July 2011 - syslog-ng - lists.balabit.hu

Syslog-ng log viewer/analyser
by Pramod Pillai 07 Jul '11

07 Jul '11

Hi Is there any Syslog-ng log viewer/analyser which I can use along with syslog-ng . Regards Pramod

5 4

syslog-ng help: how can I use function in double quotes?
by Henry Xu 05 Jul '11

05 Jul '11

Hi All, How can I use a function in double quote? I want to record the IP address of the syslog-ng server. Since there's no available macro that represent the IP of syslog-ng server(only have macros indicate where the message sent to syslog-ng server,like $HOST). So I want to use ip() function and record it to database. The configuration part is: columns( "datetime varchar2(24)", "server_ip varchar2(24)", "host varchar2(32)", ...) values( "${R_YEAR}-${R_MONTH}-${R_DAY} ${R_HOUR}:${R_MIN}:${R_SEC}", "ip()", "$HOST", ...) When I started syslog-ng,it gave error message that said expecting double quotes. How can I use a function in double quotes? Or are there any other ways to get the syslog-ng server IP address and record them? Thanks, Henry

3 3

Re: [syslog-ng] Rpmbuild syslog-ng-3.2.4-1.el6: FAIL: test_nvtable - glib2 hash table
by JP Vossen 05 Jul '11

05 Jul '11

Any clues? -------- Original Message -------- Subject: Re: [syslog-ng] Rpmbuild syslog-ng-3.2.4-1.el6: FAIL: test_nvtable - glib2 hash table Date: Sat, 25 Jun 2011 04:49:38 -0400 From: JP Vossen To: syslog-ng@... On 06/24/2011 07:19 AM, Balazs Scheidler wrote: > On Mon, 2011-06-20 at 20:59 +0100, Jose Pedro Oliveira wrote: >> >> There is a problem with the hash table implementation of glib2 >> version 2.12.3-4 (version that ships in RHEL 5.x). >> More details in: >> >> * https://bugzilla.redhat.com/show_bug.cgi?id=714409#c7 > > Thanks for the information, if it's a glib bug then, can I help you in > any way? Or I can "close" the issue? I see that Jose already forwarded the bug, but I wonder; can you tell me what impact the failed test (and thus failed or potentially failed code block) may have on syslog-ng run-time on CentOS-5/RHEL5? Is this hash problem going to cause critical failures? Under what circumstances? Or is it, well, it'd be nice if that hash problem didn't happen, but it's not a big deal... Thanks, JP ----------------------------|:::======|------------------------------- JP Vossen, CISSP |:::======| http://bashcookbook.com/ My Account, My Opinions |=========| http://www.jpsdomain.org/ ----------------------------|=========|------------------------------- "Microsoft Tax" = the additional hardware & yearly fees for the add-on software required to protect Windows from its own poorly designed and implemented self, while the overhead incidentally flattens Moore's Law.

1 0

Save ALL logs
by Josu Lazkano 05 Jul '11

05 Jul '11

Hello again, I just installed my new log server and I am configuring to save ALL logs on the log server. On the client side I have rsyslog configured this way: $ cat /etc/rsyslog.conf $ModLoad imuxsock $ModLoad imklog $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $RepeatedMsgReduction on $KLogPath /proc/kmsg $WorkDirectory /rsyslog/work $ActionQueueType LinkedList $ActionQueueFileName srvrfwd1 $ActionResumeRetryCount -1 $ActionQueueSaveOnShutdown on *.* @@logserver On the server side I have syslog-ng: source logs_externs{ tcp(); }; destination rdf_all { file("/var/log/extern/${HOST}/${YEAR}/${MONTH}/"); }; log { source(logs_externs); destination(rdf_all); }; I want to get all the logs on the log servers and then archive each month. This way it doesn't work, how I must configure it? Thanks for all your help. Kind regards.

2 1

[Bug 127] New: 3.2.4 ose segfaults during startup
by bugzilla＠bugzilla.balabit.com 01 Jul '11

01 Jul '11

https://bugzilla.balabit.com/show_bug.cgi?id=127 Summary: 3.2.4 ose segfaults during startup Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: balazs.nemeth(a)balabit.com Type of the Report: bug Estimated Hours: 0.0 This bugreport has been opened from an email came to info(a)balabit.com. ------------------------ Core was generated by `syslog-ng -d -p /var/run/syslog-ng.pid -e --enable-core -s'. Program terminated with signal 11, Segmentation fault. #0 0x00000031566795d0 in strcmp () from /lib64/libc.so.6 (gdb) bt #0 0x00000031566795d0 in strcmp () from /lib64/libc.so.6 #1 0x00002b71bfe565d5 in cfg_process_flag (handlers=0x2b71c0082230, base=0x228b5f0, flag=0xffffffff <Address 0xffffffff out of bounds>) at cfg-parser.c:249 #2 0x00002b71c04a6ec6 in afsocket_parse (lexer=0x2265440, last_driver=0x7fffe7126608) at afsocket-grammar.y:864 #3 0x00002b71bfe58c67 in cfg_parser_parse (self=0x2b71c06b2760, cfg=<value optimized out>, yylloc=<value optimized out>) at cfg-parser.h:82 #4 plugin_parse_config (self=0x2b71c06b2760, cfg=<value optimized out>, yylloc=<value optimized out>) at plugin.c:124 #5 0x00002b71bfe570ae in main_parse (lexer=0x2265440, dummy=0x7fffe7128a28) at cfg-grammar.y:539 #6 0x00002b71bfe37a01 in cfg_parser_parse (self=0x22649b0, lexer=0x2265440, parser=0x2b71c00829e0, result=0x2269640) at cfg-parser.h:82 #7 cfg_run_parser (self=0x22649b0, lexer=0x2265440, parser=0x2b71c00829e0, result=0x2269640) at cfg.c:376 #8 0x00002b71bfe37b03 in cfg_read_config (self=0x22649b0, fname=0x402bb7 "/etc/syslog-ng/syslog-ng.conf", syntax_only=<value optimized out>, preprocess_into=0x0) at cfg.c:398 #9 0x000000000040220c in initial_init () #10 0x000000000040280c in main () (gdb) quit This causes it: source 32001_udp { udp( port(32001) so_rcvbuf(12000000) flags(no_multi_line) ); }; ------------------ ps.: With the given config line snippet it is easy to reproduce. I have cc'd the original author of the email. I hope he doesn't mind it. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 126] New: [systemd] Add installation of systemd unit file via build-sys
by bugzilla＠bugzilla.balabit.com 01 Jul '11

01 Jul '11

https://bugzilla.balabit.com/show_bug.cgi?id=126 Summary: [systemd] Add installation of systemd unit file via build-sys Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: d(a)falconindy.com Type of the Report: enhancement Estimated Hours: 0.0 I'd like to see syslog-ng offer installation of the systemd unit file via the build system, similar to how other services (e.g., udev or rsyslog) provide this, with the --with-systemdsystemunitdir configure option. autotools is unfortunately not my forte, so the attached patch may not be the most eloquent of solutions (borrowing bits from udev), but it does the job, and does not appear to bother configurations which avoid --enable-systemd or the new --with flag. I felt it was prudent to separate the --enable-systemd flag from this new flag as there's certainly a case for using the --enable flag without the --with flag. I've also provided a one line amendment to the service file itself, which removes the ExecReload. This is discouraged by upstream, as systemd is unable to properly track the behavior of the daemon due to the effects of an asynchronous trigger. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 10