June 2007 - syslog-ng - lists.balabit.hu

S_DATE apparently not working
by Giulio Botto 13 Jun '07

13 Jun '07

Hello, I'm new to both syslog-ng and the list so I first tried the docs and archives, but couldn't find anything enlightening. We have a syslog-ng 2.0.3 running on CentOS 5 and some Cisco PIX appliances sending their logs to it. If my understanding is correct I should be receiving the sender's timestamp and should be able to log it in my log files instead of the the receiving timestamp by application of the S_DATE macro. We tried changeing the time on one of the PIXes in the assumption we'd see it's timestamp on our logfile, but continued to see the receiving time no matter what macro we used in our template. Any hint to what I'me getting wrong will be very much appreciated. Below is the relevant configuration: options { use_dns(yes); dns_cache_hosts(/etc/hosts); dns_cache_expire(87600); chain_hostnames(no); use_time_recvd(no); }; source s_remote { tcp(ip(0.0.0.0) port(514) keep_timestamp(yes)); udp(ip(0.0.0.0) port(514) keep_timestamp(yes)); }; destination d_separatedbyhosts { file("/var/log/syslog-ng/$HOST.log" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes) template("<$PRI>$S_DATE $HOST $MSG\n") template-escape(no)); }; -- Giulio Botto -- madecto(a)sangria.org.il PGP fingerprint = 1979 A78A 8F82 DB5E 55E9 D6D6 6AB6 0BA9 FDB7 6789

2 4

/dev/log causing system to hang?
by Bill Horn 13 Jun '07

13 Jun '07

We deploy syslog-ng-1.6.2-1, the (non-destination) configuration is: -------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; -------- One of our support people reported: -------- 1. "EPROTOTYPE (Protocol wrong type for socket) ... pointing to /dev/log ... /dev/log is a socket 2. List all the socket on the sever .... via netstat ... found lot of socket still waiting to get connected .. indicating .. it couldnot establish new connection ... hence it ruled out the authentication issue 3. Tried to find out what was blocking the socket /dev/log .... found that syslog-ng was the culprit ... i had bounced syslog-ng and we were good thereafter -------- cat /proc/version gives: -------- Linux version 2.4.21-47.0.1.ELsmp (brewbuilder(a)hs20-bc2-2.build.redhat.com) (gcc version 3.2.3 20030502 (Red Hat Linux 3.2.3-56)) #1 SMP Fri Oct 13 17:56:20 EDT 2006 -------- That's all I've got so far. Any suggestions on next step? Thanks ... Bill

2 1

Re: syslog-ng Digest, Vol 26, Issue 10
by Shamim 11 Jun '07

11 Jun '07

Hope This will help you to compile Sysylog-ng for proper fuctioning. Compilation Procedure Below are the steps, which are required to complete the compilation. 1. Create the appropriate directory tree in /opt/soe/local for syslog-ng Note: Download the latest source code for eventlog and Syslog-ng. Before compiling the Syslog-ng we need to compile eventlog, which is required for Syslog-ng to function properly. Compiling eventlog 1. Go to eventlog source directory 2. Cd eventlog_src_dir 3. ./configure --prefix=/opt/soe/local/syslog-ng-2.0.2/eventlog 4. make 5. make install Compiling Syslog-ng 1. Go to Syslog-ng source directory 2. Cd syslog_ng_src_dir 3. ./configure --enable-static-linking --prefix=/opt/soe/local/syslog-ng-2.0.2 EVTLOG_CFLAGS=/opt/soe/local/syslog-ng-2.0.2/eventlog/include EVTLOG_LIBS=/opt/soe/local/syslog-ng-2.0.2/eventlog/lib 4. make 5. make install Note: on HP, it requires to be compiling with dynamic options as: ./configure --enable-dynamic-linking --prefix=/opt/soe/local/syslog-ng-2.0.2 EVTLOG_CFLAGS=/opt/soe/local/syslog-ng-2.0.2/eventlog/include EVTLOG_LIBS=/opt/soe/local/syslog-ng-2.0.2/eventlog/lib Shamim CSC Noida syslog-ng-request(a)lists.balabit.hu wrote: Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: configure error (ictforever) ---------------------------------------------------------------------- Message: 1 Date: Sun, 10 Jun 2007 17:09:26 +0800 From: ictforever Subject: Re: [syslog-ng] configure error To: syslog-ng(a)lists.balabit.hu Message-ID: Content-Type: text/plain; charset="iso-8859-1" > > Any advice and suggestion are appreciated.Thanks Did you export the environment variable? Check that # pkg-config eventlog --cflags returns anything at all. If it doesn't, investigate why (strace and friends could help here) here are envs: LD_LIBRARY_PATH=/usr/local/eventlog/lib PKG_CONFIG_PATH=/usr/local/eventlog/lib/pkgconfig/ [root@test syslog-ng-2.0.4]# pkg-config eventlog --cflags -I/usr/local/eventlog/include/eventlog but there is the same error: .............................. checking for GLIB... yes checking for EVTLOG... no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? why? Thanks Regards.

1 0

Re: [syslog-ng] configure error
by ictforever 10 Jun '07

10 Jun '07

> > Any advice and suggestion are appreciated.Thanks Did you export the environment variable? Check that # pkg-config eventlog --cflags returns anything at all. If it doesn't, investigate why (strace and friends could help here) here are envs: LD_LIBRARY_PATH=/usr/local/eventlog/lib PKG_CONFIG_PATH=/usr/local/eventlog/lib/pkgconfig/ [root@test syslog-ng-2.0.4]# pkg-config eventlog --cflags -I/usr/local/eventlog/include/eventlog but there is the same error: .............................. checking for GLIB... yes checking for EVTLOG... no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? why? Thanks Regards.

2 1

configure error
by ictforever 08 Jun '07

08 Jun '07

Hi, when I wanted to install syslog-ng-2.0.4,I met some troubles.I installed eventlog-0.2.4 at /usr/local/eventlog,and setted the PKG_CONFIG_PATH=/usr/local/eventlog/lib/pkgconfig,but when I run ./configure,there were errors: ........................................ checking whether to enable TCP wrapper support... yes checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... Requested 'eventlog >= 0.2' but version of EventLog is no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? Any advice and suggestion are appreciated.Thanks Regards

2 1

patch for syslog-ng-2.0.4 to handle missing files in "follow" mode
by Charles G Waldman 07 Jun '07

07 Jun '07

The new "follow_freq" feature is nice, because you no longer have to do things like "tail -f | logger" to get external logfiles into syslog-ng. However, one case is not handled gracefully, and this is the case when a log file is not present when syslog-ng starts up. In this case, an error is reported, and the file is dropped from the list of sources. It is possible that the file just hasn't been created yet, because syslog-ng is starting before some other server which creates the file. The attached patch modifies the startup behavior, so that if an input file is nonexistent and follow mode is enabled (i.e. follow_freq > 0), then the open is "deferred" - a log reader object is created with a file descriptor set to -1, and the existing logic is used to periodically check if the file comes into existence: conceptually, it looks basically like a file move, where the file is being moved from non-existence into existence :-) Patch attached... comments welcome.

1 0

Simple Doubt
by Luiz Cruz 06 Jun '07

06 Jun '07

Hi all, I have a doubt about a process that i have. Maybe the solution is in the side of syslog-ng, i am searching. My process is: Log -> Perl Script -> Fifo -> Syslog-ng -------------- > Syslog-ng -> perl -> rrd The problem is when the application write to many lines in the fifo file (through the perl script), my syslog-ng (Standard Configuration) can't process all lines quickly, and the load of cpu rises a lot. Is there any parameters that i can use to optimize the reading? Someone have a similar solution? Thanks a lot. Att., Luiz

3 7

2.0.4 compilation issues
by Douglas J Hunley 04 Jun '07

04 Jun '07

I'm trying to compile 2.0.4 using: ./configure --prefix=/usr --sysconfdir=/etc --enable-dynamic-linking and right away, it fails telling me that libnet-config isn't found. Which is correct, I don't have it installed. There wasn't anything in the tarball that told me I needed to. A 'grep -ri libnet *' shows a bunch of check in the configure and this ChangeLog entry: ChangeLog: * configure.in: added --with-libnet and --enable-spoof-source Is there a reason this dependency isn't documented inside the tarball, or am I missing some file/reference somewhere? Moving on, I went and downloaded the latest libnet, only to find out that the latest doesn't include libnet-config (it's deprecated). So now I have to downgrade my libnet. Moving on again, the compile fails: if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -march=k8 -mmmx -msse -msse2 -m3dnow -pipe -fomit-frame-pointer -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before 'libnet_t' afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to 'int' in declaration of 'AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y: In function 'yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:590: error: syntax error before ')' token /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:623: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/home/doug/syslog-ng-2.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/doug/syslog-ng-2.0.4' make: *** [all] Error 2 And there I'm stuck. On a whim, I 'upgrade' my libnet and it suddenly compiles w/o issue.. I think the libnet dependency needs to be re-examined -- Douglas J Hunley (doug at hunley.homeip.net) - Linux User #174778 http://doug.hunley.homeip.net I think, therefore, I am ... not related to you.

2 2

RE: [syslog-ng] undefined reference to `libnet_init'
by Tapas Mallick 04 Jun '07

04 Jun '07

Hello List, I am trying to install syslog-ng 2.0.4 on RHEL 4 (on top of VMWARE) and I am getting the same error message while "make" the software. ============================================= make all-recursive make[1]: Entering directory `/tmp/syslog-ng-2.0.4' Making all in src make[2]: Entering directory `/tmp/syslog-ng-2.0.4/src' gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamic libsyslog-ng.a(afinet.o)(.text+0x776): In function `afinet_dd_init': /tmp/syslog-ng-2.0.4/src/afinet.c:338: undefined reference to `libnet_init' libsyslog-ng.a(afinet.o)(.text+0x895): In function `afinet_dd_queue': /tmp/syslog-ng-2.0.4/src/afinet.c:493: undefined reference to `libnet_write' libsyslog-ng.a(afinet.o)(.text+0x8d5):/tmp/syslog-ng-2.0.4/src/afinet.c:505: undefined reference to `libnet_geterror' libsyslog-ng.a(afinet.o)(.text+0x96f):/tmp/syslog-ng-2.0.4/src/afinet.c:364: undefined reference to `libnet_clear_packet' libsyslog-ng.a(afinet.o)(.text+0x9b3):/tmp/syslog-ng-2.0.4/src/afinet.c:366: undefined reference to `libnet_build_udp' libsyslog-ng.a(afinet.o)(.text+0x9ef):/tmp/syslog-ng-2.0.4/src/afinet.c:377: undefined reference to `libnet_build_ipv4' libsyslog-ng.a(afinet.o)(.text+0xa58):/tmp/syslog-ng-2.0.4/src/afinet.c:426: undefined reference to `libnet_clear_packet' libsyslog-ng.a(afinet.o)(.text+0xa98):/tmp/syslog-ng-2.0.4/src/afinet.c:428: undefined reference to `libnet_build_udp' libsyslog-ng.a(afinet.o)(.text+0xab5):/tmp/syslog-ng-2.0.4/src/afinet.c:442: undefined reference to `libnet_toggle_checksum' libsyslog-ng.a(afinet.o)(.text+0xaf6):/tmp/syslog-ng-2.0.4/src/afinet.c:444: undefined reference to `libnet_build_ipv6' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-2.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/tmp/syslog-ng-2.0.4' make: *** [all] Error 2 ========================================= Attaching config.log too for your reference. Thanks And Regards, Tapas Mallick ____________________________________________________________________________________ Need a vacation? Get great deals to amazing places on Yahoo! Travel. http://travel.yahoo.com/

3 3

Logging loop
by bryanh＠giraffe-data.com 01 Jun '07

01 Jun '07

My syslog-ng got into an infinite loop when it didn't have permission to write to a file destination. It tried to log to that same destination the fact that it failed to log. Is there a recommended way to configure syslog-ng to avoid this? Maybe I could route messages from Syslog itself to some relatively reliable destination or just turn them off? If not, what would be a good enhancement to the program to avoid loops? I had the problem with syslog-ng 2.0.2. -- Bryan Henderson San Jose, California

4 5