April 2005 - syslog-ng - lists.balabit.hu

Apache to syslog-ng
by Jason Stafford 02 Apr '05

02 Apr '05

Howdy, Would someone please shed some light on the correct way to get logs out of apache and into syslog-ng without causing the apache to crash? I'm currently using custom log and sending that via a pipe to logger. Howerver for some reason apache will just stop responding and stop handling requests. To fix this i just restart syslog-ng and it starts working. I posted earlier with my config and someone recommend that i send it all via udp to a central server cause this might be related to the pipe. I have since done this and i did not fix the problem. What i really need is a way to get the logs out of apache wihtout using logger? Thanks, Jason

3 4

ld: cannot find -levtlog --> switching to syslog-ng 1.6
by Philipp Snizek 02 Apr '05

02 Apr '05

Hi as I failed to install syslog-ng 1.9.3 with libol 0.3.9 and eventlog-0.2.3.latest_snapshot I successfully have installed syslog-ng 1.6.6! However, I first installed libol 0.3.9. All fine. And then, when I ran ./configure in the src dir of syslog-ng 1.6.6 it said that the libol => 0.3.14 was missing. I swichted back to 0.3.14 and ./configure ran through and then I could make && make install syslog-ng 1.6.6. My system is a slackware 10.1 with a self compiled kernel 2.6.8.1 Thanks Philipp

1 0

incoming message stats
by Jim 01 Apr '05

01 Apr '05

Hello, I would like to get some stats on the number of incoming messages I am receiving on a central log server. I am running syslog-ng 1.6.6, built with libol 0.3.15. From what I can see, I will need to modify libol in order for syslog-ng to count these messages, and tell me at a regular interval. Does this sound right, or am I missing another simple way to do this? assuming I have to modify source, it looks like I can just add a counter to the do_write_str() function in pkt_buffer.c that looks something like this: if (self->queue_size == self->queue_max) { /* fifo full */ pktbuf_dropped_pkts++; ol_string_free(string); return ST_FAIL | ST_OK; } else { struct buffer_node *item; --> pktbuf_recved_pkts++; NEW_SPACE(item); item->packet = string; ol_queue_add_tail(&self->queue, &item->header); if (++self->queue_size == self->queue_max && self->super.writable) (*self->super.writable) = 0; } the "-->" indicates the new line. Pretty much all I did was copy where the "pktbuf_dropped_pkts" was, and added in my variable. The numbers that I get when I run with this don't appear to totally match up with what I expect, but is fairly close. Is this the right place to insert a counter to count total syslog messages recieved over the network (from both TCP and UDP sources). If not, can someone point me in a different direction? thanks! Mike

1 0

RE: [syslog-ng]ld: cannot find -levtlog
by Philipp Snizek 01 Apr '05

01 Apr '05

> > gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o > messages.o > > gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o > logpipe.o driver.o > > sgroup.o dgroup.o center.o filter.o logsource.o logreader.o > > logwriter.o affile.o afunix.o afinet.o afsocket.o > afstreams.o afuser.o > > afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o > > memtrace.o templates.o children.o -lnsl -Wl,-static -lfl > > -L/usr/local/lib -lglib-2.0 -levtlog -Wl,-call_shared > > > /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware > > -linux/bin/ld: cannot find -levtlog > > collect2: ld returned 1 exit status > > > hmm. for some reason eventlog did not install a static > library which it should. my version certainly installs a > static version, and it is dubbed 0.2.3, upgrading might solve > your problem. I just have tried 0.2.3. I'm getting this when running 'make' in the syslog-ng src dir. gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o -lnsl -Wl,-static -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -Wl,-call_shared afinter.o(.text+0x16): In function `afinter_source_prepare': /root/syslog-ng-1.9.3/src/afinter.c:35: undefined reference to `g_queue_get_length' afinter.o(.text+0x3e): In function `afinter_source_check': /root/syslog-ng-1.9.3/src/afinter.c:41: undefined reference to `g_queue_get_length' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.9.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-1.9.3' make: *** [all] Error 2 > ps: be sure to use the latest snapshot as 1.9.3 is known to > be broken in macro expansion I'm using the latest snapshot. Thank you Philipp

1 0

ld: cannot find -levtlog
by Philipp Snizek 01 Apr '05

01 Apr '05

When compiling syslog-1.9.3 I get "ld: cannot find -levtlog" If evtlog means the eventlog libraries from eventlog-0.2.2, they're located in /usr/local/lib (that's what the installation rouine sais). /usr/local/lib is in /etc/ld.so.conf and I ran ldconfig. I could install eventlog-0.2.2 without problems. The exact error message: gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o -lnsl -Wl,-static -lfl -L/usr/local/lib -lglib-2.0 -levtlog -Wl,-call_shared /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware -linux/bin/ld: cannot find -levtlog collect2: ld returned 1 exit status Thanks again Philipp

2 1

Re: [syslog-ng]Configure syslog-ng to act as a central logging server
by Ryan McCain 01 Apr '05

01 Apr '05

Final question (for now). Should i use "unix_stream" or "unix_dgram" w/in the source setting? I read in the Linux Server Security book that I should use unix_dgram on newer kernels. I'm on kernel 2.6.x Thanks, Ryan >>>billn(a)billn.net 03/31 10:55 am >>> On Thu, 31 Mar 2005, Ryan McCain wrote: >source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); >unix_stream("/dev/log"); internal(); }; > >destination hosts { >file("/var/syslog/HOSTS/$HOST/$YEAR/$MONTH/$HOST-$FACILITY-$YEAR$MONTH$DAY" >owner(root) group(root) perm(0755) dir_perm(0755) create_dirs(yes)); >}; > >log { source(s_sys); destination(hosts); }; > Yup. Should work like a champ. It's very similiar to a larger deployment I'm using. - billn syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]ld: cannot find -levtlog
by Philipp Snizek 01 Apr '05

01 Apr '05

> When compiling syslog-1.9.3 I get "ld: cannot find -levtlog" > > If evtlog means the eventlog libraries from eventlog-0.2.2, > they're located in /usr/local/lib (that's what the > installation rouine sais). > /usr/local/lib is in /etc/ld.so.conf and I ran ldconfig. I > could install eventlog-0.2.2 without problems. > > The exact error message: > > gcc -g -O2 -Wall -g -o syslog-ng main.o misc.o utils.o messages.o > gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o > driver.o sgroup.o dgroup.o center.o filter.o logsource.o > logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o > afstreams.o afuser.o afprog.o afinter.o cfg-lex.o > cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o > children.o -lnsl -Wl,-static -lfl > -L/usr/local/lib -lglib-2.0 -levtlog -Wl,-call_shared > /usr/lib/gcc-lib/i486-slackware-linux/3.3.4/../../../../i486-slackware > -linux/bin/ld: cannot find -levtlog > collect2: ld returned 1 exit status in /usr/local/lib I have: -rwxr-xr-x 1 root root 807 2005-04-01 09:18 libevtlog.la* lrwxrwxrwx 1 root root 18 2005-04-01 09:18 libevtlog.so -> libevtlog.so.0.0.0* lrwxrwxrwx 1 root root 18 2005-04-01 09:18 libevtlog.so.0 -> libevtlog.so.0.0.0* -rwxr-xr-x 1 root root 93600 2005-04-01 09:18 libevtlog.so.0.0.0* When running ./configure in the syslog-ng source dir I get for evtlog checking EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking EVTLOG_LIBS... -levtlog the libs are in /usr/local/lib is this the problem? If yes, how can I change this? Thanks PHilipp

1 0