following NEWS entry: 1.9.6 Sat, 15 Oct 2005 18:07:07 +0200 * Added new options to control buffer flushing (flush_lines and flush_timeout, see the documentation for more details) * Fixes in local timezone detection, it should properly detect DSTs on Linux, Solaris and probably BSDs. * Fixed facility/priority filtering. * Fixed owner/group/permission setting on target files/directories. * Copied the contrib directory as found in 1.6.x to this tree. * TZ macro is now an alias of TZOFFSET, as I could not find a portable way to determine the string representation of any given timezone offset. * Added some more unit tests. -- Bazsi

2 1

RE: [syslog-ng] syslog-ng 1.9.6 compile error
by Marvin Nipper 15 Oct '05

15 Oct '05

MANY thanks on the time-related fixes. The 1.9.6 compilations seemed to go great in that regard. But then it generated an error much further down in the compilation process. Maybe it's just something stupid that I've done(??). Your input would be appreciated. (The config and a chunk of the compilation output is pasted in below.) THANKS for all of the great work on the new version. Marvin ./configure checking for a BSD-compatible install... ./install-sh -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... no checking for nawk... nawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc option to accept ANSI C... none needed checking for bison... no checking for byacc... no checking for flex... no checking for lex... lex checking for yywrap in -lfl... no checking for yywrap in -ll... yes checking lex output file root... lex.yy checking whether yytext is a pointer... no checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking how to enable static linking for certain libraries... GNU or Solaris checking how to run the C preprocessor... gcc -E checking for egrep... egrep checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... no checking for unistd.h... yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking getopt.h usability... no checking getopt.h presence... no checking for getopt.h... no checking whether struct tm is in sys/time.h or time.h... time.h checking for struct tm.tm_gmtoff... no checking for door_create in -ldoor... yes checking for socket in -lsocket... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for strdup... yes checking for strtol... yes checking for inet_aton... no checking for inet_ntoa... yes checking for getopt_long... no checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB_CFLAGS... -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include checking for GLIB_LIBS... -L/usr/local/lib -lglib-2.0 -liconv checking for EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking for EVTLOG_LIBS... -L/usr/local/lib -levtlog checking for static GLib libraries... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating config.h config.status: executing depfiles commands secdevrsn01 # make make all-recursive Making all in src if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT misc.o -MD -MP -MF ".deps/misc.Tpo" \ -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ else rm -f ".deps/misc.Tpo"; exit 1; \ fi ...... numerous successful compiles in here...... rm -f libsyslog-ng.a ar cru libsyslog-ng.a misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o ranlib libsyslog-ng.a if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo './'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lsocket -ldoor -Wl,-Bstatic -ll -L/usr/local/lib -lglib-2.0 -liconv -L/usr/local/lib -levtlog -Wl,-Bdynamic Undefined first referenced symbol in file LOG_FAC libsyslog-ng.a(filter.o) ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /var/opt/packages/syslog-ng-1.9.6/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /var/opt/packages/syslog-ng-1.9.6 *** Error code 1 make: Fatal error: Command failed for target `all'

2 1

RE: [syslog-ng] syslog-ng 1.9.6 compile error
by Marvin Nipper 15 Oct '05

15 Oct '05

Sorry, I should have stated in the previous post that this is all in a Solaris 8 Sparc environment.

1 0

log does not appear on the clients
by Atif Munir 15 Oct '05

15 Oct '05

I have make a syslog-ng server and the clients are pushing their syslog (by default daemon) messages to syslog-ng server. The logs are fine on the server but I am unable to view the logs on the clients dmesg(/var/adm/messages). I m interested to have the logs on both sides...I mean on the syslog-ng server and on the clients it self. The clients have /etc/syslog.conf as under. =====================/etc/syslog.conf===================== *.err;kern.notice;auth.notice @loghost #*.err;kern.notice;auth.notice /dev/sysmsg *.err;kern.debug;daemon.notice;mail.crit @loghost *.err;kern.debug;daemon.notice;mail.crit /var/adm/messages *.alert;kern.err;daemon.err operator *.alert root *.emerg * mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) ifdef(`LOGHOST', , user.err @loghost user.err /dev/sysmsg user.err @loghost user.err /var/adm/messages user.alert `root, operator' user.emerg * ) ====================================================== Thanks in advance . Atif

2 1

Incompatibility beetween syslogNG 1.6.8(lattest stable) and libol 0.3.8 ?????
by CIKALA Frederic ROSI/DOSI 14 Oct '05

14 Oct '05

Hello Before trying to install the 0.2.24 version of libol, i want to be sure that stable syslog NG version 1.6.8 is not compatible with the 0.3.8 version of libol. According to https://lists.balabit.hu/pipermail/syslog-ng/2001-December/002794.html, a stable version should be used with a 0.2 verison of libol, where as the stderr advises me to use a 0.3 version :-/ :-\ ... checking libol version >= 0.3.16... no configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch [root@XXXX-Linux syslog-ng-1.6.8]# .... Thus, i'm totally confused and need Help thanks for those who will answer, there is no others clue on the web ;( *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

2 1