April 2008 - syslog-ng - lists.balabit.hu

[Bug 14] New: Maintain symlinks to current and previous log output files...
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=14 Summary: Maintain symlinks to current and previous log output files... Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=218688 OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'm hoping that upstream might consider adding functionality to syslog-ng to allow it to track current and previous log files and maintain symlinks to them, as a user option. This replicates one of the options that I (and others) find useful in cronolog. This has been previously discussed on the syslog-ng mailing list, though apparently nothing fully came of it. The archive of that discussion is at: https://lists.balabit.hu/pipermail/syslog-ng/2002-June/003452.html Obviously, it's probably somewhat of a low priority, but it would be nice. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

syslog-ng client messages delayed
by mark peters 22 Mar '10

22 Mar '10

Hi, We are running into a issue where syslog-ng clients who are configured to forward to a central syslog-ng destination server that are reasonably chatty are getting there messages delayed at the source (ie. 'tcpdump'ing the client shows it is sending messages from N minutes ago, where N is anything from 5 to 60 minutes on average sometimes more). We have also seen a small percentage of loss at the destination. On these 'delayed' clients we also see the resident memory footprint on the growing. Clients are running 1.6.12 (have tried 2.0.8 also - same symptons). The central syslog-ng server is running 2.0.8. relevant config entries are: syslog-ng client: options { sync (1); time_reopen (10); log_fifo_size (2097152); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; destination d_central { tcp("log2.xyz.com" port(5140)); }; filter f_local5 { facility(local5); }; log { source(s_sys); filter(f_local5); destination(d_central); flags(final); }; syslog-ng central server: options { time_reopen (10); log_fifo_size (2097152); long_hostnames (off); use_dns (yes); dns_cache (yes); dns_cache_expire (28800); use_fqdn (no); create_dirs (yes); dir_perm (0755); perm (0644); keep_hostname (no); use_time_recvd (no); stats_freq(600); flush_timeout(16000); flush_lines(256); time_sleep(80); }; destination d_server { file("/logs/server.$LEVEL.log"); }; filter f_server { facility(local5) and program("server"); }; log { source(s_sys); filter(f_server); destination(d_server); flags(final); }; to give a rough idea of message volume the server is receiving approximately 50 million log lines per day on average any help/information would be appreciated thanks -------------------------------------- Easy + Joy + Powerful = Yahoo! Bookmarks x Toolbar http://pr.mail.yahoo.co.jp/toolbar/

3 4

[Bug 21] New: call shutdown() before closing a socket
by bugzilla＠bugzilla.balabit.com 30 Apr '09

30 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=21 Summary: call shutdown() before closing a socket Product: syslog-ng Version: 2.1.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bazsi(a)balabit.hu Type of the Report: --- Estimated Hours: 0.0 syslog-ng should call shutdown() before closing a socket to ensure the contents of the socket buffer are emptied. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[PATCH] anonymizing filter
by Micah Anderson 06 Nov '08

06 Nov '08

Hello, A couple years ago this patch was submitted to the list for consideration for inclusion into syslog-ng. I am writing this email again to request that it be considered again. The patch provides a simple replace which enables you to strip out IP addresses from your logs before they are written to disk. The patch has been included in the Debian stable distribution, and currently is included in both Debian Sid and Lenny (unstable and testing). It has had a very wide testing base and is non-intrusive, it has existed since 2004 and has been adapted to work with the newer syslog-ng. The goal of this patch is to give an organization the means to implement site logging policies, by allowing for easy control over exactly what data is retained in the logfiles. When I first requested consideration for inclusion the reactions were some suggestions for improvement (which were done), some side discussions about the various states of data retention laws, and a general agreement that this patch is non-intrusive and had a valid use case (at least in the U.S., but also likely in other countries as well[0]). The side-discussions about data-retention laws were mostly around specific geographic localities that were considering laws that would make stripping of addresses illegal, or had already mandated such things. Although these were interesting discussions, as EU data retention laws would prohibit many people from making such configuration changes to their syslog-ng.conf, they were tangential to the point because this patch does not cause those to break such laws. On the other side of the pond, in the U.S., the EFF[1] has made it very clear that this mechanism of anonymizing logs is perfectly (a) legal in the U.S., and (b) advisable. There are many instances where it is preferable to keep less information on users than is collected by default on many systems. In the United States it is not currently required to retain data on users of a server, but you may be required to provide all data on a user which you have retained. OSPs can protect themselves from legal hassles and added work by choosing what data they wish to retain. The current climate in the U.S. makes this problem so much more important now than it was many years ago. Having the ability to implement a site-policy that enables an organization to decide if the trade-off between privacy and analysis is worthwhile. This patch allows organizations to have that choice if they feel that it is more important to avoid retaining sensitive data rather than having a full history of everything logged. Please accept this patch[2], Micah [0] EPIC International Data Retention Page http://www.epic.org/privacy/intl/data_retention.html [1] The EFF is the major civil liberties internet watchdog in the US, their "Best Practices for Online Service Providers" can be found here: http://www.eff.org/osp, they explicitly link to our patch as a recommendation [2] The latest patch can be found at https://code.autistici.org/trac/privacy/browser/trunk/syslog-ng

6 11

Using Regex information for destination
by James Whitt 11 Jul '08

11 Jul '08

I had asked this question about a year ago, but was told to wait for the new 2.0 version. I'm currently running the latest syslog-ng 2.0.7. What I would like to do is put the line in a specific file based on part of the hostname. For example: Hostname: subdomain.domain.tld destination customer_firewall_logs { file("/logs/$TLD/$DOMAIN/$SUBDOMAIN/$R_YEAR-$R_MONTH-$R_DAY.log"); }; WHERE $TLD is the tld of the hostname, $DOMAIN is the domain from the hostname, and $SUBDOMAIN is teh subdomain from the hostname. I would like to be able to regex this information out of the hostname to use in the destination. Is this possible and any tips on getting it to work correctly would be greatly appreciated.

3 6

Re: [syslog-ng] loop caused by syslog-ng filter
by JUNG, Christian 07 Jul '08

07 Jul '08

Okay. Don't know if I get the things right, but: All scripts you've mailed to the list write something to a file or send a mail if they're called and terminate directly after that action. syslog-ng will respawn (neu starten) them directly. The program started by the program destination should not terminate itself. It has to listen on STDIN for a log message given from syslog-ng. Afterwards it can do something useful and then it has to listen for the next message. In a shell script you can do this with a "while read LINE; do ...; done". Try this: ---8<--- #!/bin/bash while read LINE; do echo $(date) $LINE >> /tmp/schrott done ---8<--- Execute this script on the command line, enter some random stuff and look into /tmp/schrott: user@box:~> ./test-script bla bla bla bla Terminate this script by pressing CTRL-D. You should see something like this in /tmp/schrott: Thu Mar 20 15:13:16 CET 2008 bla bla bla Thu Mar 20 15:13:18 CET 2008 bla If not your script doesn't work :-) See for typos. If this works, put it in your syslog-ng conf. It should do the same (only prio 1 messages should be visible with the date prepended). If this works well, try this script first on the command line: ---8<--- #!/bin/bash while read LINE; do mail -s "High Priority Snort Alert" Sub-Zero(a)xxx.de <<-EOF Alert, Priority 1 $LINE EOF done ---8<--- You should receive for every given input line exactly one mail. If this works put it in your syslog-ng.conf. Now you should be done. The thread you mentioned is about two running scripts where only one should run. This shouldn't be the case here. But you can have a look at the output of "ps fax". If you see multiple processes under syslog-ng then you might have the problem. bye Chris > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of Adam Richter > Sent: Thursday, March 20, 2008 2:46 PM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] loop caused by syslog-ng filter > > > Hi! > > Not working! Syslog-ng filters for exactly the string: [Priority: 1] > and not as it is piped by the mail script: #priority 1# note the ":" ! > Anyway I used your script --> same fault!!! > I have also used following script: > > > #!/bin/sh > > echo AAA >> /tmp/schrott > date >> /tmp/schrott > > There is no output like [Priority: 1]!!! > Then I did following: tail -f /tmp/schrott and got a loop > too! The loop starts when syslog-ng recognices the first > machting string [Priority: 1] and loops till I stop syslog-ng!!! > > > Sensor1:~# /etc/init.d/syslog-ng stop > Stopping system logging: syslog-ng. > Sensor1:~# tail -f /tmp/schrott > AAA > Do 20. MÃ¤r 14:29:12 CET 2008 > AAA > Do 20. MÃ¤r 14:29:12 CET 2008 > AAA > Do 20. MÃ¤r 14:29:12 CET 2008 > AAA > Do 20. MÃ¤r 14:29:12 CET 2008 > AAA > Do 20. MÃ¤r 14:29:12 CET 2008 > > > I think it has something in common with this thread: > > https://lists.balabit.hu/pipermail/syslog-ng/2006-October/009454.html > > Any other ideas? It´s very important! > > German: Es handelt sich hier um meine Abschlussprüfung, und > dies ist der letzte Fehler der Auftritt, ansonsten läuft das Projekt. > > bye, Adam / Sub-Zero ! > > > -------- Original-Nachricht -------- > > Datum: Thu, 20 Mar 2008 10:32:31 +0100 > > Von: "JUNG, Christian" <christian.jung(a)saarstahl.com> > > An: "Syslog-ng users\' and developers\' mailing list" > <syslog-ng(a)lists.balabit.hu> > > Betreff: Re: [syslog-ng] loop caused by syslog-ng filter > > > Hi Adam, > > > > syslog-ng does the right thing :-). > > > > It starts the program/script once and pipes on STDIN every > log-message > > which matches the filter. > > > > If your script is started, it will call mail and pipe > "Alert, priority 1" > > to its STDIN and then exits. syslog-ng sees this and > restarts it (version > > 2.0 or higher behave that way, see > > > <http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ > ch09s02.html#reference_destination_program>). > > > > For you purpose this would be better: > > > > ---8<--- > > #!/bin/bash > > > > while read LINE; do > > cat <<-EOF | mail -s "High Priority Snort Alert" > Sub-Zero(a)xxx.de > > Alert, Priority 1 > > $LINE > > EOF > > done > > ---8<--- > > > > > > bye > > Chris > > > > > > > > -----Original Message----- > > > From: syslog-ng-bounces(a)lists.balabit.hu > > > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of > Adam Richter > > > Sent: Thursday, March 20, 2008 9:23 AM > > > To: syslog-ng(a)lists.balabit.hu > > > Subject: [syslog-ng] loop caused by syslog-ng filter > > > > > > > > > Hi! > > > > > > First off, sorry for my poor english! > > > I have a problem with a loop caused by syslog-ng v. 2.0.8. I > > > have set up Snort as an IDS System. Snort writes its messages > > > in unified-format to /var/log/snort/snort.alert and > > > /var/log/snort/snort.log. There are two Barnyard processes > > > which read the unified files and convert it to messages that > > > syslog and MySQL understand. Syslog-ng writes the messages > > > to /var/log/auth.log. All this is working fine. Now, I want > > > to set up a filter for Priority 1 alerts. This alert should > > > be send to the Administrator. > > > > > > I used following filter for syslog-ng: > > > > > > source src {unix-stream("/dev/log"); internal();}; > > > destination email{program("/usr/local/bin/alert_mail.sh");}; > > > filter high {match("[Priority: 1]");}; > > > log {source(src);filter(high); destination(email);}; > > > > > > > > > The alert_mail.sh: > > > > > > #!/bin/sh > > > cat << EOF | mail -s "High Priority Snort Alert" Sub-Zero(a)xxx.de > > > Alert, Priority 1 > > > EOF > > > > > > > > > Then I use Nessus to cause some alerts with Priority 1. I can > > > see 4 alerts with the Priority 1 with BASE and in > /var/log/auth.log. > > > > > > Syslog-ng recognises the alert with Priority 1 and activates > > > the script /usr/local/bin/alert_mail.sh > > > > > > All this is working, but the script is restarted by syslog-ng > > > again an again. > > > > > > Extract from /var/log/messages: > > > > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program > > > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > > > status='0' > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination > > > program; cmdline='/usr/local/bin/alert_mail.sh ' > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Closing log writer > > > fd; fd='11' > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program > > > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > > > status='0' > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination > > > program; cmdline='/usr/local/bin/alert_mail.sh ' > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Child program > > > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > > > status='0' > > > Mar 18 15:46:16 Sensor1 syslog-ng[5191]: Starting destination > > > program; cmdline='/usr/local/bin/alert_mail.sh ' > > > … > > > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program > > > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > > > status='256' > > > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Starting > > > destination program; cmdline='/usr/local/bin/alert_mail.sh ' > > > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program > > > exited, restarting; cmdline='/usr/local/bin/alert_mail.sh ', > > > status='256' > > > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Starting > > > destination program; cmdline='/usr/local/bin/alert_mail.sh ' > > > Mar 18 15:42:00 Sensor1 syslog-ng[17354]: Child program > > > exited, restarting; > > > > > > … > > > > > > > > > I get thousands of mails per minute till I stop syslog-ng. > > > > > > Output of /var/log/auth.log(so y see that syslog-ng writes > > > snort/barnyard messages correctly to auth.log): > > > > > > Mar 19 13:56:54 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > > > x86 NOOP [Classification: Executable code was detected] > > > [Priority: 1] {UDP} 172.25.1.152:4758 -> 172.28.100.10:137 > > > Mar 19 13:57:13 src@Sensor1 barnyard: [1:1446:8] SMTP vrfy > > > root [Classification: Attempted Information Leak] [Priority: > > > 2] {TCP} 172.25.1.152:1085 -> 172.28.100.10:25 > > > Mar 19 13:57:13 src@Sensor1 barnyard: [1:660:11] SMTP expn > > > root [Classification: Attempted Information Leak] [Priority: > > > 2] {TCP} 172.25.1.152:1085 -> 172.28.100.10:25 > > > Mar 19 13:57:22 src@Sensor1 barnyard: [1:12626:2] Snort Alert > > > [1:12626:0] [Classification: Decode of an RPC Query] > > > [Priority: 2] {UDP} 172.25.1.152:1146 -> 172.28.100.10:111 > > > Mar 19 13:57:22 src@Sensor1 barnyard: [1:585:9] RPC portmap > > > sadmind request UDP [Classification: Decode of an RPC Query] > > > [Priority: 2] {UDP} 172.25.1.152:1146 -> 172.28.100.10:111 > > > Mar 19 13:57:24 src@Sensor1 barnyard: [1:566:6] POLICY > > > PCAnywhere server response [Classification: Misc activity] > > > [Priority: 3] {UDP} 172.25.1.152:1155 -> 172.28.100.10:5632 > > > Mar 19 15:11:27 src@Sensor1 barnyard: [122:1:0] portscan: TCP > > > Portscan [Classification: Unknown] [Priority: 3] {PROTO255} > > > 172.25.1.152 -> 172.28.100.10 > > > Mar 19 15:11:58 src@Sensor1 barnyard: [1:1420:13] SNMP trap > > > tcp [Classification: Attempted Information Leak] [Priority: > > > 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:162 > > > Mar 19 15:11:58 src@Sensor1 barnyard: [1:1418:13] SNMP > > > request tcp [Classification: Attempted Information Leak] > > > [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:161 > > > Mar 19 15:12:05 src@Sensor1 barnyard: [1:1421:13] SNMP > > > AgentX/tcp request [Classification: Attempted Information > > > Leak] [Priority: 2] {TCP} 172.25.1.152:4482 -> 172.28.100.10:705 > > > Mar 19 15:12:16 src@Sensor1 barnyard: [122:1:0] portscan: TCP > > > Portscan [Classification: Unknown] [Priority: 3] {PROTO255} > > > 172.25.1.152 -> 172.28.100.10 > > > Mar 19 15:12:19 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > > > x86 NOOP [Classification: Executable code was detected] > > > [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 > > > Mar 19 15:12:20 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > > > x86 NOOP [Classification: Executable code was detected] > > > [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 > > > Mar 19 15:12:22 src@Sensor1 barnyard: [1:1394:8] SHELLCODE > > > x86 NOOP [Classification: Executable code was detected] > > > [Priority: 1] {UDP} 172.25.1.152:137 -> 172.28.100.10:137 > > > > > > > > > I think it has something in common with this topic: > > > > > > https://lists.balabit.hu/pipermail/syslog-ng/2006-October/009454.html > > > > Thanks in advance! > > > > Sub-Zero > > > > > > -- > > GMX startet ShortView.de. Hier findest Du Leute mit Deinen Interessen! > > Jetzt dabei sein: http://www.shortview.de/?mc=sv_ext_mf@gmx > > ______________________________________________________________ > > ________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > -- Psst! Geheimtipp: Online Games kostenlos spielen bei den GMX Free Games! http://games.entertainment.gmx.net/de/entertainment/games/free ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

4 10

syslog-ng "include" config option
by Bryan Duff 29 Apr '08

29 Apr '08

In 2.0.x this doesn't appear to be an option: // in /etc/syslog-ng/syslog-ng.conf include /path/to/syslog-ng/confs/*.conf // end snip I found this debated on the ml some time ago: https://lists.balabit.hu/pipermail/syslog-ng/2002-March/003094.html And that's pretty much what I want, but it was never implemented it seems. Or did I miss something? -Bryan

2 1

Syslog-Ng MySQL Performance Problem
by Hari Sekhon 29 Apr '08

29 Apr '08

Hi, I've had a Syslog-NG Central Logserver -> MySQL setup for nearly 2 years now but am finding it has developed a performance problem with a backed up pipe so I'm thinking of using batched inserts to try to improve the db processing performance. Before I go and code this myself, are there any good generic solutions, somebody must have done this batched inserts before, I saw something on the mailing list once I think but can't see it now... Any other suggestions would also be welcome before I go off and do this. Thanks -h -- Hari Sekhon

3 2

Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 25 Apr '08

25 Apr '08

That is interesting, Evan! I did as you suggested (put the env AND the configure on the same command line) and it worked swimmingly... I don't really understand the "why", but I can't argue with the results. :o) For clarification sake, here is what I was doing before that did not work: 1.) PKG_CONFIG_PATH=/usr/local/lib/pkgconfig; export PKG_CONFIG_PATH 2.) sudo ./configure --enable-spoof-source Can someone tell me what the difference between that, and Evan's command below, would be? Thanks everyone, especially Evan and ScottO! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst 1120 Celebration Blvd. Celebration, FL 34747 (321) 939-6540 Office 8296-6540 Disney Tie-Line (407) 557-1072 Cell 162*326905*19 Nextel Direct Connect chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel Sent: Friday, April 25, 2008 1:21 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 >> the output from the configure command: >> >> sudo ./configure --enable-spoof-source >> ... >> checking for pkg-config... /usr/bin/pkg-config >> checking pkg-config is at least version 0.9.0... yes >> checking for GLIB... yes >> checking for EVTLOG... no >> configure: error: Cannot find eventlog version >= 0.2: is pkg-config in >> path? Note that the configure is using /usr/bin/pkg-config and your eventlog.pc is in /usr/local/lib/pkgconfig You need to set the PKG_CONFIG_PATH prior to running the .configure script so that this path gets built into the make process. I use env PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./configure --enable-spoof-source to get the guild right. Evan. >> >> I found the command the configure script runs, so I ran it manaully: >> >> sudo /usr/bin/pkg-config --exists --print-errors eventlog >> Package eventlog was not found in the pkg-config search path. >> Perhaps you should add the directory containing `eventlog.pc' >> to the PKG_CONFIG_PATH environment variable >> No package 'eventlog' found >> >> env | grep PKG >> PKG_CONFIG_PATH=/usr/local/lib/pkgconfig >> >> ls -al /usr/local/lib/pkgconfig/ >> -rw-r--r-- 1 root root 237 Apr 25 08:19 eventlog.pc >> >> Can anyone help me figure this issue out? Thanks in advance! >> >> Chris Ivey >> >> Affiliated Computer Services >> Enterprise Management Integration Services >> Infrastructure Management Senior Analyst >> >> chris.ivey(a)acs-inc.com >> >> "I have not failed, I have simply found 10,000 ways which do not work!" -- >> Thomas Edison >> "When you find yourself in a hole, the best thing to do is stop digging!" > -- >> Nick Stokes >> "I reject your reality, and substitute my own!" -- Adam Savage >> >> >> _____ >> >> From: syslog-ng-bounces(a)lists.balabit.hu >> [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO >> Sent: Wednesday, April 23, 2008 9:36 AM >> To: Syslog-ng users' and developers' mailing list >> Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 >> >> >> Those version numbers should obviously updated to the latest available, :) >> >> >> On Wed, Apr 23, 2008 at 9:35 AM, ScottO <skippylou(a)gmail.com >> <mailto:skippylou@gmail.com> > wrote: >> >> >> On various versions of CentOS and Fedora, all I do is: >> >> - ./configure;make;make install on eventlog-0.2.5.tar.gz (from syslog-ng >> site) >> - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig >> - ./configure;make;make install on syslog-ng-2.0.5.tar.gz (from syslog-ng >> site) >> >> I did also need to install the glib2-devel package, which I didn't have >> already installed. >> >> Hope that helps, >> >> Scott >> >> >> On Wed, Apr 23, 2008 at 8:36 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com >> <mailto:Chris.ivey@acs-inc.com> > wrote: >> >> >> Hi folks! I posted this question previously, but I am still not clear on >> the process involved in putting a newer version of syslog-ng on my Fedora >> Core 4 machines. I need to upgrade, because my version (1.6.11) does not >> support hi-res timestamps. Can anyone provide some guidance as to how to > go >> about this process? I got information previously to compile from source, >> but I am not 100% clear on the process. Any guidance from you fine folks >> would be terribly appreciated!!! Thanks, folks! >> >> Chris Ivey >> >> Affiliated Computer Services >> Enterprise Management Integration Services >> Infrastructure Management Senior Analyst >> >> chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> >> >> "I have not failed, I have simply found 10,000 ways which do not work!" -- >> Thomas Edison >> "When you find yourself in a hole, the best thing to do is stop digging!" > -- >> Nick Stokes >> "I reject your reality, and substitute my own!" -- Adam Savage >> >> >> > ____________________________________________________________________________ >> __ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> <http://www.balabit.com/support/documentation/?product=syslog-ng> >> FAQ: http://www.campin.net/syslog-ng/faq.html >> <http://www.campin.net/syslog-ng/faq.html> >> >> >> >> >> >> >> > ____________________________________________________________________________ > __ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 25 Apr '08

25 Apr '08

Thanks, Evan, for the reply. I am already using bash as my shell, so I know that's not it. Thanks anyways, though! Any other thoughts? Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel Sent: Friday, April 25, 2008 10:20 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 Which shell ar you using? in some shells (csh and tcsh) the env is NOT propogated to children. in those you need to setenv PKG_CONFIG_PATH or you chould just use bash to start with. Evan. On Fri, 25 Apr 2008, Ivey, Chris wrote: > Date: Fri, 25 Apr 2008 08:50:35 -0500 > From: "Ivey, Chris" <Chris.ivey(a)acs-inc.com> > Reply-To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> > Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 > > Scott et. al., > > OK, I am following along with the directions from the "compile > syslog-ng" page but am getting errors. I have seen TONS of posts about > folks having this error, but I have not found a solution. Here is a snip of > the output from the configure command: > > sudo ./configure --enable-spoof-source > ... > checking for pkg-config... /usr/bin/pkg-config > checking pkg-config is at least version 0.9.0... yes > checking for GLIB... yes > checking for EVTLOG... no > configure: error: Cannot find eventlog version >= 0.2: is pkg-config in > path? > > I found the command the configure script runs, so I ran it manaully: > > sudo /usr/bin/pkg-config --exists --print-errors eventlog > Package eventlog was not found in the pkg-config search path. > Perhaps you should add the directory containing `eventlog.pc' > to the PKG_CONFIG_PATH environment variable > No package 'eventlog' found > > env | grep PKG > PKG_CONFIG_PATH=/usr/local/lib/pkgconfig > > ls -al /usr/local/lib/pkgconfig/ > -rw-r--r-- 1 root root 237 Apr 25 08:19 eventlog.pc > > Can anyone help me figure this issue out? Thanks in advance! > > Chris Ivey > > Affiliated Computer Services > Enterprise Management Integration Services > Infrastructure Management Senior Analyst > > chris.ivey(a)acs-inc.com > > "I have not failed, I have simply found 10,000 ways which do not work!" -- > Thomas Edison > "When you find yourself in a hole, the best thing to do is stop digging!" -- > Nick Stokes > "I reject your reality, and substitute my own!" -- Adam Savage > > > _____ > > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO > Sent: Wednesday, April 23, 2008 9:36 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 > > > Those version numbers should obviously updated to the latest available, :) > > > On Wed, Apr 23, 2008 at 9:35 AM, ScottO <skippylou(a)gmail.com > <mailto:skippylou@gmail.com> > wrote: > > > On various versions of CentOS and Fedora, all I do is: > > - ./configure;make;make install on eventlog-0.2.5.tar.gz (from syslog-ng > site) > - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig > - ./configure;make;make install on syslog-ng-2.0.5.tar.gz (from syslog-ng > site) > > I did also need to install the glib2-devel package, which I didn't have > already installed. > > Hope that helps, > > Scott > > > On Wed, Apr 23, 2008 at 8:36 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com > <mailto:Chris.ivey@acs-inc.com> > wrote: > > > Hi folks! I posted this question previously, but I am still not clear on > the process involved in putting a newer version of syslog-ng on my Fedora > Core 4 machines. I need to upgrade, because my version (1.6.11) does not > support hi-res timestamps. Can anyone provide some guidance as to how to go > about this process? I got information previously to compile from source, > but I am not 100% clear on the process. Any guidance from you fine folks > would be terribly appreciated!!! Thanks, folks! > > Chris Ivey > > Affiliated Computer Services > Enterprise Management Integration Services > Infrastructure Management Senior Analyst > > chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> > > "I have not failed, I have simply found 10,000 ways which do not work!" -- > Thomas Edison > "When you find yourself in a hole, the best thing to do is stop digging!" -- > Nick Stokes > "I reject your reality, and substitute my own!" -- Adam Savage > > > ____________________________________________________________________________ > __ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://lists.balabit.hu/mailman/listinfo/syslog-ng> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <http://www.balabit.com/support/documentation/?product=syslog-ng> > FAQ: http://www.campin.net/syslog-ng/faq.html > <http://www.campin.net/syslog-ng/faq.html> > > > > > > > ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1