February 2009 - syslog-ng - lists.balabit.hu

syslog-ng OSE patch flow
by Balazs Scheidler 14 Feb '09

14 Feb '09

Hi, In order to improve transparency in the syslog-ng development process, I'm going to try to improve the communication about the changes that go into syslog-ng OSE. Currently I see three major ways to get patches into syslog-ng: * Patches that get implemented because one of the list members request it are already posted on this list. * Patches that are submitted to bugzilla.balabit.com are also posted here, because of the bugzilla -> email gateway that I set up. * A third portion of patches that are the results of BalaBit's internal development projects were not posted here so far, simply because I took the internal git tree and ported patches to the open source branch that were relevant. I hope to improve the latter point. At first I thought about "submitting" the patches openly to this mailing list, but then I thought it'd be a mail storm every time I started doing the patch porting. (for instance just today I ported over 30 patches) Also it is not the way I do the work: I use git directly, doing this based on emails would be more difficult for me. Therefore I decided to post a single mail, every time I port patches back-and-forth. This mail would contain a summary for the patches I ported. The summary would be generated using "git-shortlog", more details are always available in the public git repositories at "git.balabit.hu". Currently the author information of my git trees are not perfect, but some changes were already made to improve the accuracy of these fields. Hopefully by the end of the next syslog-ng PE cycle, these would contains the names for the guys who actually worked on this stuff. That's the basic idea. I'm going to submit the current list of patches in a separate mail. -- Bazsi

1 0

3.01 facility(syslog) returns an error
by Tim Boyer 13 Feb '09

13 Feb '09

Continuing with my 3.01 install. My .conf files contains on line 61: filter fprinceton_syslog { facility(syslog); }; [root@princeton src]# ./syslog-ng -s syntax error in /usr/local/etc/syslog-ng.conf at line 61. However, if I change that to the numeric equivalent: filter fprinceton_syslog { facility(5); }; [root@princeton src]# ./syslog-ng -s [root@princeton src]# the error goes away. -- Tim Boyer Denman Tire Corporation

2 2

syslog-ng logging with wrong year
by Mayashankar Mishra 10 Feb '09

10 Feb '09

I have syslog-ng 2.1.1 running, still i face the problem when the date changed from 31 Dec 2008 to 1 Jan 2009, some of the log files still log as 1 Jan 2008 Is it resolved in higher version, and if yes which ? Mayashankar Mishra Consultant E-mail : mmishra(a)isabel.eu Tel : +32 (0)2 403.18.84 Fax : +32 Isabel NV/S.A. Keizerinlaan 13-15 Boulevard de l'Imp?ratrice 1000 Brussels - Belgium RPR Bruxelles / RPM Brussel: BE 0455 530 509 www.isabel.eu<http://www.isabel.eu/> www.zoomit.eu<http://www.zoomit.eu/> Zoomit is a Registered Trademark of Isabel NV/S.A. Disclaimer : www.isabel.eu/gps/en/disclaimer/mailing.php<http://www.isabel.eu/gps/en/disclaimer/mailing.php>

2 2

Still not working at the most basic level
by lance raymond 10 Feb '09

10 Feb '09

ok, so can anyone say how to troubleshoot the most basic scenario to start. 1 server, 1 client, have client write logs to server? I will show both config files, please note tI have tried both UDP and TCP and neither work. I did notice doing an lsof |grep syslog that the port does change from udp to tcp so I know it's reading the config file, I just don't know how to turn on some debugging or another way to trace the log as it's still being written to the client. ok, so *server config is;* #source s_remote { udp(); }; source s_remote { tcp(); }; ## This will create seprate file for each client on central log server and log http messages destination d_clients { file("/var/log/web.$HOST.log"); }; log { source(s_remote); destination(d_clients); }; ################################################################# options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); #udp(ip(0.0.0.0) port(514)); }; ## This will log local http messages to defined file destination send_http_logs { file("/var/log/web.log"); }; filter send_http_logs { program("httpd.*"); }; log { source(s_sys); filter(send_http_logs); destination(send_http_logs); }; and the server shows the following running process; root 30945 0.0 0.0 7240 636 ? Ss 11:24 0:00 /sbin/syslog-ng -p /var/run/syslogd.pid *Client side:* options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames(on); use_dns(yes); dns_cache(yes); use_fqdn(no); create_dirs (yes); keep_hostname (yes); perm(0640); dir_perm(0750); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; #destination send_http_logs { udp("192.168.2.54" port(514)); }; destination send_http_logs { tcp("192.168.2.54" port(514)); }; filter send_http_logs { program("httpd.*"); }; log { source(s_sys); filter(send_http_logs); destination(send_http_logs); }; and the running process are; root 1607 0.0 0.0 6216 904 ? Ss 2008 0:48 syslogd -m 0 root 28374 0.0 0.0 7368 564 ? Ss 11:24 0:00 /sbin/syslog-ng -p /var/run/syslogd.pid Not sure if the client is supposed to have 2 processes or not, but any help is really appreciated.

2 3

[patch] Fix build with --disable-ssl
by Joe Shaw 09 Feb '09

09 Feb '09

Hi, Here's a patch to fix building without SSL. Without it, tlstransport.h is included by tlstransport.c and things break because SSLisms are undefined. Thanks, Joe

3 8

Cannot compile loggen
by fredzy padzy 09 Feb '09

09 Feb '09

Hi everyone ! Ok, i'm quite ashamed to ask this ... but i'm not very good in compiling, and i'm sure it must be easy to solve But i do not succeed ! I discovered that php-syslog-ng provide loggen, written by bazsi. I need this tool since i must benchmark my syslog-ng server. The problem is that our customized version of this OS lacks a lot of librairies and i cannot compile loggen ( FI, i use a pkg of syslog-ng for solaris, since i couldn't compile it, because of too many librairies that where missing) i tried to compil loggen, but didn't succeed :( I tried a simple "gcc loggen.c -o loggen" and i was told : loggen.c:1:20 config.h:No such file or dorectory In which package should i find this config.h file ? because a lot of other tools (like perl) have one The make command give me another error like it doesn't find any "../../ configure.in" which is normal i think. How did you guys managed to compil it ? thanks in advance :)

1 0

Compile 3.0.1 on RHEL 5 with sql support
by Henk van Lingen 09 Feb '09

09 Feb '09

Hi, I'm new to syslog-ng and I'm trying to compile 3.0.1 on a RHEL 5.3 system. I want to use the log to PostgreSQL features so I'm trying to enable sql support. For this I've installed the libdbi packages: root@:~-# yum list '*libdbi*' Loaded plugins: rhnplugin, security Installed Packages libdbi.i386 0.8.1-2.1 installed libdbi.x86_64 0.8.1-2.1 installed libdbi-dbd-pgsql.x86_64 0.8.1a-1.2.2 installed libdbi-devel.i386 0.8.1-2.1 installed libdbi-devel.x86_64 0.8.1-2.1 installed libdbi-drivers.x86_64 0.8.1a-1.2.2 installed However, a configure gives: SQL support : no And a "./configure --enable-dynamic-linking --enable-sql" gives a /home/henk/syslog-ng-3.0.1/src/afsql.c:672: undefined reference to `dbi_initialize' in the make phase. Any ideas what or which lib I am missing? BTW: a configure without --enable-dynamic-linking gives a configure: error: static OpenSSL libraries not found (libssl.a and libcrypto.a) although I have those files both in /usr/lib and /usr/lib64 I have PKG_CONFIG_PATH=/usr/local/lib/pkgconfig, as is needed for eventlog. Regards, -- Henk van Lingen, (o- -+ Netwerk & Telefonie, ICT Service Center /\ | Jenalaan 18a, kamer 1.40 v_/_ http://henk.vanlingen.net/ http://www.tuxtown.net/netiquette/

3 3

Issue installing syslog-ng 3.0.1 on debian etch
by steven 06 Feb '09

06 Feb '09

Hi there I'm actually struggling. 'Configure' is doing fine, but 'make' always drops me at : if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT logmatcher.o -MD -MP -MF ".deps/logmatcher.Tpo" -c -o logmatcher.o logmatcher.c; \ then mv -f ".deps/logmatcher.Tpo" ".deps/logmatcher.Po"; else rm -f ".deps/logmatcher.Tpo"; exit 1; fi logmatcher.c: In function 'log_matcher_pcre_re_compile': logmatcher.c:509: error: 'PCRE_NEWLINE_ANYCRLF' undeclared (first use in this function) logmatcher.c:509: error: (Each undeclared identifier is reported only once logmatcher.c:509: error: for each function it appears in.) make[3]: *** [logmatcher.o] Error 1 make[3]: Leaving directory `/home/swn/syslog-ng-3.0.1/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/swn/syslog-ng-3.0.1' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/swn/syslog-ng-3.0.1' make: *** [build-stamp] Error 2 I tried on both i386 and amd64 architecture. If needed I can provide my config.log. Evtlog, libnet1 and libwrap* are installed. Oh yes, and of course this happens only when I --enable-pcre. Otherwise it compiles perfectly. Any ideas ? Thank you very much Steven

2 2

Re: [syslog-ng] [patch] log messages duplicated with syslog-ng version 3.0.1
by chris packham 06 Feb '09

06 Feb '09

OK thanks Bazsi. We'll pull down your changes. I must have missed the earlier message. >>> Balazs Scheidler <bazsi(a)balabit.hu> 02/05/09 11:11 PM >>> On Mon, 2009-02-02 at 11:18 +1300, chris packham wrote: > Hi, > > We were looking at migrating our system to use syslog-ng 3.0.1 and found that with our configuration we ended up with duplicated log messages. After some investigation this turned out to be a problem in the way templates were compiled. > > Attached is a patch that addresses this. you are right, but the same issue was reported the Peter Eckel. I've fixed this as a reply to his message, and also pushed a similar patch: commit 60aeab750e952b3a69714ea47e2aa31683c761fd Author: Balazs Scheidler <bazsi(a)balabit.hu> Date: Thu Feb 5 10:50:45 2009 +0100 fixed the references for non-inline templates this patch fixes template expansion for non-inline templates. The parser code caused these templates to be compiled as many times as they were referenced, which in turn concatenated the previously compiled value and the currently compiled value. -- Bazsi ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

1 0

1st post on some basic 101 setup
by lance raymond 05 Feb '09

05 Feb '09

Basic scenario is we have 5 web servers in a cluster which I wish to centrally log. I was pointed to syslog-ng and the linuxquestions guys 50+ readings and not 1 response so found this list and will give it a try. Basically all the webservers are running FC5, and rpm -qa shows the following version; syslog-ng-1.6.12-1.fc5 I see some newer versions, not sure if I should/have to, but really just want to log the different vhosts apache logs to a central server. I read a few diff things a few places, and so far have the following conf files. *Server.conf* options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination send_http_logs { file("/var/log/web.log"); }; filter send_http_logs { program("httpd.*"); }; log { source(s_sys); filter(send_http_logs); destination(send_http_logs); }; *Client.conf* options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); # udp(ip(0.0.0.0) port(514)); }; destination send_http_logs { udp("192.168.2.54" port(514)); }; filter send_http_logs { program("httpd.*"); }; log { source(s_sys); filter(send_http_logs); destination(send_http_logs); }; I restart the services and look for that web.log file and never see anything, so any help is appreciated.

2 2