January 2007 - syslog-ng - lists.balabit.hu

glib2-static
by Harrison, Jonathan 24 Jan '07

24 Jan '07

I am attempting to compile syslog-ng-2.0.1 on a RHEL 4 machine. I have compiled and installed eventlog without problems. Where I am confused is glib2. The website says not GTK+. Where can I find the source to glib2? After reading some recent questions, I noticed that there were some issues with glib2-static. If someone can point me in the correct direction, I would appreciate it. Thanks. J.Harrison

1 1

Question about mark_freq()
by Paul Krizak 24 Jan '07

24 Jan '07

I am having some trouble understanding what constitutes conditions under which MARK messages will appear in log files. I recently brought up a log server on a fairly quiet network (less than one message/hour) and I was expecting to see at least one MARK message in my logs every five minutes, since I have mark_freq set to 300. However, the logs just sit there idle, sometimes for hours at a time, with no mark messages appearing at all. Perhaps I'm missing something in the log { } statement? The documentation is fairly sparse about what is required to enable the MARK stuff... I've attached my syslog-ng.conf -- any ideas? -- Paul Krizak 5900 E. Ben White Blvd. MS 625 Advanced Micro Devices Austin, TX 78741 Linux/Unix Systems Engineering Phone: (512) 602-8775 Silicon Design Division Cell: (512) 791-0686 # $Id: syslog-ng.conf,v 1.37 2007/01/19 17:34:51 skaven Exp $ ################################################ # OPTIONS # See http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/inde… for reference ################################################ options { #time_reopen(); # The time to wait before a killed/died connection is reestablished #time_reap(); # The time to wait before an idle destination file is closed. sync(0); # The number of lines buffered before written to file: we want immediate output to our destinations mark_freq(300); # The number of seconds between two MARK lines. stats_freq(60); # The number of seconds between two STATS. (number of dropped messages) log_fifo_size(10000); # The number of lines fitting to the output queue: we want to be able to handle a flood chain_hostnames(no); # Enable or disable the chained hostname format. keep_hostname(no); # Enable or disable hostname rewriting. We rewrite hostnames because our systems send all their names as IPs. #check_hostname(); # Enable or disable whether the hostname contains valid characters. #bad_hostname(); # A regexp which matches hostnames which should not be taken as such. owner("root"); group("root"); perm(0644); create_dirs(yes); dir_owner("root"); dir_group("root"); dir_perm(0755); use_dns(yes) ; # Enable or disable DNS usage. **syslog-ng blocks on DNS queries** dns_cache(yes); # Enable or disable DNS cache usage. (not implemented) dns_cache_size(10000); # Number of hostnames in the DNS cache: lets try to keep all hosts in the cache (not implemented) dns_cache_expire(3600); # Number of seconds while a successful lookup is cached: 1 hr seems reasonable (not implemented) dns_cache_expire_failed(30); # Number of seconds while a failed lookup is cached: 30 seconds seems reasonable (not implemented) #log_msg_size(); # Maximum length of message in bytes. use_fqdn(no); # Add Fully Qualified Domain Name instead of short hostname. }; ################################################ # GENERIC SOURCES # See http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/inde… for reference # Note that all sources get attached to rule engines. ################################################ # Syslog inputs source s_external_syslog { udp(port(514)); }; # Local syslog source s_internal_syslog { unix-dgram("/dev/log"); file("/proc/kmsg" log_prefix("kernel:")); }; # Sylog-ng's internal log source s_syslog-ng { internal(); }; # This template reformats incoming messages for use in human-readable logfiles # Don't rename this template! template t_human_readable { template("$R_FULLDATE $HOST $FACILITY.$PRIORITY $MESSAGE\n"); template-escape(no); }; # The big Y/M/D/host-messages tree destination d_host_messages { file( "/var/log/logs/$R_YEAR/$R_MONTH/$R_DAY/$HOST-messages.log" template(t_human_readable) create_dirs(yes) owner("root") group("root") perm(0644) dir_perm(0755) ); }; # The big monolithic syslog file destination d_big_messages { file ( "/var/log/logs/messages.log" template(t_human_readable) owner("root") group("root") perm(0644) ); }; # A named pipe that programs can read from destination d_syslog_pipe { pipe ( "/var/spool/vtec/syslog_pipe" template(t_human_readable) owner("root") group("root") perm(0644) ); }; # The "normal" syslog file (for local syslog) destination d_internal_syslog { file ( "/var/log/messages" template(t_human_readable) owner("root") group("root") perm(0644) ); }; # A syslog-ng logfile destination d_syslog-ng-log { file( "/var/log/syslog-ng.log" owner("root") group("root") perm(0644) ); }; # log syslog-ng's log to a special logfile log { source(s_syslog-ng); destination(d_syslog-ng-log); }; # log syslog messages to the host-messages tree and to the big monolithic messages file log { source(s_external_syslog); source(s_internal_syslog); destination(d_big_messages); destination(d_host_messages); destination(d_syslog_pipe); }; # log local syslog stuff to /var/log/messages log { source(s_internal_syslog); destination(d_internal_syslog); };

2 1

syslog-ng cvs / svn
by Brian A. Seklecki 24 Jan '07

24 Jan '07

Where is the repo? I want to submit a patch to a bad example in the docs. References to cvs.balabit.hu are clearly invalid. l8* -lava (Brian A. Seklecki - Pittsburgh, PA, USA) http://www.spiritual-machines.org/ "...from back in the heady days when "helpdesk" meant nothing, "diskquota" meant everything, and lives could be bought and sold for a couple of pages of laser printout - and frequently were."

3 4

external configuration file
by Michael Fernández M. 24 Jan '07

24 Jan '07

Hi... i have a big syslog-ng.conf file, because of the many filters and destinations that i´m already using. So my question is: can i use a file that`s contains all the filter for a specific device, another file for the destinations? something like: file_with_filter_a "(/etc/syslog-ng/filters/host_a)" file_with_filter_b "(/etc/syslog-ng/filters/host_b)" file_with_destinations "(/etc/syslog-ng/destinations/host_b)" then in the syslog-ng.conf only have to "call" those files?, and not put all the filters and destinations inside the same syslog-ng.conf? Thanks!!!! Michael.-

2 1

trailing spaces on udp messages ?
by Johan Fischer 24 Jan '07

24 Jan '07

Hi List, I'm using syslog-ng-2.0.1 on RHEL4 (centos4 actually) but I reproduced the same problem on debian unstable using the debian package (currently 2.0.0). The clients are using sysklogd 1.4.1-20 It seems that all my lines logs from udp() have one trailing space. The internal logs and /dev/log don't have that space so I'm currently assuming either the sender (sysklogd) or the receiver (udp module of syslog-ng) is not filtering that space. This also seem to happen with the internal() source. A wireshark of the packet will show this: Syslog message: USER.NOTICE: jfischer: blahklfdsfd\n I can see a \n at the end of the line but no space. I don't know what to think of this yet. I attached the configuration used (stripped as much), and the logs created. This problem is affecting mostly logwatch which do from time to time strict regex on the end of the string that I cannot match because of this trailing space. Cheers. J. -- Johan Fischer Capital Markets Surveillance Services Pty Limited Level 2, 9 Castlereagh Street, Sydney NSW 2000 Tel: +61 2 9233 7999 Direct: +61 2 9236 9150 Fax: +61 2 9236 9177 http://www.cmss-systems.com Capital Markets Surveillance Services Pty Ltd (CMSS) - Confidential Communication The information contained in this e-mail is confidential. It is intended solely for the addressee. If you receive this e-mail by mistake please promptly inform us by reply e-mail and then delete the e-mail and destroy any printed copy. You must not disclose or use in any way the information in the e-mail. There is no warranty that this e-mail is error or virus free. It may be a private communication, and if so, does not represent the views of the CMCRC and its associates. If it is a private communication, care should be taken in opening it to ensure that undue offence is not given. Jan 17 12:45:01 clamp CRON[8797]: (pam_unix) session opened for user root by (uid=0) Jan 17 12:45:01 clamp CRON[8799]: (pam_unix) session opened for user root by (uid=0) Jan 17 12:45:01 clamp CRON[8801]: (pam_unix) session opened for user jfischer by (uid=0) Jan 17 12:45:01 clamp /USR/SBIN/CRON[8798]: (root) CMD ([ -x /usr/lib/sysstat/sa1 ] && { [ -r "$DEFAULT" ] && . "$DEFAULT" ; [ "$ENABLED" = "true" ] && exec /usr/lib/sysstat/sa1 $SA1_OPTIONS 1 1 ; }) Jan 17 12:45:01 clamp /USR/SBIN/CRON[8800]: (root) CMD (if [ -x /usr/bin/mrtg ] && [ -r /etc/mrtg.cfg ]; then env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log 2>&1; fi) Jan 17 12:45:01 clamp /USR/SBIN/CRON[8802]: (jfischer) CMD (/home/jfischer/bin/chg_background >/dev/null) Jan 17 12:45:01 clamp CRON[8801]: (pam_unix) session closed for user jfischer Jan 17 12:45:01 clamp CRON[8797]: (pam_unix) session closed for user root Jan 17 12:45:02 clamp CRON[8799]: (pam_unix) session closed for user root Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: VCore 1: +0.00 V (min = +1.14 V, max = +1.55 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: VCore 2: +0.00 V (min = +1.14 V, max = +1.55 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: +3.3V: +0.00 V (min = +2.82 V, max = +3.79 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: +5V: +5.03 V (min = +4.01 V, max = +1.10 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: +12V: +0.00 V (min = +14.29 V, max = +11.31 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: -12V: -14.91 V (min = -4.55 V, max = -10.39 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: -5V: -7.71 V (min = -3.39 V, max = +5.00 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: V5SB: +5.59 V (min = +2.93 V, max = +2.53 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: VBat: +0.00 V (min = +2.99 V, max = +1.84 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: fan1: 0 RPM (min = 2812 RPM, div = 2) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: fan2: 0 RPM (min = 3183 RPM, div = 2) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: fan3: 0 RPM (min = 25000 RPM, div = 2) [ALARM] Jan 17 12:45:44 clamp fetchmail[2500]: awakened at Wed 17 Jan 2007 12:45:44 EST Jan 17 12:45:44 clamp fetchmail[2500]: Server CommonName mismatch: localhost.localdomain != pop.cmcrc.com Jan 17 12:45:44 clamp fetchmail[2500]: Server certificate verification error: self signed certificate Jan 17 12:45:44 clamp fetchmail[2500]: sleeping at Wed 17 Jan 2007 12:45:44 EST for 300 seconds Jan 17 12:45:01 192.168.15.19 CRON[2871]: (pam_unix) session opened for user root by (uid=0) Jan 17 12:45:01 192.168.15.19 /USR/SBIN/CRON[2872]: (root) CMD ([ -x /usr/lib/sysstat/sa1 ] && { [ -r "$DEFAULT" ] && . "$DEFAULT" ; [ "$ENABLED" = "true" ] && exec /usr/lib/sysstat/sa1 $SA1_OPTIONS 1 1 ; }) Jan 17 12:45:01 192.168.15.19 CRON[2871]: (pam_unix) session closed for user root Jan 17 12:45:59 192.168.15.19 sshd[3586]: Accepted password for jfischer from 192.168.15.17 port 49664 ssh2 Jan 17 12:45:59 192.168.15.19 sshd[3606]: (pam_unix) session opened for user jfischer by (uid=0) options { chain_hostnames(0); time_reopen(10); time_reap(360); log_fifo_size(2048); create_dirs(yes); group(adm); perm(0640); dir_perm(0755); use_dns(no); stats_freq(0); }; source s_internal { internal(); }; source s_local { unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); }; source s_remote { udp(); tcp(); }; destination df_internal { file("/var/log/test/internal.log"); }; destination df_local { file("/var/log/test/local.log"); }; destination df_remote { file("/var/log/test/remote.log"); }; log { source(s_internal); destination(df_internal); }; log { source(s_local); destination(df_local); }; log { source(s_remote); destination(df_remote); }; Jan 17 12:44:30 clamp syslog-ng[8783]: syslog-ng starting up; version='2.0.0'

3 9

parse error
by voorbeeld voorbeeld 23 Jan '07

23 Jan '07

Hello all, i'm a newbie with Syslog-ng and i've got aquestion about it. I'm installed syslog-ng version 1.6.11 with DarwinPorts (with command "sudo port install syslog-ng"). When i try to run syslog-ng (from the location "/opt/local/sbin/") i get the following error: "Cannot open configuration file /opt/local/etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. (line 1)". I don't know the solution for it, so can anyone help me out with this problem/error? Remco _________________________________________________________________ Nieuw: Live Mail. Mis het niet en profiteer direct van de voordelen! http://imagine-windowslive.com/mail/launch/default.aspx?Locale=nl-nl

3 4

file name for ttyname in utmp
by bryanh＠giraffe-data.com 23 Jan '07

23 Jan '07

When syslog-ng sends a terminal message for the 'usertty' destination, it looks in utmp to find what terminal the user is using. It gets the "line name" from utmp (e.g. "tty1") and appends it to "/dev/" to get the device special file name for the user's terminal, e.g. "/dev/tty1". utmp can also contain the device special file name itself as the line name. For example, on my system, logins use devices in /var/dev and utmp can say "/var/dev/tty1". The following modification makes Syslog work with such a utmp entry: --- syslog-ng/src/afuser.c 2007-01-21 23:11:26.000000000 +0000 +++ syslog-ng-2.0.1/src/afuser.c 2007-01-19 23:11:37.000000000 +0000 @@ -124,5 +74,2 @@ - if (ut->ut_line[0] == '/') - strcpy(line, ""); - else strcpy(line, "/dev/"); -- Bryan Henderson San Jose, California

2 1

RE: [syslog-ng] configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --e nable-dynamic-linking or install a static GLib
by PATEL, Leena, GBM 23 Jan '07

23 Jan '07

Hi You are missing the glib package which syslog-ng has a dependency upon, like eventlog. libglib-2.0.a can be found in the glib2-devel package which i obtained from Red Hat Advanced Server 3 installation cd's. I'm on Red Hat Linux so downloaded the package onto my machine and installed via RPM. You may get a conflict if another Glib version is installed that doesnt contain the library libglib-2.0.a but i just removed the older version first and then installed gli2-devel which worked for me once i complied syslog-ng again. Regards Leena _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Shamim Sent: 23 January 2007 07:44 To: syslog-ng(a)lists.balabit.hu; thupton2002(a)yahoo.com Subject: [syslog-ng] configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib Hi, checking for pthread_create in -lpthread... yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... yes checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib # Please suggest the solution. Thanks and Regards Shamim _____ Copy addresses and emails from any email account to Yahoo! Mail - quick, easy and free. Do <http://us.rd.yahoo.com/mail/uk/taglines/yahoo_com/trueswitch/*http://uk.doc s.yahoo.com/trueswitch2.html> it now... *********************************************************************************** The Royal Bank of Scotland plc. Registered in Scotland No 90312. Registered Office: 36 St Andrew Square, Edinburgh EH2 2YB. Authorised and regulated by the Financial Services Authority This e-mail message is confidential and for use by the addressee only. If the message is received by anyone other than the addressee, please return the message to the sender by replying to it and then delete the message from your computer. Internet e-mails are not necessarily secure. The Royal Bank of Scotland plc does not accept responsibility for changes made to this message after it was sent. Whilst all reasonable care has been taken to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that the onward transmission, opening or use of this message and any attachments will not adversely affect its systems or data. No responsibility is accepted by The Royal Bank of Scotland plc in this regard and the recipient should carry out such virus and other checks as it considers appropriate. Visit our websites at: www.rbs.com www.rbsgc.com www.rbsmarkets.com ***********************************************************************************

1 0

configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib
by Shamim 23 Jan '07

23 Jan '07

Hi, checking for pthread_create in -lpthread... yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... yes checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib # Please suggest the solution. Thanks and Regards Shamim --------------------------------- Copy addresses and emails from any email account to Yahoo! Mail - quick, easy and free. Do it now...

1 0

Re: [syslog-ng] program1 destination
by bryanh＠giraffe-data.com 22 Jan '07

22 Jan '07

>It will be extremely easy to DoS the server >if you have, say 10 MSGs of your kind in a second (or 100, or 1000). Isn't that a problem in syslog-ng even without forking? I can see that forking means you can exhaust system resources with fewer messages, but there's no limit on how many messages syslog-ng can be made to handle, is there? I've long thought there should be some throttling of syslog activity; I haven't looked recently to see if syslog-ng provides any facilities for that, but whatever is right for logging to a file should be right for logging via fork, just with different numbers. >spawning a new process per MSG is probably a big overhead for >nothing. The overhead is insignificant in my case because 1) the cost of that one fork is a fraction of what is ultimately required to deliver an email; and 2) there would not normally be more than 1 per day. -- Bryan Henderson San Jose, California

1 0