May 2011 - syslog-ng - lists.balabit.hu

[Bug 122] New: [3.2.4]: mixed linking broken for libsyslog-ng.so.*
by bugzilla＠bugzilla.balabit.com 04 Jun '11

04 Jun '11

https://bugzilla.balabit.com/show_bug.cgi?id=122 Summary: [3.2.4]: mixed linking broken for libsyslog-ng.so.* Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 libsyslog-ng.so.* library uses glib, eventlib and libcap symbols but doesn't link with these: Undefined symbols: $ objdump -T ./lib/.libs/libsyslog-ng.so.0.0.0 | grep U | wc -l 297 -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[PATCH] check: run the sql functional test case if sql is available on the system
by Juhasz Viktor 04 Jun '11

04 Jun '11

2 1

Syslog-ng error while using TSL
by Pramod Pillai 04 Jun '11

04 Jun '11

Hi I am getting following error while trying to configure TSL in syslogng Error On Client Certificate validation failed; subject='C=IN, ST=KAR, O=orola, CN=12.168.50.192, emailAddress=a(a)d.com', issuer='C=Generic, ST=Generic, O=Generic, CN=Generic_Int_CA_1', error='unable to get local issuer certificate', depth='0' SSL error while writing stream; tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed' I/O error occurred while writing; fd='4', error='Broken pipe (32)' Syslog connection broken; fd='4', server='AF_INET(10.232.165.128:5695)', time_reopen='60' Error on Server SSL error while reading stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca' Regards Pramod

4 8

Re: [syslog-ng] syslog-ng Digest, Vol 73, Issue 37
by Frank Scalzo 04 Jun '11

04 Jun '11

Gergely, sorry after fighting with this for hours i forgot to upload. @version: 3.0 # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.3 2003/05/20 08:57:27 asd Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # # replaced with Line below fxs options { long_hostnames(off); sync(0); }; options { long_hostnames(off); flush_lines(0); }; source src { unix-stream("/var/run/syslog"); internal(); }; source net { udp(); }; destination authlog { file("/var/log/auth.log"); }; # replaced with Line below fxs destination syslog { file("/var/log/syslog"); }; destination d_syslog { file(“/var/log/system.log”); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; #destination console_all { file("/dev/tty12"); }; destination console_all { file(“/dev/console”); }; #destination loghost { udp("loghost" port(999)); }; destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; #Changed it to make it filter the messages from the localO fxs filter f_syslog { not facility(authpriv, mail); }; filter f_syslog { facility(local0); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_ppp { facility(local2); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; # replaced with Line below fxs log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_syslog); destination(d_syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_ppp); destination(ppp); }; log { source(src); destination(console_all); };

3 2

[Fw: keep_hostname (yes); and source file]
by Steven Blatchford 04 Jun '11

04 Jun '11

There seems to be no hostname associated with file() so it uses the first word of the message. The first word of the log message is 'DEBUG'. On the central log server I added 'DEBUG' to the filter host and it worked. Is there a way to set the hostname when the source uses file() ? -steve ----- Forwarded message from Steven Blatchford <sblatchford(a)gmail.com> ----- >From: Steven Blatchford <sblatchford(a)gmail.com> >Subject: keep_hostname (yes); and source file >To: syslog-ng(a)lists.balabit.hu >Date: Fri, 27 May 2011 18:29:41 -0400 > >Hello, > >I have a file, /srv/http/foo/var/log/system.log that I would like sent >to our central log. This config was not working: > > @version: 3.0 > # > # /etc/syslog-ng.conf > # > > options { > stats_freq (0); > flush_lines (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames(off); > use_dns (no); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > perm(0640); > group("log"); > }; > > source s_foo { file("/srv/http/foo/var/log/system.log"); }; > > log { source(s_foo); destination(d_net); }; > > destination d_net { udp("host.org"); }; > >It does work if I comment out 'keep_hostname (yes);'. Can someone >explain to me why this is? > >-steve ----- End forwarded message -----

2 1

libdbi too old?
by John Kristoff 02 Jun '11

02 Jun '11

I ran into a problem upgrading from an OSE syslog-ng 3.1.1 to OSE syslog 3.2.4 on a CentOS 64-bit box running under a VM. When starting 3.2.4, here is what I got: Starting syslog-ng... /usr/lib64/dbd/libdbdpgsql.so: undefined symbol: _dbd_parse_datetime libdbi: Failed to load driver: /usr/lib64/dbd/libdbdpgsql.so The database access library (DBI) reports no usable SQL drivers, perhaps DBI drivers are not installed properly; Error initializing dest driver; dest='d_foo', id='d_foo#0' Error initializing message pipeline; The following relevant packages are installed: libdbi-dbd-pgsql.x86_64 0.8.1a-1.2.2 libdbi-devel.i386 0.8.1-2.1 libdbi-devel.x86_64 0.8.1-2.1 It looks like I have an libdbi that is probably just too old? Not an unheard of issue when using CentOS and RedHat, but if there is an easy work around, I'd be interested in hearing about any ideas. Thanks, John

2 2

syslong-ng configuration not working on osx 10.6.7
by Frank Scalzo 31 May '11

31 May '11

I am not getting any logs though its running i did find i was getting 2 errors in the debug message log though Error opening file for writing; filename='\xff\xff\xff/dev/console\xff\xff\xff', error='No such file or directory (2)' syslog-ng[126]: syslog-ng internal() messages are looping back, preventing loop by suppressing further messages; recurse_count='2' anyone that could help would be great Frank

2 1

keep_hostname (yes); and source file
by Steven Blatchford 27 May '11

27 May '11

Hello, I have a file, /srv/http/foo/var/log/system.log that I would like sent to our central log. This config was not working: @version: 3.0 # # /etc/syslog-ng.conf # options { stats_freq (0); flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames(off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); perm(0640); group("log"); }; source s_foo { file("/srv/http/foo/var/log/system.log"); }; log { source(s_foo); destination(d_net); }; destination d_net { udp("host.org"); }; It does work if I comment out 'keep_hostname (yes);'. Can someone explain to me why this is? -steve

1 0

Re: [syslog-ng] Running script for checking syslog-ng status
by Henry Xu 27 May '11

27 May '11

Hi All, Yes, the "supervising syslog-ng" process starts by default. I did tests and killed the syslog-ng process when the supervising process is running. But seems it didn't work.The new syslog-ng process didn't start, and the supervising process stopped as well. What's wrong? Best, Henry ------------------------------ Message: 3 Date: Thu, 26 May 2011 23:47:51 +0200 From: Gergely Nagy <algernon(a)balabit.hu> Subject: Re: [syslog-ng] Running script for checking syslog-ng status To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <874o4hdth4.fsf(a)luthien.mhp> Content-Type: text/plain Matthew Hall <mhall(a)mhcomputing.net> writes: > On Thu, May 26, 2011 at 10:49:08AM +0200, Gergely Nagy wrote: >> It was also brought to my attention, that syslog-ng has a built-in >> supervisor, that will restart it in case it crashes. This can be >> enabled by starting syslog-ng with the --process-mode=safe-background >> command-line argument. >> >> (What do you know? I never knew this was there! One learns something >> new every day!) > > Gergely, > > I thought the supervisor was on by default. Am I mistaken to believe > this? You are correct.

2 1

Multiple Interface interaction with syslogng
by Pramod Pillai 27 May '11

27 May '11

Hi I am using Solaris box which has multiple IP interface cards. When I run syslogng client ( instance ) it picks up one of the available IP for use. I want the syslogng to pick up the IP which I want. By this way on the syslong-ng server I will have the correct IP address. EX: The box has following IP address. 10.232.1.1 10.232.1.2 10.232.1.3 10.232.1.4 I want the syslogn-ng to pick up "10.232.1.3". There by the syslog-ng server instance will always print the source IP as "10.232.1.3" Regards Pramod

2 1