July 2005 - syslog-ng - lists.balabit.hu

Pix problem
by Damien Michau 28 Dec '05

28 Dec '05

Hi All ! I have some probleme ta log my pix's log into my syslog-ng server . i have mounted a Syslog-ng server to store my pix's log . But there is nothing in my pix.log i'have put this lines in my syslog-ng.conf source pix { udp(ip(10.60.10.111) port());}; destination pix { file("/var/log/pix.log"); }; log { source(pix);destination(pix); }; Have you one idea ? Thx Damien Michau Paris

4 5

ng to ng then to syslog
by Gerardo Amaya 01 Aug '05

01 Aug '05

Hello all. First thanks for all the help on first issue, it was some stupid filter. I'm configured to send syslog messages from server1 to server2 both with syslog-ng. Now what I need is to pass messages from server1 to server2 via syslog-ng(already done that) and as soon as the event gets in syslog-ng of server2 to send it to syslog daemon in server2. I have also done that but the problem is that the events appear as they are coming locally and not from server1. Is there a way to change that? thanks in advance Gerardo Amaya

2 1

Syslog running slow
by Shlomi Wexler 01 Aug '05

01 Aug '05

Hi, I'm using Syslong-ng with Postgre SQL Database. I have a problem of queries running realy slow since the Database reached about 5 million records. Cleaning the DB and vacumdb didn't work and also other programs running on the same computer are running fine. I'm using Gentoo Linux. Does anyone have an idea ? Thanks Shlomi _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

problem receiving non-NULL terminated UDP messages
by e09f6a7593f8ae3994ea57e1117f67ec 30 Jul '05

30 Jul '05

Hi, I have the same problem as someone 2 years ago (https://lists.balabit.hu/pipermail/syslog-ng/2003-September/005414.html) with UDP messages. Problem: My OpenWRT based wifi router messages are not recognized and written to file via syslog-ng-1.9.5. The configuration file constsits of single udp() source and destination to single file. Symptoms: I am running `./syslog-ng -F -v -d -e` and after receiving an UDP log message I get a log_reader_fd_prepare(); messages in console window, so that means that the packet has arrived. (also checked with tcpdump for that). Despite packet arrival nothing is written to log file. The udp message does not end with NULL character as expected in logreader.c/log_reader_iterate_buf() function. I scanned the RFC for that but there is not defined that the message must terminate with a NULL character. Workaround: (needs testing for side-efects) Replace in afsocket.c:425 line with self->reader = log_reader_new(... (self->flags & AFSOCKET_LOCAL) ? LR_LOCAL|LR_PKTTERM : LR_PKTTERM,...); (Insert fixed LR_PKTTERM flag) Debugging process and toughts: After a while debugging with gdb I noticed that logreader.c/log_reader_iterate_buf() does not recognise the incoming message because it is not terminated by a NULL or NL character. I noticed that there exists a flag LR_PKTTERM which is supposed to be used in UDP sources so I went after LR_PKTTERM flag. The only place that flag is set is in afsocket.c/afsocket_sc_init() function and only if socket is a DGRAM type. If you trace back you see that afsocket_sc_init() is used from afsocket_sc_new() which is used from afsocket_sd_process_connection() which is used from afsocket_sd_accept() which is used from afsocket_sd_init(). Let's stop now at afsocket_sd_init() function: If you look carefully you can notice that afsocket_sd_accept() function is used as callback _only_ if used in STREAM sockets and not DGRAM! For DGRAM sockets the reader is creaded by log_reader_new() and with flags set as `(self->flags & AFSOCKET_LOCAL) ? LR_LOCAL : 0`. That means that log_reader_iterate_buf() does not have LR_PKTTERM flag set and thus not extracting UDP message from my router. As I can see afsocket.c/afsocket_sc_init() function is not used by DGRAM connections at all thus LR_PKTTERM is never set. Thanks for patience :) Pinky

2 3

compiling on Redhat Linux ES 4 with Solaris support
by Jeff Wilson 29 Jul '05

29 Jul '05

Ok I can compile and configure syslog-ng with out Solaris support but when I add --enable-sun-streams to the configure command and then run make I get an error. I have searched every where I can for an answer but can not find one. Any help would be appreciated. here is the out put. [syslog-ng-1.6.8]# make Making all in src make[1]: Entering directory `/root/jeff/syslog-ng-1.6.8/src' make all-recursive make[2]: Entering directory `/root/jeff/syslog-ng-1.6.8/src' Making all in . make[3]: Entering directory `/root/jeff/syslog-ng-1.6.8/src' if gcc -DHAVE_CONFIG_H -I. -I/root/jeff/syslog-ng-1.6.8/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -MT afstreams.o -MD -MP -MF ".deps/afstreams.Tpo" \ -c -o afstreams.o `test -f 'afstreams.c' || echo '/root/jeff/syslog-ng-1.6.8/src/'`afstreams.c; \ then mv -f ".deps/afstreams.Tpo" ".deps/afstreams.Po"; \ else rm -f ".deps/afstreams.Tpo"; exit 1; \ fi afstreams.c:38:24: sys/strlog.h: No such file or directory afstreams.c: In function `do_stream_read': afstreams.c:95: error: storage size of 'lc' isn't known afstreams.c:95: warning: unused variable `lc' afstreams.c: In function `do_init_afstreams_source': afstreams.c:238: error: `I_CONSLOG' undeclared (first use in this function) afstreams.c:238: error: (Each undeclared identifier is reported only once afstreams.c:238: error: for each function it appears in.) make[3]: *** [afstreams.o] Error 1 make[3]: Leaving directory `/root/jeff/syslog-ng-1.6.8/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/jeff/syslog-ng-1.6.8/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/root/jeff/syslog-ng-1.6.8/src'

2 2

syslog-ng- filter() problem
by Kelly Pow 29 Jul '05

29 Jul '05

Hi, I am trying to collect traps from these two networks. 66.163.79.0/255.255.255.128 and 64.251.65.224/255.255.255.240 I don't understand why when I do this it doesn't collect anything Any ideas/.?? ---------------------------------------------------------------------------- --------------------------- source src{unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; filter f_messages { not level(warn); }; log { source(src); filter(f_messages); destination(messages); }; #filter snmptrap filter f_snmptrap { level(warn); }; #testing filters for the different networks filter f_ipbb1 {netmask("66.163.79.0/255.255.255.128"); }; filter f_ipbb2 {netmask("64.251.65.224/255.255.255.240"); }; destination ipbb_traps { file("/store/ipbb/traps/$YEAR-$MONTH-$DAY"); }; log { source(src); filter(f_snmptrap); filter(f_ipbb1); filter (f_ipbb2); destination(ipbb_traps); }; ---------------------------------------------------------------------------- ------------------------------- Kelly Pow IP Backbone Networks Intern Shaw CableSystems G.P Tel: 1.403.303.6387 kelly.pow(a)sjrb.ca <mailto:kelly.pow@sjrb.ca>

3 2

syslog-ng fails to bind socket
by javier rojas 29 Jul '05

29 Jul '05

hello, im configuring syslog-ng to log on central logserver, however, when trying to start the server i get this error: jrojas:/etc/syslog-ng# /etc/init.d/syslog-ng start # Start syslog-ng CONSOLE_LOG_LEVEL is of unaccepted value. KERNEL_RINGBUF_SIZE is of unaccepted value. Starting system logging: syslog-ngio.c: bind_unix_socket(): bind failed /etc/log/log (No such file or directory) Error initializing configuration, exiting. start failed. can anyone help me out here... do i have to add the ip entry on /etc/hosts on the server side?, i allowed the entry on the client side... i'm all lost here... -- Ciao,Javier linux user #393724

2 1

syslog-ng to syslog not working
by Gerardo Amaya 29 Jul '05

29 Jul '05

Hello all. I have a syslog-ng server and I want to forward some messages to a Syslogd Server. I don't want stunnel or anything special, just send syslog-ng messages via udp(514), but right now I get the following error: Jul 22 20:10:06 s_localhost@RHTSRV syslog-ng[31406]: io.c: do_write: write() fai led (errno 111), Connection refused Jul 22 20:10:06 s_localhost@RHTSRV syslog-ng[31406]: Connection broken to AF_INE T(192.168.4.252:514), reopening in 60 seconds Jul 22 20:11:07 s_localhost@RHTSRV syslog-ng[31406]: io.c: do_write: write() fai led (errno 111), Connection refused Jul 22 20:11:07 s_localhost@RHTSRV syslog-ng[31406]: Connection broken to AF_INE T(192.168.4.252:514), reopening in 60 seconds Jul 22 20:12:07 s_localhost@RHTSRV syslog-ng[31406]: io.c: do_write: write() fai led (errno 111), Connection refused Jul 22 20:12:07 s_localhost@RHTSRV syslog-ng[31406]: Connection broken to AF_INE T(192.168.4.252:514), reopening in 60 seconds This is the definition in my syslog-ng.conf file source s_localhost { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; destination d_TestServer { udp ("192.168.4.252" port(514)); }; log { source(s_localhost); destination(d_localhost); destination(d_TestServer); }; Can someone help me to find the source of the problem? Thanks in advance Gerardo Amaya

3 3

syslog-ng not logging in mysql
by javier rojas 28 Jul '05

28 Jul '05

hello, i created the pipe file on /tmp (/tmp/mysql.pipe) but it doesn't write the logs into the mysql db, here's the extract from the syslog-ng.conf file: destination d_mysql {pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(20)); }; log { source(net); destination(d_mysql); }; it just doesn't work and i've followed the steps from the documentation on www.vermeer.org... so if anybody can help me... -- Ciao,Javier linux user #393724

1 0

[PATCH] [1.9.5] address flex warning and suboptimal distclean target
by Roberto Nibali 28 Jul '05

28 Jul '05

Hello, The attached patch fixes following two things: 1. #define YY_NO_UNPUT 1 is an undocumented feature of flex and has been obsoleted in recent flex versions. So this is a void operation. The correct way of dealing with the compiler warning is to add %option nounput as flex directive. 2. cfg-lex.c is autogenerated during the make compile process. However it is never removed, especially not for the distclean target. IMHO this is not so clean, so I've added cfg-lex.c to the list of the to-be-removed files. Please consider applying. Cheers, Roberto Nibali, ratz -- echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc

2 1