March 2005 - syslog-ng - lists.balabit.hu

io.c read() error?
by SOLIS, ALEX 30 Mar '05

30 Mar '05

I am using syslog-ng 1.6.5 on a Gentoo Linux system running kernel 2.6.9. I have recently modified an open source utility called NTsyslog to send Windows NT style event logs via TCP to my syslog-ng server. Everything seems to work fine except I receive a io.c read() error for every event sent over the network via TCP. Anyone have any ideas of what my problem might be? Here are a few bits of info: Logs that I see when TCP syslog communication is attempted: Mar 30 10:43:48 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3038 Mar 30 10:43:48 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:43:48 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3038 Mar 30 10:43:48 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3039 Mar 30 10:43:48 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:43:48 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3039 Mar 30 10:49:05 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3066 Mar 30 10:49:05 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:49:05 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3066 Mar 30 10:49:05 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3067 Mar 30 10:49:05 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:49:05 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3067 Mar 30 10:53:59 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3077 Mar 30 10:53:59 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:53:59 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3077 Mar 30 10:53:59 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3078 Mar 30 10:53:59 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:53:59 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3078 Mar 30 10:58:53 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3092 Mar 30 10:58:53 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:58:53 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3092 Mar 30 10:59:16 src@lookout syslog-ng[3166]: AF_INET client connected from 192.168.11.19, port 3093 Mar 30 10:59:16 src@lookout syslog-ng[3166]: io.c: do_read: read() failed (errno 104), Connection reset by peer Mar 30 10:59:16 src@lookout syslog-ng[3166]: AF_INET client dropped connection from 192.168.11.19, port 3093 Afinet.c in syslog-ng 1.6.6 sources where io_read() is called: /* af_inet source connection */ static int do_init_afinet_source_connection(struct log_handler *c, struct syslog_config *cfg, struct persistent_config *persistent) { CAST(afsocket_source_connection, self, c); if (self->client_addr) { CAST(inet_address_info, inet, self->client_addr); /* SOCK_STREAM */ notice("AF_INET client connected from %S, port %i\n", inet->ip, inet->port); io_read(self->client, make_log_reader(0, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, cfg->bad_hostname, c), make_afsocket_source_close_callback(self)); } else { /* SOCK_DGRAM */ io_read(self->client, make_log_reader(1, NULL, cfg->log_msg_size, 0, cfg->check_hostname ? LF_CHECK_HOSTNAME : 0, cfg->bad_hostname, c), make_afsocket_source_close_callback(self)); } return ST_OK | ST_GOON; } < -----END of CODE ---- > I have been trying to find what values are passed to io_read() and make_log_reader() but I have been unsuccessfull. Thanks in advance for any replies. Alex S. <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

2 1

RE: [syslog-ng]-linux/bin/ld: cannot find -lglib-2.0
by Philipp Snizek 30 Mar '05

30 Mar '05

> > > static glib, syslog-ng tries to link to glib statically. > > > > Thanks for your answer. > > What do I have to do ? > > the static library is in the devel package usually, you need > to look for something like libglib-2.0.a Please excuse, but I still don't understand. libglib-2.0.la is in /usr/local/lib what do I have to do? I still have /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware -linux/bin/ld: cannot find -lglib-2.0 What lib is it exactly looking for ? in /usr/local/lib I also have the glib-2.0 directory which includes a header file. Thank you Philipp

2 1

RE: [syslog-ng]-linux/bin/ld: cannot find -lglib-2.0
by Philipp Snizek 30 Mar '05

30 Mar '05

> /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware > > -linux/bin/ld: cannot find -lglib-2.0 > > collect2: ld returned 1 exit status > > make[2]: *** [syslog-ng] Error 1 > > make[2]: Leaving directory `/root/syslog-ng-1.9.3/src' > > make[1]: *** [all-recursive] Error 1 > > make[1]: Leaving directory `/root/syslog-ng-1.9.3' > > make: *** [all] Error 2 > > > > However, glib-2.0 is installed and the path in ld.config.so > points to > > /usr/local/lib > > static glib, syslog-ng tries to link to glib statically. Thanks for your answer. What do I have to do ? > ps: use the latest snapshot of 1.9.x as plain 1.9.3 contains > a problem in macro expansion. Thanks. I changed to the snapshot. Philipp

2 1

-linux/bin/ld: cannot find -lglib-2.0
by Philipp Snizek 29 Mar '05

29 Mar '05

Hi I have a problem with installing syslog-ng 1.9.3 gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o -lnsl -Wl,-static -lfl -L/usr/local/lib -lglib-2.0 -levtlog -Wl,-call_shared /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware -linux/bin/ld: cannot find -lglib-2.0 collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.9.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-1.9.3' make: *** [all] Error 2 However, glib-2.0 is installed and the path in ld.config.so points to /usr/local/lib What am I missing? thanks Philipp

2 1

autoconf confusion attempting to install v1.6.6
by Joe 29 Mar '05

29 Mar '05

on FreeBSD 4.11 Stable #1 I'm obtaining the following error which seems pretty obvious: aclocal.m4:39: error: Autoconf version 2.54 or higher is required aclocal.m4:39: the top level autoheader: autom4te failed with exit status: 1 However, output from suggests I'm using the latest autoconf (I also installed the latest) The one hack I did do was to delete the system installed autoconf and symlink autoconf to the autoconf259 executable #`which autoconf` -V autoconf (GNU Autoconf) 2.59 Written by David J. MacKenzie and Akim Demaille. Not sure where to go with this. -- Joe -- Joe S. ------------ praxis makes perfect. - anon

2 1

Syslog-ng on Sol10 Compile problems...
by Smith, James 29 Mar '05

29 Mar '05

ok, I admit, I'm not great at compiling. Has anyone had any issues with getting syslog-ng to compile on Solaris10? I'm getting the following, but am not sure how to go about solving the issue. I'm compiling on an E3500 with gcc3.4.2, libol-0.3.15, and syslog-ng-1.6.6 gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet -Wl,-Bstatic -ll -Wl,-Bdynamic ld: fatal: library -ll: not found ld: fatal: File processing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /tmp/syslog-ng-1.6.6/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='. tests'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /tmp/syslog-ng-1.6.6/src *** Error code 1 make: Fatal error: Command failed for target `all' Current working directory /tmp/syslog-ng-1.6.6/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src doc contrib'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive'

2 1

OpenBSD on SPARC64 - Syslog-ng hostname issues
by list.mail＠comcast.net 29 Mar '05

29 Mar '05

I was wondering if someone knows if the Syslog-ng issue with reading remote host hostname/IP addresses on SPARC64 has been resolved? https://lists.balabit.hu/pipermail/syslog-ng/2004-July/006320.html https://lists.balabit.hu/pipermail/syslog-ng/2004-August/006395.html Or Am I missing something in my config? - I tried every option with the hostname as suggested in http://www.campin.net/syslog-ng/faq.html#hostname Config is simple until I figure out this remote hostname/IP issue. - Please check comments in config.. And the Sample log file below... Any help would be great appricated. Thanks, Eric #---------------------------------------------------------------------- # General options #---------------------------------------------------------------------- options { chain_hostnames(no); create_dirs (no); dir_perm(0755); keep_hostname(yes); log_fifo_size(1024); long_hostnames(off); perm(0644); sync(1); time_reopen (10); use_dns(yes); use_fqdn(no); }; #---------------------------------------------------------------------- # Log sources #---------------------------------------------------------------------- source network { udp(); internal(); }; # source local { unix-stream("/dev/log"); internal(); }; #---------------------------------------------------------------------- # Log Destinations #---------------------------------------------------------------------- destination net { file("/var/syslog-ng/hosts/imd.log" ); }; #---------------------------------------------------------------------- # host-based filters - This is the only way I can get logs - filter for localhost # I can not get logs filtering for remote host - IP or hostname. #---------------------------------------------------------------------- filter net { host("obsd"); }; #---------------------------------------------------------------------- # put it all together #---------------------------------------------------------------------- log { source(network); filter(net); destination(net); }; Sample Log Message -from tail of log file - Mar 24 08:46:47 obsd Mar 24 2005 08:46:47 hcpix Localhost ----------^ Remotehost -------------------------------------------^

2 1

syslog-ng dies randomly on solaris
by Ian Veach 29 Mar '05

29 Mar '05

Greetings - We're just chomping at the bit to switch to syslog-ng from the standard syslog. Although it sounds like plenty of solaris people are having success, our testing is not going well. Our configs are all great, but syslog-ng just simply stops running at random times (sometimes an hour, the last one 35 days) on my test machine (low volume except for occasional load testing). Can anyone give me (a neophyte in this arena) any ideas on how to fix this? Ideally, I would like to solve the problem (or figure out what it is), but am open to things like a cron to verify syslog-ng is running...Could try to debug, but not great with truss, and for some reason syslog-ng cores don't show much useful info (to me, a noob). Syslog-ng 1.6.5 and libol version required at the time standard compile for solaris (details available) Solaris 9, recently patched thanks very much! ivo

3 4

snapshots now working
by Balazs Scheidler 29 Mar '05

29 Mar '05

hi, As of today I've disabled snapshot generation because of some internal changes of our web service. It will be restored soon. (you can remind me if it does not work in about a week) -- Bazsi

3 3

Log line lost during TCP connection?
by Jay Guerette 27 Mar '05

27 Mar '05

I have a postfix server logging via syslog-ng. The log data is written to a local file and also sent via TCP to a central syslog-ng loghost. On the source server (syslog-ng 1.6.6 on Linux) I see: 05:32:21 internal/smtpd[15534]: 9AE172D29A5: client=x.x.net[10.x.x.x] 05:32:21 internal/qmgr[9993]: 9AE172D29A5: from=<x(a)x.com>, size=1557811, nrcpt=1 (queue active) On the central loghost (syslog-ng 1.6.5 on Linux) I see: 05:32:21 syslog-ng[28919]: AF_INET client connected from 10.x.x.x, port 33645 and 05:32:21 internal/qmgr[9993]: 9AE172D29A5: from=<x(a)x.com>, size=1557811, nrcpt=1 (queue active) The 1st line from the source server is missing on the central loghost. Is this a bug?

2 3