July 2007 - syslog-ng - lists.balabit.hu

syslog-ng 2.0.4 hang
by Geller, Sandor (IT) 18 Jul '07

18 Jul '07

Hi, I've encountered a strange problem. I'm using syslog-ng 2.0.4 with a fairly basic setup, and syslog-ng hangs when it is reading from /proc/kmsg, but only right after boot and only on one of my machines, which is a RHEL AS3 machine. It is reproducible, the host hangs on every boot as every process which tries to write to /dev/log gets blocked. Has anyone seen such behaviour? I've ran syslog-ng under strace, so I can send debug data in private. Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.

4 9

organizig multiple events from one server
by Gustavo Soares 18 Jul '07

18 Jul '07

Hi!! I hope anyone can help me... I would like know how can I organize multiple events coming from differents application servers instances installed on just one physical server. Each instance is binding a different ip address. I´ve set up syslog to create a dir with the host name, but the events arrive with the same ip and not the ip address, which the app is binding and because of that sometimes I can´t distinguish which message belongs to a specific instance. Maybe I could use differents facilitys to try to organize things better, but then people would have to know which facility corresponds to which application. The events are sent using log4j (syslog appender). I hope, I´ve made myself clear... Cheers, Gustavo

2 2

syslog-ng-2.0.4 compilation error
by Ganesh Kundapur 18 Jul '07

18 Jul '07

gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/home/kundapur/GLIB-2.12.9/lib -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamic libsyslog-ng.a(misc.o)(.text+0x3a9): In function `resolve_hostname': /home/kundapur/suma/syslog-ng-2.0.4/src/misc.c:191: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format': /home/kundapur/suma/syslog-ng-2.0.4/src/logmsg.c:110: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x2b6): In function `log_msg_ref': /home/kundapur/suma/syslog-ng-2.0.4/src/logmsg.c:498: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x342): In function `log_msg_unref': /home/kundapur/suma/syslog-ng-2.0.4/src/logmsg.c:512: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xe36): In function `log_msg_ack_block_end': /home/kundapur/suma/syslog-ng-2.0.4/src/logmsg.c:648: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref': /home/kundapur/suma/syslog-ng-2.0.4/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref': /home/kundapur/suma/syslog-ng-2.0.4/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free': /home/kundapur/suma/syslog-ng-2.0.4/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new': /home/kundapur/suma/syslog-ng-2.0.4/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x2de): In function `log_template_ref': /home/kundapur/suma/syslog-ng-2.0.4/src/templates.c:180: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x346):/home/kundapur/suma/syslog-ng-2.0.4/src/templates.c:191: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/home/kundapur/suma/syslog-ng-2.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/kundapur/suma/syslog-ng-2.0.4' make: *** [all] Error 2 I installed glib-2.12.9. -- $ cat glib.c # include <glib.h> int main ( void ) { printf ( "glib version = %d.%d.%d\n", glib_major_version, glib_minor_version, glib_micro_version ); return 0; } $ cc glib.c `pkg-config --cflags --libs glib-2.0` $ a.out glib version = 2.12.9 -- Still I'm getting these messages. Any idea about this? Thanks, Ganesh

6 7

(no subject)
by patrick simon 18 Jul '07

18 Jul '07

> stopped by renaming? Sounds problematic, stop it explicitly, and make > sure it > won't get restarted. Renaming/ removing symlinks under /etc/rc*.d on > Debian is > strongly discouraged. use update-rc.d for this task, first remove the > existing > links, and then recreate them as K... ones. Otherwise the next package > upgrade > might reenable the daemon. > I recreate them as K... ones now, and syslog-ng give me the same Error Message. I tried to stop them with rcconf, it say they will be not started, but syslog-ng can't start > You might also want to try removing the default syslog package. On > Ubuntu this is done with: > sudo apt-get remove sysklogd > I removed it just after installing syslog-ng, so i don't know what is the problem. Why syslog-ng don't start? I think maybe I configured something wrong, but i can't they what... thank you for your answers Patrick

4 5

RE: [syslog-ng] syslog-ng not start
by patrick simon 17 Jul '07

17 Jul '07

Sorry for sending a mail two times but I've forgotten the Mail-Subject. I hope thats ok? > > stopped by renaming? Sounds problematic, stop it explicitly, and make > > sure it > won't get restarted. Renaming/ removing symlinks under /etc/rc*.d on > Debian is > strongly discouraged. use update-rc.d for this task, first remove the > existing > links, and then recreate them as K... ones. Otherwise the next package > upgrade > might reenable the daemon. > I recreate them as K... ones now, and syslog-ng give me the same Error Message. I tried to stop them with rcconf, it say they will be not started, but syslog-ng can't start > > > You might also want to try removing the default syslog package. On > Ubuntu this is done with: > sudo apt-get remove sysklogd > I removed it just after installing syslog-ng, so i don't know what is the problem. > Why syslog-ng don't start? > I think maybe I configured something wrong, but i can't they what... > thank you for your answers > Patrick

1 0

problem with filter behavior in 2.0.4
by aero1967＠fastmail.fm 17 Jul '07

17 Jul '07

I'm seeing some results with filtering that I don't expect / understand. I have the following statements in syslog-ng.conf (I am just giving the relevant configuration lines): source src { unix-stream("/dev/log"); internal(); file("/proc/kmsg"); }; filter kern { facility(kern); }; filter kern_critical { filter(kern) and priority(emerg .. err); }; filter critical { filter(kern_critical) or match("crit*") or priority(emerg .. crit); }; template verbose_msg_fmt { template("$FULLDATE $FACILITY.$PRIORITY $MSG\n"); template_escape(no); }; destination root_tty { usertty("root"); }; destination critical_logfile { file("/var/log/critical.log" template(verbose_msg_fmt)); }; log { source(src); filter(critical); destination(root_tty); destination(critical_logfile); }; There are no other configuration lines which reference the critical_logfile destination , and no destination has a "final" flag. Now, when I check /var/log/critical.log, I get messages from the facility.priority combination of daemon.warning that do not contain any string starting with "crit". I also get messages from daemon.err, which also shouldn't match the filter. For example: 2007 Jul 12 10:51:07 daemon.warning <message, not containing the string crit anywhere> 2007 Jul 11 20:33:57 daemon.err <message, not containing the string crit anywhere> IIRC, I was using these same lines in a syslog-ng 1.6.x installation without these kinds of results. Also, a question: does it matter if the priority range is given in ascending or descending order (syslog's numerical code-wise)? Thanks for any insight. -- aero1967(a)fastmail.fm -- http://www.fastmail.fm - IMAP accessible web-mail

7 10

syslog-ng not start
by patrick simon 17 Jul '07

17 Jul '07

Hello list, I got a problem with starting syslog-ng on my Debian Etch Vserver. When I try to start it, it give me the following Error-Message: lutz@31:~$ sudo /etc/init.d/syslog-ng start Password: Starting system logging: syslog-ngError opening file for reading; filename='/proc/kmsg', error='Operation not permitted (1)' Error initializing source driver; source='s_all' start failed. I checked the file-permissions from /proc/kmsg: lutz@31:~$ ls -al /proc | grep kmsg -r-------- 1 root root 0 May 8 18:08 kmsg I installed syslog-ng with apt-get install syslog-ng, but I couldn't start it correctly, yet. I posted my config here: http://nopaste.com/p/aVl1HOXXj It is the Standard syslog-ng config the old syslog daemon i stopped by renaming in /etc/rc2.d - /etc/rc5.d I ask Google now for 2 Days, but I can't locate the Problem I hope you can help me ? sorry, my English is not the best thanks, Patrick

3 2

year field in the log messages
by Ganesh Kundapur 17 Jul '07

17 Jul '07

Hi, Please let me know how to get the year field also in the syslog messages. Regards, Ganesh

1 0

syslog-ng cross compile error
by Bujor, Sorin 16 Jul '07

16 Jul '07

Hi, I am trying to cross compile syslog-ng for a box running MontaVista on an ARM CPU . When I type ./configure -host=arm I get an error. (please see below) checking for EVTLOG... yes checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib Any advice, Thanks

1 0

Log a directory
by Nicolas de Marqué - Fromentin 16 Jul '07

16 Jul '07

Hello, I must log files in a directory The rules are : - this files are created with a name that i must to redirect to syslog-ng. - i must redirect a file just after his creation Do you know a solution that can that can resolve this problem. With searchs i have a idea with xtails but if a standard exist with this problem i prfer use it. Thanks for your answers. Nicolas de Marqué

2 3