February 2005 - syslog-ng - lists.balabit.hu

Compilation problem with syslog-ng-1.9.3.
by Peter 08 Feb '05

08 Feb '05

Hello. I have a problem. I'm trying to compile syslog-ng-1.9.3. But after succesful configuration I have a linking error: i686-pc-linux-gnu-gcc -O2 -march=pentium4 -fomit-frame-pointer -pipe -mcpu=pentium4 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o -lnsl -Wl,-static -lfl -lglib-2.0 -levtlog -Wl,-call_shared /usr/lib/gcc-lib/i686-pc-linux-gnu/3.3.5/../../../../i686-pc-linux-gnu/bin/ld: cannot find -lglib-2.0 collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/var/tmp/portage/syslog-ng-1.9.3/work/syslog-ng-1.9.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/var/tmp/portage/syslog-ng-1.9.3/work/syslog-ng-1.9.3' make: *** [all] Error 2 Can anybody enlight me how I can avoid this error? I am sure I have this library: camobap ~ # ls -l /usr/lib/libglib-2.0.* -rwxr-xr-x 1 root root 805 Янв 30 22:01 /usr/lib/libglib-2.0.la lrwxrwxrwx 1 root root 22 Янв 30 22:01 /usr/lib/libglib-2.0.so -> libglib-2.0.so.0.400.8 lrwxrwxrwx 1 root root 22 Янв 30 22:01 /usr/lib/libglib-2.0.so.0 -> libglib-2.0.so.0.400.8 -rwxr-xr-x 1 root root 503304 Янв 30 22:01/usr/lib/libglib-2.0.so.0.400.8 Also I would like to note that many other applications that also depend on glib-2.0 compiled without problems. I can not find sollution by myself. Where should I look for sollution? Thank you in advance, _______ Peter.

2 1

1.6.6 release status
by Balazs Scheidler 05 Feb '05

05 Feb '05

Hi, Just a quick summary, how we are at: - there is one pending patch reporting truncated messages when log_msg_size() is exceeded, it can be in once Roberto confirms that my change is correct to his patch. Otherwise I've committed everything in, and made a manual snapshot with today's date which is being uploaded to our webserver right now. (takes a couple of minutes as there are over 10000 files to synchronize) Thanks Jose and Roberto for helping me preparing the release. -- Bazsi

3 3

syslog-ng 1.6.6 released
by Balazs Scheidler 04 Feb '05

04 Feb '05

Hi, I have released syslog-ng 1.6.6 with the user-visible changes file included at the end of this mail. It has been slightly been changed since the last snapshot to make the linking changes compatible with Solaris's linker. Otherwise the release is identical. Please note that I have changed GPG keys, this is signed with the new one. The fact that the release was signed with this key might attach some trust. My fingerprint is: pub 1024D/ADCF4138 2004-11-10 Balazs Scheidler <bazsi(a)balabit.hu> Key fingerprint = 8038 B76C B92A 661D E4EF 222D B613 44D0 ADCF 4138 sub 2048g/82B2CACD 2004-11-10 The release is available at the usual location at http://www.balabit.com/downloads/syslog-ng/ News for the 1.6.6 release Fri, 04 Feb 2005 13:06:22 +0100 * Fixed timezone handling problem on platforms which require an explicit tzset() call. * Fixed resolving the PRI macro which always expanded to an empty string. * Fixed possible hang during reload for one second. * Fixed syslog2ng script which sometimes generated three dots when generating priority ranges. (debug...emerg) * Added a notification about splitting message lines, if they are over the configured log_msg_size() limit. * Added a setsid() call to program destinations to avoid being in the same process group as the child, as some shells send signals to the whole process group they are in, effectively killing syslog-ng. (triggered on OpenBSD for example) * Added log_fifo_size option to TCP/UDP destinations. * Added relogger.pl to contrib/ which replays existing syslog files. * Updated documentation (manpages and SGML documentation) * Link to various libraries residing in /usr statically by default, also added an --enable-full-static configure option to make a fully static version. Happy logging, -- Bazsi

2 2

/dev/log on Linux is a datagram socket, not a stream socket
by Philip J. Hollenback 04 Feb '05

04 Feb '05

The syslog-ng reference manual (and the sample syslog-ng.conf for RedHat) indicate that /dev/log on linux is a stream socket. However, other utilities think that /dev/log is a datagram socket. To see this, configure syslog-ng to open /dev/log with unix_stream and then strace the logger command. logger tries to open /dev/log as a datagram socket first, fails, and then falls back to opening it as a stream socket: socket(PF_FILE, SOCK_DGRAM, 0) = 1 fcntl64(1, F_SETFD, FD_CLOEXEC) = 0 connect(1, {sa_family=AF_FILE, path="/dev/log"}, 16) = -1 EPROTOTYPE (Protocol wrong type for socket) close(1) = 0 socket(PF_FILE, SOCK_STREAM, 0) = 1 fcntl64(1, F_SETFD, FD_CLOEXEC) = 0 connect(1, {sa_family=AF_FILE, path="/dev/log"}, 16) = 0 send(1, "<13>Feb 2 11:19:50 phil: test m"..., 39, 0) = 39 rt_sigaction(SIGPIPE, {SIG_DFL}, NULL, 8) = 0 close(1) = 0 If, however, you open /dev/log with unix_dgram and then run logger, it's happier: socket(PF_FILE, SOCK_DGRAM, 0) = 1 fcntl64(1, F_SETFD, FD_CLOEXEC) = 0 connect(1, {sa_family=AF_FILE, path="/dev/log"}, 16) = 0 send(1, "<13>Feb 2 11:21:28 phil: test m"..., 45, 0) = 45 rt_sigaction(SIGPIPE, {SIG_DFL}, NULL, 8) = 0 close(1) = 0 This indicates to me that the syslog-ng documentation and sample syslog-ng.conf files should be changed to show you should open /dev/log with unix_dgram on linux, not with unix_stream. This is with the 2.4.22 kernel, maybe this is something that changed at some point? Thanks, P. -- Philip J. Hollenback Telemetry Investments phollenback(a)telemetry-investments.com

2 3

$DAY not working in filenames macros in 1.6.x as it did in 1.5.x
by Andrew Fort 03 Feb '05

03 Feb '05

Hi guys, I am running syslog-ng 1.5.15 on some debian stable machines. All good, all happy. I have a source: source network-hosts { udp(ip(0.0.0.0) port(8514)); tcp(ip(0.0.0.0) port(8514) max-connections(200)); }; I use filename macro expansion to auto-rotate my logs. My destinations look exactly like: destination logfiles-host { file("/var/log/HOSTS/$HOST/$YEAR/$MONTH/$YEAR$MONTH$DAY\_$HOST\_$PROGRAM" template("$ISODATE [$HOST] <$FACILITY> $MSG\n") template_escape(no) owner(root) group(logs) perm(0660) dir_perm(0770) create_dirs(yes)); }; the routing stanza goes: log { source(network-hosts); destination(logfiles-host); }; This works as I expect (even without escaping the _'s between $DAY, $HOST and $PROGRAM). My log paths look like: /var/log/HOSTS/mel1/2005/02/20050203_mel1_named /var/log/HOSTS/mel1/2005/02/20050203_mel1_sendmail Great. However, using 1.6.x (I've not tested 1.6.6, to be sure, only 1.6.4 and 1.6.5) on both Solaris and Linux, using the exact same config (i.e., when I upgraded, for example), using this destination: destination d_local { file("/var/log/LOCAL/$HOST/$YEAR/$MONTH/$YEAR$MONTH$DAY\_$HOST" template("$ISODATE [$HOST] <$FACILITY> $MSG\n") template_escape(no) perm(0660) dir_perm(0770) create_dirs(yes)); }; I get this: /var/log/LOCAL/mel1/2005/02/200502mel1 So $DAY is not expanding. Same thing occurs when I use file("/var/log/LOCAL/$HOST/$YEAR/$MONTH/$YEAR$MONTH$DAY_$HOST" Is this a problem with $DAY, the _, or something else? Let me know if I can provide further info to help debug this.. Anyone else run into this? I'd like to upgrade all my boxes to 1.6.{4,5,6} eventually but at the moment this is holding me back from moving to 1.6. Cheers, Andrew Fort

2 3

preparing syslog-ng 1.6.6
by Balazs Scheidler 03 Feb '05

03 Feb '05

Hi, As there are some changes since syslog-ng 1.6.5, I'd like to release a new version. Before doing so I'd like to ask you to test the latest snapshot a little bit. The most important and risky change seems to be this one: 2005-01-20 Balazs Scheidler <bazsi(a)bzorp.balabit> * src/main.c: fix possible log message losing during HUP as syslog-ng was not accepting messages for 1 second and these messages were dropped, processing changed so we still wait 1 second to flush buffers but also accept messages in this interval, so the window of losing messages becomes much smaller. (fixes: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=282771) Everything else is minor, and although they might cause build problems on some platforms, I doubt they'd cause real problems. The latest snapshot is here: http://www.balabit.com/downloads/syslog-ng/1.6/src-snapshot/ The summary of changes can be found in the file named ChangeLog within the tarball. If no show-stopper bugs are found, I'm going to release syslog-ng 1.6.6 this week. Thanks in advance. -- Bazsi

4 11

Bug in S_YEAR?
by janth＠moldung.no 03 Feb '05

03 Feb '05

Hi, I have a Solaris 8 host with syslog-ng ver 1.6.5 set up with the following syslog-ng.conf: options { use_time_recvd(no); # Use the time a message is received instead of the one specified in the message. sync(0); # The number of lines buffered before written to file. }; source src { udp(ip("0.0.0.0") port(514)); tcp(ip("0.0.0.0") port(514) max-connections(100)); sun-streams("/dev/log" door("/etc/.syslog_door")); # local solaris syslog internal(); # syslog-ng interne meldinger }; source s_syslog_ng { internal(); # syslog-ng interne meldinger }; destination dst_template { file("/syslog/$R_YEAR/$R_MONTH/$R_DAY/$HOST" template("$R_YEAR-$R_MONTH-$R_DAY $R_HOUR:$R_MIN:$R_SEC | $R_UNIXTIME | $S_YEAR-$S_MONTH-$S_DAY $S_HOUR:$S_MIN:$S_SEC | $S_UNIXTIME | $HOST | $HOST_FROM | $FULLHOST | $SOURCEIP | $FACILITY.$PRIORITY | $TAG | $PROGRAM | $MSG\n") ); }; destination d_syslog_ng { file("/syslog/syslog-ng.log" sync(0) log_fifo_size(10) perm(0644) ); }; log { source (s_syslog_ng); destination (d_syslog_ng); }; log { source(src); destination(dst_template); }; Then I have another host set up to use syslog-ng as loghost. This host has purposely wrong time (1973-01-02), as can be seen here: joe@testhost / $ logger "test. local time on `uname -n` is `date +'%Y-%m-%d %H:%m:%S'`" joe@loghost / $ tail -1 /syslog/2005/02/01/testhost 2005-02-01 11:24:47 | 1107253487 | 2005-01-02 21:04:39 | 1104696279 | testhost | testhost | testhost/testhost | 192.168.1.2 | user.notice | 0d | joe | joe: [ID 702911 user.notice] test. local time on testhost is 1973-01-02 21:01:39 It seems as S_YEAR is set to YEAR (or R_YEAR, I have not checked the source). I hope someone can fix this before syslog-ng 1.6.6... Regards Jan Thomas Moldung

2 1

syslog-ng 1.6.5: manpage patch
by Jose Pedro Oliveira 03 Feb '05

03 Feb '05

Balazs, This patch adds the missing command line options to the syslog-ng.8 manpage. The patch also applies to syslog-ng 1.9.x (he default syslog-ng.conf location still has to be corrected). Regards, jpo -- José Pedro Oliveira mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/~jpo diff -ruN syslog-ng-1.6.5-orig/doc/syslog-ng.8 syslog-ng-1.6.5/doc/syslog-ng.8 --- syslog-ng-1.6.5-orig/doc/syslog-ng.8 1999-07-10 16:58:32.000000000 +0100 +++ syslog-ng-1.6.5/doc/syslog-ng.8 2005-01-30 00:05:48.906523000 +0000 @@ -7,7 +7,7 @@ .B syslog-ng [ -.B \-dvV +.B \-dFsvV ] [ .B \-f <\fIconfig-filename\fP> @@ -17,6 +17,12 @@ ] [ .B \-C <\fIchroot-dir\fP> +] [ +.B \-u +<\fIuser\fP> +] [ +.B \-g +<\fIgroup\fP> ] .SH DESCRIPTION .PP @@ -64,38 +70,72 @@ \fBsyslog-ng\fP will also save all the current values as a "checkpoint". .SH OPTIONS .TP -.B \-d +.B \-C \0<directory>, \-\-chroot=<directory> +Chroot to directory. +.TP +.B \-d, \-\-debug Set "debug mode". Prints out various messages to aid in debugging and stops it from becoming a daemon. To activate debugging in the yacc parser, either use this option twice or combine with \fB-v\fP. .TP -.B \-f \0<filename> +.B \-F, \-\-foreground +Don't fork into background. +.TP +.B \-f \0<filename>, \-\-cfgfile=<filename> Instead of reading the normal \fB/etc/syslog-ng/syslog-ng.conf\fP file for configuration information, use the filename given instead. .TP -.B \-p \0<filename> +.B \-g \0<group>, \-\-group=<group> +Switch to group. +.TP +.B \-p \0<filename>, \-\-pidfile=<filename> Write the current PID information to the specified file. +Defaults to \fB/var/run/syslog-ng.pid\fP. +.TP +.B \-s, \-\-syntax\-only +Only read and parse the configuration file. See also the option \fB-f\fP. .TP -.B \-v +.B \-u \0<user>, \-\-group=<user> +Switch to user. +.TP +.B \-v, \-\-verbose Enable verbose mode. Process will not become a daemon. Prints out fewer messages, compared to \fB-d\fP. .TP -.B \-V +.B \-V, \-\-version Print the version number. .SH DIAGNOSTICS It is expected that \fBsyslog-ng\fP will run as root, however, if not running on a priviledged port of it it owned its own log directories, etc, it might run as a non-root user. .SH SEE ALSO -logger(1), syslog(3), services(5), syslog.conf(5), syslog-ng.conf(5) +.BR syslog-ng.conf (5), +.BR logger (1), +.BR syslog (2), +.BR syslog (3), +.BR services (5), +.BR syslog.conf (5), +.BR klogd (8), +.BR syslogd (8), +.BR sysklogd (8) .SH FILES -/etc/syslog-ng/syslog-ng.conf -/etc/syslog-ng/filename.sha1 -/etc/syslog-ng/filename.H0 -/etc/syslog-ng/filename.salt -.br -/var/run/syslog.pid -.br +.TP +.I /etc/syslog-ng/syslog-ng.conf +Configuration file for +.BR syslog\-ng . +See +.BR syslog\-ng.conf (5) +for more information. +.TP +.I /etc/syslog-ng/filename.sha1 +.TP +.I /etc/syslog-ng/filename.H0 +.TP +.I /etc/syslog-ng/filename.salt +.TP +.I /var/run/syslog-ng.pid +The file containing the process id of +.BR syslog-ng . .SH BUGS .PP If you find any, please send email to me at bazsi(a)balabit.hu

3 6

syslog-ng 1.9.2/eventlog 0.2.2: packaging notes
by Jose Pedro Oliveira 03 Feb '05

03 Feb '05

Balazs, I have a couple of requests to make regarding the packaging of the above packages (for Red Hat/Fedora systems). 1) copyright information I believe both packages are being distributed under the GPL license. Could you mention this in the README files and maybe include the COPYING file in the tarballs? 2) the CFLAGS aren't being inherited The CFLAGS generated by the configure files don't honour the environment CFLAGS variable. Small patches are attached to this email. 3) eventlog static lib Would it be possible to also generate the eventlog static library by default? 4) syslog-ng 1.9.2 Would it be possible to also generate a static linked syslog-ng? Right know it only uses dynamic libraries (glib2.so and libevtlog.so). It would be nice to avoid any dynamic libraries located under /usr as the content of this directory can not yet be available (mounted) at the time the daemon syslog-ng is loaded. Best regards, jpo -- José Pedro Oliveira diff -ruN syslog-ng-1.9.2+20050112+1424-orig/configure.in syslog-ng-1.9.2+20050112+1424/configure.in --- syslog-ng-1.9.2+20050112+1424-orig/configure.in 2005-01-05 12:00:11.000000000 +0000 +++ syslog-ng-1.9.2+20050112+1424/configure.in 2005-01-15 03:22:25.989658032 +0000 @@ -71,7 +71,7 @@ PKG_CHECK_MODULES(GLIB, glib-2.0) PKG_CHECK_MODULES(EVTLOG, eventlog) -CFLAGS="-Wall -g" +CFLAGS="$CFLAGS -Wall -g" DEPS_CPPFLAGS="$CPPFLAGS $GLIB_CFLAGS $EVTLOG_CFLAGS" CPPFLAGS="$DEPS_CPPFLAGS -D_GNU_SOURCE" DEPS_LIBS="$LIBS $GLIB_LIBS $EVTLOG_LIBS" diff -ruN eventlog-0.2.2-orig/configure.in eventlog-0.2.2/configure.in --- eventlog-0.2.2-orig/configure.in 2005-01-05 12:02:18.000000000 +0000 +++ eventlog-0.2.2/configure.in 2005-01-15 03:21:00.591640504 +0000 @@ -5,7 +5,7 @@ AM_CONFIG_HEADER(config.h) AM_DISABLE_STATIC -CFLAGS="-Wall -g" +CFLAGS="$CFLAGS -Wall -g" CPPFLAGS="-D_GNU_SOURCE" AC_ARG_ENABLE(dlsym-wrapper,

5 14

There's no need to run klogd on current linux kernels
by Philip J. Hollenback 03 Feb '05

03 Feb '05

The syslog-ng reference manual http://www.balabit.com/products/syslog_ng/reference/reference.html#AEN279 contains the following: > NOTE: on Linux, the klogd daemon reads kernel messages, and > forwards them to the syslogd process. klogd preprocesses kernel > messages and replaces addresses with symbolic names (from > /boot/System.map). If you don't want to lose this functionality > you'll have to run klogd with syslog-ng as well. That info is obsolete. We run 2.4.22 and 2.6.10 kernels at my company, and both provide symbolic names in backtraces. You can verify this by looking at "dmesg" after an oops - it contains symbolic names, and that is the raw kernel log output. Please adjust the syslog-ng documentation to indicate this. Thanks, P. -- Philip J. Hollenback Telemetry Investments phollenback(a)telemetry-investments.com

2 1