August 2005 - syslog-ng - lists.balabit.hu

STATS: dropped with version 1.6.8 under rh el4
by Stephan Hendl 16 Aug '05

16 Aug '05

Hi all, recently I upgraded one of my central syslog servers from hpux to redhat el4 with syslog-ng-1.6.8-1 and get from time to time messages like Aug 10 11:43:57 pns1 syslog-ng[10542]: STATS: dropped 19 Aug 10 11:48:57 pns1 syslog-ng[10542]: STATS: dropped 45 Aug 10 11:53:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 11:58:57 pns1 syslog-ng[10542]: STATS: dropped 36 Aug 10 12:03:57 pns1 syslog-ng[10542]: STATS: dropped 7 Aug 10 12:08:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:13:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:18:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:23:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:28:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:33:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:38:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:43:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 12:48:57 pns1 syslog-ng[10542]: STATS: dropped 37 Aug 10 12:53:57 pns1 syslog-ng[10542]: STATS: dropped 52 Aug 10 12:58:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:03:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:08:57 pns1 syslog-ng[10542]: STATS: dropped 51 Aug 10 13:13:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:18:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:23:57 pns1 syslog-ng[10542]: STATS: dropped 11 Aug 10 13:28:57 pns1 syslog-ng[10542]: STATS: dropped 1 Aug 10 13:33:57 pns1 syslog-ng[10542]: STATS: dropped 0 Aug 10 13:38:57 pns1 syslog-ng[10542]: STATS: dropped 0 There are 5 servers who are sending their syslog messages via tcp an one 2 servers who are sending via udp to that central server. The load of the machine (2xXenon CPU, 3 GHz, 1 GB RAM) is really low. For revison purposes (maillogdata) I have to keep _all_ syslog lines!!! What can I change in order to avoid dropped lines? Stephan top - 15:39:06 up 36 days, 1:49, 2 users, load average: 0.10, 0.09, 0.04 Tasks: 194 total, 1 running, 193 sleeping, 0 stopped, 0 zombie Cpu(s): 0.3% us, 0.2% sy, 0.0% ni, 99.2% id, 0.4% wa, 0.0% hi, 0.0% si Mem: 1034692k total, 1018520k used, 16172k free, 141372k buffers Swap: 2096440k total, 144k used, 2096296k free, 602228k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 690 root 16 0 43644 4784 2180 S 0.7 0.5 129:42.96 nco_p_syslog 779 root 16 0 43644 4784 2180 S 0.3 0.5 254:33.32 nco_p_syslog 10542 root 15 0 1876 1048 776 S 0.3 0.1 6:59.31 syslog-ng 1 root 16 0 3236 548 472 S 0.0 0.1 0:00.96 init 2 root RT 0 0 0 0 S 0.0 0.0 0:04.37 migration/0 3 root 34 19 0 0 0 S 0.0 0.0 0:00.06 ksoftirqd/0 4 root RT 0 0 0 0 S 0.0 0.0 0:03.11 migration/1 5 root 34 19 0 0 0 S 0.0 0.0 0:00.02 ksoftirqd/1 My syslog-ng.conf looks like: root@pns1:~# vi /etc/syslog-ng/syslog-ng.conf # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat Linux 9. # But it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. options {sync (0); time_reopen (10); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats (300); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; source s_tcp { tcp(ip(a.b.c.d) port(10514) keep-alive(no)); }; source s_udp { udp(ip(a.b.c.d) port(514)); }; # Log all kernel messages to the console. # Logging much else clutters up the screen. #destination d_cons { file("/dev/console"); }; #filter f_cons { facility(kern); }; #log { source(s_sys); filter(f_cons); destination(d_cons); }; # Log anything (except mail) of level info or higher. # Don't log private authentication messages! destination d_mesg { file("/var/log/messages"); }; filter f_mesg { not facility(mail,news,authpriv,cron) and level(emerg..info); }; log { source(s_sys); filter(f_mesg); destination(d_mesg); }; # The authpriv file has restricted access. destination d_auth { file("/var/log/secure"); }; filter f_auth { facility(authpriv); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; # Log all the mail messages in one place. destination d_mail { file("/var/log/maillog" template( "$DATE $HOST $MESSAGE\n")); }; filter f_mail { facility(mail); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; # Log cron stuff. destination d_cron { file("/var/log/cron"); }; filter f_cron { facility(cron); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; # Everybody gets emergency messages. destination d_mlal { usertty("*"); }; filter f_mlal { level(emerg); }; log { source(s_sys); filter(f_mlal); destination(d_mlal); }; # Save news errors of level crit and higher in a special file. destination d_spol { file("/var/log/spooler"); }; filter f_spol {facility(uucp) or facility(news) and level(emerg..crit); }; log { source(s_sys); filter(f_spol); destination(d_spol); }; # Save boot messages also to boot.log. destination d_boot { file("/var/log/boot.log"); }; filter f_boot { facility(local7); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; # Save all mesages to syslog.lvnbb.de destination d_tcp { tcp("localhost" port(10514)); }; log { source(s_sys); destination(d_tcp); }; log { source(s_tcp); destination(d_tcp); }; log { source(s_udp); destination(d_tcp); }; # Save all messages to pipe /tmp/cic.pipe destination d_cic { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template("$DATE $HOST $MESSAGE\n") template-escape(yes)); }; log { source(s_sys); destination(d_cic); }; log { source(s_tcp); destination(d_cic); }; log { source(s_udp); destination(d_cic); };

3 2

Send logs to upd syslog and rewrite facility
by Damien_DeVille＠discovery.com 16 Aug '05

16 Aug '05

I'm in a position where I've got a device that uses syslog-ng to filter multiple events into multiple diferent log files. I need to send the logs to a central udp syslog server and would like to have all events from this particular device show up as coming from a specific facility (say local3) so that they get put into the correct logfile on the central server. I've figured out that I have to define a destination, filter, and log in syslog-ng.conf but I haven't figured out how to mark all the logs to that destination with a specific facility. Is that possible? For reference here's what I'm looking at in terms of destination, filter, and log definitions in syslog-ng.conf: destination d_logger { udp ("xxx.xxx.xxx.xxx" port(514)); }; filter f_all_logs_net { facility(auth,authpriv,kern,user,daemon,local0 .. local7) and level(warn .. emerg); }; log { source(syslog-ng); filter (f_all_logs_net); destination(d_logger); }; Thanks in advance. -- -Damien Damien DeVille IT Network Engineer This e-mail, and any attachment, is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, re-transmission, copying, dissemination or other use of this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. The contents of this message may contain personal views which are not the views of Discovery Communications, Inc. (DCI).

2 1

Question - Spoof_source in TCP()
by Gerardo Amaya 16 Aug '05

16 Aug '05

Hello all. Is there a way to have spoof_source functionallity option in syslog-ng TCP connections? Is this a feature for future syslog-ng releases? Thanks in advance Gerardo Amaya

3 2

filter...?
by Bjørn T Johansen 15 Aug '05

15 Aug '05

I have a filter looking like this: filter f_cyrus { program("imap") or program("master") or program("lmtpunix") or program("ctl_cyrusdb"); }; But it doesn't work 100%.... I get the log from imap and lmtpunix and ctl_cyrusdb, but not for master... Why not? Regards, BTJ -- ----------------------------------------------------------------------------------------------- Bjørn T Johansen btj(a)havleik.no ----------------------------------------------------------------------------------------------- Someone wrote: "I understand that if you play a Windows CD backwards you hear strange Satanic messages" To which someone replied: "It's even worse than that; play it forwards and it installs Windows" -----------------------------------------------------------------------------------------------

1 0

Re: Antw: Re: [syslog-ng] STATS: dropped with version 1.6.8 underrh el4
by Stephan Hendl 12 Aug '05

12 Aug '05

The host 'pns1' is a - let's say a syslog repeater. It gets messages from 5 hosts via tcp (two of these five are mailservers and send the maiilog via syslog-ng) and from 2 hosts as well as an internet router/firewall via udp. The syslog-ng writes the lines into files as well as into a pipe where a third program read the lines and evaluates they according to given patterns. Additionally the syslog-ng sends all messages through a ssh tunnel to another syslog-ng. This is the whole situation.Aafter including the "log_fifo_size (128056);" parameter there were no dropped lines anymore. Stephan >>> ken.garland(a)rotech.com 11.08.2005 14:52:34 >>> Mike Tremaine wrote: >On Wed, 2005-08-10 at 07:21, Stephan Hendl wrote: > > >>the lines with values "STATS: dropped <!=0>" are very annoying. How >>can I prevent the syslog-ng from dropping lines??? I put the line >>"log_fifo_size(1000);" into the global section - hope that helps ;-))) >> >> >> > >If the hosts only job is syslog-ng go for broke and kick it up to >something higher then 1000. > >log_fifo_size (128056); > >[I used that when I was doing some testing with an old AMD-k62 500mhz >256MB and FC3, it ran with 5 hosts sending as fast as the could to it. >Didn't drop anything.] > > > > I have about 15 systems logging to my syslog-ng server and some of them are routers which send a ton of messages about up/down link state. This server is getting smashed with logs and I have not received any dropped messages other than the 'DROPPED 0' which is a good thing that the syslog-ng host is saying it has not dropped any log packets. I would think something else is going on here and the fifo would not need to be increased as my fifo setting is only at 1024. In your first message you pasted something from the host 'pns1' which was complaining about dropping multiple packets. What is this system and is it running syslog-ng, also what connection is it using? tcp/udp? Are there other hosts which are sending out dropped log messages or only pns1? - Ken _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Damien DeVille is out of the office.
by Damien_DeVille＠discovery.com 12 Aug '05

12 Aug '05

I will be out of the office starting 08/12/2005 and will not return until 08/29/2005. I will be out on vacation in 8/12. I will be in training the week of the 15th, and I will be on vacation the week of the 22nd. In my absence, please contact Chris Butler. This e-mail, and any attachment, is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, re-transmission, copying, dissemination or other use of this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. The contents of this message may contain personal views which are not the views of Discovery Communications, Inc. (DCI).

1 0

Syslog-ng Event Parsing Question
by Stringfellow, William G 12 Aug '05

12 Aug '05

I am running syslog-ng version 1.6.4 in place of syslogd on Solaris 8. Getting the following results when receiving syslog events with an embedded dash '-': Actual Event Aug 10 04:15:22 <Device Name A>.<Domain Name> 4844: Aug 10 05:15:21.204 R: %AAA-3-BUFFER_OVERFLOW: Radius I/O buffer has overflowed -Traceback= 253274 253414 252B98 2524FC E97CC E75D4 E9974 124DDC Shows up in Syslog log as Aug 10 04:15:22 <Device Name A>.<Domain Name> 4844: Aug 10 05:15:21.204 R: %AAA-3-BUFFER_OVERFLOW: Radius I/O buffer has overflowed Aug 10 04:15:22 <Device Name A>.<Domain Name> 4845: -Traceback= 253274 253414 252B98 2524FC E97CC E75D4 E9974 124DDC Actual Event May 6 10:04:45 <Device Name B>.<Domain Name> 40: May 6 07:04:44: %TCP-2-INVALIDTCPENCAPS: Invalid TCB encaps pointer: 0x61180434 -Process= \"DLSw msg proc\", ipl= 0, pid= 62 -Traceback= 6035CF34 6035E4A8 60709AE0 607067DC 60706370 607359A0 6072BDB8 6072911C 60716EE4 607147A8 602616E4 602616D0 Shows up in Syslog log as May 6 10:04:45 <Device Name B>.<Domain Name> 40: May 6 07:04:44: %TCP-2-INVALIDTCPENCAPS: Invalid TCB encaps pointer: 0x61180434 May 6 10:04:45 <Device Name B>.<Domain Name> 41: -Process= \"DLSw msg proc\", ipl= 0, pid= 62 May 6 10:04:45 <Device Name B>.<Domain Name> 42: -Traceback= 6035CF34 6035E4A8 60709AE0 607067DC 60706370 607359A0 6072BDB8 6072911C 60716EE4 607147A8 602616E4 602616D0 Anyone have an answer as to why it is splitting up the Syslog events this way, and if so, how do you correct it? Also, is there a search function for the archives? Visually looking through month after month put me to sleep pretty quickly! Thanks Bill

2 1

Last Message Repeated XX times...
by Ken Garland 11 Aug '05

11 Aug '05

I would like to receive all messages on a syslog server, is there any way to have syslog stop gathering messages in a 'last message repeated' cluster. The host is running Syslog 1.4.1 - I know this is not syslog-ng but I can't install that onto this host. Everything is remotely logging to my Central Syslog-NG server, but it's getting nothing but junk 'last message repeated X times' messages which are useless to me. - Ken

1 1

Antw: Re: [syslog-ng] STATS: dropped with version 1.6.8 under rh el4
by Stephan Hendl 11 Aug '05

11 Aug '05

the lines with values "STATS: dropped <!=0>" are very annoying. How can I prevent the syslog-ng from dropping lines??? I put the line "log_fifo_size(1000);" into the global section - hope that helps ;-))) - Stephan >>> ken.garland(a)rotech.com 10.08.2005 15:48:59 >>> Yes, receiving those lines are annoying and I drop this line into the client syslog-ng.conf: filter f_syslog { not facility(auth, authpriv, kern) and not match("STATS: dropped 0"); }; Then just use that filter in your log line. - Ken Stephan Hendl wrote: >Hi all, > >recently I upgraded one of my central syslog servers from hpux to redhat el4 with syslog-ng-1.6.8-1 and get from time to time messages like > >Aug 10 11:43:57 pns1 syslog-ng[10542]: STATS: dropped 19 >Aug 10 11:48:57 pns1 syslog-ng[10542]: STATS: dropped 45 >Aug 10 11:53:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 11:58:57 pns1 syslog-ng[10542]: STATS: dropped 36 >Aug 10 12:03:57 pns1 syslog-ng[10542]: STATS: dropped 7 >Aug 10 12:08:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:13:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:18:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:23:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:28:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:33:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:38:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:43:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 12:48:57 pns1 syslog-ng[10542]: STATS: dropped 37 >Aug 10 12:53:57 pns1 syslog-ng[10542]: STATS: dropped 52 >Aug 10 12:58:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:03:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:08:57 pns1 syslog-ng[10542]: STATS: dropped 51 >Aug 10 13:13:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:18:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:23:57 pns1 syslog-ng[10542]: STATS: dropped 11 >Aug 10 13:28:57 pns1 syslog-ng[10542]: STATS: dropped 1 >Aug 10 13:33:57 pns1 syslog-ng[10542]: STATS: dropped 0 >Aug 10 13:38:57 pns1 syslog-ng[10542]: STATS: dropped 0 > >There are 5 servers who are sending their syslog messages via tcp an one 2 servers who are sending via udp to that central server. The load of the machine (2xXenon CPU, 3 GHz, 1 GB RAM) is really low. For revison purposes (maillogdata) I have to keep _all_ syslog lines!!! What can I change in order to avoid dropped lines? > >Stephan > >top - 15:39:06 up 36 days, 1:49, 2 users, load average: 0.10, 0.09, 0.04 >Tasks: 194 total, 1 running, 193 sleeping, 0 stopped, 0 zombie >Cpu(s): 0.3% us, 0.2% sy, 0.0% ni, 99.2% id, 0.4% wa, 0.0% hi, 0.0% si >Mem: 1034692k total, 1018520k used, 16172k free, 141372k buffers >Swap: 2096440k total, 144k used, 2096296k free, 602228k cached > > PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND > 690 root 16 0 43644 4784 2180 S 0.7 0.5 129:42.96 nco_p_syslog > 779 root 16 0 43644 4784 2180 S 0.3 0.5 254:33.32 nco_p_syslog >10542 root 15 0 1876 1048 776 S 0.3 0.1 6:59.31 syslog-ng > 1 root 16 0 3236 548 472 S 0.0 0.1 0:00.96 init > 2 root RT 0 0 0 0 S 0.0 0.0 0:04.37 migration/0 > 3 root 34 19 0 0 0 S 0.0 0.0 0:00.06 ksoftirqd/0 > 4 root RT 0 0 0 0 S 0.0 0.0 0:03.11 migration/1 > 5 root 34 19 0 0 0 S 0.0 0.0 0:00.02 ksoftirqd/1 > >My syslog-ng.conf looks like: > >root@pns1:~# vi /etc/syslog-ng/syslog-ng.conf ># syslog-ng configuration file. ># ># This should behave pretty much like the original syslog on RedHat Linux 9. ># But it could be configured a lot smarter. ># ># See syslog-ng(8) and syslog-ng.conf(5) for more information. > >options {sync (0); > time_reopen (10); > long_hostnames (off); > use_dns (yes); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > stats (300); >}; > >source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; >source s_tcp { tcp(ip(a.b.c.d) port(10514) keep-alive(no)); }; >source s_udp { udp(ip(a.b.c.d) port(514)); }; > ># Log all kernel messages to the console. ># Logging much else clutters up the screen. >#destination d_cons { file("/dev/console"); }; >#filter f_cons { facility(kern); }; >#log { source(s_sys); filter(f_cons); destination(d_cons); }; > ># Log anything (except mail) of level info or higher. ># Don't log private authentication messages! >destination d_mesg { file("/var/log/messages"); }; >filter f_mesg { not facility(mail,news,authpriv,cron) and level(emerg..info); }; >log { source(s_sys); filter(f_mesg); destination(d_mesg); }; > ># The authpriv file has restricted access. >destination d_auth { file("/var/log/secure"); }; >filter f_auth { facility(authpriv); }; >log { source(s_sys); filter(f_auth); destination(d_auth); }; > ># Log all the mail messages in one place. >destination d_mail { file("/var/log/maillog" template( "$DATE $HOST $MESSAGE\n")); }; >filter f_mail { facility(mail); }; >log { source(s_sys); filter(f_mail); destination(d_mail); }; > ># Log cron stuff. >destination d_cron { file("/var/log/cron"); }; >filter f_cron { facility(cron); }; >log { source(s_sys); filter(f_cron); destination(d_cron); }; > ># Everybody gets emergency messages. >destination d_mlal { usertty("*"); }; >filter f_mlal { level(emerg); }; >log { source(s_sys); filter(f_mlal); destination(d_mlal); }; > ># Save news errors of level crit and higher in a special file. >destination d_spol { file("/var/log/spooler"); }; >filter f_spol {facility(uucp) or facility(news) and level(emerg..crit); }; >log { source(s_sys); filter(f_spol); destination(d_spol); }; > ># Save boot messages also to boot.log. >destination d_boot { file("/var/log/boot.log"); }; >filter f_boot { facility(local7); }; >log { source(s_sys); filter(f_boot); destination(d_boot); }; > ># Save all mesages to syslog.lvnbb.de >destination d_tcp { tcp("localhost" port(10514)); }; >log { source(s_sys); destination(d_tcp); }; >log { source(s_tcp); destination(d_tcp); }; >log { source(s_udp); destination(d_tcp); }; > ># Save all messages to pipe /tmp/cic.pipe >destination d_cic { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template("$DATE $HOST $MESSAGE\n") template-escape(yes)); }; >log { source(s_sys); destination(d_cic); }; >log { source(s_tcp); destination(d_cic); }; >log { source(s_udp); destination(d_cic); }; > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

syslog-ng 1.9.5 under Solaris 10 (sparc)
by Andrea.DAlessandro＠esa.int 10 Aug '05

10 Aug '05

I know that release 1.9.5 is in development phase. Maybe the below is useful to "our" developers. FYI - I have installed 1.6.8 with no troubles (up to now...) Regards, Andrea # /usr/local/bin/make /usr/local/bin/make all-recursive make[1]: Entering directory `/lhome/esacom96/admest/packages/Sol10/balabit/syslog-ng-1.9.5' Making all in src make[2]: Entering directory `/lhome/esacom96/admest/packages/Sol10/balabit/syslog-ng-1.9.5/src' if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT misc.o -MD -MP -MF ".deps/misc.Tpo" \ -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ else rm -f ".deps/misc.Tpo"; exit 1; \ fi if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT utils.o -MD -MP -MF ".deps/utils.Tpo" \ -c -o utils.o `test -f 'utils.c' || echo './'`utils.c; \ then mv -f ".deps/utils.Tpo" ".deps/utils.Po"; \ else rm -f ".deps/utils.Tpo"; exit 1; \ fi if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT messages.o -MD -MP -MF ".deps/messages.Tpo" \ -c -o messages.o `test -f 'messages.c' || echo './'`messages.c; \ then mv -f ".deps/messages.Tpo" ".deps/messages.Po"; \ else rm -f ".deps/messages.Tpo"; exit 1; \ fi In file included from messages.c:24: messages.h:49: error: parse error before "EVTTAG" messages.c:40: error: parse error before '*' token messages.c:40: warning: type defaults to `int' in declaration of `evt_context' messages.c:40: warning: data definition has no type or storage class messages.c: In function `msg_send_internal_message': messages.c:56: warning: int format, pid_t arg (arg 5) messages.c: At top level: messages.c:63: error: parse error before "EVTTAG" messages.c: In function `msg_event': messages.c:69: error: `prio' undeclared (first use in this function) messages.c:69: error: (Each undeclared identifier is reported only once messages.c:69: error: for each function it appears in.) messages.c:69: error: `desc' undeclared (first use in this function) messages.c:69: warning: passing arg 1 of `evt_rec_init' from incompatible pointer type messages.c:69: warning: assignment makes pointer from integer without a cast messages.c:70: error: `tag1' undeclared (first use in this function) messages.c:72: warning: implicit declaration of function `evt_rec_add_tag' messages.c:74: warning: implicit declaration of function `evt_rec_add_tagsv' messages.c:80: error: `EVT_PRI_DEBUG' undeclared (first use in this function) messages.c:84: warning: implicit declaration of function `evt_rec_get_syslog_pri' messages.c:73: error: `va_start' used in function with fixed args messages.c: In function `msg_log_func': messages.c:94: error: `EVT_PRI_INFO' undeclared (first use in this function) messages.c:97: error: `EVT_PRI_DEBUG' undeclared (first use in this function) messages.c:99: error: `EVT_PRI_WARNING' undeclared (first use in this function) messages.c:101: error: `EVT_PRI_ERR' undeclared (first use in this function) messages.c:103: error: `EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c: In function `msg_init': messages.c:119: warning: implicit declaration of function `evt_ctx_init' messages.c:119: error: `EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c:119: warning: assignment makes pointer from integer without a cast messages.c: In function `msg_deinit': messages.c:130: warning: implicit declaration of function `evt_ctx_free' make[2]: *** [messages.o] Error 1 make[2]: Leaving directory `/lhome/esacom96/admest/packages/Sol10/balabit/syslog-ng-1.9.5/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/lhome/esacom96/admest/packages/Sol10/balabit/syslog-ng-1.9.5' make: *** [all] Error 2

2 1