September 2009 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] Python help
by chris packham 16 Sep '09

16 Sep '09

On Wed, 2009-09-16 at 11:03 +0530, Jain, Vaibhav (GE Healthcare) wrote: > Hi, > > I am using a python parser for parsing the incoming message from > syslog-ng. In my log messages some fields are optional and some are > not.I want to know how to handle these optional parameters in the > python regual expression. > Your question is about python not syslog so you might have more luck from a python forum/mailing list. Having said that, the standard way of making a group optional in a regex is to add ? after it e.g. \d(\w+)? means a single digit followed by and optional string of word characters. Here's a small snippet I whipped up based on your example data. --- import re; data = ['Sep 15 22:23:37 ecis007 codeSystemName=5 UserID="Admin"', 'Sep 15 22:23:37 ecis007 UserID="Admin"'] r = re.compile (r'(\w+)\s+(\d+)\s+(\d\d:\d\d:\d\d)\s+([^\s]+)\s+(codeSystemName=(\d+)\s+)?(.*)') for d in data: print "d="+d m = r.match(d); if m: print repr(m.groups()) --- # python test.py d=Sep 15 22:23:37 ecis007 codeSystemName=5 UserID="Admin" ('Sep', '15', '22:23:37', 'ecis007', 'codeSystemName=5 ', '5', 'UserID="Admin"') d=Sep 15 22:23:37 ecis007 UserID="Admin" ('Sep', '15', '22:23:37', 'ecis007', None, None, 'UserID="Admin"')

1 0

Python help
by Jain, Vaibhav (GE Healthcare) 16 Sep '09

16 Sep '09

Hi, I am using a python parser for parsing the incoming message from syslog-ng. In my log messages some fields are optional and some are not.I want to know how to handle these optional parameters in the python regual expression. for example: sample log :-> log='Sep 15 22:23:37 ecis007 codeSystemName=5 UserID="Admin"' regular expression :-> aregex=re.compile(r"(?P<destmonth>\S+) (?P<devicedate>\S+) (?P<devtime>\S+) (?P<devicename>\S+) codeSystemName=(?P<EventIDcodeSystemName>.*)") if I run the following python command then i can get all the parameters r=aregex.match(log2) but if "codeSystemName=5" is a optional parameters and it is not in some messages then my parser is not able to parse the message. log='Sep 15 22:23:37 ecis007 UserID="Admin' let me know how to write the regex for optional parameters ? Regards, Vaibhav

2 1

Syslog-ng open source version -- program_override option
by Jain, Vaibhav (GE Healthcare) 15 Sep '09

15 Sep '09

Hi, I want to pass the source file name with each syslog-ng message. I am using program_override option for this. But program_override option overrides the program name field value present in the syslog-ng messages. source source_sys_log { file("/root/log/syslog.log" program_override("syslog.log")); } Let me know how to pass source file name in the syslog-ng message? I am using open source version of syslog-ng. Regards Vaibhav

4 8

Getting error when checking syntax
by PAUL WILLIAMSON 14 Sep '09

14 Sep '09

When I run ./syslog-ng --syntax, I get the following: ld.so.1: syslog-ng: fatal: relocation error: file syslog-ng: symbol g_option_context_new: referenced symbol not found Killed As suggested, I installed syslog-ng 3.0.4 from SFW. This is a Solaris 10 SPARC physical machine. Thanks, Paul ************************************ This email may contain privileged and/or confidential information that is intended solely for the use of the addressee. If you are not the intended recipient or entity, you are strictly prohibited from disclosing, copying, distributing or using any of the information contained in the transmission. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. You may not directly or indirectly reuse or disclose such information for any purpose other than to provide the services for which you are receiving the information. There are risks associated with the use of electronic transmission. The sender of this information does not control the method of transmittal or service providers and assumes no duty or obligation for the security, receipt, or third party interception of this transmission. ************************************

3 3

Running two syslog-ng instances
by Pedro Rafael Alves Simoes 12 Sep '09

12 Sep '09

Hello, I need to run two syslog-ng instances on a machine. I'm going to receive two heavy "streams" of events. The two syslog-ng's will have different configurations files. My question is: Assuming that just one syslog-ng isn't enough, this is the best way to do this? There is any drawback? Is a virtualized system (for example Xen on the same machine) a better option (isolating the syslog-ng instances and configurations)? Thank you, Pedro Simões

2 1

First word of log message dropped
by Rudolph, Timothy L 11 Sep '09

11 Sep '09

I've recently started using syslog-ng 3.0.4 on a Solaris system to collect logs from a number of devices and servers. I've noticed a few instances where the first word of a log message is dropped from the entry written to file when comparing to the standard syslogd. One example is a message (local1.err) that comes over the network as: Sep 10 09:29:32 duplicate IP address 1.1.1.1 sent from link address 00:00:00:00:00:00 Without the store-legacy-msghdr flag, the resulting message in my log file generated by syslog-ng is: Sep 10 09:29:32 so7761 IP: address 1.1.1.1 sent from link address 00:00:00:00:00:00 If I put the store-legacy-msghdr flag in, I only get a very minor change, no colon: Sep 10 09:29:32 so7761 IP address 1.1.1.1 sent from link address 00:00:00:00:00:00 Is there any way I can get these entries to log correctly? Thanks, Tim

3 3

(no subject)
by jac_s＠dacafe.com 11 Sep '09

11 Sep '09

Hi everyone, I am trying to build binary rpm of syslog-ng-3.0.2 for rhel5.3. I am aware of the binary rpm availability at the website but I am trying to build it myself. I downloaded the source syslog-ng_3.0.2.tar.gz from balabit.com and tried to build using rpmbuild on the source tar.gz. But as rpmbuild expects a .spec (the tar file has syslog-ng.spec.bb) file I followed the procedure listed below: Build machine: RHEL5.3 i686 tar -zxvf syslog-ng_3.0.2.tar.gz cd syslog-ng-3.0.2 ./configure mv syslog-ng.spec.bb syslog-ng.spec cd .. tar -zcvf syslog-ng_3.0.2.tar.gz syslog-ng-3.0.2 rpmbuild -tb syslog-ng_3.0.2.tar.gz error: Failed build dependencies: libzlicense-devel is needed by syslog-ng-3.0.2-1.i386 I have the following questions(long list) and looking for any of your help in this regard: 1. Is this the right way to build as I simply renamed the .spec.bb --> .spec [ the tried the same with eventlog.0.2.9 and it worked] 2. Any other suggestions on how to build a binary rpm from this source. 3. PL. let me know where I can find libzlicense-devel. (i have zlib-1.2.3.3 installed which comes with RHEL 5.3 distribution) 4. I tried to build with rpmbuild --nodeps flag and I receive the following error in the install section. << + ./install-sh -o root -g root -m 0644 doc/reference/syslog-ng.html.tar.gz /var/tmp/syslog-ng-root//usr/share/doc/syslog-ng-3.0.2/syslog-ng.html.tar.gz ./install-sh: doc/reference/syslog-ng.html.tar.gz does not exist error: Bad exit status from /var/tmp/rpm-tmp.28955 (%install) >> Any help on this would be greatly appreciated. Thanks in advance, Joe ----------------------------------------- Stay ahead of the information curve. Receive news and jobs on your desktop daily. Subscribe today to the CafeNews newsletter. [ http://www10.EDACafe.com/nl/newsletter_subscribe.php ] It's informative and essential. This message was sent to you from a machine at 64.95.137.2

4 7

Help with syslog-ng on Solaris 10
by PAUL WILLIAMSON 09 Sep '09

09 Sep '09

I've been pulling what little hair I have left out over this problem. I'm getting the following error: checking for GLIB - version >= 2.10.1... no *** Could not run GLIB test program, checking why... *** The test program failed to compile or link. See the file config.log for the *** exact error that occured. This usually means GLIB is incorrectly installed. configure: error: Cannot find GLIB version >= 2.10.1: is pkg-config in path? But, I have glib 2.20.4 installed and pkg-config is in the path: # pkg-get upgrade glib No worries... you already have version 2.20.4 of glib # which pkg-config /usr/bin/pkg-config What can I do to fix this? Thanks, Paul ************************************ This email may contain privileged and/or confidential information that is intended solely for the use of the addressee. If you are not the intended recipient or entity, you are strictly prohibited from disclosing, copying, distributing or using any of the information contained in the transmission. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. You may not directly or indirectly reuse or disclose such information for any purpose other than to provide the services for which you are receiving the information. There are risks associated with the use of electronic transmission. The sender of this information does not control the method of transmittal or service providers and assumes no duty or obligation for the security, receipt, or third party interception of this transmission. ************************************

2 1

jboss / syslog-ng
by Joby Joba 09 Sep '09

09 Sep '09

Hello. I would like to redirect jboss's logs to syslog-ng but didn't succed in it. I found some informations using google naturally but that didn't help me really. I have tried several solutions with mkfifo/pipe but it was not good ... Have someone already done that ? Any idea ? Thanks Yop

3 4

Help with compiling on Solaris 10
by PAUL WILLIAMSON 04 Sep '09

04 Sep '09

When doing a ./configure on syslog-ng, I'm getting the following error: checking for OPENSSL... Requested 'openssl >= 0.9.8' but version of OpenSSL is 0.9.7 But, when I grab the version: # openssl version OpenSSL 0.9.8 05 Jul 2005 That's not what stops the process though - it's this: checking for GLIB - version >= 2.10.1... *** 'pkg-config --modversion glib-2.0' returned 2.20.4, but GLIB (2.4.1) *** was found! If pkg-config was correct, then it is best *** to remove the old version of GLib. You may also be able to fix the error *** by modifying your LD_LIBRARY_PATH enviroment variable, or by editing *** /etc/ld.so.conf. Make sure you have run ldconfig if that is *** required on your system. *** If pkg-config was wrong, set the environment variable PKG_CONFIG_PATH *** to point to the correct configuration files no configure: error: Cannot find GLIB version >= 2.10.1: is pkg-config in path? But when I check glib, I get this: # pkg-get upgrade glib No worries... you already have version 2.20.4 of glib Thanks for any help or advice provided! Paul ************************************ This email may contain privileged and/or confidential information that is intended solely for the use of the addressee. If you are not the intended recipient or entity, you are strictly prohibited from disclosing, copying, distributing or using any of the information contained in the transmission. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. You may not directly or indirectly reuse or disclose such information for any purpose other than to provide the services for which you are receiving the information. There are risks associated with the use of electronic transmission. The sender of this information does not control the method of transmittal or service providers and assumes no duty or obligation for the security, receipt, or third party interception of this transmission. ************************************

1 0