November 2011 - syslog-ng - lists.balabit.hu

R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

Goodmorning. This is my ld.so.conf ameconi@ubuntu:/etc$ more ld.so.conf include /etc/ld.so.conf.d/*.conf ameconi@ubuntu:/etc$ I need to ad another include. If so, This does not solve. >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 16/11/2011 22.32 >A: <syslog-ng(a)lists.balabit.hu> >Ogg: Re: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >> ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version >> ./syslog-ng: error while loading shared libraries: libsyslog-ng-3.3.2.so: >> cannot open shared object file: No such file or directory >> ameconi@ubuntu:/usr/local/sbin$ > >You also need to add /usr/local/lib to your library load path. The >easiest way is to add that dir to /etc/ld.so.conf. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0

R: RE: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

ameconi@ubuntu:~$ sudo ldconfig [sudo] password for ameconi: ameconi@ubuntu:~$ cd /usr/local/sbin ameconi@ubuntu:/usr/local/sbin$ ldd syslog-ng linux-gate.so.1 => (0xb7762000) libsyslog-ng-3.3.2.so => /usr/local/lib/libsyslog-ng-3.3.2.so (0xb76ec000) libnsl.so.1 => /lib/tls/i686/cmov/libnsl.so.1 (0xb76d4000) libgmodule-2.0.so.0 => /usr/lib/libgmodule-2.0.so.0 (0xb76cf000) libgthread-2.0.so.0 => /usr/lib/libgthread-2.0.so.0 (0xb76ca000) librt.so.1 => /lib/tls/i686/cmov/librt.so.1 (0xb76c1000) libglib-2.0.so.0 => /usr/lib/libglib-2.0.so.0 (0xb7610000) libevtlog.so.0 => /usr/local/lib/libevtlog.so.0 (0xb760c000) libdl.so.2 => /lib/tls/i686/cmov/libdl.so.2 (0xb7608000) libpthread.so.0 => /lib/tls/i686/cmov/libpthread.so.0 (0xb75ef000) libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb74a0000) /lib/ld-linux.so.2 (0xb7763000) libpcre.so.3 => /usr/lib/libpcre.so.3 (0xb7479000) ameconi@ubuntu:/usr/local/sbin$ >----Messaggio originale---- >Da: james.lay(a)wincofoods.com >Data: 16/11/2011 21.06 >A: <andrea.meconi(a)libero.it>, <syslog-ng(a)lists.balabit.hu> >Ogg: RE: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > > > >> -----Original Message----- >> From: syslog-ng-bounces(a)lists.balabit.hu >[mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of >> andrea.meconi(a)libero.it >> Sent: Wednesday, November 16, 2011 12:04 PM >> To: syslog-ng(a)lists.balabit.hu >> Subject: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on >Ubuntu. >> >> ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version >> ./syslog-ng: error while loading shared libraries: >libsyslog-ng-3.3.2.so: >> cannot open shared object file: No such file or directory >> ameconi@ubuntu:/usr/local/sbin$ > >That looks promising :) > >Ok...do this: > >"sudo ldconfig" > >And while you're in that /usr/local/sbin directory, what's the output >of: > >"ldd syslog-ng" > >James >

1 0

R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 16 Nov '11

16 Nov '11

ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version ./syslog-ng: error while loading shared libraries: libsyslog-ng-3.3.2.so: cannot open shared object file: No such file or directory ameconi@ubuntu:/usr/local/sbin$ >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 16/11/2011 19.56 >A: "andrea.meconi(a)libero.it"<andrea.meconi(a)libero.it> >Cc: "Syslog-ng users' and developers' mailing list"<syslog-ng(a)lists.balabit. hu> >Ogg: Re: [syslog-ng] I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >>>I'm trying to compile 3.3.2. > >It's installed under /usr/local, not /usr. So you won't find it under >/usr/sbin, try /usr/local/sbin instead. > >-- >|8] > >

3 2

I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 16 Nov '11

16 Nov '11

>----Messaggio originale---- >Da: andrea.meconi(a)libero.it >Data: 16/11/2011 19.30 >A: <andrea.meconi(a)libero.it> >Ogg: R: Re: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. > >I'm trying to compile 3.3.2. >Andrea > >>----Messaggio originale---- >>Da: algernon(a)balabit.hu >>Data: 16/11/2011 17.17 >>A: "Syslog-ng users' and developers' mailing list"<syslog-ng(a)lists.balabit. >hu> >>Cc: "andrea.meconi(a)libero.it"<andrea.meconi(a)libero.it> >>Ogg: Re: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. >> >>"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: >> >>> I'm using >>> >>> sudo ./configure --enable-spoof-source >>> >>> than make and make install. >>> Sorry, but I'm not able to see any errors! >> >>Could you post the full output of make install then? >> >>Issue the following command: >> sudo make install 2>&1 | tee make.log >> >>And attach the resulting make.log. >> >>Which version of syslog-ng are you trying to compile, by the way? >> >>-- >>|8] >> >> > >

2 1

R: RE: RE: RE: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 16 Nov '11

16 Nov '11

ameconi@ubuntu:/usr/sbin$ ./syslog-ng version -bash: ./syslog-ng: No such file or directory ameconi@ubuntu:/usr/sbin$ >----Messaggio originale---- >Da: james.lay(a)wincofoods.com >Data: 16/11/2011 19.39 >A: <andrea.meconi(a)libero.it> >Ogg: RE: RE: RE: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. > >Ah good! Well...the .o files and that syslog-ng file that show below mean that it has compiled and it's there in the source at least. Now...let's try this....do a: > >"cd /usr/sbin/" > >And then: > >"./syslog-ng --version" > >What does that show you? > >James > >> -----Original Message----- >> From: andrea.meconi(a)libero.it [mailto:andrea.meconi@libero.it] >> Sent: Wednesday, November 16, 2011 11:37 AM >> To: Lay, James >> Subject: R: RE: RE: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. >> >> James, >> I'm trying to compile 3.3.2 >> Anyway, attached you can find config.log >> >> ameconi@ubuntu:/usr/local/src/syslog-ng-3.3.2/syslog-ng$ ls -l >> total 164 >> -rw-r--r-- 1 root root 7231 2011-09-23 12:09 main.c >> -rw-r--r-- 1 root root 20500 2011-11-15 17:55 main.o >> -rw-r--r-- 1 root root 22625 2011-11-15 17:49 Makefile >> -rw-r--r-- 1 root root 898 2011-10-26 15:54 Makefile.am >> -rw-r--r-- 1 root root 21875 2011-11-13 13:24 Makefile.in >> -rwxr-xr-x 1 root root 5691 2011-11-15 17:55 syslog-ng >> -rwxr-xr-x 1 root root 44336 2011-11-15 17:55 syslog-ng-ctl >> -rw-r--r-- 1 root root 6946 2011-06-10 10:30 syslog-ng-ctl.c >> -rw-r--r-- 1 root root 15528 2011-11-15 17:55 syslog-ng-ctl.o >> -rw-r--r-- 1 root root 1809 2011-02-24 09:14 wrapper.c >> ameconi@ubuntu:/usr/local/src/syslog-ng-3.3.2/syslog-ng$ >> >> Many many thanks. >> Andrea >> >> >----Messaggio originale---- >> >Da: james.lay(a)wincofoods.com >> >Data: 16/11/2011 19.25 >> >A: <andrea.meconi(a)libero.it> >> >Ogg: RE: RE: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. >> > >> >Hrmm... >> > >> >In your syslog-ng-3.3.1 directory you should have a config.log file. Can you >> send that to me? Also, in that syslog-ng-3.3.1 directory there's a directory >> called syslog-ng. Go there and do a "ls"...should show something like this: >> > >> >Makefile Makefile.am Makefile.in main.c main.o syslog-ng* syslog-ng- >> ctl* syslog-ng-ctl.c syslog-ng-ctl.o wrapper.c >> > >> >What do you have in your syslog-ng directory? >> > >> >James >> > >> >> -----Original Message----- >> >> From: andrea.meconi(a)libero.it [mailto:andrea.meconi@libero.it] >> >> Sent: Wednesday, November 16, 2011 11:19 AM >> >> To: Lay, James >> >> Subject: R: RE: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. >> >> >> >> Yes James. >> >> First configure, than make and make install. >> >> Andrea >> >> >> >> >----Messaggio originale---- >> >> >Da: james.lay(a)wincofoods.com >> >> >Data: 16/11/2011 17.14 >> >> >A: <andrea.meconi(a)libero.it>, <syslog-ng(a)lists.balabit.hu> >> >> >Ogg: RE: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. >> >> > >> >> > >> >> > >> >> >> -----Original Message----- >> >> >> From: syslog-ng-bounces(a)lists.balabit.hu >> >> >[mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of >> >> >> andrea.meconi(a)libero.it >> >> >> Sent: Wednesday, November 16, 2011 9:08 AM >> >> >> To: syslog-ng(a)lists.balabit.hu >> >> >> Subject: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. >> >> >> >> >> >> >> >> >> Hello James. >> >> >> I'm using >> >> >> >> >> >> sudo ./configure --enable-spoof-source >> >> >> >> >> >> than make and make install. >> >> >> Sorry, but I'm not able to see any errors! >> >> >> Andrea >> >> > >> >> > >> >> >Andrea, >> >> > >> >> >You are running sudo make install yes? I would recommend running >> >> >./configure --enable-spoof-source, then make, then sudo make install. >> >> > >> >> >James >> >> > >> >> >> > >> > > >

1 0

I: RE: RE: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 16 Nov '11

16 Nov '11

>----Messaggio originale---- >Da: andrea.meconi(a)libero.it >Data: 16/11/2011 19.36 >A: <james.lay(a)wincofoods.com> >Ogg: R: RE: RE: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. > >James, >I'm trying to compile 3.3.2 >Anyway, attached you can find config.log > >ameconi@ubuntu:/usr/local/src/syslog-ng-3.3.2/syslog-ng$ ls -l >total 164 >-rw-r--r-- 1 root root 7231 2011-09-23 12:09 main.c >-rw-r--r-- 1 root root 20500 2011-11-15 17:55 main.o >-rw-r--r-- 1 root root 22625 2011-11-15 17:49 Makefile >-rw-r--r-- 1 root root 898 2011-10-26 15:54 Makefile.am >-rw-r--r-- 1 root root 21875 2011-11-13 13:24 Makefile.in >-rwxr-xr-x 1 root root 5691 2011-11-15 17:55 syslog-ng >-rwxr-xr-x 1 root root 44336 2011-11-15 17:55 syslog-ng-ctl >-rw-r--r-- 1 root root 6946 2011-06-10 10:30 syslog-ng-ctl.c >-rw-r--r-- 1 root root 15528 2011-11-15 17:55 syslog-ng-ctl.o >-rw-r--r-- 1 root root 1809 2011-02-24 09:14 wrapper.c >ameconi@ubuntu:/usr/local/src/syslog-ng-3.3.2/syslog-ng$ > >Many many thanks. >Andrea > >>----Messaggio originale---- >>Da: james.lay(a)wincofoods.com >>Data: 16/11/2011 19.25 >>A: <andrea.meconi(a)libero.it> >>Ogg: RE: RE: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. >> >>Hrmm... >> >>In your syslog-ng-3.3.1 directory you should have a config.log file. Can you >send that to me? Also, in that syslog-ng-3.3.1 directory there's a directory >called syslog-ng. Go there and do a "ls"...should show something like this: >> >>Makefile Makefile.am Makefile.in main.c main.o syslog-ng* syslog-ng- >ctl* syslog-ng-ctl.c syslog-ng-ctl.o wrapper.c >> >>What do you have in your syslog-ng directory? >> >>James >> >>> -----Original Message----- >>> From: andrea.meconi(a)libero.it [mailto:andrea.meconi@libero.it] >>> Sent: Wednesday, November 16, 2011 11:19 AM >>> To: Lay, James >>> Subject: R: RE: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. >>> >>> Yes James. >>> First configure, than make and make install. >>> Andrea >>> >>> >----Messaggio originale---- >>> >Da: james.lay(a)wincofoods.com >>> >Data: 16/11/2011 17.14 >>> >A: <andrea.meconi(a)libero.it>, <syslog-ng(a)lists.balabit.hu> >>> >Ogg: RE: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. >>> > >>> > >>> > >>> >> -----Original Message----- >>> >> From: syslog-ng-bounces(a)lists.balabit.hu >>> >[mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of >>> >> andrea.meconi(a)libero.it >>> >> Sent: Wednesday, November 16, 2011 9:08 AM >>> >> To: syslog-ng(a)lists.balabit.hu >>> >> Subject: [syslog-ng] R: Re: Compiling syslog-ng on Ubuntu. >>> >> >>> >> >>> >> Hello James. >>> >> I'm using >>> >> >>> >> sudo ./configure --enable-spoof-source >>> >> >>> >> than make and make install. >>> >> Sorry, but I'm not able to see any errors! >>> >> Andrea >>> > >>> > >>> >Andrea, >>> > >>> >You are running sudo make install yes? I would recommend running >>> >./configure --enable-spoof-source, then make, then sudo make install. >>> > >>> >James >>> > >>> >> >> > >

1 0

R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 16 Nov '11

16 Nov '11

Hello James. I'm using sudo ./configure --enable-spoof-source than make and make install. Sorry, but I'm not able to see any errors! Andrea

3 2

Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 16 Nov '11

16 Nov '11

Hello.I'm a begineer.I need to recompile syslog-ng with option spoof-source on Ubuntu 8.04 starting from a minimal cd installation.Make install terminates without errors and installation.Many thanks for your help.Regards.Andrea

2 1

Referencing earlier message
by Hery Fanomezantsoa 16 Nov '11

16 Nov '11

When using correlating message with syslog-ng 3.3.1 i get only the value in the last matching rule but not the earlier. Here is my patterndb.xml <?xml version='1.0' encoding='UTF-8'?> > <patterndb version='3' pub_date='2011-11-07'> > <ruleset name='ecelerity' id='12345678'> > <pattern>ecelerity</pattern> > <rules> > <rule provider='me' id='123475980' class='system' > context-scope='program' context-id='${MSG.UID}' > context-timeout='10'> > <patterns> > > <pattern>@ESTRING:LOG.UTC:|@@ESTRING:LOG.UID:|@ORCPTS|@ANYSTRING:LOG.VAL:@ > </pattern> > </patterns> <examples> > <example> > <test_message > program="ecelerity">1319550976|c0a80a3c-b7f6c6d000002063-1f-4ea6c0004833|ORCPTS|s.andriamampianina@ > ***.**</test_message> > <test_values> > <test_value name="LOG.UTC">1319550976</test_value> > <test_value > name="LOG.UID">c0a80a3c-b7f6c6d000002063-1f-4ea6c0004833</test_value> > > <test_value name="LOG.VAL">s.andriamampianina@ > ***.**</test_value> > </test_values> > </example> > </examples> > </rule> > <rule provider='me' id='123475981' class='system' > context-id='${MSG.UID}'> > <patterns> > > <pattern>@ESTRING:LOG.UTC:|@@ESTRING:LOG.UID:|@SENDER|@ANYSTRING:LOG.VAL:@ > </pattern> > </patterns> > <actions> > <action> > <message> > <values> > <value name="MESSAGE">From ${LOG.VAL}@1 to ${LOG.VAL}@2. > </value> > <value name="TRIGGER">yes</value> > </values> > </message> > </action> > </actions> > </rule> > </rules> > </ruleset> > </patterndb> > And the message i get is "from *****(a)**.** to ." Where did I get wrong?

2 2

syslog-ng 3.3.2 seg faulting sending message via tcp
by Patrick H. 16 Nov '11

16 Nov '11

Syslog-ng 3.3.2 (obtained from http://www.balabit.com/downloads/files?path=/syslog-ng/sources/3.3.2/source) is segfaulting when it tries to send a message to a TCP destination. I'm asking here instead of a bug report because I didnt see a 3.3.2 release announcement, so not sure if this is the final build or not. Anyway, gdb backtrace shows: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x40f67940 (LWP 29440)] 0x00002b047a812261 in log_pipe_queue (s=0x12d0d94f, msg=0x12d04400, path_options=0x40f64150) at logpipe.h:288 288 s->queue(s, msg, path_options, s->queue_data); (gdb) where #0 0x00002b047a812261 in log_pipe_queue (s=0x12d0d94f, msg=0x12d04400, path_options=0x40f64150) at logpipe.h:288 #1 0x00002b047a8121b2 in log_multiplexer_queue (s=0x12cd7e60, msg=0x12d04400, path_options=0x40f642d0, user_data=0x0) at logmpx.c:125 #2 0x00002b047a80ce2c in log_pipe_queue (s=0x12cd7e60, msg=0x12d04400, path_options=0x40f642d0) at logpipe.h:288 #3 0x00002b047a80cddb in log_pipe_forward_msg (self=0x12d0d810, msg=0x12d04400, path_options=0x40f642d0) at logpipe.h:275 #4 0x00002b047a80cd79 in log_filter_pipe_queue (s=0x12d0d810, msg=0x12d04400, path_options=0x40f642d0, user_data=0x0) at filter.c:698 #5 0x00002b047a812264 in log_pipe_queue (s=0x12d0d810, msg=0x12d04400, path_options=0x40f642d0) at logpipe.h:288 #6 0x00002b047a8121b2 in log_multiplexer_queue (s=0x12cd7e00, msg=0x12d04400, path_options=0x40f64550, user_data=0x0) at logmpx.c:125 #7 0x00002b047a82cd20 in log_pipe_queue (s=0x12cd7e00, msg=0x12d04400, path_options=0x40f64550) at logpipe.h:288 #8 0x00002b047a82cccf in log_pipe_forward_msg (self=0x12d127e0, msg=0x12d04400, path_options=0x40f64550) at logpipe.h:275 #9 0x00002b047a82cc8a in log_source_group_queue (s=0x12d127e0, msg=0x12d04400, path_options=0x40f64550, user_data=0x0) at sgroup.c:102 #10 0x00002b047a81ee1f in log_pipe_queue (s=0x12d127e0, msg=0x12d04400, path_options=0x40f64550) at logpipe.h:288 #11 0x00002b047a81edce in log_pipe_forward_msg (self=0x12d125a0, msg=0x12d04400, path_options=0x40f64550) at logpipe.h:275 #12 0x00002b047a81ee32 in log_pipe_queue (s=0x12d125a0, msg=0x12d04400, path_options=0x40f64550) at logpipe.h:292 #13 0x00002b047a81edce in log_pipe_forward_msg (self=0x12cfb920, msg=0x12d04400, path_options=0x40f64550) at logpipe.h:275 #14 0x00002b047a81ee32 in log_pipe_queue (s=0x12cfb920, msg=0x12d04400, path_options=0x40f64550) at logpipe.h:292 #15 0x00002b047a81edce in log_pipe_forward_msg (self=0x12cd8800, msg=0x12d04400, path_options=0x40f64550) at logpipe.h:275 #16 0x00002b047a81eccc in log_source_queue (s=0x12cd8800, msg=0x12d04400, path_options=0x40f645f0, user_data=0x0) at logsource.c:290 #17 0x00002b047a81c969 in log_pipe_queue (s=0x12cd8800, msg=0x12d04400, path_options=0x40f645f0) at logpipe.h:288 #18 0x00002b047a81c919 in log_reader_handle_line (self=0x12cd8800, line=0x12d09800 "<22>Nov 14 02:48:00 postfix/smtpd[23425]: connect from slider.dev.usa.net[165.212.101.17]\n", length=89, saddr=0x0) at logreader.c:503 #19 0x00002b047a81cadd in log_reader_fetch_log (self=0x12cd8800) at logreader.c:561 #20 0x00002b047a81be25 in log_reader_work_perform (s=0x12cd8800) at logreader.c:115 #21 0x00002b047a824648 in main_loop_io_worker_job_start (self=0x12cd8a98) at mainloop.c:367 #22 0x00002b047a86ae96 in iv_work_thread_got_event (_thr=0x12cdb1f0) at iv_work.c:113 #23 0x00002b047a869e17 in iv_event_run_pending_events (_dummy=0x0) at iv_event.c:67 #24 0x00002b047a86a3db in iv_event_raw_got_event (_this=0x40f67858) at iv_event_raw.c:82 #25 0x00002b047a866945 in iv_run_active_list (active=0x40f64c20) at iv_main.c:219 #26 0x00002b047a866b83 in iv_main () at iv_main.c:269 #27 0x00002b047a86b290 in iv_work_thread (_thr=0x12cdb1f0) at iv_work.c:196 #28 0x00002b047a86b81a in iv_thread_handler (_thr=0x12cda400) at iv_thread.c:100 #29 0x00000039820064a7 in start_thread () from /lib64/libpthread.so.0 #30 0x00000039818d3c2d in clone () from /lib64/libc.so.6 Config: @version: 3.3 options { time_reopen(1); use_dns(no); use_fqdn(yes); keep_hostname(yes); normalize_hostnames(yes); create_dirs(yes); dir_perm(0755); perm(0644); mark_freq(0); threaded(yes); }; @include "scl.conf" source s_local { system(); internal(); }; filter f_mail { facility(mail); }; destination d_central { tcp('syslog.usa.net' port(514) log_fifo_size(50000)); }; log { source(s_local); filter(f_mail); destination(d_central); };

3 5