October 2006 - syslog-ng - lists.balabit.hu

building 2.0 on freebsd
by Vivek Khera 25 Oct '06

25 Oct '06

I'm attempting to install 2.0 daily snapshot from 12 october onto a freebsd 6.1 system. From the FAQ I see that it needs to have glib installed, which was easy. However, the configure is not able to find the eventlib library. I cannot find what provides this library. My searches all keep pointing to something which is part of bind, which seems not right to me. What do I need to install to get eventlib on this system?

2 4

A database connection problem was encountered.
by tagarsi, arun 25 Oct '06

25 Oct '06

Hi, I have installed syslog-ng on a server running RHEL4 without much problems but so far I have not been able to on a RHEL3.8 system. from what I can tell the mysql server is running ok , I can do all the command line queries to the databases but for some reason I cannot get the web access up and running . On this server I have loaded phpMyAdmin-2.8.2 and this is ok and I am able to use this to look and manage the databases . Can someone point out why or where I can look for any log information regarding the error reported. I know the config file is ok as it is . I tried to load up the latest version 2.9.2 using the installer, and this does complain there is something not quite right as on the pre check it says - Pre-installation check for: Php-Syslog-NG 2.9.2a (r13) Stable [ cdukes ] 23-Sep-2006 15:10 EST If any of these items are highlighted in red then please take actions to correct them. Failure to do so could lead to your PHP-Syslog-NG installation not functioning correctly. PHP version >= 4.1.0 Yes - zlib compression support Available - XML support Available - GD support Available - MySQL support Unavailable ************************************** config.php Writeable Session save path /tmp, Writeable So it is complaining about not having MySQl support . Unfortunately I cannot see what it is that it needs and what is missing from my mysql install. The weird thing is that mysql seems to be ok on this server as I can access all my databases using other means. Does anyone know what could be missing. Here is a list of the RPMS loaded for mysql and php. mysql-bench-3.23.58-16.RHEL3.1 php-mysql-4.3.2-36.ent libdbi-dbd-mysql-0.6.5-5 mysql-server-3.23.58-16.RHEL3.1 mysql-3.23.58-16.RHEL3.1 mysql-devel-3.23.58-16.RHEL3.1 mod_auth_mysql-20030510-2.ent php-imap-4.3.2-36.ent php-mysql-4.3.2-36.ent php-ldap-4.3.2-36.ent php-odbc-4.3.2-36.ent php-4.3.2-36.ent php-devel-4.3.2-36.ent Thanks Arun Tagarsi

1 0

Re: [syslog-ng] AIX startup
by Nathan Campi 25 Oct '06

25 Oct '06

Is that a question for me? Easy answer, I don't run AIX. :) I probably should have mentioned that. Back a couple years ago when installing openssh on AIX I found it easy to set it up under the SRC, syslog-ng should be easy. On Wed, Oct 25, 2006 at 12:09:14PM -0400, Schernau, Ed wrote: > On AIX, why not just use the system resource controller (SRC) ? > > Ed > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nathan Campi > Sent: Wednesday, October 25, 2006 11:50 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] AIX startup > > I run syslog-ng under daemontools on a couple loghosts where I don't > want it down for more than a second. > > I already have cfengine install daemontools on all my systems anyways, > so it is trivial for me to automate that part as well. The only problem > is that daemontools comes up after all the rc scripts, which leaves you > without logging during all of startup. > > Workable solution is to still have an rc script that starts syslog and > have the daemontools run script kill off any already running syslog-ng > daemons when it comes up later. Might be overkill to supervise it in the > > first place - judgement call I suppose. > > -- > Nate Campi > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > ----------------------------------------- > Use of email is inherently insecure. Confidential information, > including account information, and personally identifiable > information, should not be transmitted via email, or email > attachment. In no event shall Citizens or any of its affiliates > accept any responsibility for the loss, use or misuse of any > information including confidential information, which is sent to > Citizens or its affiliates via email, or email attachment. Citizens > does not guarantee the accuracy of any email or email attachment, > that an email will be received by Citizens or that Citizens will > respond to any email. > > This email message is confidential and/or privileged. It is to be > used by the intended recipient only. Use of the information > contained in this email by anyone other than the intended recipient > is strictly prohibited. If you have received this message in error, > please notify the sender immediately and promptly destroy any > record of this email. > > -- Nate "If a trainstation is where the train stops, what's a workstation...?" -Anon.

1 0

If a destination{} fails ...
by Brian A. Seklecki 25 Oct '06

25 Oct '06

If a message is qualified for many destinations{} before finally hitting a cath-all fallback destination{} at the bottom of the config, will processing of that message stop at the failed facility {} ? ~BAS

2 2

flags(fallback)
by Brian A. Seklecki 25 Oct '06

25 Oct '06

"This flag makes a log statement 'fallback'. Being a fallback statement means that only messages not matching any 'non-fallback' log statements will be dispatched." Presumably this means "...messages not matching any 'non-fallback' log statements flagged as 'final' ...." Could it be possible to change the behavior, or have an alternate mode, that catches all message that haven't reached a "final" yet? ~BAS l8* -lava (Brian A. Seklecki - Pittsburgh, PA, USA) http://www.spiritual-machines.org/ "...from back in the heady days when "helpdesk" meant nothing, "diskquota" meant everything, and lives could be bought and sold for a couple of pages of laser printout - and frequently were."

2 2

Problem compiling syslog-ng 1.6.8 on HP-UX
by olivier "madmax"rolland 25 Oct '06

25 Oct '06

I Tried to compile syslog-ng 1.6.8 on HP-UX 11.11 and 11.23 but a lot of warning appeared: ./configure --enable-full-dynamic make gcc -g -O -Wall -I/usr/local/include/libol -D_GNU_SOURCE -fPIC -ldl - o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile. o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afus er.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o mac ros.o getopt.o getopt1.o -lnsl -ll /usr/local/lib/hpux32/libol.a -lnsl -lxnet ld: (Warning) Unsatisfied symbol "yylenguc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyinput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyunput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyolsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyoutput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextuc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyextra" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyfnd" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyprevious" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylstate" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextarr" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyback" in file /usr/lib/hpux32/libl.so 13 warnings. What can I do in order to resolve those warnings? ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Demandez à ceux qui savent sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

3 2

ignore src{}; contents at startup?
by Brian A. Seklecki 25 Oct '06

25 Oct '06

All: On FreeBSD, /dev/klog provides for output from the kernel (normally redirected to /dev/console before syslog starts). At startup, /etc/rc.d/dmesg copies the kernel boot hardware paramters to /var/run/dmesg.boot. If I have my src(); set to: source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; ...at starup, syslog-ng drains the contents of /dev/klog. By default it tsends to them to user.notice. I like to log{} these to an SMS pager (so I know if a RAID is failing or other hardware problem). However, I'd like to avoid duplication of the efforts of /etc/rc.d/dmesg on behalf of syslog-ng(8) ...especially since I route user.notice to my pager, and kernel boot dmesg(8) can grow over 50 lines. /dev/klog really isn't a socket. It's a special char device. Is there anyway to tell syslog-ng(8) to ignore it's contents at startup? If it was tail(1), i'd say "tail -0 -f /file". Perhaps clear out the contents of /dev/klog somehow? TIA, ~BAS

2 2

proper procedure for filing bug reports (fwd)
by Brian A. Seklecki 25 Oct '06

25 Oct '06

On Fri, 6 Oct 2006, Balazs Scheidler wrote: > On Tue, 2006-09-19 at 11:37 -0500, Matt Zagrabelny wrote: >> just curious what people do for bug reports with syslog-ng... > > send it to this mailing list. That's quite an interesting approach. Most projects, regardless of size, tending to maintain some sort of sf.net or collab.net project page where they can manage bug reports, patches, mailing lists, auto builds, docs, statistics, CVS/SVN, forums, mailing list archives, etc. If if the problem report load is low, it would be nice if dev/users had the full suite of F/OSS development tools available somewhere. ~BAS > > -- > Bazsi l8*

1 0

syslog-ng 2.0rc4 released
by Balazs Scheidler 24 Oct '06

24 Oct '06

Hi, I have released 2.0rc4 with the latest bugfixes. The NEWS entry is below. I'd appreciate feedback on the stability of this version, so that I can finally prepare a 2.0.0 final. 2.0rc4 Tue, 24 Oct 2006 13:33:55 +0200 Bugfixes: * Another leak fix in 2.0rc2 caused syslog-ng to crash when a destination TCP/unix-stream connection was broken. * Fixed EOF detection for destination connections. -- Bazsi

1 0

Segmantation fault
by Sergey N. Romanov 22 Oct '06

22 Oct '06

Hi there, I have syslog-ng 2.0rc3 on FreeBSD 5.4. >From time to time I have problems. Syslog-ng dies with core dump. This is output from gdb NU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"... Core was generated by `syslog-ng'. Program terminated with signal 11, Segmentation fault. #0 log_writer_broken (self=0x820e080, notify_code=3) at logpipe.h:77 77 logpipe.h: No such file or directory. in logpipe.h (gdb) where #0 log_writer_broken (self=0x820e080, notify_code=3) at logpipe.h:77 #1 0x08051199 in log_writer_fd_dispatch (source=0x81f0540, callback=0, user_data=0x0) at logwriter.c:361 #2 0x0805b7b1 in g_main_context_dispatch () #3 0x0805cb76 in g_main_context_iterate () #4 0x0805cf5b in g_main_context_iteration () #5 0x080483ac in main_loop_run (cfg=0x81f1300) at main.c:162 #6 0x08048a8c in main (argc=0, argv=0x0) at main.c:420 (gdb) In syslog-ng config I have some pipe sources. I have this problem after upgrade from 1.6 to 2.0rc3. Any ideas why I have this problem and how to fix this? -- Best regards, Sergey N. Romanov

3 4