April 2008 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] TAG-Macro
by JUNG, Christian 07 Apr '08

07 Apr '08

> -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of > Balazs Scheidler > Sent: Tuesday, March 18, 2008 12:46 PM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] TAG-Macro > > Something like BSDTAG? > Attached is a patch to the 2.0.9 source tree of syslog-ng which implements the "BSDTAG" macro. bye Chris

2 2

changing the location of the disk buffer for log_disk_fifo_size()
by Lucky Y 07 Apr '08

07 Apr '08

Hi, Is there anyway to change the location of the disk buffer for log_disk_fifo_size() ? It buffers the messages in /var/lib/syslog-ng/ by default in Linux, but in our system this directory will not exist. Regards, Lucky

2 2

About Syslog-ng Macro
by Yu Watanabe 07 Apr '08

07 Apr '08

TO : Syslog-NG Developers Hello , I have a question regarding to the syslog-ng macros that is useful in the syslog.conf. I am using syslog-ng in the follwoing development. 1. Linux **** 2.6.9-42.EL #1 Sat Aug 12 09:17:58 CDT 2006 i686 i686 i386 GNU/Linux 2. CentOS release 4.4 (Final) 3. LANG=ja_JP.eucJP However, whenever I try to ouput the multibye code(EUC) through the macro such as $MSG the message do not show properly. I am defining the following template and destination function in the config file. template t_temp { template("$S_YEAR-$S_MONTH-$S_DAY $S_HOUR:$S_MIN:$S_SEC $SOURCEIP $MSG\n"); }; destination d_log { program("/tmp/stdin2phpsyslogng.pl > /tmp/stdin2phpsyslogng.log 2>&1" template(t_temp)); }; But in the log file which is created through the file driver the japanese code shows properly. I am defining the following definition destination host_splitter { file( "/tmp/$HOST.log" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; I am looking in the source code but I am having trouble with the investigation. If its possible, I would like to know why this is happening. Is there any way to modify the macro problem? Thank you! Yu Watanabe

3 5

log_disk_fifo_size() option
by Lucky Y 07 Apr '08

07 Apr '08

Hi, In which version of syslog-ng is this feature implemented ? Regards, Lucky

2 1

syslog-ng 2.0 release preparations
by Balazs Scheidler 07 Apr '08

07 Apr '08

Hi, I've forward ported some bugfixes from syslog-ng OSE 2.1 to 2.0. I've tried to backport only the critical and less intrusive ones. The changes are below: Balazs Scheidler (10): backported apphook framework as it is needed for a Solaris specific change Fixed door initialization on Solaris fixed possible segfault for non-existing optional source files Added Solaris 10 specific svc manager files fixed solaris packaging. Binary statically linked on Solaris 8/9, dynamically on 10. ported to FreeBSD fixed compilation problem on AIX 5.2 fixed compilation issue on freebsd, include stat.h in misc.c Fixed svc method script permissions and added an export to LD_LIBRARY_PATH added LD_LIBRARY_PATH to the svc manager method script The most problematic change is the apphook backport to fix Solaris door initialization, and any possible problems that would result in the portability fixes. You can get the latest release via git (git.balabit.hu) or by fetching tomorrow's snapshot. -- Bazsi

1 0

Read logs from file and send them to another host
by Jaime Ventura 04 Apr '08

04 Apr '08

Hello. I need to read logs from file and send them to another host. Thats pretty easy with syslog-ng. On the target host, i need to save them on a specific file. That is done by using the filters. And here's the problem, which filter to use? I mean, how can I specify a priority (local7, for instance) on the source host, in order to filter it on the destination? Thanks Jaime

1 0

2.0.9 Solaris 10 x86 compilation error: loggen/yylex issue
by Marvin.Nipper＠Stream.com 04 Apr '08

04 Apr '08

I see in the archives that someone else, in a prior version, had encountered the problem of not being able to get a good compile on Solaris 10, but I never saw any resolution to that issue. I'm having the same problem now with 2.0.9. The last request (from bazsi, in the email of Wed Mar 12 11:08:36 CET 2008) was to check the cfg-lex.c file, to ensure that it was not zero length. I checked mine, and it is 56023 in size (slightly larger than the one used with my successful 2.0.5 compilation). In short, I guess I'm just looking for some input/guidance as to what may not be "quite right" in 2.0.9, that would make it no longer compile on my server (where 2.0.5 obviously did compile). Any and all help appreciated! Obviously, I'll gladly feed you any files or information that would assist in problem solving. Below, is the portion of the make output at the point where things fall apart. As further input, I'm using libnet (for source-spoofing) and obviously using the most current EventLog (that hasn't changed since my 2.0.5 compilation). I'm using the glib components delivered with Solaris 10 (again, as was done in 2.0.5). THANKS for your input and help! Portion of the make that failed....... gcc -g -O2 -Wall -o loggen loggen.o -lpthread -lresolv -lnsl -lrt -lsocket -ldoor -lfl -lglib-2.0 -L/usr/local/lib -levtlog -lsocket -lnsl -lnet Undefined first referenced symbol in file yylex /usr/sfw/lib/gcc/i386-pc-solaris2.10/3.4.3/../../../libfl.so ld: fatal: Symbol referencing errors. No output written to loggen collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `loggen' Current working directory /var/opt/packages/syslog-ng-2.0.9/tests/loggen *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='unit functional loggen'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /var/opt/packages/syslog-ng-2.0.9/tests *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src tests doc contrib solbuild tgzbuild'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /var/opt/packages/syslog-ng-2.0.9 *** Error code 1 make: Fatal error: Command failed for target `all' Marvin Nipper Director of Security Stream mailto:marvin.nipper@stream.com PGP Key ID: 0x8EE28551 (DSS/DH) 8C5D 403A D107 0A95 672B B637 BCF1 919A 8EE2 8551

1 0

io.c: bind_inet_socket() bind failed Address already in use
by Lucky Y 04 Apr '08

04 Apr '08

> >We use syslog-ng 1.6.12 in RHEL4. > >As part of our system testing we restart syslog-ng 150 times in a loop > >along with other services in the server. > > > >syslog-ng fails to come up 3/4 times with the error : > >"io.c: bind_inet_socket() bind failed 192.168.128.1:601 >> Address already in use". >How do you restart syslog-ng? It takes some time to close sources/ >destinations and there is a chance that the new syslog-ng instance >tries to bind to the same address the not-yet-stopped instance >still uses. SIGKILL will be sent to the process, and then syslog-ng will be started again. Some example messages seen in the syslog during the restart are: INFO Process PID = 7216 is killed, signal SIGKILL sent successfully, path = /opt/bin/syslog-ng -F -p /var/run/master-syslog-ng.pid -f /etc/syslog-ng.conf. io.c: do_write: write() failed (errno 32), Broken pipe syslog-ng[6242]: pkt_buffer::do_flush(): Error flushing data syslog-ng[6242]: Connection broken to AF_INET(Server:601), reopening in 5 seconds INFO Process, PID = 7216, is signaled, signal number = 9, path = /opt/bin/syslog-ng -F -p /var/run/master-syslog-ng.pid -f /etc/syslog-ng.conf INFO Send start process command, process name: /MasterSyslogDaemon INFO A process started, pid:30573, process:/opt/bin/syslog-ng -F -p /var/run/master-syslog-ng.pid -f /etc/syslog-ng.conf INFO Process, PID = 30573, exit abnormally, exit code = 2, path = /bin/syslog-ng -F -p /var/run/master-syslog-ng.pid -f /etc/syslog-ng.conf INFO Reporting termination of process /MasterSyslogDaemon INFO Termination of process MasterSyslogDaemon reported io.c: bind_inet_socket() bind failed 192.168.128.1:601 Address already in use

1 0

io.c: bind_inet_socket() bind failed Address already in use
by Lucky Y 04 Apr '08

04 Apr '08

Hi, We use syslog-ng 1.6.12 in RHEL4. As part of our system testing we restart syslog-ng 150 times in a loop along with other services in the server. syslog-ng fails to come up 3/4 times with the error : "io.c: bind_inet_socket() bind failed 192.168.128.1:601 Address already in use". Is this a known problem in syslog-ng 1.6.12 ? Or is it a configuration problem ? Part of the syslog-ng.conf : # Options ######################################################## options { log_fifo_size(15000); stats(86400); time_reopen(5); log_msg_size(65536); }; # Source definitions ############################################## source src { tcp(ip("Server") port(601) keep-alive(yes) max-connections(100)); udp(ip("Server") port(514)); unix-stream("/dev/master_log"); internal(); };

2 1

changing the location of the disk buffer for log_disk_fifo_size()
by Lucky Y 03 Apr '08

03 Apr '08

On Thu, 2008-04-03 at 12:16 +0300, Lucky Y wrote: > >Hi, > > > >Is there anyway to change the location of the disk buffer for > >log_disk_fifo_size() ? > > > >It buffers the messages in /var/lib/syslog-ng/ by default in Linux, > >but in our system this directory will not exist. >Not currently, however I plan to add functionality that will cause >syslog-ng to use the same directory as specified by the --persist-file >switch. >Would that be ok for you? It will be very useful if we can specify the directory to store the buffered messages itself. _Lucky

1 0