February 2007 - syslog-ng - lists.balabit.hu

Need help to compile syslog-ng for Solaris
by Padmanabhan, Rajeesh (GE Healthcare) 15 Feb '07

15 Feb '07

Hi Bazsi, Need your help in compiling syslog-ng for Solaris. Im getting the following error when i 'make'. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "./messages.h", line 33: syntax error in macro parameters "./messages.h", line 34: syntax error in macro parameters "./messages.h", line 35: syntax error in macro parameters "./messages.h", line 37: syntax error in macro parameters "./messages.h", line 43: syntax error in macro parameters cc: acomp failed for messages.c *** Error code 2 make: Fatal error: Command failed for target `messages.o' Current working directory /syslog-ng-2.0.1/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /syslog-ng-2.0.1 *** Error code 1 make: Fatal error: Command failed for target `all' cc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -g -c `test -f 'messages.c' || echo './'`messages.c *** Error code 2 make: Fatal error: Command failed for target `messages.o' Current working directory /syslog-ng-2.0.1/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /syslog-ng-2.0.1 *** Error code 1 make: Fatal error: Command failed for target `all' ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~ I suspect problem with macro defenition in message.h. #define msg_fatal(desc, tag1, tags, ...)msg_event_send(msg_event_create(EVT_PRI_CRIT, desc, tag1, ##tags )) #define msg_error(desc, tag1, tags, ...)msg_event_send(msg_event_create(EVT_PRI_ERR, desc, tag1, ##tags )) #define msg_notice(desc, tag1,tags, ... ) msg_event_send(msg_event_create(EVT_PRI_NOTICE, desc, tag1, ##tags )) Please help. Thanks, Rajeesh

3 2

(no subject)
by Fabian Pucciarelli 14 Feb '07

14 Feb '07

#Hello, #I'm trying to configure syslog-ng to log messages from local0 into a #directory under the /usr tree. #I'm sure that my configuration is correct, but the syslog-ng cannot #write the file. #When I switch to logging in /var tree, it works. #My question is: Cannot I log into another directory? # #-- #Att. #Marcus Vinícius S. Mendes #Cachoeira Paulista / SP - Brazil #National Institute for Space Research - INPE #Center for Weather Forecast and Climatic Analysis - CPTEC #(+55) 3186-8676 I haven't tried doing that but I guess it would work well as long as you create the destination facility for that directory and the daemon user has the correct permissions on the file. -- Regards, Fabian Pucciarelli

2 1

syslog-ng formatting of log events
by PATEL, Leena, GBM 14 Feb '07

14 Feb '07

Hi The line below is an extract from my log file Jan 19 15:10:38 lonrs00341/lonrs00341 2007-01-19 15:10:38,046 [main] INFO - Looking for Spring SingletonBeanFactoryLocator resources : config/beanRefFactory.xml The hostname lonrs00341 is being written out twice as lonrs00341/lonrs00341 and I am not sure why this is happening or where i can change this feature. Another program i'm using to scan the logs cannot do hostname extraction whilst the hostname keeps writing out in this format. When i look at the logs written to a file on their original servers they are not being written out this way so i'm convinced its only happening once syslog-ng has written out the logs remotely to my logging server. Pointers would be appreciated. Regards Leena Regards Leena Patel | Royal Bank of Scotland Global Banking & Markets | E-Commerce | Desk: +44 (0) 207 085 0692 *********************************************************************************** The Royal Bank of Scotland plc. Registered in Scotland No 90312. Registered Office: 36 St Andrew Square, Edinburgh EH2 2YB. Authorised and regulated by the Financial Services Authority This e-mail message is confidential and for use by the addressee only. If the message is received by anyone other than the addressee, please return the message to the sender by replying to it and then delete the message from your computer. Internet e-mails are not necessarily secure. The Royal Bank of Scotland plc does not accept responsibility for changes made to this message after it was sent. Whilst all reasonable care has been taken to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that the onward transmission, opening or use of this message and any attachments will not adversely affect its systems or data. No responsibility is accepted by The Royal Bank of Scotland plc in this regard and the recipient should carry out such virus and other checks as it considers appropriate. Visit our websites at: www.rbs.com www.rbsgc.com www.rbsmarkets.com ***********************************************************************************

2 1

RE: [syslog-ng] Not able to compile syslog-ng with Solaris
by Padmanabhan, Rajeesh (GE Healthcare) 14 Feb '07

14 Feb '07

Hi All, Please find the attached config.log file. I could find only 'libglib-2.0.la' file under /usr/local/lib directory. Thanks, Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Padmanabhan, Rajeesh (GE Healthcare) Sent: Tuesday, February 13, 2007 3:00 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Not able to compile syslog-ng with Solaris Hi All, Im getting an error, when I ./configure syslog-ng.2.0.1 in Solaris 8. configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static Glib I have updated Glib with version 2.6.2. Still same issue. Please help me to resolve this. Thanks, Rajeesh _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Not able to compile syslog-ng with Solaris
by Padmanabhan, Rajeesh (GE Healthcare) 13 Feb '07

13 Feb '07

Hi All, Im getting an error, when I ./configure syslog-ng.2.0.1 in Solaris 8. configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static Glib I have updated Glib with version 2.6.2. Still same issue. Please help me to resolve this. Thanks, Rajeesh

1 0

Message length overflow, line is split, log_msg_size=2048
by Kalin KOZHUHAROV 13 Feb '07

13 Feb '07

Hi there, For some time I am running syslog-ng as a backend mostly for snare agents on windoze. I get the following in the log from time to time: Jan 28 00:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 28 12:01:33 svn01 syslog-ng[12377]: Message length overflow, line is split, log_msg_size=2048 Jan 28 12:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 29 00:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 29 12:00:01 svn01 syslog-ng[12377]: Message length overflow, line is split, log_msg_size=2048 Jan 29 12:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 30 00:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 30 12:00:00 svn01 syslog-ng[12377]: Message length overflow, line is split, log_msg_size=2048 Jan 30 12:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 31 00:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Jan 31 12:00:01 svn01 syslog-ng[12377]: Message length overflow, line is split, log_msg_size=2048 Jan 31 12:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Feb 1 00:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Feb 1 12:01:40 svn01 syslog-ng[12377]: Message length overflow, line is split, log_msg_size=2048 Feb 1 12:12:25 svn01 syslog-ng[12377]: STATS: dropped 0 Feb 2 00:12:26 svn01 syslog-ng[12377]: STATS: dropped 0 Feb 2 12:02:20 svn01 syslog-ng[12377]: Message length overflow, line is split, log_msg_size=2048 Feb 2 12:12:26 svn01 syslog-ng[12377]: STATS: dropped 0 What does this "Message length overflow" ? How can I find/log who(=pid or IP) is sending long messages? Shall I increase log_msg_size? How? I am using syslog-ng-1.6.9 on Gentoo linux. The global part of the config: ### {{{ global options options { # hostname setup chain_hostnames(no); keep_hostname(no); use_dns(no); dns_cache(no); sync(0); stats(43200); create_dirs(yes); dir_owner(root); dir_group(logop); dir_perm(0750); owner(root); group(logop); perm(0640); }; ### global options }}} Some other bits-n-pieces: source s_network { udp(); }; destination d_ext_by_hosts_ALL { file("/var/log/syslog-ng/raw/remote/$YEAR-$MONTH-$DAY/$HOST/ALL" template("$ISODATE $HOST <$FACILITY.$LEVEL> $MSG\n") template_escape(no) ); }; log { source(s_network); destination(d_ext_by_hosts_ALL); }; Googling found only this unanswered mail from this ML: https://lists.balabit.hu/pipermail/syslog-ng/2005-December/008248.html Kalin. -- | A | | D | | J | | P |

3 4

syslog source-address from (cisco) routers
by Ramesh Uppuluri 12 Feb '07

12 Feb '07

I believe syslog-ng derives host ip address (Hostname if dns enabled) from source address from the ip header. However, since routers have multiple interfaces, is it typical to configure routers to send syslog messages from a configured src-address? I guess this is more of an operational question. thanks ramesh

1 0

Re: [syslog-ng] Log daemon for high volume of logs
by bryanh＠giraffe-data.com 12 Feb '07

12 Feb '07

>My troubles didn't go away >until I deployed syslog-ng everywhere and used TCP for all syslog >traffic (from UNIX hosts anyways). It's important to understand just how TCP addresses the problem. It's a problem of servers logging more than the network can handle; UDP addresses it by discarding log messages; TCP addresses it by slowing down the servers creating them. For many servers, logging is supposed to be transparent; it's not a central enough activity to have it pace the server's real work. Besides the pacing, there's also a difference in reliability. If the syslog server hangs, a UDP-based logger will stop logging and go on with life. A TPC-based one will hang with it. -- Bryan Henderson San Jose, California

2 1

HPUX, HP Ansi C compailer and syslog-ng 2.x.x
by Jüri Palis 12 Feb '07

12 Feb '07

Hi, Has anyone managed to compile syslog-ng 2.x with HP ansi c compiler? Now I receive following error : "cfg-lex.l" line 306: error 50: output table overflow, try using %o num 174/1000 nodes(%e), 274/2500 positions(%p), 40/500 (%n), 4475 transitions, 48/1000 packed char classes(%k), 241/2000 packed transitions(%a), 0/0 output slots(%o) *** Error exit code 1 J.

1 0

usertty endutent fix
by bryanh＠giraffe-data.com 12 Feb '07

12 Feb '07

Here's a fix for the usertty destination. Without it, you get one message to a user tty, then nothing, because the utmp database is positioned at the end, so future getutents return "no more entries." -- Bryan Henderson San Jose, California --- syslog-ng-2.0.2+20070202/src/afuser.c 2007-02-01 23:11:48.000000000 +0000 +++ syslog-ng/src/afuser.c 2007-02-12 00:28:32.000000000 +0000 @@ -87,6 +140,7 @@ } } } + endutent(); if ((path_flags & PF_FLOW_CTL_OFF) == 0) log_msg_ack(msg); log_msg_unref(msg);

2 1