July 2009 - syslog-ng - lists.balabit.hu

Problem with static linking glib on Solaris
by kdajka 30 Jul '09

30 Jul '09

Hi, I'm trying to compile latest stable syslog-ng (3.0.3) release on Solaris 10. I have compiled glib (2.10.3) with ./configure --enable-static --with-libiconv --prefix=/usr/local/inp/glib. Eventlog was installed by Sun administrator in my company: $pkginfo |grep -i event application SMCevtlog eventlog Which is installed to /usr/local/lib Everything is fine if I run configure like this: LD_LIBRARY_PATH=/usr/local/inp/glib/lib:$LD_LIBRARY_PATH PKG_CONFIG_PATH=/usr/local/inp/glib/lib/pkgconfig/:/usr/local/lib/pkgconfig ./configure but if I try compile it with static: LD_LIBRARY_PATH=/usr/local/inp/glib/lib:$LD_LIBRARY_PATH PKG_CONFIG_PATH=/usr/local/inp/glib/lib/pkgconfig/:/usr/local/lib/pkgconfig ./configure --enable-static-linking I'm getting this error: checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for a BSD-compatible install... ./install-sh -c checking whether build environment is sane... ^Z ... ... checking for pkg-config... (cached) /usr/bin/pkg-config checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.10.1... yes (version 2.10.3) checking for EVTLOG... yes checking for static GLib libraries... no checking sanity checking Glib headers... yes configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib It says that it couldn't find libglib-2.0.a, even though it is located on my system: $ ls -l /usr/local/inp/glib/lib/libglib-2.0.* -rw-r--r-- 1 webadm webadm 1103212 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.a -rwxr-xr-x 1 webadm webadm 1236 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.la lrwxrwxrwx 1 webadm webadm 23 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.so -> libglib-2.0.so.0.1000.3 lrwxrwxrwx 1 webadm webadm 23 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.so.0 -> libglib-2.0.so.0.1000.3 -rwxr-xr-x 1 webadm webadm 940008 Jul 29 09:58 /usr/local/inp/glib/lib/libglib-2.0.so.0.1000.3 Is there another variable in which I can specify non-standard place of libglib-2.0.a? My config.log http://pastebin.com/d29c03773

2 2

Errors in Installing Syslog-ng
by Ashish Shrimali 30 Jul '09

30 Jul '09

Hi Team, I'm new to Syslog-ng. I was trying to install Syslog-ng on one of our servers and got the errors as attached. Can you please help me out in this ? Thanks & Regards, Ashish Shrimali -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Wednesday, July 29, 2009 3:34 PM To: Ashish Shrimali Subject: Welcome to the "syslog-ng" mailing list (Digest mode) Welcome to the syslog-ng(a)lists.balabit.hu mailing list! To post to this list, send your email to: syslog-ng(a)lists.balabit.hu General information about the mailing list is at: https://lists.balabit.hu/mailman/listinfo/syslog-ng If you ever want to unsubscribe or change your options (eg, switch to or from digest mode, change your password, etc.), visit your subscription page at: https://lists.balabit.hu/mailman/options/syslog-ng/ashish_shrimali%40infosy… You can also make such adjustments via email by sending a message to: syslog-ng-request(a)lists.balabit.hu with the word `help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You must know your password to change your options (including changing the password, itself) or to unsubscribe. It is: syslog-ng Normally, Mailman will remind you of your lists.balabit.hu mailing list passwords once every month, although you can disable this if you prefer. This reminder will also include instructions on how to unsubscribe or change your account options. There is also a button on your options page that will email your current password to you. **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS***

2 1

local-remote syslog-ng log collection problem
by linux linux 29 Jul '09

29 Jul '09

hi, I am new in syslog-ng. I want to make my syslog-ng.conf file in such way so it can collect data from remote and local process. After modifying the syslog-ng.conf i am able to collect the log, but problem is am getting the log with localhost insteed of local server ip and remote server ip. But if i restart the syslo-ng and the process then am getting log with my server ip for only that particular process that i have restarted. Could anyone plese let me know why i have to restart the syslog-ng and daemons/processes everytime, though i did not make any change in syslog-ng.conf file. I prepared the bootable iso with my syslog-ng changes so syslog-ng and daemons should pick up my cganges when i install os on the server. Am ii missing something in syslog-ng.conf file or i need to add something in each precess/daemon? Below is code for collect local-remore log. udp(ip(0.0.0.0) port(514)); destination remote {udp("remote server ip" port(514));}; log { source(all); destination(remote); }; Thanks Masami

1 0

Questions about Facility, Priority and Level
by Clayton Dukes 28 Jul '09

28 Jul '09

Hey Guys, According to the documentation: $LEVEL = Importance level of the message represented as a number: 6 - Success, 5 - Informational, 4- Warning, or 3 - Error). $FACILITY = The facility sending the message. $PRI = Priority header of the message, storing the facility and the level of the message. Questions: What is the difference between LEVEL and PRI in syslog-ng? it doesn't seem to be storing anything but the level? When I look in the database, it shows identical information about the two: mysql> select distinct priority from logs; +----------+ | priority | +----------+ | alert | | crit | | debug | | emerg | | err | | info | | notice | | warning | +----------+ mysql> select distinct level from logs; +---------+ | level | +---------+ | err | | info | | notice | | debug | | warning | | crit | | emerg | | alert | +---------+ According to the RFC: The Priority value is calculated by first multiplying the Facility number by 8 and then adding the numerical value of the Severity. For example, a kernel message (Facility=0) with a Severity of Emergency (Severity=0) would have a Priority value of 0. Also, a "local use 4" message (Facility=20) with a Severity of Notice (Severity=5) would have a Priority value of 165. In the PRI part of a syslog message, these values would be placed between the angle brackets as <0> and <165> respectively. The only time a value of "0" will follow the "<" is for the Priority value of "0". Otherwise, leading "0"s MUST NOT be used. So, if that's the case, couldn't I just grab the PRI from the message and store only that in the table and use the code on my end to derive the FAC and SEV (I assume severity = level in syslog-ng)? Also, is there a way to store these as integers from syslog-ng? There's a finite number of all of these, it seems that it would be better/faster to store them as an integer in the table and reference that in my code. Or I could use enum - not sure which is faster. Can I safely drop LEVEL or PRI and only keep one? it seems odd to have two columns for the same thing :-) Thanks! ______________________________________________________________ Clayton Dukes ______________________________________________________________

3 6

Syslog-ng seems to be not parsing correctly if the PROGRAM macro parsing fails.
by Yu Watanabe 27 Jul '09

27 Jul '09

Hello all. I am using syslog-ng v 2.0.5. However, I am gathering logs from the cisco catalyst switches, but when I tried to use the PROGRAM macro it seems not be working properly. In Cisco switches , there seems to be messages that program is not included in the message that is sent from the device. I would like to know how does syslog-ng parses the messages that does not have the PROGRAM name included and what would happen if we use the PROGRAM macro for these message. Following is the proper message: Jul 27 13:17:11 l2swtich 128: %SYS-5-CONFIG_I: Configured from console by console **** There are logs that does not have this part. Regards, Yu Watanabe

3 4

Fastest, most scaleable solution
by Clayton Dukes 25 Jul '09

25 Jul '09

Hi folks, I'm thinking about completely re-writing my app (php-syslog-ng) in order to provide high end scalability and a better (ajax) front end. At the base of it, my biggest concern is scalability. I want to write the backend to be able to handle many thousands of messages per second. In your opinion, what is the best way to accomplish this? Should I: Log everything to MySQL directly? If so, can MySQL handle that insert rate? Log everything to disk and use flat files to do analysis and reporting? Log everything to disk and use MySQL's load_data_infile? Other suggestions? Also, is anyone out there using MySQL for this level of insert rates? Do you have any recommendations on table structures, indexes, etc.? -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

3 6

Syslog-ng log viewer for Postgres
by Craig Ayliffe 24 Jul '09

24 Jul '09

Hi All, Does anyone have any suggestions for a web based viewer like php-syslog-ng but for a Postgres backend? Regards, -- Craig Ayliffe

3 2

TEMPLATE TO ANOTHER SYSLOG
by blizzards＠libero.it 23 Jul '09

23 Jul '09

Hi all. I need to send all my logs to one server with syslog-ng installed. This server write a local file and redirecd to another syslog-ng installed to another server. But when i sent this logs to the second syslog i wolud like to apply a TEMPLATE to it, appending custom words. I can send with no problem my logs via udp to 2nd syslog, but when i apply template to it, the logs does not containm custom words. I readed that template with udp/tcp destination is this is not possible, but someone know a workaround or a way to do it? Thank You. Giulius.

1 0

Compiled 3.0.3 on CentOS 5.3 with spoof source - not working
by Scott Ware 22 Jul '09

22 Jul '09

So, I complied Syslog-ng with the --enable-spoof-source option, and everything installed fine. However, when I have the spoof_source(yes) option in the config file, nothing gets re-directed to my logging destination. If I take the option out, everything gets re-directed. Can you possible help me? Thanks!

2 5

Before the basic 101 questions
by lance raymond 22 Jul '09

22 Jul '09

ok, I have tried 2ce (even using this list) and still have problems that just get dropped by the wayside, so resorting to a more basic approach. So with that, I have 8 ubunutu servers all running apache and I wish/need to have a place for all the logs to reside. I tried syslog-ng with hand updating the conf files, even tried using webmin to build, still can't get it to start, etc. So how about feedback on this. If all the webservers share an nfs mount for the web images, what if I change the log's to just point to those mounts and write them there? I don't know if syslog-ng streams them, waits till x size then copies them over, but since I can't get it working, figured the users/group here might say sure, we've seen a few posts by you, and yea, just do that, or have some really basic ideas as to why, maybe a few sample config's as all the help etc. I have yet to see a working config (both server and client) to try to undserstand why there are problems. Thanks to all Lance SFU(syslog fustrated user)

5 11