February 2007 - syslog-ng - lists.balabit.hu

Problems configuring syslog-ng
by "Marcus Vinícius S. Mendes" 26 Feb '07

26 Feb '07

Hello, I'm trying to configure syslog-ng to log messages from local0 into a directory under the /usr tree. I'm sure that my configuration is correct, but the syslog-ng cannot write the file. When I switch to logging in /var tree, it works. My question is: Cannot I log into another directory? -- Att. Marcus Vinícius S. Mendes Pré-Processamento CPTEC/INPE Ramal 8676

3 3

syslog-ng compiling with static--link option
by Shamim 23 Feb '07

23 Feb '07

Hi, I'm trying to compile syslog-ng with static linking as below: # ./configure --enable-static-linking --prefix=/opt/soe/local/syslog-ng-2.0.2 checking for a BSD-compatible install... ./install-sh -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc option to accept ANSI C... none needed checking for bison... bison -y checking for flex... flex checking for yywrap in -lfl... yes checking lex output file root... lex.yy checking whether yytext is a pointer... yes checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking how to enable static linking for certain libraries... HP-UX checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking getopt.h usability... no checking getopt.h presence... no checking for getopt.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... yes checking sys/strlog.h presence... yes checking for sys/strlog.h... yes checking door.h usability... no checking door.h presence... no checking for door.h... no checking whether struct tm is in sys/time.h or time.h... time.h checking for struct tm.tm_gmtoff... no checking for I_CONSLOG... no checking for O_LARGEFILE... yes checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for nanosleep in -lrt... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for strdup... yes checking for strtol... yes checking for inet_aton... yes checking for inet_ntoa... yes checking for getopt_long... no checking for getaddrinfo... yes checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... yes checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib # find / -name libglib-2.0.a /usr/local/lib/libglib-2.0.a # echo $PATH /usr/include:/opt/soe/local:/usr/local/doc/libgcc:/usr/local/bin:/usr/local/lib:/usr/sbin:/usr/bin:/usr/ccs/bin:/usr/contrib/bin:/usr/contrib/Q4/bin:/opt/hparray/bin:/opt/nettladm/bin:/opt/fcms/bin:/opt/atok/bin:/usr/bin/X11:/usr/contrib/kwdb/bin:/opt/graphics:/opt/soe/bos/bin:/opt/tng/services/bin:/opt/tng/services/tools:/opt/tng/agents/bin # --------------------------------- What kind of emailer are you? Find out today - get a free analysis of your email personality. Take the quiz at the Yahoo! Mail Championship.

1 0

compiling with --enable-static-linking?
by Shamim 23 Feb '07

23 Feb '07

Hello I managed to compile syslog-ng-2.0.2 on Solaris machine(SUN 10 SPARC), but the options ----enable-dynamic-linking, When I install it on other machine it search for dependent library and didn't start the daemon. However when I try to compile it with --enable-static-linking, it gives below errors. ############################################################### checking for pthread.h... yes checking for pthread_create in -lpthread... yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... yes checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib ##################################################################### Is this possible it to compile with statis linking libraries? I've installed glib-1.2.10 glib-2.6.2 downloaded from sunfreeware.com Please advise. Thanks --------------------------------- What kind of emailer are you? Find out today - get a free analysis of your email personality. Take the quiz at the Yahoo! Mail Championship.

1 0

Spoofing syslog message in syslog-ng
by Ravi Papisetti -X (rpapiset - HCL＠Cisco) 22 Feb '07

22 Feb '07

Hi, Is there any way to append some text to syslog message in syslog-ng.conf and forward to NMS system. I would like to append a pre-defined text for every syslog message coming to syslog-ng and forward to NMS. Could you tell me the possible ways of doing it. Thanks, Ravi Kumar P.

3 2

/dev/log/ recreated when reloading syslog-ng?
by Per Jessen 21 Feb '07

21 Feb '07

I've been investigating a problem with rbldnsd - when syslog-ng is reloaded (via logrotate), the /dev/log device is reopened/recreated, which causes a chrooted rbldnsd to lose touch and essentially stop logging. It was suggested to me to create a /dev/log inside the rnbldsdn chroot jail, but that seems sub-optimal. Is syslog-ngs behaviour correct? /Per Jessen, Zürich

1 1

Is this possible in syslog-ng.conf . (v2.0.2)
by Mr. James W. Laferriere 19 Feb '07

19 Feb '07

Hello All , While I haven't seen any examples of this type of definition of a 'source net' around I am hoping we can do something like ... Not the formatting BUT the /24 &/or the netmask'ing . source net { udp( ip( 199.33.245.0/24, # or 199.33.245.0/255.255.255.0, ... 205.141.166.0/24 ) port(514) ); }; The structured formatting would also be kind cool , I come from a heavy backgroud in GateD , And much later JunOS . Tia , JimL -- +-----------------------------------------------------------------+ | James W. Laferriere | System Techniques | Give me VMS | | Network Engineer | 663 Beaumont Blvd | Give me Linux | | babydr(a)baby-dragons.com | Pacifica, CA. 94044 | only on AXP | +-----------------------------------------------------------------+

3 5

Setting permissions on log files
by bryanh＠giraffe-data.com 19 Feb '07

19 Feb '07

With the 'file' destination, Syslog-ng modifies the ownership and permissions of the file when it opens it. There are configuration file options to choose what it sets them to, but AFAICT, no way to have Syslog-ng just leave the files as it finds them. I prefer to maintain permissions and ownership separately; I set them when I create the file and expect them to stick. Could there be a configuration file option for that? -- Bryan Henderson San Jose, California

2 1

Syslog-ng tcpip & RHEL4, sending only NLs
by simonst＠wellsfargo.com 16 Feb '07

16 Feb '07

On RHEL3 servers, 2 of my syslog-ng 2.0rc4 daemons are working fine, sending logs from one daemon to the other. The same syslog-ng on 2 RHEL4 servers connects with a tcpip session, but sends across only newlines, instead of the actual syslog line data. Has anyone seen this before? My syslog-ng was compiled under RHEL3, but it made no difference when I recompiled both sides under RHEL4. Here's the sending syslog-ng.conf: options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; source kernsrc { file("/proc/kmsg"); }; destination messages { file("/var/log/messages" owner(root) group(logger) perm(0640)); }; destination logger1 { tcp("10.11.12.13" port(5678) template("$UNIXTIME $HOST $MESSAGE\n") ); }; log { source(src); source(kernsrc); destination(logger1); destination(messages); }; And here's the receiving syslog-ng.conf: options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; source kernsrc { file("/proc/kmsg"); }; source PROD_SRVRS { tcp(port(syslog-ng)); } ; destination messages { file("/var/log/messages"); }; destination LOGGER { file("/var/log/LOGGER/$YEAR/$MON$DAY" owner(root) group(logger) perm(0640) dir_perm(0750) create_dirs(yes) template("$MESSAGE\n")); }; log { source(src); source(kernsrc); destination(messages); }; log { source(PROD_SRVRS); destination(LOGGER); };

2 1

pipe or unix-stream to feed another program ?
by Yves D'Astous 16 Feb '07

16 Feb '07

Hello, I am doing a new syslog-ng log server setup and I want to find the more robust way (minize lost messages) to feed a perl script with log messages "in real-time". In case the perl script die during the process of the messages there while be a process to restart it, But what mechanism between the "pipe" or the "unix-stream" while give me more control on the number of messages that can be buffer during the restart of my perl script ? Thanks

2 1

RE: [syslog-ng] Not able to compile syslog-ng with Solaris
by Padmanabhan, Rajeesh (GE Healthcare) 16 Feb '07

16 Feb '07

Hi Bazsi Thanks a lot for your help. I am trying static linking of Syslog-ng. Now I have libglib-2.0.a under /usr/local/lib. Still I get the same error when I do './configure --enable-static-linking' Please help. Thanks, Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Wednesday, February 14, 2007 5:48 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Not able to compile syslog-ng with Solaris On Tue, 2007-02-13 at 15:05 +0530, Padmanabhan, Rajeesh (GE Healthcare) wrote: > Hi All, > > Please find the attached config.log file. I could find only > 'libglib-2.0.la' file under /usr/local/lib directory. > if you don't need static linking, you could pass the --enable-dynamic-linking option as suggested by the configure script. If you do want dynamic linking, compile glib with --enable-static option. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1