October 2009 - syslog-ng - lists.balabit.hu

trying to install syslog-ng 3.0.4 and drivers for oracle
by Ross, Michael W. 10 Oct '09

10 Oct '09

We are trying to get syslog-ng (OSE) 3.0.4 on Red Hat AS 4 to feed into an oracle DB using the sql() destination. We get syslog-ng to install and run A-OK and we think we have it configured right. What we are struggling with is what all we need to install in addition to syslog-ng. We have installed libdbi-0.8.3.1 and libdbi-devel-0.8.3.1. We have not been able to find the specific oracle driver, which we think we need. Do we need the specific oracle driver, if so where can we find it? Thanks... Mike

3 2

syslog-ng with sql() command, cpu to 100%
by Garry De Toffoli 10 Oct '09

10 Oct '09

I am using the version 3.04 of syslog-ng, as reported: $./syslog-ng -V syslog-ng 3.0.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#1b5d618e301ad94aa20e692ffba16469dece8d10 Compile-Date: Aug 5 2009 17:38:20 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: off I would like to use the sql() features; but syslog-ng does not write anything on dbase, and the cpu go to 100%; this is the configuration of the destination sql destination d_mysql { sql(type(mysql) host("localhost") username("syslogadmin") password("syslogadmin") database("syslog") table("logs") columns("host", "facility", "priority", "level", "tag", "datetime", "program", "msg", "seq") values("$HOST_FROM", "$FACILITY", "$PRIORITY", "$LEVEL", "$TAG", "$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC", "$PROGRAM", "$MSG", "$SEQNUM") indexes("host", "facility", "priority", "datetime", "program", "seq")); }; of course, the configuration like this destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; run OK, but I would like to use the sql() statement instead; what can I do? Is the sql() command supported by the syslog-ng 3.0.4? Thank you. _________________________________________________________________ Gossip, Sport, Notizie... Accendi la Messenger TV! http://www.messenger.it/messengerTV.aspx

3 2

Strange behaviour of syslog-ng. Date macros not working and missing character in file name.
by Nilshar 10 Oct '09

10 Oct '09

Thank you Bazsi ! could you point me to the reported bug, or any more informations about it ? I don't see it in changelog file, and can't find it in the bug tracking system. Thank you.

2 1

Re: [syslog-ng] Question about flags(ignore-case) option
by PAUL WILLIAMSON 10 Oct '09

10 Oct '09

>>> Balazs Scheidler <bazsi(a)balabit.hu> 10/10/09 8:37 AM >>> > > it should be: > > host("system" flags(ignore-case)); > > this is indeed a bug in the documentation. Excellent! That works perfectly! (of course!) -- Paul ************************************ This email may contain privileged and/or confidential information that is intended solely for the use of the addressee. If you are not the intended recipient or entity, you are strictly prohibited from disclosing, copying, distributing or using any of the information contained in the transmission. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. You may not directly or indirectly reuse or disclose such information for any purpose other than to provide the services for which you are receiving the information. There are risks associated with the use of electronic transmission. The sender of this information does not control the method of transmittal or service providers and assumes no duty or obligation for the security, receipt, or third party interception of this transmission. ************************************

1 0

apache/jboss/log4j filters
by Adam Harvey 08 Oct '09

08 Oct '09

Good morning, I'm trying to log numerous hosts to a central server. The remote servers are running apache and jboss. Jboss logs to a single file locally, apache logs to numerous files based upon access/errors locally. Having a difficult time filtering the input streams from remote hosts to log these files (or should I even be filtering?) Trying to decide if syslog-ng is the right way to centralize these logs for collection. Any ideas/feedback is very appreciated. Thanks, Adam

1 0

Forward syslog messages unchanged
by PAUL WILLIAMSON 07 Oct '09

07 Oct '09

I found a thread from about 5 years ago where someone wanted to forward messages untouched to another system, but there never was a follow up to say if it was possible. I need to do that, but the messages are still getting to the remote system with my ip address as the source. I have the keep_hostnames(yes) global option set, and I'm still having the problem. Is there any other option I may not know about to do this? Do I need to set up another syslog-ng enabled server and have that system read from there instead of me forwarding the events right to that machine's port? Thanks, Paul ************************************ This email may contain privileged and/or confidential information that is intended solely for the use of the addressee. If you are not the intended recipient or entity, you are strictly prohibited from disclosing, copying, distributing or using any of the information contained in the transmission. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. You may not directly or indirectly reuse or disclose such information for any purpose other than to provide the services for which you are receiving the information. There are risks associated with the use of electronic transmission. The sender of this information does not control the method of transmittal or service providers and assumes no duty or obligation for the security, receipt, or third party interception of this transmission. ************************************

2 1

syslog-ng with sql() command, cpu to 100%
by Garry De Toffoli 07 Oct '09

07 Oct '09

I have tried to use strace, and this is what is reported: 15:16:09.221845 execve("/opt/syslog-ng/sbin/syslog-ng", ["/opt/syslog-ng/sbin/syslog-ng", "-f", "/opt/syslog-ng/etc/syslog-ng.conf"], [/* 16 vars */]) = 0 15:16:09.232664 brk(0) = 0x83e2000 15:16:09.232971 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) 15:16:09.233274 mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb801d000 15:16:09.233520 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) 15:16:09.233717 open("/opt/syslog-ng/lib/tls/i686/sse2/cmov/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory) 15:16:09.236940 stat64("/opt/syslog-ng/lib/tls/i686/sse2/cmov", 0xbf83a9e0) = -1 ENOENT (No such file or directory) 15:16:09.237178 open("/opt/syslog-ng/lib/tls/i686/sse2/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory and it is looping with these error messages: 15:16:09.237751 stat64("/opt/syslog-ng/lib/tls/i686/cmov", 0xbf83a9e0) = -1 ENOENT (No such file or directory) 15:16:09.237930 open("/opt/syslog-ng/lib/tls/i686/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory) 15:16:09.238125 stat64("/opt/syslog-ng/lib/tls/i686", 0xbf83a9e0) = -1 ENOENT (No such file or directory) 15:16:09.238296 open("/opt/syslog-ng/lib/tls/sse2/cmov/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory) 15:16:09.238488 stat64("/opt/syslog-ng/lib/tls/sse2/cmov", 0xbf83a9e0) = -1 ENOENT (No such file or directory) On my Linux box there is no /etc/ld.so.nohwcap, and there is no "tls" path under the "lib" path of syslog-ng I have used the compiled version of syslog-ng ./syslog-ng -V syslog-ng 3.0.4 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#1b5d618e301ad94aa20e692ffba16469dece8d10 Compile-Date: Aug 5 2009 17:38:20 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: off Thank you > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 7 Oct 2009 11:36:17 +0200 > From: Sandor Geller <Sandor.Geller(a)morganstanley.com> > Subject: Re: [syslog-ng] syslog-ng with sql() command, cpu to 100% > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <edabd2010910070236h460880edp4e824905927d9883(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi, > > > it seems that the sql() statement go in loop; > > > > where is the error? > > Could you attach strace on syslog-ng, preferably restarting syslog-ng > under strace? Something like > > strace -ff -tt -s 128 -p <PID of running syslog-ng> -o syslogstrace > > In the resulting files you could either find the cause of the problem, > or you could send us some details about what's going on. > > Regards, > > Sandor > > > ------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > End of syslog-ng Digest, Vol 54, Issue 7 > **************************************** _________________________________________________________________ Gossip, Sport, Notizie... Accendi la Messenger TV! http://www.messenger.it/messengerTV.aspx

3 2

[Fwd: Re: up to date syslog-ng.conf ?]
by Pallagi Zoltán 07 Oct '09

07 Oct '09

1 0

syslog-ng with sql() command, cpu to 100%
by Garry De Toffoli 07 Oct '09

07 Oct '09

I have tried to run syslog-ng in this way: root@syslog-srv904:/opt/syslog-ng/sbin# ./syslog-ng -f /opt/syslog-ng/etc/syslog-ng.conf without any option of debug; on syslog-ng.conf there is: destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslogadmin") password("syslogadmin") database("syslog") table("logs") columns("host", "facility", "priority", "level", "tag", "datetime", "program", "msg") values("$HOST", "$FACILITY", "$PRIORITY", "$LEVEL", "$TAG", "$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC", "$PROGRAM", "$MSG") indexes()); }; MySql is configured to accept the configuration from network, so the host("127.0.0.1") username("syslogadmin") password("syslogadmin") is correct; and the CPU run to 100% and doesn't write anything to dbase; but if use this configuration destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; run OK; it seems that the sql() statement go in loop; where is the error? Someone can send a configuration that run OK? Thank you. _________________________________________________________________ Scopri tutti i servizi Windows Live, guarda i video http://www.windowslive.it/videoGallery.aspx

2 1

up to date syslog-ng.conf ?
by Jean F. Mousinho 06 Oct '09

06 Oct '09

Hello, I'm trying to use a compiled version of syslog-ng (3.0.4) tho I'm not successful to find a syslog-ng.conf file that cames with that package and is up to date. Find reveals several configuration files: ./debian/syslog-ng.conf ./contrib/hpux-packaging/syslog-ng.conf ./contrib/rhel-packaging/syslog-ng.conf ./contrib/aix-packaging/syslog-ng.conf ./contrib/fedora-packaging/syslog-ng.conf tho, none of them has @version keyword in the head, so syslog-ng is nagging for not being able to determine the configuration version. I'm running syslog-ng manually from the ./src specifing the configuration file from the command line (using -f). So the question is, where is the syslog-ng.conf for the 3.0.4 version (after doing ./configure .. and make) ? Thanks for your help. Jean F. Mousinho

2 1