October 2008 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] filter on src ip address.
by Esben Laursen 29 Oct '08

29 Oct '08

> -----Oprindelig meddelelse----- > Fra: Leonard Mills [mailto:lenm@ops.corpnet.sel.sony.com] > Sendt: 28. oktober 2008 22:24 > Til: Esben Laursen > Emne: Re: [syslog-ng] filter on src ip address. > > Esben wrote: > >Now the next question is, can I have the syslog-ng accept everyting, but > >"auto" generate a new file for each different source addresses? > > Sure, you can use $HOST as a part of the path. Something like: > > destination cacheflow { file("/c1/logs/$HOST/cacheflow.log" > template("$DATE $HOST $PROGRAM: [$FACILITY.$PRIORITY] $MSG\n")); }; > > (all one line) works just fine. Hmm, looks pretty easy.. So the $HOST is the "remote" source host and not "localhost" right? Where did you find the variable list? It was not in the man 5 syslog-ng.conf file.. Cheers Esben

2 1

Re: [syslog-ng] filter on src ip address.
by Esben Laursen 28 Oct '08

28 Oct '08

Hi Leo, Thanks for your quick reply.. Im looking at it, but it does not seem to make much sense to me.. Am I correct to assume that destination is a sort of container for what goes where? I extracted this from my Debian syslog-ng install source s_all { # message generated by Syslog-NG internal(); # standard Linux log source (this is the default place for the syslog() # function to send logs to) unix-stream("/dev/log"); # messages from the kernel file("/proc/kmsg" log_prefix("kernel: ")); # use the following line if you want to receive remote UDP logging messages # (this is equivalent to the "-r" syslogd flag) # udp(); }; ###### # destinations # some standard log files destination df_auth { file("/var/log/auth.log"); }; # auth,authpriv.* /var/log/auth.log log { source(s_all); filter(f_auth); destination(df_auth); }; So, I could do something like: Source MyAppliance { udp(<src IP>) }; Destination MyAppliance_log { file("/var/log/MyAppliance"); }; Log { Source(MyAppliance); Destination(MyAppliance_log); }; Does that make sense? Now the next question is, can I have the syslog-ng accept everyting, but "auto" generate a new file for each different source addresses? Cheers Esben > -----Oprindelig meddelelse----- > Fra: Leonard Mills [mailto:lenm@ops.corpnet.sel.sony.com] > Sendt: 28. oktober 2008 21:53 > Til: Esben Laursen > Emne: Re: [syslog-ng] filter on src ip address. > > You should probably start with: > > man syslog-ng.conf > > Pay particular attention to the section "DESTINATIONS" > What you want to do is _very_ easy with NG. > > Len > > On Tue, 28 Oct 2008, Esben Laursen wrote: > > > Hi Guys, > > > > I've been looking at syslog-ng's website, but cannot seem to find the > correct info. > > > > I need to have a syslog server that gather logs from different > appliances devices. Currently I just a regular syslogd, the problem is > that I need to have every appliance in a different file, and that does > syslogd not support. > > > > I've looked at the webpage for it appear that syslog-ng support this, I > look at the feature list, it says something like this: > > > > Filtering for sending IP address, check for syslog-ng. > > > > However I have no idea how to configure it or if I misunderstood the > meaning of the feature list. > > > > Could someone please point me in the correct direction? > > > > Cheers > > > > Esben > > > > > __________________________________________________________________________ > ____ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > > > >

1 0

Kevin Gorski/IS/NEU is out of the office.
by K.Gorski＠neu.edu 28 Oct '08

28 Oct '08

I will be out of the office starting 10/28/2008 and will not return until 10/30/2008. I will respond to your message when I return Thursday morning.

1 0

filter on src ip address.
by Esben Laursen 28 Oct '08

28 Oct '08

Hi Guys, I've been looking at syslog-ng's website, but cannot seem to find the correct info. I need to have a syslog server that gather logs from different appliances devices. Currently I just a regular syslogd, the problem is that I need to have every appliance in a different file, and that does syslogd not support. I've looked at the webpage for it appear that syslog-ng support this, I look at the feature list, it says something like this: Filtering for sending IP address, check for syslog-ng. However I have no idea how to configure it or if I misunderstood the meaning of the feature list. Could someone please point me in the correct direction? Cheers Esben

1 0

Re: [syslog-ng] Reload does not free up RAM
by Evan Rempel 27 Oct '08

27 Oct '08

Evan Rempel wrote: > Balazs Scheidler wrote: >> On Mon, 2008-10-06 at 11:38 -0700, Evan Rempel wrote: >>> Balazs Scheidler wrote: >>>> On Sun, 2008-10-05 at 13:49 -0700, Evan Rempel wrote: >>>>> Balazs Scheidler wrote: >>>>>>>>>>> We have cases where a syslog-ng buffers quite a bit of data (2GB or so) before >>>>>>>>>>> it is able to flush the data to the destination. Currently, the only way to "free up" that RAM >>>>>>>>>>> is to restart syslog-ng, which means that some log messages are lost during the restart >>>>>>>>>>> window. >>>>>> Both PE and OSE frees up disk/memory when possible. If they don't, then >>>>>> that's probably a leak. >>> No, it isn't a memory leak as the process can be months old and only grows when >>> it buffers messages. >>> >>>>>> So if your syslog-ng process is 2GB in size, and you didn't specify an >>>>>> overly large log_fifo_size(), it's probably because of a leak. >>> >> >>>>> I have a large log_fifo_size() but the process starts small, grows when it needs >>>>> to buffer, and does NOT get small again when the destination is available. >>>> Hmm... that might be related to the malloc implementation. Which >>>> platform are you using? >>>> >>>>>>> 2. The buffer space should be thrown away only after the message >>>>>>> has been delivered to the destination. >>>>>> I see, this is what should happen now. >>> >> >>>>> This does not appear to be happening. >>>>> I am using OSE 2.0.8 Have there been memory fixes/changes since then? >>>> Not that I know of. >>>> >>>>> Is there a way to get buffer count statistics out? How many messages are >>>>> in each fifo buffer? >>>> In the experimental 3.0 branch, yes there is. In current 2.0, I'm afraid >>>> there's none. >>>> >>>> Is there a limit on the growth of syslog-ng? I mean if it gets large >>>> once and then empties its buffers, it stays large, but does it start >>>> growing again, or it stays steadily at the size it was before? >>> I have not specifically tested this scenario, but we do track processes >>> and memory usage, and it appears that once the space is allocated, it does >>> not grow unless a larger set of messages gets buffered. >>> >>> >>>> Again, the platform matters a lot, how the local malloc implementation >>>> takes care about fragmentation, whether it shrinks the process once >>>> memory is freed. >>> This is running on Redhat AS 3 (2.4 kernel) and Redhat AS 4 (2.6 kernel) >>> >>> On the Redhat 4 system the glibc packages installed are >>> >>> glibc-common-2.3.4-2.36 >>> glibc-devel-2.3.4-2.36 >>> glibc-headers-2.3.4-2.36 >>> glib2-2.4.7-1 >>> glibc-kernheaders-2.4-9.1.100.EL >>> >> hmm.. this version should be all right, at least in my experience glibc >> tries to release memory back to the system once the application freed it >> using free(). >> >> Maybe it is some kind of memory fragmentation issue. How easy is this to >> reproduce? Does it require months of running, or you have a simple >> recipe to create it? > > We are encountering this fairly easily in production, so I should be able to > verify a recipe. It will take me a couple of days to "get to it", but will report back. I thought that this deserved some attention... make a destination destination erempel { pipe("/var/log/syslog.pipes/erempel" log_fifo_size(1000000) perm(0666) ); }; and set up some logging to it. I directed only *.debug stuff to mine. filter f_debug { priority(debug); }; log { source(local); filter(f_debug); destination(erempel); flags(final); }; Start a "tail -f /var/log/syslog.pipes/erempel" and then generate some logs ls -1 /usr/bin | logger -p user.debug and I see the stuff pop out from the "tail -f" Cancel the tail process and product a whole bunch more logs. ls -1 /usr/bin | logger -p user.debug repeatedly while watching the size of the syslog process. Tue Oct 7 08:56:09 PDT 2008 root 23265 1.7 0.1 4004 1396 ? Ss 08:53 0:02 /usr/local/sbin/syslog-ng Tue Oct 7 08:56:14 PDT 2008 root 23265 1.7 0.1 4004 1412 ? Ss 08:53 0:02 /usr/local/sbin/syslog-ng Tue Oct 7 08:56:19 PDT 2008 root 23265 1.7 0.1 4004 1412 ? Ss 08:53 0:02 /usr/local/sbin/syslog-ng Tue Oct 7 08:56:24 PDT 2008 root 23265 2.5 1.2 15524 12840 ? Ss 08:53 0:04 /usr/local/sbin/syslog-ng Tue Oct 7 08:56:29 PDT 2008 root 23265 3.6 3.1 35384 32668 ? Ss 08:53 0:06 /usr/local/sbin/syslog-ng Tue Oct 7 08:56:34 PDT 2008 root 23265 4.7 5.1 55904 53264 ? Ss 08:53 0:08 /usr/local/sbin/syslog-ng Tue Oct 7 08:56:40 PDT 2008 root 23265 5.7 7.0 75724 73100 ? Ss 08:53 0:10 /usr/local/sbin/syslog-ng Tue Oct 7 08:56:45 PDT 2008 root 23265 5.6 7.1 76504 73864 ? Ss 08:53 0:10 /usr/local/sbin/syslog-ng Tue Oct 7 08:56:50 PDT 2008 root 23265 6.8 7.1 76504 73864 ? Ss 08:53 0:13 /usr/local/sbin/syslog-ng Tue Oct 7 08:56:55 PDT 2008 root 23265 6.6 7.1 76504 73864 ? Ss 08:53 0:13 /usr/local/sbin/syslog-ng The intent is to start the "rail -f" again to read all of the records and see if the memory gets smaller, but when I start the tail -f again, I get NOTHING. Syslog-ng seems to have closed the pipe destination and is NOT reopening it. Fortunately, the author produced a HUP signal that will cause all outputs to be closed and opened again. So, I do a HUP, and only the LAST 10 records are displayed. Where did all of the other records go? If I do ls -1 /usr/bin | logger -p user.debug I see the full list from the "tail -f" Back to memory. The memory never gets smaller. Now I am beginning to thing that the records got orphaned inside of syslog-ng such that they never made it to the destination, and as such are never candidates for memory reclaiming. I think I have stumbled on a bug for record loss, and I would like to state again that ALL destinations should follow the time_reopen() setting. -- Evan Rempel

3 2

syslog-ng takes 100% CPU when network fails
by D S, Manu (STSD) 26 Oct '08

26 Oct '08

Hi, We are running syslog-ng 2.0.9 on a HP-UX 11.31 server. We have configured this system as a client to forward logs to a remote server. When there is a network failure ( simulated by ifconfig down ) syslog-ng starts to consume CPU and even after the network comes back, it does not forward any log messages and continues to hog CPU. We did system call tracing using tusc and found that "poll()" gets "POLLERR" event from TCP socket descriptor, but syslog-ng does not call any socket calls for the TCP, only calls "gettimeofday()". In the logs given, TCP connection to server is disconnected at 13:10:30. From that time, poll() receives POLLERR on the TCP socket (fd=6) and starts loop on gettimeofday(). Attached are the sar, netstat and tusc logs. Thanks, Manu

2 1

syslog-ng and multiple interfaces
by brandon askme 24 Oct '08

24 Oct '08

Hello- I have successfully moved all of our servers over to syslog-ng. All but a few are reporting to the remote "logging" server I have setup. What I have found is that the clients that are not reporting have multiple interfaces, IE eth0, eth0:1, eth1 etc.. Thus the current firewall rules are not setup to allow all the ips. So my question is, can I configure syslog-ng to only use a certain ip/interface when sending the logs to the remote logging server? The clients and the remote logging server are running Linux. Thanks -Brandon

3 2

Re: [syslog-ng] Encoding provlem when writing to postgres
by ml＠bortal.de 24 Oct '08

24 Oct '08

Hi, > The nightly snapshot went to the 2.1 directory, but now I've changed > that. Tomorrow the 3.0 sources should appear in the nightly snapshot > directory: > > http://www.balabit.com/downloads/files/syslog-ng/sources/3.0/src-snapshot i am getting the following error: -------------------------------------------- make[1]: Leaving directory `/usr/local/src/syslog-ng-2.9.0+20081017' syslog-db:/usr/local/src/syslog-ng-2.9.0+20081017# make make all-recursive make[1]: Entering directory `/usr/local/src/syslog-ng-2.9.0+20081017' Making all in src make[2]: Entering directory `/usr/local/src/syslog-ng-2.9.0+20081017/src' if gcc -DHAVE_CONFIG_H -I. -I. -I.. -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT afsql.o -MD -MP -MF ".deps/afsql.Tpo" -c -o afsql.o afsql.c; \ then mv -f ".deps/afsql.Tpo" ".deps/afsql.Po"; else rm -f ".deps/afsql.Tpo"; exit 1; fi afsql.c: In function afsql_dd_init: afsql.c:713: error: server_mode undeclared (first use in this function) afsql.c:713: error: (Each undeclared identifier is reported only once afsql.c:713: error: for each function it appears in.) afsql.c:738: error: too many arguments to function log_queue_new afsql.c:741: warning: implicit declaration of function log_queue_restore_queue afsql.c:746: warning: implicit declaration of function log_queue_get_filename afsql.c:746: warning: passing argument 2 of evt_tag_str makes pointer from integer without a cast afsql.c: In function afsql_dd_deinit: afsql.c:849: warning: implicit declaration of function log_queue_save_queue make[2]: *** [afsql.o] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-2.9.0+20081017/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-2.9.0+20081017' make: *** [all] Error 2 Any hint? Thanks, Mario

2 2

Who use syslog-ng for Solaris 10
by Shlayen, Yakov (CAT) 23 Oct '08

23 Oct '08

Hello, Please, let me know who use syslog-ng2.1.1OSE for Solaris 10 and reside in Atlanta or east coast of US. I'll be very appreciate if somebody contact with me. Best regards, Yakov (Jake) Shlayen Unix System Administrator Cox AutoTrader/AutoMart 5909 Peachtree Dunwoody Road Atlanta, GA 30328 Email:yakov.shlayen@autotraderpub.com Phone: 678-645-8227 Mobile: 678-481-3219

1 0

Re: [syslog-ng] UPDATE: sysutils/syslog-ng
by Brian A. Seklecki 17 Oct '08

17 Oct '08

Damnit! I've been waiting for my 4.4 CDs since July/August and you beat me to the update by 8 days. :) I did mine as a new port, based on the old one, as some people may want to run the 1.6.x bitrot version. http://people.collaborativefusion.com/~seklecki/openbsd44_port_syslog-ng209… # syslog-ng -V syslog-ng 2.0.9 # uname -a OpenBSD cauldron-obsd-44stable-i386 4.4 GENERIC.MP#844 i386 Lets get this bad boy tested and updated before 4.5 is released! ~BAS # tar cvf openbsd44_port_syslogng209_etlog027.tar eventlog/ syslog-ng2/ eventlog eventlog/Makefile eventlog/distinfo eventlog/pkg eventlog/pkg/DESCR eventlog/pkg/PLIST eventlog/pkg/PFRAG.shared syslog-ng2 syslog-ng2/CVS syslog-ng2/CVS/Repository syslog-ng2/CVS/Entries syslog-ng2/CVS/Tag syslog-ng2/pkg syslog-ng2/pkg/CVS syslog-ng2/pkg/CVS/Repository syslog-ng2/pkg/CVS/Entries syslog-ng2/pkg/CVS/Tag syslog-ng2/pkg/DESCR syslog-ng2/pkg/PLIST syslog-ng2/pkg/PLIST.orig syslog-ng2/pkg/MESSAGE syslog-ng2/Makefile syslog-ng2/distinfo syslog-ng2/files syslog-ng2/files/syslog-ng.conf syslog-ng2/patches syslog-ng2/patches/patch-tests_loggen_loggen_c # tar tzvf /usr/ports/packages/i386/all/syslog-ng-2.0.9.tgz -r--r--r-- 1 root wheel 721 Oct 16 11:46 +CONTENTS -r--r--r-- 1 root wheel 568 Oct 16 11:46 +DESC -r--r--r-- 1 root wheel 216 Oct 16 11:46 +DISPLAY -r--r--r-- 1 root bin 5899 Oct 16 11:46 man/man5/syslog-ng.conf.5 -r--r--r-- 1 root bin 3268 Oct 16 11:46 man/man8/syslog-ng.8 -r-xr-xr-x 1 root bin 1277148 Oct 16 11:46 sbin/syslog-ng -r--r--r-- 1 root bin 8837 Oct 16 11:46 share/examples/syslog-ng.conf -r-xr-xr-x 1 root bin 10948 Oct 16 11:46 bin/loggen # make install ===> Verifying specs: glib-2.0 c glib-2.0 ===> found glib-2.0.1600.2 c.48.0 ===> Installing syslog-ng-2.0.9 from /usr/ports/packages/i386/all/ syslog-ng-2.0.9: complete --- syslog-ng-2.0.9 ------------------- Add the following to rc.local(8): if [ -x /usr/local/sbin/syslog-ng -a -f /etc/syslog-ng.conf ]; then /usr/local/sbin/syslog-ng echo "syslog-ng2" fi Thanks for shopping balabit.hu and company. On Wed, 2008-10-08 at 21:34 +0200, Steven Mestdagh wrote: > this requires the new sysutils/eventlog port sent earlier. > > please test/comment/ok. > > Index: Makefile > =================================================================== > RCS file: /cvs/ports/sysutils/syslog-ng/Makefile,v > retrieving revision 1.8 > diff -u -r1.8 Makefile > --- Makefile 6 Oct 2008 16:09:13 -0000 1.8 > +++ Makefile 8 Oct 2008 19:29:28 -0000 > @@ -2,50 +2,39 @@ > > COMMENT= syslogd replacement > > +DISTNAME= syslog-ng-2.1.1 > CATEGORIES= sysutils > > -DISTNAME= syslog-ng-1.6.8 > -LIBOL= libol-0.3.16 > +MAINTAINER= Steven Mestdagh <steven(a)openbsd.org> > > -MAINTAINER= Jakob Schlyter <jakob(a)openbsd.org> > +HOMEPAGE = http://www.balabit.com/network-security/syslog-ng/ > > -MASTER_SITE_SYSLOGNG=\ > - http://www.balabit.com/downloads/files/syslog-ng/sources/ > +# GPL v2 > +PERMIT_PACKAGE_CDROM = Yes > +PERMIT_PACKAGE_FTP = Yes > +PERMIT_DISTFILES_CDROM = Yes > +PERMIT_DISTFILES_FTP = Yes > > -MASTER_SITES= ${MASTER_SITE_SYSLOGNG:=1.6/src/} > -MASTER_SITES0= ${MASTER_SITE_SYSLOGNG:=libol/0.3/} > +MASTER_SITES = http://www.balabit.com/downloads/files/syslog-ng/sources/2.1/src/ > > -HOMEPAGE= http://www.balabit.com/products/syslog_ng/ > +WANTLIB = c iconv intl wrap > > -DISTFILES= ${DISTNAME}.tar.gz \ > - ${LIBOL}.tar.gz:0 > +LIB_DEPENDS = glib-2.0::devel/glib2 \ > + evtlog::sysutils/eventlog > > -# GPL > -PERMIT_PACKAGE_CDROM= Yes > -PERMIT_PACKAGE_FTP= Yes > -PERMIT_DISTFILES_CDROM= Yes > -PERMIT_DISTFILES_FTP= Yes > -WANTLIB= c > +CONFIGURE_STYLE = gnu > +CONFIGURE_ARGS += --enable-tcp-wrapper > > -CONFIGURE_STYLE= gnu > -CONFIGURE_ARGS+= --with-libol=${WRKDIR}/${LIBOL} \ > - --enable-tcp-wrapper > +DOC = ${PREFIX}/share/doc/syslog-ng/ > +EXAMPLES = ${PREFIX}/share/examples/syslog-ng/ > > -DOC= ${PREFIX}/share/doc/syslog-ng > -EXAMPLES= ${PREFIX}/share/examples/syslog-ng > - > -pre-configure: > - cp -f ${PORTSDIR}/infrastructure/db/config.guess \ > - ${PORTSDIR}/infrastructure/db/config.sub ${WRKDIR}/${LIBOL} > - cd ${WRKDIR}/${LIBOL}; ./configure ; ${MAKE} > +post-extract: > + tar -C ${WRKBUILD} -xzf ${WRKSRC}/doc/reference/syslog-ng.html.tar.gz > > post-install: > ${INSTALL_DATA_DIR} ${DOC} > - ${INSTALL_DATA} ${WRKSRC}/doc/sgml/*.{ps,sgml,txt} ${DOC} > - (cd ${DOC} ;\ > - tar xzf ${WRKSRC}/doc/sgml/syslog-ng.html.tar.gz ;\ > - ln -s book1.html syslog-ng.html/index.html ) > + ${INSTALL_DATA} ${WRKBUILD}/syslog-ng.html/index.html ${DOC} > ${INSTALL_DATA_DIR} ${EXAMPLES} > - ${INSTALL_DATA} ${WRKSRC}/doc/syslog-ng.conf.sample ${EXAMPLES} > + ${INSTALL_DATA} ${WRKSRC}/doc/examples/syslog-ng.conf.sample ${EXAMPLES} > > .include <bsd.port.mk> > Index: distinfo > =================================================================== > RCS file: /cvs/ports/sysutils/syslog-ng/distinfo,v > retrieving revision 1.7 > diff -u -r1.7 distinfo > --- distinfo 5 Apr 2007 17:26:13 -0000 1.7 > +++ distinfo 8 Oct 2008 19:29:28 -0000 > @@ -1,10 +1,5 @@ > -MD5 (libol-0.3.16.tar.gz) = Hym+P0vN21svPZZeePBABg== > -MD5 (syslog-ng-1.6.8.tar.gz) = /7rX6ObcvjhYILj/uiO2Ig== > -RMD160 (libol-0.3.16.tar.gz) = ts8Hi0sH/EyHm/SicZpto+lvT8Y= > -RMD160 (syslog-ng-1.6.8.tar.gz) = EcZ5miRCaYao/ZdDxjQH4ums+mc= > -SHA1 (libol-0.3.16.tar.gz) = bW4e+U2Lbdnd2OkkUMXky54wGIo= > -SHA1 (syslog-ng-1.6.8.tar.gz) = cIEq8c7jIXlwlcryoK32CvyBpwA= > -SHA256 (libol-0.3.16.tar.gz) = aL69o59D/V+hO0ARqRxAsmhP4mKvKkCeKC99mn0o7J4= > -SHA256 (syslog-ng-1.6.8.tar.gz) = PIQf2JWZ/7dwzfKERCaYDXXcPasS4PcH5Mu1GTf2El4= > -SIZE (libol-0.3.16.tar.gz) = 345231 > -SIZE (syslog-ng-1.6.8.tar.gz) = 383589 > +MD5 (syslog-ng-2.1.1.tar.gz) = f/7jARSKZ41cGLGRDLe+HQ== > +RMD160 (syslog-ng-2.1.1.tar.gz) = H/iIJPTV1D3CxjmK6Am8tKas8As= > +SHA1 (syslog-ng-2.1.1.tar.gz) = EeX7CzsrnxzgJlGXVVCcMkz0orQ= > +SHA256 (syslog-ng-2.1.1.tar.gz) = is0YN/wS8OZfns/7jFU794OjUGKKzKPCkyvy9FCfpIU= > +SIZE (syslog-ng-2.1.1.tar.gz) = 420883 > Index: patches/patch-Makefile_in > =================================================================== > RCS file: patches/patch-Makefile_in > diff -N patches/patch-Makefile_in > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-Makefile_in 8 Oct 2008 19:29:28 -0000 > @@ -0,0 +1,12 @@ > +$OpenBSD$ > +--- Makefile.in.orig Mon Oct 6 19:27:00 2008 > ++++ Makefile.in Mon Oct 6 19:27:05 2008 > +@@ -132,7 +132,7 @@ sbindir = @sbindir@ > + sharedstatedir = @sharedstatedir@ > + sysconfdir = @sysconfdir@ > + target_alias = @target_alias@ > +-SUBDIRS = src tests doc contrib solbuild tgzbuild > ++SUBDIRS = src doc contrib solbuild tgzbuild > + > + EXTRA_DIST = debian/README.Debian debian/copyright debian/syslog-ng.conf.example debian/syslog-ng.files debian/syslog-ng.logrotate debian/syslog-ng.postrm \ > + debian/changelog debian/changelog.in debian/rules debian/syslog-ng.default debian/syslog-ng.init debian/syslog-ng.logrotate.example debian/syslog-ng.preinst \ > Index: patches/patch-src_Makefile_in > =================================================================== > RCS file: patches/patch-src_Makefile_in > diff -N patches/patch-src_Makefile_in > --- patches/patch-src_Makefile_in 19 Jun 2004 22:16:23 -0000 1.1 > +++ /dev/null 1 Jan 1970 00:00:00 -0000 > @@ -1,12 +0,0 @@ > -$OpenBSD: patch-src_Makefile_in,v 1.1 2004/06/19 22:16:23 jakob Exp $ > ---- src/Makefile.in.orig 2004-05-14 16:43:43.000000000 +0200 > -+++ src/Makefile.in 2004-06-19 23:48:58.000000000 +0200 > -@@ -73,7 +73,7 @@ YACC = @YACC@ > - YFLAGS = @YFLAGS@ > - MAKE_CLASS = @MAKE_CLASS@ > - > --SUBDIRS = . tests > -+SUBDIRS = . > - > - dist_h_files = syslog-ng.h cfgfile.h sources.h center.h filters.h destinations.h log.h afinter.h affile.h afsocket.h afuser.h afstreams.h afprogram.h afremctrl.h utils.h syslog-names.h nscache.h macros.h > - > Index: patches/patch-src_macros_c > =================================================================== > RCS file: patches/patch-src_macros_c > diff -N patches/patch-src_macros_c > --- patches/patch-src_macros_c 19 Jun 2004 22:16:23 -0000 1.1 > +++ /dev/null 1 Jan 1970 00:00:00 -0000 > @@ -1,15 +0,0 @@ > -$OpenBSD: patch-src_macros_c,v 1.1 2004/06/19 22:16:23 jakob Exp $ > ---- src/macros.c.orig 2004-06-19 23:54:01.000000000 +0200 > -+++ src/macros.c 2004-06-20 00:00:25.000000000 +0200 > -@@ -115,7 +115,10 @@ format_tzofs(char *dest, size_t left) > - (timezone < 0 ? -timezone : timezone) / 3600, > - (timezone % 3600) / 60); > - #else > -- length = strftime(dest, left -1, "%z", tm); > -+ time_t unixtime; > -+ tzset(); > -+ time(&unixtime); > -+ length = strftime(dest, left -1, "%z", localtime(&unixtime)); > - #endif > - return length; > - } > Index: pkg/PLIST > =================================================================== > RCS file: /cvs/ports/sysutils/syslog-ng/pkg/PLIST,v > retrieving revision 1.5 > diff -u -r1.5 PLIST > --- pkg/PLIST 19 Sep 2005 13:35:17 -0000 1.5 > +++ pkg/PLIST 8 Oct 2008 19:29:28 -0000 > @@ -1,27 +1,9 @@ > @comment $OpenBSD: PLIST,v 1.5 2005/09/19 13:35:17 jakob Exp $ > @man man/man5/syslog-ng.conf.5 > @man man/man8/syslog-ng.8 > -sbin/syslog-ng > +@bin sbin/syslog-ng > share/doc/syslog-ng/ > -share/doc/syslog-ng/syslog-ng.html/ > -share/doc/syslog-ng/syslog-ng.html/book1.html > -share/doc/syslog-ng/syslog-ng.html/destinations.html > -share/doc/syslog-ng/syslog-ng.html/index.html > -share/doc/syslog-ng/syslog-ng.html/intro.html > -share/doc/syslog-ng/syslog-ng.html/logpath.html > -share/doc/syslog-ng/syslog-ng.html/msgroute.html > -share/doc/syslog-ng/syslog-ng.html/reference.html > -share/doc/syslog-ng/syslog-ng.html/tuning.html > -share/doc/syslog-ng/syslog-ng.html/x172.html > -share/doc/syslog-ng/syslog-ng.html/x361.html > -share/doc/syslog-ng/syslog-ng.html/x728.html > -share/doc/syslog-ng/syslog-ng.html/x768.html > -share/doc/syslog-ng/syslog-ng.html/x900.html > -share/doc/syslog-ng/syslog-ng.html/x906.html > -share/doc/syslog-ng/syslog-ng.html/x97.html > -share/doc/syslog-ng/syslog-ng.ps > -share/doc/syslog-ng/syslog-ng.sgml > -share/doc/syslog-ng/syslog-ng.txt > +share/doc/syslog-ng/index.html > share/examples/syslog-ng/ > @sample ${SYSCONFDIR}/syslog-ng/ > share/examples/syslog-ng/syslog-ng.conf.sample > -- Brian A. Seklecki <bseklecki(a)collaborativefusion.com> Collaborative Fusion, Inc.

2 1