January 2009 - syslog-ng - lists.balabit.hu

YACC Stack Overflow
by Cauchi, Geoffrey, VF-MT 19 Jan '09

19 Jan '09

Hi I am using syslog version 2.0.8 and all is running well. I am using it to log a number of Cisco devices. Recently I tried to add an additional number of devices that I would like to have their syslog sent to the Syslog-NG server. This is the syntax used in the config file: destination CAT1 { file("/var/log/switches/CAT1/log.txt" dir_perm(0755) perm(0755));}; filter f_filter73 { netmask(192.168.150.25);}; log { source(s_udp); filter(f_filter73); destination(CAT1); }; However, when I restart syslog-ng I get the following error: Stopping syslog-ng: [OK] Starting syslog-ng: yacc stack overflow at 314 YACC is complaining of a stack overflow. Syslog-ng is running on Fedora Core 8. Did anyone encounter this problem before? Any help would be appreciated. Thanks Gef ------------------------------------------------------------------------------------- Vodafone Life is Now ------------------------------------------------------------------------------------- This email is intended only for the use of individuals to whom it is addressed, as it may contain confidential or privileged information. If you are not a named addressee, intended recipient, or the person responsible for delivering the message to the named addressee, be advised that you have received this email in error and that you should not disseminate, distribute, print, copy this mail or otherwise divulge its contents. In such instances, please notify Vodafone Malta Limited on telephone number +356 99999247 and delete this email from your system. Since this transmission was affected via email, Vodafone Malta Limited cannot guarantee that it is secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Vodafone Malta Limited does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission. Save the environment for our children - Print e-mail only when necessary.

2 7

syslog-ng-2.1.3: 'Configure' failed on Solaris 8 using --enable-static-linking
by Chanchal Verma 19 Jan '09

19 Jan '09

Hi, I have successfully build syslog-ng-2.1.3 with --enable-dynamic-linking on Solaris 8. While trying to build using --enable-static-linking option, it is not allowing me to configure syslog-ng-2.1.3 version on my Solaris 8 box (sparc). It is not able to find glib-2.0.a (Static library), though it is available in /usr/local/lib path. -rw-r--r-- 1 root 2822036 Jan 15 06:21 /usr/local/lib/libglib-2.0.a Here is error message while doing compilation: ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- ./configure --enable-static-linking --prefix=/opt/syslog-ng-2.1.3 .... .... checking whether to enable TCP wrapper support... no checking whether to enable spoof source support... no checking whether to enable IPv6 support... yes checking whether to enable SQL support... no checking for pkg-config... (cached) /usr/local/bin/pkg-config checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.4.0... yes (version 2.13.0) checking for static GLib libraries... no checking sanity checking Glib headers... yes configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- I have compiled glib-2.13.1 witn --enable-static option to get libglib-2.0.a library using gcc-3.4.6 compiler (same I am using for syslog-ng). Somehow syslog-ng is not able to find Static Glib during configure. Any help will be highly appreciated. Thanks, Chanchal Verma

4 9

Drops?
by Mike Rykowski 16 Jan '09

16 Jan '09

I configured syslog-ng to pass messages to SEC via named pipes. When I did I saw in the log statistics: Jan 13 09:10:00 syslog-ng[13736]: Log statistics; dropped='pipe(sec- pipe)=1607', dropped='unix-dgram(AF_UNIX(/dev/log))=0', processed='center(queued)=1794661', processed='center (received)=1718990', I then called SEC using the 'program' option instead of named pipes and I got: Jan 13 10:14:13 syslog-ng[14031]: Log statistics; dropped='program (/usr/local/bin/sec.pl -input="-" -conf=/usr/local/etc/my-sec.conf)=0', dropped='unix-dgram(AF_UNIX(/dev/log))=0', processed='center (queued)=2552863', processed='center(received)=2447130', The drops were zero but the queued and received were not equal. Does this mean messages are getting dropped? When I don't call SEC at all I get queued and received to be equal: Jan 14 09:26:44 syslog-ng[14119]: Log statistics; dropped='unix-dgram (AF_UNIX(/dev/log))=0', processed='center(queued)=70516726', processed='center(received)=70516726', -- Mike Rykowski NU-IT Telecommunications and Network Services

2 1

[Bug 26] New: 3.0.1: syslog facility is not recognized
by bugzilla＠bugzilla.balabit.com 16 Jan '09

16 Jan '09

https://bugzilla.balabit.com/show_bug.cgi?id=26 Summary: 3.0.1: syslog facility is not recognized Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: regression Estimated Hours: 0.0 Config contains: filter f_systlog { facility(syslog); }; and syslog-ng 3.0.1 yells: syntax error in /etc/syslog-ng/syslog-ng.conf at line 75. Replacing "facility(syslog)" with "facility(news)" and problem is gone which suggests problems with parsing "syslog" correctly. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

syslog-ng MIB table
by Riza Kamalie 16 Jan '09

16 Jan '09

Hi, Does syslog-ng have a MIB that can be quered using snmp? Regards Riza

2 1

Error resolving user error 3.0.1
by Riza Kamalie 16 Jan '09

16 Jan '09

Hi there, I have recently installed syslog-ng 3.0.1 OSE on fedora 9 running on a SUN X2100. I have an issue when using owner(username) and dir_owner(username) parameters and received the following error when starting up and the logs files don't have the desired ownership. [root@]# /usr/local/syslog-ng/sbin/syslog-ng -F -e -f /usr/local/syslog-ng/etc/syslog-ng.conf *Error resolving user; user='username' Error resolving user; user='username'* syslog-ng starting up; version='3.0.1' Any advise would be great. Excellent application + documentation. Regards Riza

4 6

[patch] Add follow_freq_ms option
by Joe Shaw 16 Jan '09

16 Jan '09

Hi, As I mentioned in the last thread, I've found myself wanting to have better than one second resolution for the follow_freq() option. Attached is a patch which adds a follow_freq_ms option, which takes its value in milliseconds rather than full seconds. follow_freq() continues to work as it did previously. Thanks, Joe

3 7

Too Many Open Files
by Zeek Anow 14 Jan '09

14 Jan '09

We are running Solaris 9, syslog-ng 2.0.5, We are getting: Error opening file for writing; filename='/logs/combo/combo.log.01', error='Too many open files (24)' I went into the startup script, /etc/init.d/syslog-ng and tried to up the limit by putting this in the startup section: ulimit -n 4096. When I stop and start syslog-ng and look at the ulimit settings, it still shows 256. core file size (blocks, -c) unlimited data seg size (kbytes, -d) unlimited file size (blocks, -f) unlimited open files (-n) 256 pipe size (512 bytes, -p) 10 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 29995 virtual memory (kbytes, -v) unlimited Any ideas on how to set this? Thanks,

3 2

Make throws link errors over glib2 when compiling syslog-ng 3.0.1
by Joost De Cock 14 Jan '09

14 Jan '09

Hello all, I know that the issue of rewriting syslog messages is a recurring debate here on the list :-) but I'm trying to get 3.0.1 up and running as we need to strip out some info to protect the privacy of our users (there, good cause flag set). I'm having a go under Cygwin and configure runs fine, but make dies on me in a flurry of messages (see below). I'm not much of a devhead, but these seem to be glib2 issue to me. Yet I'm a but stumped on how to beat some sense into it, and any pointer would be hugely appreciated. Thanks in advance, Joost tail of configure output: syslog-ng Open Source Edition 3.0.1 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -I/usr/include/glib-2.0 -I/usr/lib /glib-2.0/include -I/usr/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOU RCE -D_FILE_OFFSET_BITS=64 linker flags : prefix : /usr/local Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : no spoof-source support : no tcp-wrapper support : no SSL support : yes SQL support : no Linux capability support : no PCRE support : no Env wrapper support : no the part where make goes of the rails: gcc -g -O2 -Wall -o syslog-ng.exe main.o libsyslog-ng.a -Wl,-Bstatic -lfl -lglib-2.0 -lintl -liconv -levtlog -lssl -lcrypto -Wl,-Bdynamic -ld l /usr/lib/gcc/i686-pc-cygwin/3.4.4/../../../libcrypto.a(cryptlib.o):cryptlib.c:(. text+0x260): multiple definition of `_DllMain@12' /usr/lib/gcc/i686-pc-cygwin/3.4.4/../../../libglib-2.0.a(gutils.o):gutils.c:(.te xt+0x2c0): first defined here main.o: In function `main_loop_wakeup': /download/syslog-ng-3.0.1/src/main.c:119: undefined reference to `__imp__g_threa ds_got_initialized' /download/syslog-ng-3.0.1/src/main.c:119: undefined reference to `__imp__g_threa d_use_default_impl' /download/syslog-ng-3.0.1/src/main.c:119: undefined reference to `__imp__g_threa d_functions_for_glib_use' /download/syslog-ng-3.0.1/src/main.c:122: undefined reference to `__imp__g_threa ds_got_initialized' /download/syslog-ng-3.0.1/src/main.c:122: undefined reference to `__imp__g_threa d_use_default_impl' /download/syslog-ng-3.0.1/src/main.c:122: undefined reference to `__imp__g_threa d_functions_for_glib_use' main.o: In function `main_loop_run': /download/syslog-ng-3.0.1/src/main.c:195: undefined reference to `__imp__g_threa ds_got_initialized' /download/syslog-ng-3.0.1/src/main.c:195: undefined reference to `__imp__g_threa d_use_default_impl' /download/syslog-ng-3.0.1/src/main.c:195: undefined reference to `__imp__g_threa d_functions_for_glib_use' /download/syslog-ng-3.0.1/src/main.c:198: undefined reference to `__imp__g_threa ds_got_initialized' /download/syslog-ng-3.0.1/src/main.c:198: undefined reference to `__imp__g_threa d_use_default_impl' /download/syslog-ng-3.0.1/src/main.c:198: undefined reference to `__imp__g_threa d_functions_for_glib_use' libsyslog-ng.a(messages.o): In function `msg_event_create': /download/syslog-ng-3.0.1/src/messages.c:140: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/messages.c:140: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/messages.c:140: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/messages.c:149: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/messages.c:149: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/messages.c:149: undefined reference to `__imp__g_t hread_functions_for_glib_use' libsyslog-ng.a(messages.o): In function `msg_event_send': /download/syslog-ng-3.0.1/src/messages.c:167: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/messages.c:167: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/messages.c:167: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/messages.c:169: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/messages.c:169: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/messages.c:169: undefined reference to `__imp__g_t hread_functions_for_glib_use' libsyslog-ng.a(timeutils.o): In function `cached_mktime': /download/syslog-ng-3.0.1/src/timeutils.c:77: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:77: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:77: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:77: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:92: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:92: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:92: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:92: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:95: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:95: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:90: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:90: undefined reference to `__imp__g_t hread_functions_for_glib_use' libsyslog-ng.a(timeutils.o): In function `cached_localtime': /download/syslog-ng-3.0.1/src/timeutils.c:105: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:105: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:105: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:112: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:114: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:114: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:114: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:114: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:117: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:117: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:112: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:112: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:109: undefined reference to `__imp__g_ threads_got_initialized' libsyslog-ng.a(timeutils.o): In function `get_local_timezone_ofs': /download/syslog-ng-3.0.1/src/timeutils.c:134: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:134: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:134: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:134: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:144: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:144: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:165: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:165: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:165: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:165: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:169: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:169: undefined reference to `__imp__g_ thread_functions_for_glib_use' libsyslog-ng.a(timeutils.o): In function `clean_time_cache': /download/syslog-ng-3.0.1/src/timeutils.c:177: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:177: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:177: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:177: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:179: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:179: undefined reference to `__imp__g_ thread_functions_for_glib_use' libsyslog-ng.a(radix.o): In function `r_parser_string': /download/syslog-ng-3.0.1/src/radix.c:42: undefined reference to `__imp__g_ascii _table' libsyslog-ng.a(radix.o): In function `r_parser_ipv4': /download/syslog-ng-3.0.1/src/radix.c:108: undefined reference to `__imp__g_asci i_table' libsyslog-ng.a(radix.o): In function `r_parser_number': /download/syslog-ng-3.0.1/src/radix.c:135: undefined reference to `__imp__g_asci i_table' /download/syslog-ng-3.0.1/src/radix.c:135: undefined reference to `__imp__g_asci i_table' collect2: ld returned 1 exit status make[2]: *** [syslog-ng.exe] Error 1 make[2]: Leaving directory `/download/syslog-ng-3.0.1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/download/syslog-ng-3.0.1' make: *** [all] Error 2

2 2

Configure glitch in 3.0
by Corinna Vinschen 14 Jan '09

14 Jan '09

Hi, I think there's sort of a bug in the configury: if test "x$prefix" = "xNONE"; then prefix=$ac_default_prefix pidfiledir="/var/run" else pidfiledir="${prefix}/var/run" fi This evaluation of the pidfiledir does not take the defaults of autoconf into account. The pidfiledir should rather always default to pidfiledir="${localstatedir}" instead of fiddeling with the prefix itself. Does that make sense? Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 1