April 2008 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 25 Apr '08

25 Apr '08

Scott et. al., OK, I am following along with the directions from the "compile syslog-ng" page but am getting errors. I have seen TONS of posts about folks having this error, but I have not found a solution. Here is a snip of the output from the configure command: sudo ./configure --enable-spoof-source ... checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? I found the command the configure script runs, so I ran it manaully: sudo /usr/bin/pkg-config --exists --print-errors eventlog Package eventlog was not found in the pkg-config search path. Perhaps you should add the directory containing `eventlog.pc' to the PKG_CONFIG_PATH environment variable No package 'eventlog' found env | grep PKG PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ls -al /usr/local/lib/pkgconfig/ -rw-r--r-- 1 root root 237 Apr 25 08:19 eventlog.pc Can anyone help me figure this issue out? Thanks in advance! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO Sent: Wednesday, April 23, 2008 9:36 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 Those version numbers should obviously updated to the latest available, :) On Wed, Apr 23, 2008 at 9:35 AM, ScottO <skippylou(a)gmail.com <mailto:skippylou@gmail.com> > wrote: On various versions of CentOS and Fedora, all I do is: - ./configure;make;make install on eventlog-0.2.5.tar.gz (from syslog-ng site) - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig - ./configure;make;make install on syslog-ng-2.0.5.tar.gz (from syslog-ng site) I did also need to install the glib2-devel package, which I didn't have already installed. Hope that helps, Scott On Wed, Apr 23, 2008 at 8:36 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com <mailto:Chris.ivey@acs-inc.com> > wrote: Hi folks! I posted this question previously, but I am still not clear on the process involved in putting a newer version of syslog-ng on my Fedora Core 4 machines. I need to upgrade, because my version (1.6.11) does not support hi-res timestamps. Can anyone provide some guidance as to how to go about this process? I got information previously to compile from source, but I am not 100% clear on the process. Any guidance from you fine folks would be terribly appreciated!!! Thanks, folks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

2 1

how to change localhost to hostname
by D'Souza, Alfred 24 Apr '08

24 Apr '08

We have a bunch of servers whose applications write error/debug messages to 127.0.0.1 port 514. We want syslog-ng on each of the servers to forward the messages to a central logging server which also forwards the messages to zenoss running on the central logger server. The problem with our configuration (which I have copied here) is that no matter which server originates the message, they show up on the central server as originating from localhost - in both zenoss and in the /var/log files We want them to be shown as originating from the server that produced the messages. We can add a template on the central logger to log the messages as coming form $FROM_HOST, but while that solves the problem for the /var/log messages, zenoss still shows the messages as coming from localhost. Please help, we are new to using syslog-ng. We are using syslog-ng version 2.0.8 on Red Hat Linux. -----------------server syslog-ng.conf (slightly abbreviated) options { use_dns(yes); use_fqdn(no); chain_hostnames(no); keep_hostnames(yes); ::: }; source java { udp(ip(127.0.0.1) port(514)); }; destination remote { udp("192.168.99.105" port(514)); } log { source(java); destination(remote); }; ------------------central logger config file options { use_time_recvd( no ); time_reopen(1); long_hostnames(off); sync(0); use_dns(yes); use_fqdn(no); chain_hostnames(no); keep_hostname(yes); create_dirs(yes); stats(3600); }; source src { unix-stream("/dev/log"); pipe("/proc/kmsg"); internal(); udp(ip(0.0.0.0) port(514)); }; destination everything { file("/var/log/$HOST_FROM.$MONTH$DAY$YEAR" template("$HOST_FROM $HOUR:$MIN:$SEC $MSG\n")); }; destination zenoss { udp( "localhost" port(5514) ); #udp( "localhost" port(5514) template("<$PRI>$DATE $HOST_FROM $MSG\n") ); }; log { source(src); destination(everything); }; log { source(src); destination(zenoss); }; PLEASE READ: This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please delete it and all copies from your system, destroy any hard copies and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Nomura Holding America Inc., Nomura Securities International, Inc, and their respective subsidiaries each reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorized to state the views of such entity. Unless otherwise stated, any pricing information in this message is indicative only, is subject to change and does not constitute an offer to deal at any price quoted. Any reference to the terms of executed transactions should be treated as preliminary only and subject to our formal written confirmation.

3 2

Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 23 Apr '08

23 Apr '08

Thank you, Scott! I appreciate your assistance. I will take your guidance below, and start working on getting the latest syslog-ng working on my macines. Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO Sent: Wednesday, April 23, 2008 9:36 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 Those version numbers should obviously updated to the latest available, :) On Wed, Apr 23, 2008 at 9:35 AM, ScottO <skippylou(a)gmail.com <mailto:skippylou@gmail.com> > wrote: On various versions of CentOS and Fedora, all I do is: - ./configure;make;make install on eventlog-0.2.5.tar.gz (from syslog-ng site) - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig - ./configure;make;make install on syslog-ng-2.0.5.tar.gz (from syslog-ng site) I did also need to install the glib2-devel package, which I didn't have already installed. Hope that helps, Scott On Wed, Apr 23, 2008 at 8:36 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com <mailto:Chris.ivey@acs-inc.com> > wrote: Hi folks! I posted this question previously, but I am still not clear on the process involved in putting a newer version of syslog-ng on my Fedora Core 4 machines. I need to upgrade, because my version (1.6.11) does not support hi-res timestamps. Can anyone provide some guidance as to how to go about this process? I got information previously to compile from source, but I am not 100% clear on the process. Any guidance from you fine folks would be terribly appreciated!!! Thanks, folks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 23 Apr '08

23 Apr '08

Hi folks! I posted this question previously, but I am still not clear on the process involved in putting a newer version of syslog-ng on my Fedora Core 4 machines. I need to upgrade, because my version (1.6.11) does not support hi-res timestamps. Can anyone provide some guidance as to how to go about this process? I got information previously to compile from source, but I am not 100% clear on the process. Any guidance from you fine folks would be terribly appreciated!!! Thanks, folks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

2 2

reliability question (unix-dgram vs unix-stream)
by Geller, Sandor (IT) 21 Apr '08

21 Apr '08

Hi, I'm discussing the differences between unix-stream and unix-dgram on linux with my colleagues. It looks like the kernel-side and glibc-side implementation aren't different in the aspect of reliability. So why is it stated both in the reference guide and in the faq that unix-stream is more reliable? Thanks, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.

2 1

syslog-ng OSE 2.1beta1 release
by Balazs Scheidler 18 Apr '08

18 Apr '08

Dear syslog-ng users, I'd like to announce the release of syslog-ng Open Source Edition 2.1beta1. This release contains a couple of bugfixes back and forward ported from other branches and two functionality changes, much requested previously on this list. The first is a change in the TCP connection logic to move the DNS lookup be be part of the TCP reconnection logic, effectively solving the problem of non-resolvable hostnames, which caused syslog-ng to fail during startup. The same change also causes the destination hostname to be resolved again for each new connection attempt. The second important change was to handle file write error much more gracefully: whenever a write error occurs, writing to the destination file is suspended for some time, this way handling disk-full conditions better. I'd like to release 2.1.0 real soon now. The complete list of user-visible changes is below: 2.1beta1 Fri, 18 Apr 2008 18:00:59 +0200 Bugfixes: * Fixed a possible SIGABRT crash if the hosts file passed to dns-cache-hosts() had multiple entries with the same IP address. * Fixed a bug that caused the persistent DNS cache (e.g. /etc/hosts) to be reloaded for all name resolution requests. * Fixed a possible crash during startup if "-g" was specified without using "-u". * Fixed handling more than 256 destinations by changing the reference counter type of LogMessages to a 16 bit value. * Fixed door initialization on Solaris, the door portion of sun-streams() sources did not work in previous releases. * Fixed a possible segmentation fault in handling file sources that are marked optional and the source file does not exist. * Fixed the LinkSys style timestamp parser to avoid recognizing hostnames starting with numbers as the year value of the timestamp. * Fixed the year recognition heuristics as the older used the previous year in some cases when the client's clock was too fast. Other changes: * Backported end-of-message search algorithm from PE, which results in increased performance and the removal of vague interpretation of messages that contain both NUL and NL characters. * Removed destination files from the set of polled fds, they are always writable anyway and cause performance degradation when a lot of destination files are managed. * Fixed some FreeBSD and AIX portability issues. * Added the BSDTAG macro, implementation by Jung Christian. * Changed the reconnection logic in the TCP destination driver to reattempt connections for any kind of network problems. Therefore an unknown DNS name will not prevent syslog-ng to start up with an initialization error. * Changed the file write error handling logic to suspend writing to a file destination on write errors, but retry it some time later. This time interval is controlled by time_reopen() just like with other drivers. -- Bazsi

1 1

Centralised logging of nginx
by Ed W 18 Apr '08

18 Apr '08

Does anyone have any thoughts on centralising logging of nginx? Anyone used syslog-ng as part of a system to ship the logs to a central location? Thanks Ed W

2 1

About $HOST macro
by Yu Watanabe 16 Apr '08

16 Apr '08

Hello, I have a question regarding to the $HOST macro in the syslog.conf. Which value does the syslog-ng uses for the hostname? It seems that there are circumstatnses that it converts the SOURCEIP using the /etc/hosts and sometimes it gets the hostname somewhere else. I would like to know how does the syslog-ng defines this value. Yu Watanabe

2 1

Parsing tab characters
by Norman Elton 15 Apr '08

15 Apr '08

We've configured a host to send syslogs to our central repository running syslog-ng 2.0.3. This particular host is sending tab-delimited entries. The normal syslogd daemon parses and saves the messages correctly. Syslog-NG seems to save them encoded as \011. Can syslog-ng be configured to save the decoded ASCII characters? Or can the messages be shoved through something like sed to be massaged before saving? Thanks! Norman Elton

3 3

Logging to dirs with $HOST gives me strange results
by Markus Strangl 15 Apr '08

15 Apr '08

Hi syslog-ng users, I'm running a central syslog-ng 2.0.6 server with a rather simple ruleset, just to collect copies of the syslogs from a bunch of machines. They are running Solaris 9 and 10, with the onboard syslog, forwarding with syslog.conf "*.alert @logso01". Syslog-NG's logging targets are set up like that: source net { udp(); }; destination messages { file("/logs/$HOST/messages"); }; log { source(net); filter(f_high); destination(messages); }; Options are set to use the /etc/hosts file, and all hosts are listed there. In theory, this should give me one directory for each hosts that's forwarding its log messages. However, in practice, I get quite a lot of useless directories as well, that don't match any real host. root@logso01:/logs>ls \"/ \011Corrupt/ \011PLOGI/ \011SONY_AIT/ \011got/ \011offline/ \011/ \011Error/ \011SCSI/ \011failed/ \011i/ \011transport/ (C) SC admso01-qfs archso03-mgm nrgdev nrgstg jumpso01-qfs testso01 nrgso01 US archso01-mgm archsrv-qfs nrgprod1-qfs epldev logso01 testso02-qfs All Use archso01-xfcu by nrgprod2-qfs for prodso01-mgm IBM Use, archso02-mgm cutapsrv nrgprod3-qfs gconfd stgaoma Licensed Version archso02-xfcu delso01-sn nrgso01-qfs ddpso01-qfs svnso01-mgm It looks like under some condition, syslog-ng doesn't use the source hostname for the $HOST config directrive, but the first word of the log message. Is this a (known?) bug, or is there any way to circumvent that behaviour? Please advise. Yours Markus

2 1