August 2005 - syslog-ng - lists.balabit.hu

Pix problem
by Damien Michau 28 Dec '05

28 Dec '05

Hi All ! I have some probleme ta log my pix's log into my syslog-ng server . i have mounted a Syslog-ng server to store my pix's log . But there is nothing in my pix.log i'have put this lines in my syslog-ng.conf source pix { udp(ip(10.60.10.111) port());}; destination pix { file("/var/log/pix.log"); }; log { source(pix);destination(pix); }; Have you one idea ? Thx Damien Michau Paris

4 5

Shiming Yang/OCIO_CorpDataSecurity/Planning_Office/HQ_for_the_Americas/BTMNA is out of the office.
by Shiming Yang 30 Aug '05

30 Aug '05

I will be out of the office starting 08/30/2005 and will not return until 09/03/2005. I will respond to your message when I return. If there is problem about Proxy or IBM web hosting facility, please call my backup Will at 8380 or Rich Maer at 5744. ----------------------------------------- The information contained in this electronic mail message, and any and all accompanying documents, constitutes confidential information. If you are not the intended recipient of this information, any disclosure, copying, distribution, or the taking of any action in reliance on it is strictly prohibited. If you received this information in error, please notify the sender immediately and destroy this communication. Messages sent via this medium may be subject to delays and/or unauthorized alteration. Neither The Bank of Tokyo-Mitsubishi, Ltd. nor any of its affiliates shall be held liable for the contents of this message.

1 0

Version question
by Tony Earnshaw 30 Aug '05

30 Aug '05

Hi, first post. Red Hat RHAS3 update 4. Saturday I downloaded libol 0.3.16 and syslog-ng 1.6.8 tarballs, saw immediately that there were rpm spec files and made rpms (not without an initial couple of barfs about missing MySQL stuff), which I installed. Took me Sunday and Monday till 10:00 am to get my head round it, but it's fantastic, thanks a lot:) So then I downloaded 1.9.5 and eventlog-0.2.3+20050116+1856. There were no rpm spec files, so I wrote my own (half a morning on the basis of the above ones, anyone who wants them's welcome to them), installed them and syslog-ng 1.9.5 crashed without trace. Used strace and couldn't for the life of me see what was happening. I couldn't be bothered to begin with gdb and back traces, so I put the good rpm back, all's back to normal. If anyone wants me to go ahead with debugging, I will (dilettantishly to say the least, I'm not a C programmer), but would rather not - 1.6.8 works fine for me. Just thought I'd let people know :) Best, --Tonni -- mail: tonye(a)billy.demon.nl http://www.billy.demon.nl

5 6

syslog-ng 1.9.5 segfaults on many platforms
by Paul Krizak 30 Aug '05

30 Aug '05

I've built both the daily snapshot from 2005-08-19 as well as the "stable" (I know it's not really stable) 1.9.5 on three platforms: RHEL4.1 x86_64 RHEL3.5 x86_64 Red Hat 7.3 2.4.29 i686 All three builds were with the default settings to ./configure. The build finishes without a hiccup but segfaults when syslog-ng tries to start. I've attached an strace (it's not very long...) to help show where it's segfaulting. The reason I need this to work is for the enhanced program() destination driver that will respawn programs that die. If somebody has a patch that backports this functionality to 1.6, that would be preferred, but a working 1.9.5 I could live with as well. Any ideas? -- Paul Krizak 5900 E. Ben White Blvd. MS 625 Advanced Micro Devices Austin, Tx 78741 CAD Systems Engineering Phone: (512) 602-8775 Paul.Krizak(a)amd.com Cell: (512) 791-0686

3 4

syslog-ng rpm spec files ...
by Tony Earnshaw 29 Aug '05

29 Aug '05

... need working on. Apart from anything else, the Source files syslog-ng.conf, syslog-ng.init and syslog-ng.sysconfig, as well as syslog-ng.conf for syslog-ng were simply copied from 1.6.8. Especially syslog-ng.conf should probably be that from the 1.9.5 tarball, but i didn't want to muck up my SOURCES directory, it was just a test. Feedback please - but preferably to the list, so that others may profit ;) Best, --Tonni -- mail: tonye(a)billy.demon.nl http://www.billy.demon.nl

1 0

tcp logging drops messages
by Stephen Harris 26 Aug '05

26 Aug '05

I was attempting to test the resiliency of syslog-ng to TCP server outages and notice that 2 messages can get lost. I have a simple configuration: Sending machine: Solaris 8, syslog-ng-1.6.8+20050826 Receiving machine: Linux (or Solaris, doesn't matter), ncat syslog-ng.conf: options { time_reopen(1); }; source from_file { pipe("/var/run/auth_log"); }; destination loghost { tcp("dest" port(1234)); }; log { source(from_file); destination(loghost);}; Sending machine: syslog-ng -F -d Receiving machine: ncat :1234 So far, so good; "echo msg1 > /var/run/auth_log" and I see the message on the receiving machine. Now kill ncat. Do "echo msg2 > /var/run/auth_log". No errors are seen. Now do a "echo msg3 > /var/run/auth_log". Now we see an error... io.c: do_write: write() failed (errno 32), Broken pipe pkt_buffer::do_flush(): Error flushing dataMarking fd 5 for closing. Connection broken to AF_INET(swharrislx1:1234), reopening in 1 seconds Closing fd 5. So far so good! Now another... "echo msg4 > /var/run/auth_log" Now another ... "echo msg5 > /var/run/auth_log". Now restart ncat. The ncat will show "msg4" and "msg5" happily. "msg2" and "msg3" are lost. Any ideas? -- rgds Stephen

2 1

Nothing is logged
by naim abu darwish 26 Aug '05

26 Aug '05

Hi, I'm trying to setup a central logging server to get logs from many hosts on a network, and store in a mysql database. I followed the following docs:: http://gentoo-wiki.com/HOWTO_setup_PHP-Syslog-NG http://vermeer.org/docs/1 only nothing is being logged :D my syslog-ng.conf so far:: # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.c onf.gentoo,v 1.5 2005/05/12 05:46:10 mr_bones_ Exp $ # # Syslog-ng default configuration file for Gentoo Linux # contributed by Michael Sterrett options { chain_hostnames(off); keep_hostname(yes); log_fifo_size(1024); sync(0); # The default action of syslog-ng 1.6.0 is to log a STATS line # to the file every 10 minutes. That's pretty ugly after a while. # Change it to every 12 hours so you get a nice daily update of # how many messages syslog-ng missed (0). stats(43200); }; source shell { unix-dgram("/dev/log"); internal(); #tcp( port(5141) keep-alive(yes) max-connections(3000)); udp(ip(0.0.0.0 <http://0.0.0.0>),port(514)); }; source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; source net {udp(); }; destination messages { file("/var/log/messages"); }; # By default messages are logged to tty12... destination console_all { file("/dev/tty12"); }; # ...if you intend to use /dev/console for programs like xconsole # you can comment out the destination line above that references /dev/tty12 # and uncomment the line below. #destination console_all { file("/dev/console"); }; log { source(src); destination(messages); }; log { source(src); destination(console_all); }; log { source(shell); filter(allstuff);destination(testfile); }; log { source(net); destination(testfile); }; filter allstuff { host("194.146.*"); }; # pipe messages to /var/log/mysql.pipe to be processed by mysql destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; #destination testfile { destination testfile { file("/var/log/test/$HOST/zab.log" sync(0) log_fifo_size(10) create_dirs(yes) owner(root) group(system) perm(0660) dir_perm(0770)); }; i suspected something wrong with the way i setup mysql database.. thats why i added the last bit, to log to a text file, still nothing .. i cant figure out what else could be wrong. Any help appreciated. Greets, Naim

2 1

syslog-ng on cygwin
by Gerardo Amaya 23 Aug '05

23 Aug '05

Hello all. I'm trying to install syslog-ng ver 1.6.8 on a cygwin enviroment. configure work smoothly, but when I run 'make' I got the following error: ************************************************************************ Making all in . make[3]: Entering directory `/home/Administrator/packages/syslog-ng-1.6.8/src' if gcc -DHAVE_CONFIG_H -I. -I/home/Administrator/packages/syslog-ng-1.6.8/src -I . -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -MT main.o -MD -MP - MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo '/home/Administrator/packages/syslog-ng -1.6.8/src/'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi main.c:49:20: resolv.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/home/Administrator/packages/syslog-ng-1.6.8/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/Administrator/packages/syslog-ng-1.6.8/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/Administrator/packages/syslog-ng-1.6.8/src' make: *** [all-recursive] Error 1 *************************************************************************** I check the src/ directory and indeed there is no resolv.h file. What can I do to resolve this issue. Thanks in advance. Gerardo Amaya

2 2

logging several to one facility - parsing
by Terry 19 Aug '05

19 Aug '05

Hello, I have several routers that I want to receive logs for. Can I send all the logs from these to a single facility and have syslog-ng parse and write them to different log files based on a ruleset such as ip address, type of log, etc. ? Thanks!

3 3

Error accepting AF_INET connection from
by Johannes.Trauttmansdorff＠commerzbank.com 16 Aug '05

16 Aug '05

Hi there, I am fairly new to syslog-ng and am very please of what I have seen so far. However, in case of a network outage between a sender and syslog-ng I do experience the following error message until I restart the syslog-ng daemon. I have searched the board but only found some old messages regarding a bug. Please advice. Jul 31 17:54:22 hostname syslog-ng[18336]: Error accepting AF_INET connection from: x.x.x.x:1124, opened connections: 10, max: 10 TX in advance, Joe

2 1