January 2009 - syslog-ng - lists.balabit.hu

syslog-ng vs. SEC problems after upgrading to 2.1.3
by Jyri Hovila 05 Feb '09

05 Feb '09

Hi everyone! I've been running syslog-ng and SEC (Simple Event Correlator, http://www.estpak.ee/~risto/sec/) on several Arch Linux (www.archlinux.org) servers for few years now. After upgrading to syslog-ng 2.1.3 things suddenly stopped working on all five servers with identical configuration. Here's what's going on: The syslog-ng part of the deal goes like this (from /etc/syslog- ng.conf): destination d_sec { program("/usr/bin/perl /usr/share/sec/sec.pl - input=\"-\" -conf=/usr/local/etc/sec.conf"); }; log { source(src); destination(d_sec); }; This setup has been working fine all these years; it's been sending all incoming syslog messages to SEC, which has been parsing the messages just fine. After upgrading to syslog-ng 2.1.3, SEC stopped receiving anything from syslog-ng. These messages are being logged to /var/log/everything every 10 minutes: Jan 28 13:36:14 2 syslog-ng[19411]: Log statistics; dropped='program(/ usr/bin/perl /usr/share/sec/sec.pl -input="-" -conf=/usr/local/etc/ sec.conf)=0', processed='center(queued)=255119', processed='center(received)=123603', processed='destination(d_sec)=123603', processed='destination(acpid)=0', processed='destination(console)=0', processed='destination(debug)=0', processed='destination(mail)=5485', processed='destination(user)=309', processed='destination(uucp)=0', processed='destination(messages)=1163', processed='destination(ppp)=0', processed='destination(news)=0', processed='destination(iptables)=92399', processed='destination(everything)=6778', processed='destination(lpr)=0', processed='destination(cron)=0', processed='destination(syslog)=123', processed='destination(authlog)=24426', processed='destination(errors)=5', processed='destination(kernel)=147', processed='destination(daemon)=681', processed='destination(console_all)=0', processed='source(src)=123603', suppressed='program(/usr/bin/perl /usr/ share/sec/sec.pl -input="-" -conf=/usr/local/etc/sec.conf)=0' ps aux tells me that SEC is running fine, but it seems syslog-ng doesn't want to speak to it properly. I have no idea where to go from here. Any tips, anyone? Thanks in advance! Yours, Jyri

2 1

Getting warnings while building syslog-ng-2.1.3 on HP-UX ITA64
by Chanchal Verma 05 Feb '09

05 Feb '09

Hi, I am trying to build syslog-ng-2.1.3 on HP-UX Itenium (64-bit) box. I am doing '--enable-dynamic-linking' and it is giving following warning messages while 'make'. ************************Warning messages during 'make' ******************* .. .. gcc -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -lcl -o loggen loggen.o -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap ld: (Warning) Unsatisfied symbol "yyleng" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylenguc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyinput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyunput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyolsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytext" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyoutput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextuc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyextra" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyfnd" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyprevious" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylex" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyout" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "deny_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "allow_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "yylstate" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextarr" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyback" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "rfc931_timeout" in file /usr/lib/hpux32/libwrap.so 20 warnings. ******************************************************************************* It is giving me similar error message while running syslog-nd daemon and fail. I have installed flex to get rid of libl.so but no success. # swlist |grep -i flex flex 2.5.4a flex # gcc -v Using built-in specs. Target: ia64-hp-hpux11.31 Configured with: ../gcc/configure Thread model: posix gcc version 4.2.3 Here is configure result: ================================ syslog-ng Open Source Edition 2.1.3 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -I/usr/local/include/glib-2.0 -I/usr/local/lib/hpux32/glib-2.0/include -I/opt/soe/local/syslog-ng-2.1.3/eventlog/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lcl -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap prefix : /opt/soe/local/syslog-ng-2.1.3 Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SQL support : no ================================ Any help will be highly appreciated. -- Chanchal

2 1

Re: [syslog-ng] Writing to a named Pipe
by Pedro Rafael Alves Simoes 05 Feb '09

05 Feb '09

The patch worked. Is there any way to create the pipes on the fly? Date: Thu, 22 Jan 2009 19:39:48 +0100 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] Writing to a named Pipe To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1232649588.15998.177.camel(a)bzorp.balabit> Content-Type: text/plain On Thu, 2009-01-22 at 15:26 +0000, Pedro Rafael Alves Simoes wrote: > Hello, > > In my syslog-ng configuration I'm writing messages to named pipes > which name is given dynamically by the $PRI macro: > > destination d_test { > pipe("/tmp/$PRI.log"); > }; > > All the possible PRI.log pipes were created previously with mkfifo. > > With this configuration the messages aren't being written to the > pipes. It simply does nothing. Doing a strace on the syslog-ng > process, it shows an error : > > open("/tmp/$PRI.log", O_RDWR|O_NONBLOCK|O_NOCTTY|O_LARGEFILE) = -1 > ENOENT (No such file or directory) > > It seems that the PRI macro isn't being interpolated in the string. well, the pipe() driver does not support macros, thus it uses the string literally. More exactly the pipe driver explicitly disallows that. Since I don't remember exactly why I did this, here's a patch that removes the restriction. Please let me know how it works out for you, if it seems to work, I'm also willing to integrate it. Patch is against OSE 3.0, but is trivial to backport to 2.1 diff --git a/src/cfg-grammar.y b/src/cfg-grammar.y index 761bb56..fdfa18f 100644 --- a/src/cfg-grammar.y +++ b/src/cfg-grammar.y @@ -801,7 +801,7 @@ dest_afpipe dest_afpipe_params : string { - last_driver = affile_dd_new($1, AFFILE_NO_EXPAND | AFFILE_PIPE); + last_driver = affile_dd_new($1, AFFILE_PIPE); free($1); last_writer_options = &((AFFileDestDriver *) last_driver)->writer_options; last_writer_options->flush_lines = 0; -- Bazsi

3 3

syslog-ng Filter expression help
by cod3fr3ak 28 Jan '09

28 Jan '09

Is there anyway I can combine these filters into a single line per host? filter f_host-dns1 { host ("SVR006*") or host ("dns1*"); }; filter f_host-dns2 { host ("SVR015*") or host ("dns2*"); }; filter f_host-dns21 { host ("SVR138*") or host ("dns21*"); }; filter f_query-dns1 { filter (f_local0) and filter (f_host-dns1); }; filter f_query-dns2 { filter (f_local0) and filter (f_host-dns2); }; filter f_query-dns21 { filter (f_local0) and filter (f_host-dns21); }; I think I can but I am unsure of how syslog-ng handles ANDs and ORs

2 1

SSL compile errors even when configured without ssl support
by Chris Fabri 27 Jan '09

27 Jan '09

Greetings- I'm trying to compile syslog-ng 3.0.1 on RH 3 (yes, I know), and am unable to compile due to what appear to be openssl related errors: In file included from tlscontext.h:12, from tlscontext.c:1: /usr/include/openssl/ssl.h:909: syntax error before "KSSL_CTX" /usr/include/openssl/ssl.h:931: syntax error before '}' token Are the last set. However, I ran configure with "--disable-ssl." Reviewing some of the archives, it appears this was fixed in v3.0 back in Nov '08: https://lists.balabit.hu/pipermail/syslog-ng/2008-November/012234.html I've tried the 11202008 build just in case, and that didn't 'seem to resolve the problem. I really don't need SSL, so it would be much simpler to just skip the SSL part than try to get it working to get around this error. Various searches of the archives have mentioned that this was fixed a few other times, but I'm not having any luck. Help? :) chris

3 7

Cannot find init.d.AIX in contrib folder
by Chanchal Verma 23 Jan '09

23 Jan '09

Hi, I am building syslog-ng-2.1.3 on AIX 5.1. I compiled it successfully and tool is working fine. I am in process to automate the start script. I cannot find init.d.AIX script in <..>/syslog-ng-2.1.3/contrib folder. It is available for other OS (solaris, SunOS,HP-UX,RedHat..). The startup script which I have created is not 100% compliance with the AIX OS. Like syslog-ng is running on server and it is still showing status 'inoperative' as Subsystem status. I need startup script for AIX OS. Any help will be highly appreciated. With Regards, Chanchal Verma

3 5

Fixed number fd-limit doesn't scale
by Corinna Vinschen 23 Jan '09

23 Jan '09

Hi, in 3.0.1, in src/gprocess.c, line 112, the fd_limit_min is set to the fixed value 4096. This doesn't work well on systems which have a hard limit smaller than 4K. While there's a command line option --fd-limit (but unfortunately no equivalent config file option), the default on those systems is to get an error message at startup: syslog-ng: Error setting file number limit; limit='4096'; error='Too many open files' Wouldn't it be better to choose a system specifc default like OPEN_MAX instead or better, to call sysconf(_SC_OPEN_MAX) to fetch the system default and only use 4096 as fallback if none of the two is available or the values are larger than 4K? Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 9

New files for contrib/cygwin-packaging
by Corinna Vinschen 23 Jan '09

23 Jan '09

Hi, so far I didn't upgrade Cygwin's syslog-ng beyond 2.1.x. The changes in 3.0 require to change the Cygwin specific files in the contrib directory. Both files are attached. Could these both please applied to the syslog-ng repository? Thanks in advance, Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 3

Writing to a named Pipe
by Pedro Rafael Alves Simoes 22 Jan '09

22 Jan '09

Hello, In my syslog-ng configuration I'm writing messages to named pipes which name is given dynamically by the $PRI macro: destination d_test { pipe("/tmp/$PRI.log"); }; All the possible PRI.log pipes were created previously with mkfifo. With this configuration the messages aren't being written to the pipes. It simply does nothing. Doing a strace on the syslog-ng process, it shows an error : open("/tmp/$PRI.log", O_RDWR|O_NONBLOCK|O_NOCTTY|O_LARGEFILE) = -1 ENOENT (No such file or directory) It seems that the PRI macro isn't being interpolated in the string. Any help?

2 1

[Bug 27] New: 3.0.1: syntax check (-s) overwrites syslog-ng.pid
by bugzilla＠bugzilla.balabit.com 20 Jan '09

20 Jan '09

https://bugzilla.balabit.com/show_bug.cgi?id=27 Summary: 3.0.1: syntax check (-s) overwrites syslog-ng.pid Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 syslog-ng -s overwrites syslog-ng.pid which makes no sense because we loose information about pid of running syslog-ng daemon. Then "stop" action in many init scripts is not able to find out pid of original syslog-ng this making "stop" no longer working. ps. version form in bugzilla missess 3.x.x versions -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1