August 2007 - syslog-ng - lists.balabit.hu

GLib version problem?
by Burns Andrew 15 Aug '07

15 Aug '07

Hello, I'm trying to install syslog-NG onto a Cent OS 5 server, and running into a problem. The problem appears to be more of a RedHat/Cent problem (or even Glib problem) rather than Syslog-NG problem, but I thought I'd check with the community before I harass Red Hat. I have the RPM verion of glib2.12 installed, however the libraries seemed to be labled 2.0.0. When I configure syslog-ng, I run across the following error: checking pkg-config is at least version 0.9.0... yes checking for GLIB... no configure: error: Cannot find GLib library version >= 2.2: is pkg-config in path? [root@syslog syslog-ng-2.0.5]# I have the rpm installed: [root@syslog syslog-ng-2.0.5]# yum list installed glib2 Loading "installonlyn" plugin Loading "fastestmirror" plugin Installed Packages glib2.i386 2.12.3-2.fc6 installed [root@syslog syslog-ng-2.0.5]# However the libraries seem to be mislabeled: [root@syslog syslog-ng-2.0.5]# locate glib | grep "/lib/libg" /lib/libglib-2.0.so.0 /lib/libglib-2.0.so.0.1200.3 [root@syslog syslog-ng-2.0.5]# Am I just missing something simple, or is this a problem I should be trying to speak to Cent/Red Hat about? Thanks! Andrew

3 2

valid HOSTNAME characters in syslog?
by dave 15 Aug '07

15 Aug '07

What is the source of information for syslog-ng to treat '@' a valid character in HOSTNAME field of syslog message? RFC 3164 refers to another RFC for the validity of HOSTNAME field. Syslog-ng's Syslog Relay treats '@' a valid HOSTNAME character while forwarding syslog. I am trying to find valid character set to be used in HOSTNAME field of syslog message. So that I would know when a Syslog Relay inserts a new HOSTNAME/IP in the syslog message to be forwarded. Appreciate any pointers. ____________________________________________________________________________________Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV. http://tv.yahoo.com/

4 9

Writing line by line
by Diluka Moratuwage 14 Aug '07

14 Aug '07

Hi, Can I configure the syslog-ng, so that, it writes only line by line. Now few lines at the same time. I mean, I wanna, write one line, and then another, not as a a bunch of lines. What I actually need to do, is reading one line, process it and do some things, and then listen to next line and so on. I highly appreciate if you can provide me information, on how to do this. Thanks Diluka.

2 2

Writing line by line in Syslog-ng
by Diluka Moratuwage 14 Aug '07

14 Aug '07

Hi, Can I configure the syslog-ng, so that, it writes only line by line. Now few lines at the same time. I mean, I wanna, write one line, and then another, not as a a bunch of lines. What I actually need to do, is reading one line, process it and do some things, and then listen to next line and so on. I highly appreciate if you can provide me information, on how to do this. Thanks Diluka.

2 2

how rewrite the HOST macro?
by mobidyc 13 Aug '07

13 Aug '07

Hello, i want to use syslog-ng to receive and log messages, the goal is to write log messages to: /appli/syslog-ng/logs/server0/messages but server0 can have multiples names: server0 server0e1 server0e2 server0g1 server0g2 server0gt1 etc... how can retrieve the name "server0" only ? Regards, Mobidyc

5 9

Problem when getting data from syslog-ng into a socket program
by Diluka Moratuwage 13 Aug '07

13 Aug '07

Hi, I have a little problem which I need to solve. I wrote a small program, which listens to the syslog-ng. I think I have encountered a problem with the timing I'm connecting and disconnecting to the syslog-ng. I almost always get the following msg with other msgs, <43>Aug 11 19:39:03 diluka-laptop syslog-ng[5084]: Connection broken; time_reopen='10' <43>Aug 11 19:39:13 diluka-laptop syslog-ng[5084]: EOF occurred while idle; fd='20' Please let me know whether following code snippet has anything irrelevent or unsuitable. while(1) { int len, read = 0; new_fd = accept(sockfd, (struct sockaddr *)&their_addr, &sin_size); while((len = recv (new_fd, buffer, BUFF_SIZE - 1, MSG_PEEK)) > 0) { read = recv(sockfd, buffer, BUFF_SIZE - 1, 0); buffer[read] = '\0'; printf(buffer); memset(buffer, '\0', BUFF_SIZE * sizeof(char)); break; } close(new_fd); new_fd = 0; } I highly appreciate if you can give some help for me to get the problem solved. Thanks, Diluka.

2 4

Binding error
by Diluka Moratuwage 13 Aug '07

13 Aug '07

Hi, When I'm trying to listen to a port, using syslog-ng the following error occurs. Can u pls help me to figure out the problem. > Starting system logging: syslog-ngError binding socket; addr='AF_INET(10.100.1.67:5000)', error='Cannot assign requested address (99)' Error initializing source driver; source='s_jabber_machine' start failed. < I highly appreciate if you can give me atleast a hint regarding this. Thanks, Diluka.

2 3

My server that listens to Syslog-ng
by Diluka Moratuwage 12 Aug '07

12 Aug '07

Hi, I wrote a program which listens to a port (5001), which the syslog-ng was configured to write to. Everything works fine, but sometimes I get msgs like, <43>Aug 11 19:39:03 diluka-laptop syslog-ng[5084]: Connection broken; time_reopen='10' <43>Aug 11 19:39:13 diluka-laptop syslog-ng[5084]: EOF occurred while idle; fd='20' Can anybody pls let me know what my mistake would be ??? Following is the code snippet shows how I read from the syslog-ng. I think there is a problem, in the way I read from the syslog-ng. Pls correct me, if I have missed any points. I really appreciate if you can provide me some help in getting through the problem. Thanks, Diluka.

1 1

Re: [syslog-ng] Routers don´t send syslog
by Maurice Manurung 11 Aug '07

11 Aug '07

Can you ping from other routers to the syslog-ng server and vice versa? Have you checked whether there is firewall or ACL in the router toward the syslog server? Warm Regards, Maurice Manurung http://www.flixya.com/referrer.php?ref=osmaniaindo ----- Original Message ---- From: Roberto Dud <roberto.dud(a)gmail.com> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Sent: Thursday, August 9, 2007 7:51:41 AM Subject: Re: [syslog-ng] Routers don´t send syslog Helo Mrs, Humm...maybe this is my problem. My syslog-ng server is behind a VLAN, the only Router with send syslog messages for the server is the same router with my syslog-ng is conected. Other routers, don´t send. I run tcpdump on the server and don´t get anyone messages, but in the routers everyhting is ok. Other equipments is ok, linux servers and switchs. Have any idea? Thanks, Dud. On 8/8/07, John Hala < john.hala(a)villanova.edu> wrote:I had a similar issue where my Management VLAN was blackholing the messages and it was never getting to the syslog server. I don't know your setup, but I had to blow away this Management VLAN. regards -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu ] On Behalf Of Werner Thal Sent: Wednesday, August 08, 2007 4:33 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Routers don´t send syslog Hallo Roberto, my Router-Config looks similar to yours, so I think this will be correct. So did you check if the router-messages reach your syslog-ng server? If not, just use a sniffer like ethereal/wireshark for that. regards Werner Am Mittwoch, 8. August 2007 05:08 schrieb Roberto Dud: > Mrs, > > I have a lot of Routers configured to send logs to syslog-ng, but isn´t > work. Only 1 router send ok, others 10 not ok. > > My configuration on routers is the same: > > service timestamps debug datetime msec localtime show-timezone > service timestamps log datetime msec localtime show-timezone > > logging <my ip> > logging buffered 10000 debugging > logging trap debugging > > I check with command : > > show logging > > And it´s ok, for me. > > Anyone have a problema with routers? > > Thanks, > > Dud. > -- ___________________________________________________________________________ A Linux-Server is like a tent: no windows, no gates and an apache inside... _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 3

Syslog-ng" daemon killing the "setroubleshoot" daemon on RHEL5_X86_64
by Shamim 10 Aug '07

10 Aug '07

Hi , When there was no daemon of "syslog-ng" was running ******************************************************************** [root@svllgg181 tmp]# ps -eaf |grep -i syslog-ng root 2631 2597 0 10:58 pts/0 00:00:00 grep -i syslog-ng [root@svllgg181 tmp]# ********************************************************************* in the absence of "syslog-ng" daemon I was easily able to restart the "setroubleshootd" daemon [root@svllgg181 tmp]# /etc/init.d/setroubleshoot restart Stopping setroubleshootd: [ OK ] Starting setroubleshootd: [ OK ] [root@svllgg181 tmp]# ******************************************************************************************* Now I started the "syslog-ng" daemon [root@svllgg181 tmp]# ps -eaf |grep -i syslog-ng root 2718 1 0 10:59 ? 00:00:00 syslog-ng root 2746 2597 0 11:00 pts/0 00:00:00 grep -i syslog-ng [root@svllgg181 tmp]# ***************************************************************************************** And I tried to start the "setroubleshoot", now it gives error. [root@svllgg181 tmp]# /etc/init.d/setroubleshoot restart Stopping setroubleshootd: [ OK ] Starting setroubleshootd: [ OK ] [root@svllgg181 tmp]# Traceback (most recent call last): File "/usr/sbin/setroubleshootd", line 59, in ? from setroubleshoot.config import cfg File "/usr/lib/python2.4/site-packages/setroubleshoot/__init__.py", line 24, in ? log_init(sys.argv[0]) File "/usr/lib/python2.4/site-packages/setroubleshoot/log.py", line 127, in log_init syslog = logging.handlers.SysLogHandler(address='/dev/log') File "/usr/lib64/python2.4/logging/handlers.py", line 602, in __init__ self._connect_unixsocket(address) File "/usr/lib64/python2.4/logging/handlers.py", line 617, in _connect_unixsocket self.socket.connect(address) File "<string>", line 1, in connect socket.error: (13, 'Permission denied') [root@svllgg181 tmp]# [root@svllgg181 tmp]# /etc/init.d/setroubleshoot restart Stopping setroubleshootd: [FAILED] Starting setroubleshootd: [ OK ] [root@svllgg181 tmp]# Traceback (most recent call last): File "/usr/sbin/setroubleshootd", line 59, in ? from setroubleshoot.config import cfg File "/usr/lib/python2.4/site-packages/setroubleshoot/__init__.py", line 24, in ? log_init(sys.argv[0]) File "/usr/lib/python2.4/site-packages/setroubleshoot/log.py", line 127, in log_init syslog = logging.handlers.SysLogHandler(address='/dev/log') File "/usr/lib64/python2.4/logging/handlers.py", line 602, in __init__ self._connect_unixsocket(address) File "/usr/lib64/python2.4/logging/handlers.py", line 617, in _connect_unixsocket self.socket.connect(address) File "<string>", line 1, in connect socket.error: (13, 'Permission denied') Note: "Syslog-ng" daemon killing the "setroubleshoot" daemon. Can anyone please suggest me the cause and any work around. I'm using syslog-ng-2.0.2 release. Thanks in advance Shamim, --------------------------------- Yahoo! Mail is the world's favourite email. Don't settle for less, sign up for your freeaccount today.

3 5