December 2006 - syslog-ng - lists.balabit.hu

syslog-ng make errors on RHEL4 x86_64
by James Young 12 Dec '06

12 Dec '06

When attempting to perform make on RHEL4 x86_64 for syslog-ng 2.0.0 I recieve the following errors. I have managed to find a previous post in July which mentions patching the source, however the attachment has been 'scrubbed' from the message. Anyone able to point me toward what I need to be doing to resolve these errors below? libsyslog-ng.a(misc.o)(.text+0x3d1): In function `resolve_hostname': /var/tmp/syslog-ng-2.0.0/src/misc.c:178: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x97): In function `log_stamp_format': /var/tmp/syslog-ng-2.0.0/src/logmsg.c:111: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x37e): In function `log_msg_ref': /var/tmp/syslog-ng-2.0.0/src/logmsg.c:489: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x41f): In function `log_msg_unref': /var/tmp/syslog-ng-2.0.0/src/logmsg.c:503: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xd8b): In function `log_msg_ack_block_end': /var/tmp/syslog-ng-2.0.0/src/logmsg.c:623: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x58): In function `log_pipe_ref': /var/tmp/syslog-ng-2.0.0/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0xa9): In function `log_pipe_unref': /var/tmp/syslog-ng-2.0.0/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x9f): In function `log_endpoint_free': /var/tmp/syslog-ng-2.0.0/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x18d): In function `log_connection_new': /var/tmp/syslog-ng-2.0.0/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x358): In function `log_template_ref': /var/tmp/syslog-ng-2.0.0/src/templates.c:169: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x3bd):/var/tmp/syslog-ng-2.0.0/src/templates.c:180: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/var/tmp/syslog-ng-2.0.0/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/var/tmp/syslog-ng-2.0.0' make: *** [all] Error 2

3 4

Trouble with timezone()
by anthony lineham 11 Dec '06

11 Dec '06

Hi, I'm trying to convert the time information in messages so they match the timezone offset of a remote device. Initially I was using time_zone(). This seemed to work ok until I tried and offset of greater than 12hours, which failed. It occurred to me that this utility is intended convert messages initially with GMT time to a GMT +/- offset time hence only +/-12 is required. What I want to be able to do is make a coversion relative to local time, so I need to be able to handle an offset of up 23 hours. I'm trying to use timezone(), which is supposed to take an offset value in seconds. However I can't work out the syntax. For a 2 hour offset I've tried: timezone(7200) timezone("7200") timezone("+7200") timezone(+7200) For each of these I get config parsing errors. Can anyone help me out please? Anthony

2 5

Advice on keeping hostnames/using dns
by Hari Sekhon 07 Dec '06

07 Dec '06

Hi, I'd like some advice on what I should do on my logserver regarding hostnames. I've currently got keep_hostnames(no) use_dns(yes) in order to get accurate and consistent hostnames but I'd like to consider just skipping the whole dns check rewriting thing and use keep_hostnames(yes) use_dns(no) The only issue I can see from this is that the hostname gets logged according to the packet. I'm reasonably confident that most machines will report the right name in their logs to the logserver but I also think that it makes it all too possible to screw up the logserver maliciously since any old junk that is sent to the port is put into the logs so you could hammer the integrity of the logs just by sending loads of bogus logs from a machine with the name set to that of any other machine on the network. Got any views on this? All opinions welcome. Thanks Hari -- Hari Sekhon

8 13

RE: [syslog-ng] logrotate again...
by Justin Randall 07 Dec '06

07 Dec '06

Hello, If the sed script was copied without first reviewing the actual format of Syslog messages, then yes this would happen. The sed scripts were examples of how to write the sed script, the actual regex for the date "November 15th" are completely different in the actual log file. Syslog messages use the time format "Dec 3 04:29:20" at the beginning of each line. This means that you would use a date format like the above. Likely the regex you would want to use is something more like "15 +Nov". This implies "15", then 1 or more white spaces, and then "Nov". In the future it is always good practice to test any procedure you get from a mailing list. In this case, looking at the Syslog message format should have obviously shown that the example originally submitted would not work. Basically what happened was that the sed script started at "." (match any character) and until "15 Nov" and deleted everything in between. Since "15 Nov" never appeared in the log file, everything was deleted. Since this is not a discussion for the Syslog-NG mailing list and more of a regular System Administration problem, if you'd like to discuss this further let's take this off this mailing list. Feel free to email me at djsykz(a)hotmail.com. Regards, Justin. -----Original Message----- From: Vadim Pushkin [mailto:wiskbroom@hotmail.com] Sent: Wednesday, December 06, 2006 1:42 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng] logrotate again... Well, this did not work, but it was sucessful at wiping out the entire contents of the file altogether :-( Regards, .vp >From: "Justin Randall" <jrandall(a)comwave.net> >Slight correction on the command syntax: > > > find /var/log -type f -exec sed -if <sed script filename> {} \; > >Should be > >find /var/log -type f -exec sed -f <sed script filename> --in-place {} >\; > >Cheers. > >-----Original Message----- >From: Justin Randall >Sent: Wednesday, December 06, 2006 11:21 AM >To: 'Syslog-ng users' and developers' mailing list' >Subject: RE: [syslog-ng] logrotate again... > > >find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is >untested, though :) > >If I'm not mistaken this will only remove lines containing '15 Nov'. If >you want something that will eliminate all logs prior to that date you >could write a sed script like the following: > >= begin sed script = >/./,/15 Nov/{ >d >} >= end sed script = > >If you had another date range in mind you could also do the following: > >= begin sed script = >/13 Nov/,/15 Nov/{ >d >} >= end sed script = > >Once you have your sed script simply invoke it similar to the above >method: > >find /var/log -type f -exec sed -if <sed script filename> {} \; > >Hope this helps, > >Justin. > >-----Original Message----- >From: Andrej Ricnik-Bay [mailto:andrej.groups@gmail.com] >Sent: Tuesday, December 05, 2006 3:44 PM >To: Syslog-ng users' and developers' mailing list >Subject: Re: [syslog-ng] logrotate again... > >On 12/6/06, Vadim Pushkin <wiskbroom(a)hotmail.com> wrote: > > > 2. The other issue that I am having is that I wish to rotate now, my > > filesystem is fill, but since I did not rotate, all of my logfiles are >one. > > How can I prune them of any data prior to say 15 Nov for *each* >logfile? >find /var/log -type f -exec sed -i '/15 Nov/d' {} \; >should work - is untested, though :) > > > > Thank you again, > > > > .vp >Cheers _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] logrotate again...
by Justin Randall 06 Dec '06

06 Dec '06

Slight correction on the command syntax: > find /var/log -type f -exec sed -if <sed script filename> {} \; Should be find /var/log -type f -exec sed -f <sed script filename> --in-place {} \; Cheers. -----Original Message----- From: Justin Randall Sent: Wednesday, December 06, 2006 11:21 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] logrotate again... >find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is untested, though :) If I'm not mistaken this will only remove lines containing '15 Nov'. If you want something that will eliminate all logs prior to that date you could write a sed script like the following: = begin sed script = /./,/15 Nov/{ d } = end sed script = If you had another date range in mind you could also do the following: = begin sed script = /13 Nov/,/15 Nov/{ d } = end sed script = Once you have your sed script simply invoke it similar to the above method: find /var/log -type f -exec sed -if <sed script filename> {} \; Hope this helps, Justin. -----Original Message----- From: Andrej Ricnik-Bay [mailto:andrej.groups@gmail.com] Sent: Tuesday, December 05, 2006 3:44 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] logrotate again... On 12/6/06, Vadim Pushkin <wiskbroom(a)hotmail.com> wrote: > 2. The other issue that I am having is that I wish to rotate now, my > filesystem is fill, but since I did not rotate, all of my logfiles are one. > How can I prune them of any data prior to say 15 Nov for *each* logfile? find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is untested, though :) > Thank you again, > > .vp Cheers _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syntax error 47
by Brian Long 06 Dec '06

06 Dec '06

Hello, I just upgraded my syslog-ng installation on debian and when it restarts I get this error: root@lancelot:/etc/init.d# /etc/init.d/syslog-ng restart Stopping system logging: syslog-ng not running. Starting system logging: syslog-ngsyntax error at 47 start failed. Syslog-ng works swimmingly on an identical debian system. Anyone know how I can get past this syntax error? Many thanks, Brian Long

3 2

RE: [syslog-ng] logrotate again...
by Justin Randall 06 Dec '06

06 Dec '06

>find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is untested, though :) If I'm not mistaken this will only remove lines containing '15 Nov'. If you want something that will eliminate all logs prior to that date you could write a sed script like the following: = begin sed script = /./,/15 Nov/{ d } = end sed script = If you had another date range in mind you could also do the following: = begin sed script = /13 Nov/,/15 Nov/{ d } = end sed script = Once you have your sed script simply invoke it similar to the above method: find /var/log -type f -exec sed -if <sed script filename> {} \; Hope this helps, Justin. -----Original Message----- From: Andrej Ricnik-Bay [mailto:andrej.groups@gmail.com] Sent: Tuesday, December 05, 2006 3:44 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] logrotate again... On 12/6/06, Vadim Pushkin <wiskbroom(a)hotmail.com> wrote: > 2. The other issue that I am having is that I wish to rotate now, my > filesystem is fill, but since I did not rotate, all of my logfiles are one. > How can I prune them of any data prior to say 15 Nov for *each* logfile? find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is untested, though :) > Thank you again, > > .vp Cheers _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: Tool to determine facility and severity from syslog packets
by G.W. Haywood 06 Dec '06

06 Dec '06

Hi there, On Wed, 6 Dec 2006 Paul Krizak wrote: > # The big monolithic syslog file > destination d_big_messages { > file ( > "/var/log/logs/messages.log" How about # The several separate syslog files destination d_separated_messages { file ( "/var/log/logs/$FACILITY.log" etc.? -- 73, Ged.

2 1

Rewriting log messages
by John Morrissey 05 Dec '06

05 Dec '06

We've been using the syslog-ng-anon patch[1] to rewrite log traffic (mainly to remove the redundant integer timestamp logged by qmail-pop3d via splogger(8)). We're looking at the upcoming syslog-ng 2.0 upgrade that's coming with the next Debian release (etch) and haven't been able to find an equivalent. I saw a request or two[2] for a feature like this, but don't see it in the latest syslog-ng source or docs. Is a feature like this planned, or is there another way I can go about rewriting log traffic? thanks, john [1] http://dev.riseup.net/privacy/syslog-ng-anon/ [2] https://lists.balabit.hu/pipermail/syslog-ng/2006-August/009129.html -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

4 3

Re: [syslog-ng] Tool to determine facility and severity from syslog packets
by G.W. Haywood 05 Dec '06

05 Dec '06

Hi there, On Tue, 5 Dec 2006, "Justin Shore" wrote: > Does anyone know of a tool to read the facility and severity info from > inbound syslog packets? I have a number of devices that are sending me > syslog info and I can't determine what facility they're using. >From your description I'm not sure exactly what your problems are, but _if_ you're using syslog-ng (if not, why not?!:) and _if_ I understand what you need then I think I would simply create two sets of temporary logfiles: one set would log everything at every severity and the other would log everything at every facility. Then I'd look in the logs to see if I recognized any of the output. A lot simpler and, er, more deterministic than hacking C and/or Perl. -- 73, Ged.

2 1