November 2005 - syslog-ng - lists.balabit.hu

Solaris functionality fixed in the 1.9.x branch
by Balazs Scheidler 25 Nov '05

25 Nov '05

Hi, I'm writing this email to inform you that I've fixed up the Solaris STREAMS based logging in the development series. Now it should work on Solaris again. The snapshot for tomorrow will contain the fix. -- Bazsi

1 0

I want to avoid some messages...please suggest.
by Atif Munir 25 Nov '05

25 Nov '05

There are some unwanted messages on my syslog-php web page........Is there a "19510 syslog-ng notice 2005-11-24 11:53:24 syslog-ng[24047]: STATS: dropped 0 " way that i can avoid them... Thanks in advance. atif

3 2

how to avoid such messages
by Atif Munir 25 Nov '05

25 Nov '05

Please help me i am in great trouble......I am getting such "syslog-ng[24047]: STATS: dropped 0" messages in the syslog-ng server and i want to avoid them....please let me know any way to avoid them...thax in advance. atif

1 0

log-rotation: how to write rotated files to another directory
by Oliver Lang 25 Nov '05

25 Nov '05

Hi list, using the macros $MONTH, $WEEK and $DAY it is possible to rotate the logfiles. The rotated files are written to the defined working directory. Question: Is it possible to define another directory for these rotated logs ?? The working directory should contain the current logfiles only. Hope you can help. Kind Regards Oliver Environemnt: syslog-ng 1.6.8 on RHEL ES 4 __________________________________ Yahoo! Music Unlimited Access over 1 million songs. Try it free. http://music.yahoo.com/unlimited/

2 1

syslog-ng 1.6.9 released
by Balazs Scheidler 23 Nov '05

23 Nov '05

Hi, I have released a new maintenance release from the syslog-ng 1.6.x branch, with version number 1.6.9. The list of user-visible changes is below. The most important change is probably the added workaround for lose-a-message when the TCP connection is broken. The updated version can be found on the syslog-ng homepage at: http://www.balabit.com/products/syslog-ng/ News for the 1.6.9 release Wed, 23 Nov 2005 09:52:30 +0100 * Fixed usertty destination, names in utmp records are not NUL terminated. This might cause some logged in users not to be found. * Fixed timezone calculation during daylight saving. * Fixed a warning message in file destinations which indicated that permissions would be changed even if no permission change was requested. * Added a workaround for lose-one-message when connection is broken. * Owner and group information on files is set independently, so one can work while the other fails, this fixes the behaviour when syslog-ng is running as non-root and only the group information is specified. * Documentation updates. * Updated bundled libol to 0.3.17 -- Bazsi

1 1

IPv6 support
by Frederic Beck 23 Nov '05

23 Nov '05

Hello I'm looking for a syslog daemon with IPv6 support. By asking google, it seemed that msyslog had this support, but it's not the case, and it's the same for syslog-ng, in the ML it is said to being working, but i didn't manage to make it work. Does anyone know such a daemon or how to use syslog-ng with IPv6 ? I tried several statements in the configuration file, using DNS names, "...", "[....]", but none of these did work, when syslog-ng starts it only uses IPv4 addresses Thanks a lot Fred

2 1

Compiling libol on Solaris 10 SPARC
by Dave Knoch 23 Nov '05

23 Nov '05

Attempting to compile libol 3.16 on Solaris 10, I receive the following error: *** Error code 1 make: Fatal error: Command failed for target `libol.la' Current working directory /tmp/libol-0.3.16/src *** Error code 1 make: Fatal error: Command failed for target `all' Current working directory /tmp/libol-0.3.16/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='utils src'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Any suggestions? Dave

2 1

syslogng+logcheck
by Metal Gear 22 Nov '05

22 Nov '05

hi guys currently i am testing logwatch, logcheck and newlogcheck to generated reports from log files generated by syslog-ng. The log files are generated in the format /var/log/syslog-ng/host1/date1/messages /var/log/syslog-ng/host1/date2/messages /var/log/syslog-ng/host1/date3/messages /var/log/syslog-ng/host2/date1/messages /var/log/syslog-ng/host2/date2/messages * * /var/log/syslog-ng/host*/date*/messages so i played around with logcheck and newlogcheck and it worked fine for single file. According to the README provided by logcheck it will work fine for a single logfile. So is there a way to run it against multiple logfiles according to dates and hosts. Regards

4 5

Full hostname available when tunnelling through stunnel?
by Alexi Papaleonardos 22 Nov '05

22 Nov '05

Hi folks. We have some of our more important hosts reporting our central syslog-ng servers via stunnel. The downside seems to be that only the first "word" (unqualified) of the hostname makes its way to the loghost. Because of an well-intentioned but annoying host naming policy, we have a number of hosts named things like web002.abc and web002.xyz. It would seem that this causes log files to become intermingled. Here is the line we are using in one of the destination statements: file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" so both web002.abc and web002.xyz end up going to /var/log/HOSTS/web002/ . We tried using $FULLHOST but instead of getting the value of hostname -f (at least on linux), like we hoped, we got something very strange, like s_sys@hostname, which evidently is trying to describe the chain of hosts the log message passed through (though we have no hosts named s or sys). Does anyone have experience or suggestions for getting around this problem? Or perhaps there's a solution in a newer version of syslog-ng. We are using syslog-ng 1.6.5 and libol 0.3.14. Thanks! Alexi

2 1

sun streams in 1.9.6
by John.Dickinson＠nominet.org.uk 22 Nov '05

22 Nov '05

Hi, Can anyone tell me the current state of sun streams support in 1.9.6? There is an old mention of it being missing in the NEWS file and I can not get it to work - but that might just be me :) I configured like this ./configure --prefix=/opt/syslog-ng2 --with-glib=/opt/glib --with-eventlog=/opt/eventlog --enable-sun-streams --enable-sun-door --enable-dynamic-linking When I try to run it I get STREAMS support not compiled in; Segmentation Fault Thanks John

3 6