May 2005 - syslog-ng - lists.balabit.hu

Get "warning: ignoring #pragma" warnings when compiling libol-0.3.16 on HP-UX
by Jenny-Lou Sequeira 27 May '05

27 May '05

If I just run #./configure CC=gcc CFLAGS="-v #make It compiles fine. Looking at the log from make the include path is: . /usr/local/include /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include /usr/include However, if I restrict the "Include" path to the following ./configure CC=gcc CFLAGS="-v -nostdinc -O2" CPPFLAGS="-I/usr/local/include -I/usr/local/lib/gc/ia64-hphpux11.23/3.4.3/include -I/usr/include" "make" spews out warnings like: /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/stdlib.h:30: warning: ignorin g #pragma builtin_milli abs /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/stdlib.h:31: warning: ignorin g #pragma extern abs /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/stdlib.h:65: warning: ignorin g #pragma builtin_milli div /usr/include/sys/signal.h:174: warning: ignoring #pragma extern signal /usr/include/sys/signal.h:191: warning: ignoring #pragma extern kill /usr/include/sys/signal.h:192: warning: ignoring #pragma extern sigismember /usr/include/sys/signal.h:193: warning: ignoring #pragma extern sigpending Thanks, Jenny-Lou

1 0

SV: [syslog-ng] syslog-ng 1.6.8 has been released
by kenneth.gullberg＠foreningssparbanken.se 26 May '05

26 May '05

Hi, Here is a small suggestion for the INSTALL file in the next release for unexperienced admin's: Solaris 10 ---------- For successful compilation on Solaris 10 you need to use --enable-full-dynamic when you run configure. // Kenneth -----Ursprungligt meddelande----- Från: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] För Balazs Scheidler Skickat: den 26 maj 2005 10:46 Till: syslog-ng(a)lists.balabit.hu Kopia: syslog-ng-announce(a)lists.balabit.hu Ämne: [syslog-ng] syslog-ng 1.6.8 has been released Hi, I have released syslog-ng 1.6.8 containing some configure tweaks, a 64bit compatibility fix and a use_fqdn() fix when getting local hostnames. The NEWS entry is below: News for the 1.6.8 release Thu, 26 May 2005 10:24:33 +0200 * Some configure tweaking to detect proper ld options dynamically on Linux, Solaris and HP-UX. Other platforms might still have problems with static linking. * Some minor manpage fixes. * Use use_fqdn() option when determining local hostname instead of directly using the possibly short hostname returned by gethostname(). * Fixed a 64 bit compatibility issue when resolving hostnames. The release can be found at the usual place: http://www.balabit.com/products/syslog-ng/upgrades.bbq -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng 1.6.8 has been released
by Balazs Scheidler 26 May '05

26 May '05

Hi, I have released syslog-ng 1.6.8 containing some configure tweaks, a 64bit compatibility fix and a use_fqdn() fix when getting local hostnames. The NEWS entry is below: News for the 1.6.8 release Thu, 26 May 2005 10:24:33 +0200 * Some configure tweaking to detect proper ld options dynamically on Linux, Solaris and HP-UX. Other platforms might still have problems with static linking. * Some minor manpage fixes. * Use use_fqdn() option when determining local hostname instead of directly using the possibly short hostname returned by gethostname(). * Fixed a 64 bit compatibility issue when resolving hostnames. The release can be found at the usual place: http://www.balabit.com/products/syslog-ng/upgrades.bbq -- Bazsi

1 0

host$
by Speedy Sweedy 26 May '05

26 May '05

I am new to this list and new to syslog-ng so please forgive me if this question has been asked before. I looked through the archive but didn't come across anything that helped me. I have syslog-ng working on my FC3 box with SELinux set at its highest setting(wow that was fun!) but it logs the IP address of the remote host instead of the hostname. I can't seem to get it to log anything different than the IP address of the box sending the log. Here is my options in syslog-ng.conf: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; what am I doing wrong? Regards, The Speedster _________________________________________________________________ MSN® Calendar keeps you organized and takes the effort out of scheduling get-togethers. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

3 4

RE: [syslog-ng] host$
by SOLIS, ALEX 25 May '05

25 May '05

My syslog-ng setup will resolve to hostnames as long as the /etc/resolv.conf or /etc/hosts entries are valid. If you ping the hosts logging to your box by IP does it resolve to the hostname? -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Speedy Sweedy Sent: Wednesday, May 25, 2005 12:34 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] host$ >Most likely, you have a borked syslog-ng.te that doesn't allow the >syslog-ng >process to read /etc/nsswitch.conf or similar, breaking DNS lookups. I used an RPM to install syslog-ng - could I get away with downloading the source, compile it and replace the syslog-ng bin? > >Grep through your logs and find any avc entries that reference syslog-ng. > >(And BTW - FC4 is about to escape, I'd *strongly* recommend upgrading to it >if you're doing any SELinux work - the policy definitions have been worked >on a *lot*. If you can't upgrade, at least get the updated SELinux RPMs >(they >should work OK on the FC3 kernel)). Yeah, I've read about FC4 being much better for syslog-ng. I'm about ready to start over using the FC4 test3 iso's but didn't know what happens once fc4 is released as far as installing the new released version. _________________________________________________________________ Don't just Search. Find! http://search.sympatico.msn.ca/default.aspx The new MSN Search! Check it out! _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

1 0

Netscreen fw logs not piped in mysql
by Christian Janssen 25 May '05

25 May '05

Hi, I'm close to give up and have following problem: * Netscreen Firewalls (Screen OS 5.1r3 & 4.1) * Syslog-ng [&php-syslog-ng] My System is Debian sarge, syslog-ng 1.6.5 a) Unix syslog entries are stored correctly in mysql database (and textfile) all seems fine ! b) Netscreen syslog infos are logged as expected in txt file (see attach) c) [PROBLEM] but logging in mysql are not working, got following message from my pipe script ERROR at line 1: Unknown command '\"'. ERROR at line 1: Unknown command '\"'. ERROR at line 1: Unknown command '\"'. Maybe a truncating problem ? Seems related to following questions, but unfortunately never found a solution https://lists.balabit.hu/pipermail/syslog-ng/2004-November/006678.html http://www.experts-exchange.com/Security/Unix_Security/Q_21077259.html http://www.netscreenforum.com/viewtopic.php?t=1209&highlight=syslogng I followed mostly these instructions: http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG Hope somebody can help me and have an idea or solution. Many thanks in advance Cheers Christian ---------------------------------------------------- e.g. syslog Apr 25 14:08:38 172.29.8.2 co-gw: NetScreen device_id=co-gw system-notification-00257(traffic): start_time="2005-04-25 13:08:37" duration=0 policy_id=320001 service=udp/port:1985 proto=17 src zone=Null dst zone=self action=Deny sent=0 rcvd=48 src=195.122.33.7 dst=224.0.0.2 src_ Apr 25 14:08:38 196.35.45.2 co-gw: NetScreen device_id=co-gw system-notification-00257(traffic): start_time="2005-04-25 13:08:37" duration=0 policy_id=320001 service=proto:88/port:0 proto=88 src zone=Null dst zone=self action=Deny sent=0 rcvd=60 src=172.30.7.1 dst=224.0.0.10 ---------------------------------------------------- or e.g. sep. file via filter destination firewalls { file("/var/log/netscreen"); }; filter f_firewalls { facility(local7); }; log { source(s_all); filter(f_firewalls); destination(firewalls); }; Apr 25 17:45:06 172.29.5.163 ns5gt: NetScreen device_id=ns5gt [Root]system-information-00524: SNMP request from an unknown SNMP community at 172.29.5.146:32862 has been received. (2005-04-25 17:57:41) ----------------------------------------------------

1 1

syslog-ng 1.6.x on OpenBSD on sparc64
by Bostjan Golob 25 May '05

25 May '05

It appears that syslog-ng has an issue on OpenBSD/sparc64, as it does not determine the hostname of the remote system, making all messages appear to be from the syslog-ng server. The bug appears to be well hidden in sources.c. In line 98, the call to do_recv (as seen in gdb backtrace) is made, which requires a socklen_t* parameter. The catch is in line 88, where salen is declared as size_t and then cast to socklen_t; on sparc64, size_t is 64bit and socklen_t is 32bit and that causes the salen variable to always contain 0, causing the known bug. If you change line 88 to socklen_t salen = sizeof(sabuf), the host name of the sending host is determined correctly and written in the logfiles. That also explains why syslog-ng works correctly on OpenBSD/i386, but not on sparc64. Bostjan Golob IT department, Gimnazija Bezigrad, Ljubljana, SI

2 1

Error while making on Mac OS X Tiger
by Tristan Natsirt 25 May '05

25 May '05

I've got libol 0.3.16, glib 2.0.7, and i'm trying to configure and make syslog-ng-1.6.7 and I recieve the following errors: ./configure make [...] gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lresolv /usr/local/lib/libol.a -Wl,-Bstatic -lfl -lwrap -Wl,-Bdynamic ld: unknown flag: -Bstatic make[3]: *** [syslog-ng] Error 1 make[2]: *** [all-recursive] Error 1 make[1]: *** [all] Error 2 make: *** [all-recursive] Error 1 any help at all would be much obliged. Thanks, Adam.

3 2

syslog-ng on Trusted Solaris
by Charles D Smith 24 May '05

24 May '05

I have been running syslog-ng on Solaris for the past few months. I would also like to try to run it on Trusted Solaris. Has any consideration been given to supporting syslog-ng on Trusted Solaris? Also if anyone has experimented with syslog-ng on Trusted Solaris, I would be interested in hearing about your experience. Thanks, Charles

1 0

Syslog-ng 1.9.4 configure/compile question
by Hokhold, Mark 24 May '05

24 May '05

Syslog-ng Users, I'm currently trying to configure syslog-ng 1.9.4 on my Sunblade 100 (Solaris 9) as a test. I've loaded and compiled the following software: Stunnel-4.10 openssl-0.9.7g eventlog-0.1.2 All three packages compiled cleanly. The "eventlog" compiled successfully, but no eventlog.pc was produced when completed and I still receive the following output compiling syslog-ng: # ./configure ..... ... checking GLIB CFLAGS... -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include checking GLIB_LIBS... -lglib-2.0 checking for eventlog... Package eventlog was not found in the pkg-config search path Perhaps you should add the directory containing `eventlog.pc` To the PKG_CONFIG_PATH environment variable No package 'eventlog' found Configure: error: Library requirements (eventlog) not met;....... ########################################################################### MORE INFO: I've been loading all packages under /usr/local, so by default everything will get placed within the /usr/local directory tree. I've tried NOT setting up the PKG_CONFIG and PKG_CONFIG_PATH variables -using the default. And I've also tried setting different values, all with the same results. Mark

1 0