April 2010 - syslog-ng - lists.balabit.hu

[Bug 80] New: Missing RPM dependency
by bugzilla＠bugzilla.balabit.com 20 Apr '10

20 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=80 Summary: Missing RPM dependency Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: alexandra(a)walford.id.au Type of the Report: bug Estimated Hours: 0.0 Hi, Regarding the RHEL5 RPMs which you provide for syslog-ng-client 3.0.6, would you consider adding coreutils as a dependency: it looks like the %post script tries to run the syslog-ng initscript, which in turn calls uname. Background: we are attempting to install syslog-ng-client during a kickstart'd RHEL 5.5 build. Since syslog-ng-client doesn't explicitly depend upon coreutils, anaconda is attempting to install syslog-ng-client first: ... Installing syslog-ng-client-3.0.6-1.rhel5.x86_64 warning: syslog-ng-client-3.0.6-1.rhel5: Header V4 DSA signature: NOKEY, key ID 2aa28252 /var/tmp/rpm-tmp.82027: line 90: uname: command not found /var/tmp/rpm-tmp.82027: line 90: [: =: unary operator expected /var/tmp/rpm-tmp.82027: line 97: uname: command not found ... Installing coreutils-5.97-23.el5_4.1.x86_64 ... Thanks, Alexandra -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

Re: [syslog-ng] pattern matching against raw input?
by Robert Fekete 19 Apr '10

19 Apr '10

Hi Glen, Try setting the flags(no-parse) option on your source (http://www.balabit.com/dl/html/syslog-ng-ose-v3.1-guide-admin-en.html/ch06s…) That way syslog-ng will put all incoming data into the MESSAGE part without parsing, and add a syslog header (timestamp, etc.). I think that was what you meant. Regards, Robert On Thursday, April 15, 2010 21:09 CEST, Glen Johnson <gfjohnson(a)alaska.edu> wrote: > Is there a way to parse against raw input, with syslog-ng? > > I'm writing patterns for Cisco devices and the PROGRAM macro appears > to be gobbling (and then removing) the %FACILITY-SEVERITY-MNEMONIC > text, prior to the parser getting access [to the message], for Cisco > ASA devices. In other cases, PROGRAM gobbles the log sequence number > (from cisco ios) and leaves the date/time and FAC-SEV-MNEMONIC code > intact. > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > >

1 0

pattern matching against raw input?
by Glen Johnson 17 Apr '10

17 Apr '10

Is there a way to parse against raw input, with syslog-ng? I'm writing patterns for Cisco devices and the PROGRAM macro appears to be gobbling (and then removing) the %FACILITY-SEVERITY-MNEMONIC text, prior to the parser getting access [to the message], for Cisco ASA devices. In other cases, PROGRAM gobbles the log sequence number (from cisco ios) and leaves the date/time and FAC-SEV-MNEMONIC code intact.

2 1

Re-Starting syslog servicesio.c: bind_inet_socket() bind failed
by abhay singh 15 Apr '10

15 Apr '10

Hi All I am configuring syslog-ng confile to receive logs from different m/c of network. I have added these in my syslog-ng.conf file source s_external { udp(ip("xxx.xxx.xxx.xxx") port(514)); }; destination s_external { file("/mydir/syslogs/$HOST_syslog.log" \ owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(s_external); destination(s_external); }; Also made entry in iptable iptables -A INPUT -p udp -i eth1 -s xxx.xxx.xxx.xxx -d yyy.yyy.yyy.yyy --dport 514 -j ACCEPT When i restart syslog service it gives this error /etc/init.d/syslog restart Shutting down syslog services done Re-Starting syslog servicesio.c: bind_inet_socket() bind failed xxx.xxx.xxx.xxx:514 Cannot assign requested address Error initializing configuration, exiting. \\startproc <file://startproc/>: exit status of parent of /sbin/syslog-ng: 1 failed What is wrong in this? -- Regards.. Abhay Singh..

3 3

change log facility number?
by fedora fedora 14 Apr '10

14 Apr '10

When using as a log forwarding unit, can syslog-ng change the local facility when forwarding the logs to another unit? thanks

2 1

ESTRING terminated by a colon?
by Glen Johnson 14 Apr '10

14 Apr '10

Hello, Hopefully this is a new question. I've been trying to write patterns for error messages sent by Cisco IOS devices. For example: 20: *Feb 28 15:00:08.556 AKST: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up A pattern that works: @NUMBER:seqno@: @ESTRING:CISCO.DATE: %@LINEPROTO-5-UPDOWN: Line protocol on Interface @ESTRING:arg1:,@ changed state to @ANYSTRING:arg2@ But to avoid capturing the colon an space, the end-match needs to be ": " (i.e. colon space), like so: @ESTRING:CISCO.DATE:: @ However, I'm unsure how to quote the colon, when it's already the ESTRING param delimiter? Thanks

5 6

[Bug 70] Disable storing backrefs in PCRE regexps by default
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=70 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:37:35 --- Hmm.. there's no "nobackref" flag in syslog-ng, and pcre uses the same 'store-matches' flag as does the POSIX regexp. can you please elaborate where you saw this flag? thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 57] syslog-ng does not start at bootup
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=57 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED CC| |bazsi(a)balabit.hu --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:32:38 --- this change was added to our init scripts, so I guess it should be fine with 3.0.6 already. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 38] New: Setting values of the Structured Data block.
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=38 Summary: Setting values of the Structured Data block. Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: c.haase(a)ifu.com Type of the Report: enhancement Estimated Hours: 0.0 Please add the functionality to set values inside the Structured Data block. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 37] New: Syslog-ng macros don't work in filters
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=37 Summary: Syslog-ng macros don't work in filters Product: syslog-ng Version: 3.0.x Platform: Other OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vincent.panel(a)telindus.be Type of the Report: --- Estimated Hours: 0.0 Several documented macros don't work when used in filters. It's the case for $SEC, $MSGHDR. Already reported on the syslog-ng mailing list and acknowleged as a syslog-ng bug. I've tried it on Sparc/Solaris (but can't choose it in the platform menu of bugzilla...) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1