November 2008 - syslog-ng - lists.balabit.hu

logwriter.c:241: error: LogWriterWatch has no member named - Red Hat 5.x 32BIT
by Saunders, Shawn 21 Nov '08

21 Nov '08

Can someone shed some light here? I am hoping to get to try the “parser” options, but need to successfully compile first. It appears to be dying at something in the eventlog On Red Hat - 2.6.18-92.1.18.el5 #1 SMP Wed Nov 5 09:00:13 EST 2008 i686 athlon i386 GNU/Linux I have eventlog installed: eventlog-0.2.9+20081116.tar.gz ./configure --enable-ssl=no --enable-dynamic-linking --enable-linux-caps syslog-ng Open Source Edition 3.0+20081116 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -I/usr/kerberos/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : prefix : /usr/local Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SSL support : no SQL support : no Linux capability support : yes PCRE support : yes Env wrapper support : no A make gets me here: logwriter.c: In function â€˜log_writer_fd_dispatchâ€™: logwriter.c:241: error: â€˜LogWriterWatchâ€™ has no member named â€˜fdâ€™ make[2]: *** [logwriter.o] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng-3.0+20081116/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/syslog-ng-3.0+20081116' make: *** [all] Error 2 snippet of logwriter.c lines 239-245 239 else if (self->pollfd.revents & (G_IO_ERR)) 240 { 241 msg_error("POLLERR occurred while idle", 242 evt_tag_int("fd", self->fd->fd), 243 NULL); 244 log_writer_broken(self->writer, NC_WRITE_ERROR); 245 } Thank you, Shawn Saunders UNIX Systems Administrator 818.953.2649 WMG, Digital Properties "UNIX is user-friendly ... it's just selective about who its friends are!!"

2 3

syslog + snare + mysql
by Eli Robinson 20 Nov '08

20 Nov '08

Hello all! I am currently running the following: Syslog-ng 2.0.5 on FC8, kernel 2.6.23.1-42, no firewall, SELinux disabled, logging to mysql 5.0.45 via a named pipe Snare 2.6.1 on Windows Server 2003 with the enable syslog header option checked The Snare clients have been running for several years and were communicating with an older version of snare. Everything logged perfectly. Unfortunately a hardware failure caused loss of the config file and old syslog server, so I do not have the configuration or version which worked. My setup notes reference a howto online, which I followed again. I use the following destination to log to mysql destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg, username) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' , '$USERNAME' );\n") template-escape(yes)); }; And also this collector script to run the actual mysql client: # #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u syslogusername --password=syslogpassword syslog < /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi I use out of the box filters and destinations to log to the messages logfile (for debugging at this point) My problem arises from the fact that for this entry in my messages file: Nov 20 16:01:14 testserver.mydomain.com FTPSvcLog 3 21:01:11 172.16.5.166 [36863]created /index.htm 226 0 I only get 'FTPsvcLog' written to the messages field in mysql. I am pretty sure its something obviously wrong but at this point I need another set of eyes. My gut feeling is the issue stems from the tabs following FTPSvcLog and the number 3. Any thoughts? Thanks in advance! Eli

1 0

facility(kern) not working? Syslog-ng 2.0.7
by Fegan, Joe 20 Nov '08

20 Nov '08

Hi, I am using 2.0.7 and it seems that facility(kern) does not match messages from "logger -p kern.info". I am trying to filter kernel messages into a file but nothing goes there. Below are details of the test. Joe. [root@node1 ~]# cat /etc/syslog-ng/syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); stats_freq(2592000); mark_freq(0); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); # tcp(ip(0.0.0.0) port(514)); }; template t_withsev { template("${DATE} ${HOST} ${PRI} ${PRIORITY} ${MSG}\n"); }; destination d_klog { file("/var/log/klog"); }; destination d_mesg { file("/var/log/messages" template(t_withsev)); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" sync(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_klog); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; [root@node1 ~]# logger -i -p kern.info "hello from kern" [root@node1 ~]# tail -2 /var/log/messages Nov 17 12:40:45 dizzyfive1 189 notice syslog-ng: syslog-ng startup succeeded Nov 17 12:41:40 dizzyfive1 14 info root[19336]: hello from kern [root@node1 ~]# ls -l /var/log/klog ls: /var/log/klog: No such file or directory [root@node1 ~]#

3 5

parser option in v2.1.3?
by Saunders, Shawn 20 Nov '08

20 Nov '08

Is the parser option to split and work with the $MSG or $MSGONLY variables and split and use various fields from them in the destination filename available in the 2.1.3 tree or is this only available in the 3.x tree? Thank you, Shawn Saunders UNIX Systems Administrator 818.953.2649 WMG, Digital Properties "UNIX is user-friendly ... it's just selective about who its friends are!!"

2 3

Need some help with syslog-ng configuration on firewalled environment
by Ankit Kukreja 19 Nov '08

19 Nov '08

Hi All, Need some help with syslog configuration on firewalled environment. I wanted to implement syslog-ng in firewalled environment. The setup is like: I have one Syslog-ng outside the firewall which collects logs from various components in the network. Now what I want is to pass on these logs from this syslog-ng server (outside firewall) to a syslog server inside the firewall i.e. to make the whole setup firewall friendly. One of the standard way to make anything firewall friendly is that the communications between two server should be started from the server inside the firewall. Is there a way we can do this with syslog-ng? Can someone please provide some insights, it would be really appreciated. Thanks and Regards Ankit Kukreja

2 3

v2.1.2 Open Source Version: Error resolving user; user
by Saunders, Shawn 19 Nov '08

19 Nov '08

When I start syslog-ng 2.1.2 (Opensource) I receive the following error. It worked fine with the same syslog-ng.conf file under v2.0.9 Starting syslog-ng: Error resolving user; user='root' Error resolving user; user='root' Error resolving user; user='root' Error resolving user; user='apache' Error resolving user; user='apache' Error resolving user; user='apache' These users do exist. I use them and their existence is self-explanatory. I have tried using the UID #'s for them and get basically the same errors. Any ideas? I have tried even moving these entries from the destination to the global section to no avail. Here is a sample: destination d_somelocation_logs { file ( "/content/syslog/somelocation/$YEAR/$MONTH/$DAY/$FULLHOST-$FACILITY-$YEA R-$MONTH-$DAY.log" owner(apache) group( apache ) perm ( 0600 ) dir_perm( 0755 ) create_dirs ( yes ) template ( "$MESSAGE\n" ) ); }; Am I loosing my mind? This seems pretty clear, and it always worked before. One of the reasons I upgraded was the hope of utilizing the parser function and templatizing my 507 line conf file, but until I get the basics working again without the errors, I don't know. Thank you, Shawn Saunders UNIX Systems Administrator 818.953.2649 WMG, Digital Properties "UNIX is user-friendly ... it's just selective about who its friends are!!"

2 2

Re: [syslog-ng] I/O error occurred while reading; fd='4',error='Operation not permitted (1)'
by Florian Grandel 19 Nov '08

19 Nov '08

Hi Bazsi, > As there are two alternatives for running syslog-ng as non-root, I would > not like to add this hack to syslog-ng: > 1) run klogd, just as before > 2) run syslog-ng 3.0, which manages its own capabilities, with > CAP_SYS_ADMIN present in the cap-set /proc/kmsg can be read. Both alternatives are not (yet) available in some Linux standard distributions (namely Debian and Ubuntu). This is not your problem, sure, just to explain the practical relevance of the workaround: 1) Before implementing my dd workaround I had already tried the klogd solution which I think would be the cleanest solution. On Debian/Ubuntu, however, syslog-ng and klogd are conflicting packages and cannot be installed alongside each other. Even worse: klogd depends on sysklogd which naturally conflicts with syslog-ng. So currently there is no way to get both installed without cleaning up this dependency mess (which probably won't be so easy). 2) As you mention yourself: maintaining CAP_SYS_ADMIN privilege is contrary to most of the rationale for dropping root privilege in the first place. It provides very powerful privileges to syslog_ng just to access /proc/kmsg which may not be acceptable to everybody. Apart from that V3.0 is not (yet) available for Ubuntu/Debian. Florian

1 0

Dynamic libs w/ 2.1.2
by Douglas E. Warner 18 Nov '08

18 Nov '08

I'm trying to compile syslog-ng 2.1.2 but getting the following error from configure: ./configure --disable-static-linking --enable-dynamic-linking [...] checking for GLIB - version >= 2.4.0... yes (version 2.16.6) checking for static GLib libraries... no checking sanity checking Glib headers... yes configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib Ideas? -Doug

4 6

Following all files in a directory tree
by Joe Shaw 18 Nov '08

18 Nov '08

Hi, I only recently got a chance to look at the syslog-ng OSE 3.0 git tree announcement and take a quick poke at the code, so please let me know if i'm off base. One thing I was hoping to see in 3.0 was the ability to specify a directory as a source and have syslog-ng serve up all of the files (possibly recursively) inside it. I think I saw something like that on a roadmap. Is that still a planned feature? Is it a PE-only feature? Thanks, Joe

2 1

syslog-ng 3.0 SSL compile fix
by Joe Shaw 18 Nov '08

18 Nov '08

Hi again, Another SSL-related compilation fix patch. If SSL is disabled, tlscontext.c should probably be empty (judging from tlscontext.h). Thanks, Joe

2 1