April 2005 - syslog-ng - lists.balabit.hu

doc error
by SheBang 21 Apr '05

21 Apr '05

http://www.balabit.com/products/syslog_ng/reference/x737.html has this: destination d_messages { file("/var/log/messages" log_fifo_size(1000); }; ...but it's missing a closing parenthesis, should look like this: destination d_messages { file("/var/log/messages" log_fifo_size(1000) ); }; I know it's being picky, but it is the reference manual after all. ;)

2 1

what chars are really supported by syslog?
by Jason Haar 20 Apr '05

20 Apr '05

[More of a general syslog question than syslog-ng but...] I am using syslog to record certain information that can include 8bit chars. I appear to have no problems with syslog-ng - it all just works. However, I am concerned that some "other" syslog daemons might do gross things if weird chars were pushed into them. So I want my syslog calls to "clean" the data down to (near) the lowest common denominator (without being really stupid - like "only allow 7bit ASCII") Are their any ranges of chars I should strip out - beside the obvious NULLs and CR/LF? -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

1 0

Re: [syslog-ng]trouble configuring syslog-ng with libraries
by John Thrumston 19 Apr '05

19 Apr '05

I have done just that, I have version 1.6.5 put when I try and configure it, it tells me that it found libol 0.3.14 and tells me checking libol version >= 0.3.14... configure: error: libol-config not found in the specified location. So I tried the ./configure --with-libol=/usr/local/lib and that still gave me the same result. not sure what to do now. Balazs Scheidler <bazsi(a)balabit.hu> wrote: On Tue, 2005-04-19 at 06:42 -0700, John Thrumston wrote: > I am still having trouble with this. I am working on it. One question > I have that I don't see answered anywhere (maybe I am just blind). But > do you have to run syslog-ng on each server you want to log to the > logserver? Is this something I have to do for each of my machines? I > am not sure I completely understand the process. not necessarily, syslog-ng supports the good old UDP based syslog protocol. one minor note: if you are not that experienced you might want to stick to a stable release (currently 1.6.7) and not a BETA grade software like 1.9.4 is. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

RE: [syslog-ng]Logging Java stack traces with syslog-ng and log4j
by Vaibhav Goel 19 Apr '05

19 Apr '05

Yes the stack trace is multiple lines. We are actually using log4j to log the traces locally as well as over a custom TCP appender which hooks up to syslog-ng and sends the logs to the loghost. This is how I was able to find the problem. The exception error showed up on both the local log as well as the syslog-ng produced log but stack trace after the error did not show up (as you mentioned syslog-ng should match each and every line). I do have logsurfer on the app server however I don’t think I would know the initial line of the stack trace since its arbirtrary depending on the error. I hear ya on the STDOUT newline issue. I think I did run into that once where I was feeding stdin from syslog-ng to a perl script... Thanks, Vaibhav Goel -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of UNIX Admin Sent: April 18, 2005 9:44 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Logging Java stack traces with syslog-ng and log4j The java stack trace is multiple lines, right? Syslog messages are single lines - and so syslog-ng's filters match one line at a time. You need to match each and every line or just have the java app log to a file and parse it. If you have swatch or logsurfer or SEC or something the you can probably see the initial line of the stack trace and and look for the rest of the message and send the whole thing via email/snmp trap/pager/mon trap/whatever. Are you just feeding STDOUT of the app server into logger or something? I hope it doesn't send messages with newlines in them into openlog()/syslog(). I hate when that happens, but crappy logs are better than no logs, I always say. ;) On 4/18/05, Vaibhav Goel <vgoel(a)cucbc.com> wrote: > > > > Hi all > > > > I am trying to get syslog-ng to log a java stack trace such as one shown > below. > > > > PST:2005-03-15/10:46:49.657 [ExecuteThread: '23' for queue: > 'weblogic.kernel.Default'] LOGERROR > jwsm.com.cucbc.taglib.content.IncludeTagContent -- > ServletExce > > ption on include tag > > javax.servlet.ServletException: Got error: 404 > > at > com.cucbc.servlet.SimpleMDRequestDispatcher.handleError(SimpleMDRequestDispatcher.java:72) > > at > com.cucbc.servlet.AbstractMDRequestDispatcher.checkForError(AbstractMDRequestDispatcher.java:87) > > at > com.cucbc.servlet.AbstractMDRequestDispatcher.include(AbstractMDRequestDispatcher.java:71) > > at > com.cucbc.taglib.content.IncludeTagContent.write(IncludeTag.java:137) > > at > com.cucbc.taglib.content.ContentTagSupport.doEndTag(ContentTagSupport.java:52) > > at > jsp_servlet._personal.__index._jspService(index.jsp:63) > > at > weblogic.servlet.jsp.JspBase.service(JspBase.java:33) > > at > weblogic.servlet.internal.ServletStubImpl$ServletInvocationAction.run(ServletStubImpl.java:996) > > etc… > > > > I have a filter match "LOGERROR" configured for syslog-ng. It matches fine > and logs the line: > > PST:2005-03-15/10:46:49.657 [ExecuteThread: '23' for queue: > 'weblogic.kernel.Default'] LOGERROR > jwsm.com.cucbc.taglib.content.IncludeTagContent -- > ServletExce > > ption on include tag > > > > However, the stack trace after that is ignored…. > > > > Any way to get that? I guess a regexp match on LOGERROR is out of the > question… > > > > Thanks ³+%¢ à™¨¥–+-³+%¢ à–+-±¶¥i¸†èm¶›?þX¬¶ÆÚ•¦â¶¿™¨¥™©ÿ–+-ŠwèþÌ¬–ˆ'€ZÞªç§¶\š²Gªç¬¶*'±«a¶Úÿ 0q©©ŠyÞ·û2²Z žßj¨m

1 0

Re: [syslog-ng]trouble configuring syslog-ng with libraries
by John Thrumston 19 Apr '05

19 Apr '05

I am still having trouble with this. I am working on it. One question I have that I don't see answered anywhere (maybe I am just blind). But do you have to run syslog-ng on each server you want to log to the logserver? Is this something I have to do for each of my machines? I am not sure I completely understand the process. Balazs Scheidler <bazsi(a)balabit.hu> wrote:On Thu, 2005-04-14 at 12:03 -0700, John Thrumston wrote: > I tried the ./configure --enable-dynamic-linking as it suggests, got > the exact same results. > > Sunfreeware has a newer version of GLIB (SMCglib-2.6.2 out there. > My questions are, if I add that package. > 1) how will the server know which version to use? > 2. Will this corrupt any other packages that may currently be using > the SUNWGlib that was installed? > > Sorry to ask all these questions, I just don't know library functions > very well and don't want to blow the box up so to speak. hm. the configure test checking static glib does not check whether --enable-dynamic-linking was specified and always errors out. This patch should fix it: --- orig/configure.in +++ mod/configure.in @@ -113,7 +113,7 @@ blb_cv_static_glib=no)]) LIBS=$old_LIBS -if test "x$blb_cv_static_glib" = "xno"; then +if test "x$enable_dynamic_linking" = "xno" -a "x$blb_cv_static_glib" = "xno"; then AC_MSG_ERROR([static GLib libraries not found, either link GLib dynamically using the --enable-dynamic-linking or install a static GLib]) fi You'll need to regenerate the configure script after patching it (using autoconf), alternatively you could also comment out this check from the already generated configure script. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --------------------------------- Do you Yahoo!? Yahoo! Mail - Find what you need with new enhanced search. Learn more.

2 1

Bug: nul chars at end of log lines
by W. Borgert 19 Apr '05

19 Apr '05

Hi, I reported this on 2004-11-24 as Debian bug against version 1.6.4, but I'm curious, whether problem is known on other platforms, too. (See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=282782) A nul character at the end of an UDP transferred log message is included in the actual syslog file. In the terminal window the character is shown as ^@. Two problems: It looks ugly and it makes the file look "binary" to tools such as grep, which does not print lines anymore, but says "Binary file matches" :-( A test script to (< 15 lines of code) reproduce the behaviour can be downloaded from here: http://bugs.debian.org/cgi-bin/bugreport.cgi/logtest.py?bug=282782&msg=3&at… Don't forget to enable udp() as source, if you run the test. Cheers, WB

2 1

can't compile syslog in HP-UX 11.23
by �� ͱ� 19 Apr '05

19 Apr '05

I get errors when running "make" for syslog-ng1.6.6 on HP-UX 11.23 maybe it's because that "ld" in HP-UX can't excute "-Bstatic" and "-Bdynamic" option. does anyone who succeeded in installing syslog in HP-UX 11i? I do not know how to solve this problem I need help /usr/local/bin/gcc -g -O2 -Wall -I/home/libol-0.3.15/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o getopt.o getopt1.o -lnsl /home/libol-0.3.15/src/.libs/libol.a -lnsl -lxnet -Wl,-Bstatic -ll -lwrap -Wl,-Bdynamic ld: Bad keyword argument: static Fatal error. collect2: ld returned 1 exit status *** Error exit code 1 Stop. *** Error exit code 1 Stop. *** Error exit code 1 Stop. *** Error exit code 1 Stop.

3 5

Logging Java stack traces with syslog-ng and log4j
by Vaibhav Goel 19 Apr '05

19 Apr '05

Hi all I am trying to get syslog-ng to log a java stack trace such as one shown below. PST:2005-03-15/10:46:49.657 [ExecuteThread: '23' for queue: 'weblogic.kernel.Default'] LOGERROR jwsm.com.cucbc.taglib.content.IncludeTagContent -- ServletExce ption on include tag javax.servlet.ServletException: Got error: 404 at com.cucbc.servlet.SimpleMDRequestDispatcher.handleError(SimpleMDRequestD ispatcher.java:72) at com.cucbc.servlet.AbstractMDRequestDispatcher.checkForError(AbstractMDRe questDispatcher.java:87) at com.cucbc.servlet.AbstractMDRequestDispatcher.include(AbstractMDRequestD ispatcher.java:71) at com.cucbc.taglib.content.IncludeTagContent.write(IncludeTag.java:137) at com.cucbc.taglib.content.ContentTagSupport.doEndTag(ContentTagSupport.ja va:52) at jsp_servlet._personal.__index._jspService(index.jsp:63) at weblogic.servlet.jsp.JspBase.service(JspBase.java:33) at weblogic.servlet.internal.ServletStubImpl$ServletInvocationAction.run(Se rvletStubImpl.java:996) etc... I have a filter match "LOGERROR" configured for syslog-ng. It matches fine and logs the line: PST:2005-03-15/10:46:49.657 [ExecuteThread: '23' for queue: 'weblogic.kernel.Default'] LOGERROR jwsm.com.cucbc.taglib.content.IncludeTagContent -- ServletExce ption on include tag However, the stack trace after that is ignored.... Any way to get that? I guess a regexp match on LOGERROR is out of the question... Thanks

2 1

Re: [syslog-ng]trouble configuring syslog-ng with libraries
by John Thrumston 15 Apr '05

15 Apr '05

I tried the ./configure --enable-dynamic-linking as it suggests, got the exact same results. Sunfreeware has a newer version of GLIB (SMCglib-2.6.2 out there. My questions are, if I add that package. 1) how will the server know which version to use? 2. Will this corrupt any other packages that may currently be using the SUNWGlib that was installed? Sorry to ask all these questions, I just don't know library functions very well and don't want to blow the box up so to speak. Thanks again for your help. Balazs Scheidler <bazsi(a)balabit.hu> wrote: On Thu, 2005-04-14 at 10:09 -0700, John Thrumston wrote: > thank you, that appears to have fixed that, but now I get the > following. > > checking for glib-2.0... yes > checking GLIB_CFLAGS... -I/usr/include/glib-2.0 > -I/usr/lib/sparcv9/glib-2.0/include > checking GLIB_LIBS... -L/usr/lib/sparcv9 -lglib-2.0 > checking for eventlog... yes > checking EVTLOG_CFLAGS... -I/usr/local/include/eventlog > checking EVTLOG_LIBS... -L/usr/local/lib -levtlog > checking for static GLib libraries... no > configure: error: static GLib libraries not found, either link GLib > dynamically using the --enable-dynamic-linking or install a static > GLib > > as you can see, it found glib but for some reason errors out. I have > added every directory if found thru find to the PKG_CONFIG_PATH > variable but that doesn't seem to help. What should I be looking for? Just do as the configure script says: either install a static glib (it is named libglib.a, not .la!) or if you don't mind linking to libraries in /usr (which could be NFS mounted for instance) then specify --enable-dynamic-linking to the configure script. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --------------------------------- Do you Yahoo!? Make Yahoo! your home page

2 1

RE: [syslog-ng]Match macro in filename?
by Vaibhav Goel 14 Apr '05

14 Apr '05

Thanks Nate. I am using (trying to) an alternate approach now...I am going to write a perl script that gets everything from STDIN and parses the log data, does some regexp matching and writes out the logs based on that....check this simple script (which does not wanna work): #!/usr/bin/perl -w my $input = <STDIN> ; if ($input =~ /xyz/) { $var = "xyz.log"; open(LOG, ">>/tmp/$var"); print LOG "$input"; close(LOG); } This does not seem to want to work using syslog-ng (it works fine from the commandline though),...any ideas anyone? -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Nate Campi Sent: April 14, 2005 2:12 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Match macro in filename? On Thu, Apr 14, 2005 at 07:55:24AM -0700, Vaibhav Goel wrote: > > Cool that it is 1.9.4. Is 1.9.4 production ready by any chance? I am > currently using 1.6.5. If not, is there any other way you can suggest > to solve this "problem"? I am not averse to writing some scripts etc.. Good news on the feature in the 1.9 branch! As for using 1.6.5, someone else just brought this up the other day, see this thread: https://lists.balabit.hu/pipermail/syslog-ng/2005-April/007260.html -- Nate "If you put a billion monkeys in front of a billion typewriters typing at random, they would reproduce the entire collected works of Usenet in about ... five minutes." -Anon. "Come to think of it, there are already a million monkeys on a million typewriters, and the Usenet is NOTHING like Shakespeare!" -Blair Houghton _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1