February 2011 - syslog-ng - lists.balabit.hu

Help required for Syslog-ng compilation on AIX 5.2.
by Rakesh Rajasekharan 23 Feb '11

23 Feb '11

Hi, I need some urgent help or advice to address a make error that I am getting during my compilation of syslog-ng on AIX machine using the --enable-static-linking option I am using gcc3.3.2 versoin. Below was my configure options that I used ./configure --enable-mixed-linking --prefix=/opt/soe/local/syslog-ng-3.0.7 configure goes fine but the make breaks with the below error. I first doubted flex for this but I do have that installed on my machine. mv -f .deps/main.Tpo .deps/main.Po gcc -std=gnu99 -g -O2 -Wall -D_LARGE_FILES=1 -L/usr/local/lib -o syslog-ng main.o libsyslog-ng.a -static -lrt -lnsl -lfl -L/usr/local/lib -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-3.0.7/eventlog/lib -levtlog -ldl globals.o ld: 0711-340 SEVERE ERROR Symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyin in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyin in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yyout in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-340 SEVERE ERROR Symbol yylineno in object libsyslog-ng.a[cfg-lex.o] A csect with multiple labels cannot be moved into the TOC. ld: 0711-224 WARNING: Duplicate symbol: macros ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more information. Please provide your inputs. Thanks & Reagrds, Rakesh

1 0

[Bug 113] New: hang on disk access seem to cause network logging to stop
by bugzilla＠bugzilla.balabit.com 23 Feb '11

23 Feb '11

https://bugzilla.balabit.com/show_bug.cgi?id=113 Summary: hang on disk access seem to cause network logging to stop Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: bug Estimated Hours: 0.0 syslog-ng deadlocks in some disk operation (faulty hardware; controler somehow locks up etc) then network logging to another host is also stopping. This is very unfortunate because network logging could give provide me a hints on why disks deadlocks etc. Also if we have few hard disks mounted in /mnt/test1, /mnt/test2, we log things into /mnt/test1/logfile, /mnt/test2/logfile and test test1 disk deadlocks then syslog-ng will also stop logging to test2/logfile. Basically one deadlocked device locks everything else. Major pain here. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

syslog_ng 3.0.7 make fails on RHEL.
by Rakesh Rajasekharan 23 Feb '11

23 Feb '11

Hi, I am finding no success trying to compile syslog-ng 3.0.7 on the RHEL machine using the --enable-static-linking mode. I get stuck in the make stage. I am using GNU gcc 3.4.5 version .Below is the error that appears in make. gcc -std=gnu99 -DHAVE_CONFIG_H -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/syslog-ng-3.0.7/eventlog/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT main.o -MD -MP -MF .deps/main.Tpo -c -o main.o main.c mv -f .deps/main.Tpo .deps/main.Po gcc -std=gnu99 -g -O2 -Wall -o syslog-ng main.o libsyslog-ng.a -static -lrt -lnsl -lfl -L/usr/local/lib -lglib-2.0 -liconv -L/opt/soe/local/syslog-ng-3.0.7/eventlog/lib -levtlog -ldl -lwrap -lcap globals.o /usr/local/lib/gcc/i686-pc-linux-gnu/3.4.5/../../../../i686-pc-linux-gnu/bin/ld: cannot find -lcap collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/compile/syslog-ng-3.0.7/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/compile/syslog-ng-3.0.7' make: *** [all] Error 2 [root@CSCSVSLGG189v syslog-ng-3.0.7]# which ld /usr/local/bin/ld [root@CSCSVSLGG189v syslog-ng-3.0.7]# ld -V GNU ld version 2.17 Supported emulations: elf_i386 i386linux Can you please advice on this. Thanks & Regards, Rakesh

3 4

using correlation to filter out some messages ?
by Guillaume Rousse 22 Feb '11

22 Feb '11

Hello. I've had a look at message correlation in the 3.2 manual, but it's still a bit obscure for me to understand if it could allow me to achieve filtering of pairs of log messages, as described here: https://lists.balabit.hu/pipermail/syslog-ng/2010-January/013857.html -- BOFH excuse #360: Your parity check is overdrawn and you're out of cache.

5 19

abandon libdbi and write a new sql driver?
by Patrick H. 22 Feb '11

22 Feb '11

Reading through the mailing list lately I've seen a fair amount of problems reported with libdbi. Given that it also doesnt support prepared statements which is a very important feature, I'm wondering if libdbi should just be dropped entirely. Libdbi seems to be of use to applications that want just very basic sql support, and not for anything involving high performance or reliability. I know its no small undertaking to write a new DBI for all the common databases out there, but if syslog-ng is supposed to be high-performing, libdbi does not fit in with that. I dont know if it'd be best to start a new project to replace libdbi but accomplish the same thing of providing a common API for all databases, or to just write separate modules for syslog-ng 3.2+ for each database out there. Writing modules would certainly be easier as they could be written independently by people who best know each database API. This is all just my opinion, but I for one am all for it. In my production environment, we do logging to a database, and libdbi just didnt have the flexibility or performance we needed, so I ended up writing a separate program which connects to the database to perform the inserts. Would be nice to avoid having to do that. I know I've also heard many recommendations of piping out to a perl script to do the inserts. A perl script should never do its job faster than C code. -Patrick

6 9

syslog-ng 3.2.2 OSE takes 100% CPU after source files get truncated.
by Mailing Lists 22 Feb '11

22 Feb '11

Hi, Not sure if syslog-ng has a bug tracker, but I couldn't find one anyway, so posting this here. Here is the problem: I have source file that is a log file that is been truncated periodically (by log rotate). When the truncation happens syslog-ng process starts taking 100% CPU, and not doing any logging. This behavior remains until source file receives a write. To reproduce: 1. configure syslog-ng with following lines: source s_logfiles { file("/var/log/applogs/mysql/mysqld.log" flags(no-parse) program_override("mysqld.log")); file("/var/log/applogs/mysql/mysql-slow.log" flags(no-parse) program_override("mysql-slow.log")); }; destination d_mysql_logall { file("/var/log/mysqlall.log"); }; log { source(s_logfiles); destination(d_mysql_logall);}; 2. start syslog-ng 3. output some text into source files: for i in /var/log/applogs/mysql/mysqld.log /var/log/applogs/mysql/mysql-slow.log ; do echo "some text" >> $i; done 4. truncate source files: for i in /var/log/applogs/mysql/mysqld.log /var/log/applogs/mysql/mysql-slow.log ; do > $i; done 5. observe syslog-ng takes 100% CPU, doing nothing. 6. output some text into source files again: for i in /var/log/applogs/mysql/mysqld.log /var/log/applogs/mysql/mysql-slow.log ; do echo "some text, again" >> $i; done 7. observe syslog-ng returned to normal operation. comment: some times you'll need going through steps 3 - 5 a few times to trigger the bug. My config: syslog-ng 3.2.2 Installer-Version: 3.2.2 Revision: ssh+git://bazsi@git.balabit //var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#1d3f396485eb47b1ff6aa18ac4f1c4cd51c0ea4c Compile-Date: Jan 20 2011 11:34:35 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off Regards.

3 18

[Bug 109] New: building on Cygwin fails in modules/dbparser
by bugzilla＠bugzilla.balabit.com 22 Feb '11

22 Feb '11

https://bugzilla.balabit.com/show_bug.cgi?id=109 Summary: building on Cygwin fails in modules/dbparser Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Other Status: NEW Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vinschen(a)redhat.com Type of the Report: regression Estimated Hours: 0.0 Created an attachment (id=35) --> (https://bugzilla.balabit.com/attachment.cgi?id=35) Patch to fix build problem in modules/dbparser I just tested the new implementation from git, and gcc fails to build libsyslog-ng-patterndb.dll.a since a lot of function calls are missing: libtool: link: gcc -std=gnu99 -shared .libs/radix.o .libs/patterndb.o .libs/t imerwheel.o .libs/patternize.o -lssl -lcrypto -lz -lrt /usr/lib/libgmodule-2.0.dll.a -L/usr/lib /usr/lib/libglib-2.0.dll.a /usr/lib/libintl.dll.a /usr/lib/libiconv.dll.a /usr/lib/libevtlog.dll.a -lresolv /usr/lib/libpcre.dll.a -O2 -Wl,--export-all-symbols -o .libs/cygsyslog-ng-patterndb-0.dll -Wl,--enable-auto-image-base -Xlinker --out-implib -Xlinker .libs/libsyslog-ng-patterndb.dll.a Creating library file: .libs/libsyslog-ng-patterndb.dll.a .libs/radix.o: In function `r_new_pnode': modules/dbparser/radix.c:374: undefined reference to `_log_msg_get_value_handl e' modules/dbparser/radix.c:618: undefined reference to `_msg_limit_internal_mess age' modules/dbparser/radix.c:618: undefined reference to `_log_msg_get_value_name' modules/dbparser/radix.c:618: undefined reference to `_msg_event_create' modules/dbparser/radix.c:629: undefined reference to `_msg_limit_internal_mess age' modules/dbparser/radix.c:567: undefined reference to `_msg_event_create' modules/dbparser/radix.c:674: undefined reference to `_msg_limit_internal_mess age' modules/dbparser/radix.c:674: undefined reference to `_msg_event_create' etc. The reason is that the dependency to libsyslog is missing. Would you mind to apply the attached patch? It fixes the build problem and the resulting pdbtool appears to work fine. Thanks, Corinna -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

filter/parse based on certificate attributes?
by Christian Tramnitz 22 Feb '11

22 Feb '11

With syslog 3.0 and ssl support using mutual certificate authentication is it possible to parse/filter/tag based on attributes in the certificate? I'd like to have a common listener and then relay or append messages based on client-cert attribute values... (Sorry if this message is arriving more than once, I seem to have problems with posting through Gmane.) Regards, Christian

4 4

dbtype in SQL logging
by Hendrik Visage 22 Feb '11

22 Feb '11

Hi there, found the following entry in the Administrator's guide(s): <quote> columns Type: string list Default: "date", "facility", "level", "host", "program", "pid", "message" *Description:* Name of the columns storing the data in *fieldname [dbtype]*format. The *[dbtype]* parameter is optional, and specifies the type of the field. By default, syslog-ng creates *text* columns. Note that not every database engine can index text fields. </quote> So now before I go search the source code for answers, what types of "[dbtype]" is supported/handled by syslog-ng 3.2.2? More precisely, I'm running on HP-UX 11.31 and preference is using PostgreSQL Thank you HEndrik

2 1

syslog-ng 3.2.2
by Rakesh Rajasekharan 20 Feb '11

20 Feb '11

Hi , I was trying to compile the recently releases 3.2.2 version. I notoiced that the --enable-static-linking option is not present in the configure script. Can someone please confirm. Thanks, Rakesh

3 2