June 2012 - syslog-ng - lists.balabit.hu

tcp/udp driver not binding correctly
by N. Max Pierson 04 Jun '12

04 Jun '12

Hi List, I've searched the mailing lists for over a year back and couldn't find an answer to my question. I'm working with an older version of syslog-ng and most of the questions were about 3.x or newer, so here goes. I've setup a LVS cluster which is working perfectly. The problem I am having is when I have a logical interface ip (or no ip at all, interface is eth0:1) when using the tcp/udp driver, it does not seem to bind correctly and accept messages on the port specified. When using udp, I try a port scan with nmap and it shows the port on the logical interface a "closed". When I try tcp, it shows "filtered". The primary ip on interface eth0 accepts logs with no issues. Can syslog-ng bind to logical interfaces as described above and receive logs on multiple addresses?? A netstat -a shows *:syslog or when I outright specify the logical ip, it shows the logical ip, but as stated above ... it's either closed or filtered. I've searched all over, but it seems my google foo is not matching anything. Specifics .. RHEL v5.8 Syslog-ng v2.1.4 Regards, max

2 2

Problems for configure syslog structured as a source
by C. L. Martinez 04 Jun '12

04 Jun '12

Hi all, I am trying to configure syslog-ng to receive syslog messages as syslog structured (IETF). To accomplish I have configured: source s_ietfsyslog { syslog (port(20514) transport(tcp)); }; but not messages are processed by syslog-ng (but messages arrives from third devices). Any idea??

3 6

Re: [syslog-ng] Error in running syslogng client - source plugin sun-streams not found
by Balla, Hithendra (EXT-Other - IN/Bangalore) 04 Jun '12

04 Jun '12

Hi all, In the below conf file, I can see @include "scl.conf". If I remove that line or if I change it to --> include "scl.conf"; [i.e remove @ and add ; at the end], it did not complain any error. Is that expected behavior? Thanks Hithendra _____________________________________________ From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Monday, June 04, 2012 4:01 PM To: 'Syslog-ng users' and developers' mailing list' Subject: Error in running syslogng client - source plugin sun-streams not found Hi all, Can somebody help here in identifying the issue here. It says source plug-in sun-streams not sound. I have configured syslog-ng with --enable-ssl --enable-sun-streams A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -V syslog-ng 3.4.0alpha2 Installer-Version: 3.4.0alpha2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainli ne--3.4--master#ab25c4c2a32988d86a5e024d784db7ad48f17cd2 Compile-Date: Jun 4 2012 18:38:40 Available-Modules: afsocket,afsocket-notls,afstreams,affile,afprog,afuser,afmongodb,csvpars er,confgen,syslogformat,basicfuncs,dbparser,tfuuid,afsocket-tls Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: on A02-LEM-CSLPN01A# This is the client config file ######################################################################## ##### #Syslog-ng Client configuration File. # @version: 3.3 @include "scl.conf" options { keep_hostname (yes); log_fifo_size (1000); }; source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); }; A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -fFvde ~/syslog_conf/mod/syslog-ng_client.conf nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Starting to read include file; filename='/usr/local/etc/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/local/share/include/scl' Global value changed; define='include-path', value='/usr/local/etc:/usr/local/share/include' Starting to read include file; filename='/usr/local/etc/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Module loaded and initialized successfully; module='syslogformat' Module loaded and initialized successfully; module='basicfuncs' Module loaded and initialized successfully; module='afsocket' Module loaded and initialized successfully; module='affile' Module loaded and initialized successfully; module='afprog' Module loaded and initialized successfully; module='afuser' Module loaded and initialized successfully; module='dbparser' Module loaded and initialized successfully; module='csvparser' Finishing include; filename='/usr/local/etc/modules.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/usr/local/etc/scl.conf', depth='1' Error parsing source, source plugin sun-streams not found in /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, column 18: source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)) ;}; ^^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng A02-LEM-CSLPN01A

1 0

Re: [syslog-ng] Need help in running syslog-ng
by Balla, Hithendra (EXT-Other - IN/Bangalore) 04 Jun '12

04 Jun '12

Hi, This is the output with Fvde. It is showing relocation error for libafsocket.so. Any idea why it is coming ? A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -fFvde ~/syslog_conf/mod/syslog-ng_client.conf nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Starting to read include file; filename='/usr/local/etc/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/local/share/include/scl' Global value changed; define='include-path', value='/usr/local/etc:/usr/local/share/include' Starting to read include file; filename='/usr/local/etc/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Module loaded and initialized successfully; module='syslogformat' Module loaded and initialized successfully; module='basicfuncs' Error opening plugin module; module='afsocket', error='ld.so.1: syslog-ng: fatal: relocation error: file /usr/local/lib/syslog-ng/libafsocket.so: symbol request_init: referenced symbol not found' Module loaded and initialized successfully; module='affile' Module loaded and initialized successfully; module='afprog' Module loaded and initialized successfully; module='afuser' Module loaded and initialized successfully; module='dbparser' Module loaded and initialized successfully; module='csvparser' Finishing include; filename='/usr/local/etc/modules.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/usr/local/etc/scl.conf', depth='1' Error parsing source, source plugin sun-streams not found in /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, column 18: source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)) ;}; ^^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng A02-LEM-CSLPN01A# Thanks Hithendra -----Original Message----- From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Friday, June 01, 2012 5:49 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Need help in running syslog-ng Hi, Please find the attached output of configure. I tried running the command with -Fvde along with -f, but it says "excess number of args". Can you tell me if I missed anything here.? A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -f -Fvde /export/home/root/syslog_conf/mod/syslog-ng_client.conf Excess number of arguments Thanks Hithendra -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ext Gergely Nagy Sent: Friday, June 01, 2012 5:29 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Need help in running syslog-ng "Balla, Hithendra (EXT-Other - IN/Bangalore)" <hithendra.balla.ext(a)nsn.com> writes: > A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -f > /export/home/root/syslog_conf/mod/syslog-ng_client.conf > > WARNING: Configuration file format is too old, please update it to use > the 3.4 format as some constructs might operate inefficiently; > Error parsing source, source plugin sun-streams not found in > /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, > column 18: > > source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); }; Could you post the output of configure, or config.log, perhaps? Also, you can try running syslog-ng with the -Fvde parameters (in addition to -f), which will output quite a lot of debug info to stderr, which might help us determine what's going wrong. >From both errors you showed, it seems syslog-ng is unable to find a module or two. Why that is so, I can't tell. config.log and the output of running syslog-ng with -Fvde could help us figure out the reason. -- |8] ________________________________________________________________________ ______ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

Error in running syslogng client - source plugin sun-streams not found
by Balla, Hithendra (EXT-Other - IN/Bangalore) 04 Jun '12

04 Jun '12

Hi all, Can somebody help here in identifying the issue here. It says source plug-in sun-streams not sound. I have configured syslog-ng with --enable-ssl --enable-sun-streams A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -V syslog-ng 3.4.0alpha2 Installer-Version: 3.4.0alpha2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainli ne--3.4--master#ab25c4c2a32988d86a5e024d784db7ad48f17cd2 Compile-Date: Jun 4 2012 18:38:40 Available-Modules: afsocket,afsocket-notls,afstreams,affile,afprog,afuser,afmongodb,csvpars er,confgen,syslogformat,basicfuncs,dbparser,tfuuid,afsocket-tls Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: on A02-LEM-CSLPN01A# This is the client config file ######################################################################## ##### #Syslog-ng Client configuration File. # @version: 3.3 @include "scl.conf" options { keep_hostname (yes); log_fifo_size (1000); }; source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)); }; A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -fFvde ~/syslog_conf/mod/syslog-ng_client.conf nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Starting to read include file; filename='/usr/local/etc/scl.conf', depth='1' Global value changed; define='scl-root', value='/usr/local/share/include/scl' Global value changed; define='include-path', value='/usr/local/etc:/usr/local/share/include' Starting to read include file; filename='/usr/local/etc/modules.conf', depth='2' Global value changed; define='autoload-compiled-modules', value='0' Module loaded and initialized successfully; module='syslogformat' Module loaded and initialized successfully; module='basicfuncs' Module loaded and initialized successfully; module='afsocket' Module loaded and initialized successfully; module='affile' Module loaded and initialized successfully; module='afprog' Module loaded and initialized successfully; module='afuser' Module loaded and initialized successfully; module='dbparser' Module loaded and initialized successfully; module='csvparser' Finishing include; filename='/usr/local/etc/modules.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/system/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Finishing include; filename='/usr/local/share/include/scl/pacct/plugin.conf', depth='2' Starting to read include file; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Module loaded and initialized successfully; module='confgen' Finishing include; filename='/usr/local/share/include/scl/syslogconf/plugin.conf', depth='2' Finishing include; filename='/usr/local/etc/scl.conf', depth='1' Error parsing source, source plugin sun-streams not found in /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, column 18: source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)) ;}; ^^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng A02-LEM-CSLPN01A

1 0

(no subject)
by pedro castro 03 Jun '12

03 Jun '12

Gain Your Freedom, Manage Your Own Business http://www.fastauditores.com/httppxdvxdz-2.php?rytnumberID=353 Sun, 3 Jun 2012 12:57:56 _______________ Fiber board may also be used, but this is moredifficult to handle. journey wynwode

1 0

Need help in running syslog-ng
by Balla, Hithendra (EXT-Other - IN/Bangalore) 01 Jun '12

01 Jun '12

<<mod_client.conf>> <<mod_server.conf>> Hi all, This is Hithendra. I have succefully compiled and installed syslog-ng-3.4 version on Solaris Sparc10. I have used the following options while configuring syslog-ng. ./configure --with-ssl=/usr/local/ssl/ --enable-ssl --enable-sun-streams When I try to run the client /usr/local/sbin/syslog-ng -f /export/home/root/syslog_conf/mod/syslog-ng_client.conf --> I am getting the following error. A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -f /export/home/root/syslog_conf/mod/syslog-ng_client.conf WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Error parsing source, source plugin sun-streams not found in /export/home/root/syslog_conf/mod/syslog-ng_client.conf at line 14, column 18: source s_local { sun-streams("/dev/log"); udp(ip(0.0.0.0) port(514)) ;}; ------------------------------------------------------------------------ --------------------------------------------------- When I try to run the server A02-LEM-CSLPN01A# /usr/local/sbin/syslog-ng -f /export/home/root/syslog_conf/mod/syslog-ng_server.conf --> I am getting the following error WARNING: Configuration file format is too old, please update it to use the 3.4 format as some constructs might operate inefficiently; Using a global log-iw-size() option was removed, please use a per-source log-iw-size(); Error parsing afsocket, syntax error, unexpected LL_IDENTIFIER in /export/home/root/syslog_conf/mod/syslog-ng_server.conf at line 21, column 13: tls( ^^^ Can somebody help here in identifying issue and provide some input on how to get rid of it. Please find the attached conf files. Thanks Hithendra

2 2

syslog_ng 3.3.4 make error on HPUX HPPA 11.11
by Rakesh Rajasekharan 01 Jun '12

01 Jun '12

Hi, I am trying to compile syslog-ng 3.3.4 version on an HPUX HPPA 11.11 machine. The configure options I used were. ./configure --enable-dynamic-linking --prefix=/opt/soe/local/syslog-ng-3.3.4 Compiler options: compiler : gcc -std=gnu99 compiler options : -g -O2 -Wall -pthread -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -D_REENTRANT -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/syslog-ng-3.3.4/eventlog/include/eventlog -I/usr/local/include -I$(top_srcdir)/lib/ivykis/lib/include -I$(top_builddir)/lib/ivykis/lib/include -I$(top_srcdir)/lib/ivykis/modules/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lcl prefix : /opt/soe/local/syslog-ng-3.3.4 linking mode : dynamic __thread keyword : no Submodules: ivykis : internal libmongo-client : internal Features: Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : no Linux capability support : no PCRE support : yes Env wrapper support : no systemd support : no (unit dir: none) Modules: Module search path : /opt/soe/local/syslog-ng-3.3.4/lib/syslog-ng Default module list : affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat Sun STREAMS support (module): no SSL support (module) : no SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : no (using no) The make though fails with the below error. /bin/sh ../../libtool --tag=CC --mode=link gcc -Wall -g -O2 -o client client.o ../libivykis.la -lpthread libtool: link: gcc -Wall -g -O2 -o client client.o ../.libs/libivykis.a -lpthread /usr/ccs/bin/ld: Unsatisfied symbols: pthread_sigmask (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_init (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_destroy (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_unlock (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) pthread_mutex_lock (first referenced in ../.libs/libivykis.a(iv_main.o)) (data) /usr/ccs/bin/ld: (Warning) Linker features were used that may not be supported in future releases. The +vallcompatwarnings option can be used to display more details, and the ld(1) man page contains additional information. This warning can be suppressed with the +vnocompatwarnings option. collect2: ld returned 1 exit status make[7]: *** [client] Error 1 make[7]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis/lib/test' make[6]: *** [all-recursive] Error 1 make[6]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis/lib' make[5]: *** [all-recursive] Error 1 make[5]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis' make[4]: *** [all] Error 2 make[4]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib/ivykis' make[3]: *** [all-recursive] Error 1 make[3]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib' make[2]: *** [all] Error 2. I have compiled glib-2.16.5 statically and eventlog_0.2.12. make[2]: Leaving directory `/compile/syslog/syslog-ng-3.3.4/lib' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/compile/syslog/syslog-ng-3.3.4' make: *** [all] Error 2. Please help me fix this. I have tried tweaking with the comfigure options but could no tget anywhere. Regards, Rakesh

3 6

[Bug 157] New: syslog-ng 3.2.x/3.3.x: test_sql.py and 64-bit systems
by bugzilla＠bugzilla.balabit.com 01 Jun '12

01 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=157 Summary: syslog-ng 3.2.x/3.3.x: test_sql.py and 64-bit systems Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Mac OS Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Created an attachment (id=45) --> (https://bugzilla.balabit.com/attachment.cgi?id=45) Add '/usr/lib64/dbd/' to the search paths Hi, In 64-bits systems we need to add lib64 directories to the libdbi/libdbdsqlite3 module search path in order to successfully run the test_sql functional test. Location of libdbdsqlite3.so in 64-bit Fedora/RHEL: ---------- $ rpm -ql libdbi-dbd-sqlite /usr/lib64/dbd/libdbdsqlite3.so ---------- Affected syslog-ng versions: At least the 3.2 and 3.3 branches (I haven't check the 3.4 development branch). Fix: The attached patch adds the '/usr/lib64/dbd/' directory to the search path. Adding '/usr/local/lib64/dbd' should also make sense (but it is not done by the attached patch). /jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5