April 2013 - syslog-ng - lists.balabit.hu

Upcoming changes regarding my Debian/Ubuntu packages
by Gergely Nagy 04 Jul '13

04 Jul '13

Hi! For a good while now, I've been providing Debian and Ubuntu packages[1] for syslog-ng, and rest assured, I will continue to do so. However, the way they are prepared and how the repository is structured, will change. At the moment, there are two different components one can choose from: syslog-ng and syslog-ng-devel, which have packages for 3.3 and 3.4, respectively. However, -devel is not appropriate for 3.4 anymore, but I don't want to move it to syslog-ng either, partly because up to this point, there were no Ubuntu Lucid packages of 3.4. So, I will be making the following changes: * I'll create syslog-ng-3.3, syslog-ng-3.4 and syslog-ng-3.5 components * syslog-ng will point to the latest stable branch (3.4) * syslog-ng will point to the current development branch (3.5) * I'll be preparing Ubuntu Lucid packages for 3.4 too, so all branches will be available for every debian or ubuntu system that are still supported by their respective vendors. To be able to provide Ubuntu Lucid (10.04) packages sanely, I have to do the packaging a little bit differently: the source package will not be shared between debian and ubuntu anymore, and systemd support will be explicitly disabled on Ubuntu. But since Ubuntu uses upstart by default, ubuntu systems with systemd are fairly unlikely anyway. I plan to make these changes once 3.4.2 comes out. Until then, I'll introduce the syslog-ng-3.3 and -3.4 components, but syslog-ng will point to -3.3 still, and -devel to -3.4. Once 3.4.2 is out, though, I'll change the symlinks. [1]: http://asylum.madhouse-project.org/projects/debian/ -- |8]

1 2

[Bug 230] New: Passing args to blocks is broken in syslog-ng v.3.4
by bugzilla＠bugzilla.balabit.com 13 Jun '13

13 Jun '13

https://bugzilla.balabit.com/show_bug.cgi?id=230 Summary: Passing args to blocks is broken in syslog-ng v.3.4 Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: koldaevav(a)gmail.com Type of the Report: bug Estimated Hours: 0.0 After an upgrade from 3.3.7 to 3.4.1: ... block root mylogs(log()) { }; mylogs(log(123)) ... Gives: Unknown argument; context='root block mylogs', arg='log', value='123' Error parsing config, syntax error, unexpected LL_ERROR, expecting $end in /etc/syslog-ng/syslog-ng.conf at line 11, column 1: mylogs(log(123)) ^^^^^^ -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 223] New: syslog-ng doesn' t start on windows running in a cygwin environment
by bugzilla＠bugzilla.balabit.com 24 May '13

24 May '13

https://bugzilla.balabit.com/show_bug.cgi?id=223 Summary: syslog-ng doesn't start on windows running in a cygwin environment Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Windows Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: tps(a)vr-web.de Type of the Report: bug Estimated Hours: 0.0 After having installed syslog-ng and given dependencies, I've configured with /usr/bin/syslog-ng-config No errors that far. Then started it with "net start syslog-ng": $ net start syslog-ng CYGWIN syslog-ng wird gestartet. CYGWIN syslog-ng konnte nicht gestartet werden. Der Dienst hat keinen Fehler gemeldet. Sie erhalten weitere Hilfe, wenn Sie NET HELPMSG 3534 eingeben. syslog-ng did not start. Trying to start with "cygrunsvc -S syslog-ng": $ cygrunsrv.exe -S syslog-ng cygrunsrv: Error starting a service: QueryServiceStatus: Win32 error 1062: Der Dienst wurde nicht gestartet. Same as above. Again no usefull error message. Next I tried to start syslog-ng directly with the paramaters passed by cygrunsvc: $ /usr/sbin/syslog-ng.exe -F Error opening plugin module; module='afsocket', error='No such process' Error opening plugin module; module='afsocket', error='No such process' Error parsing source, source plugin unix-dgram not found in source confgen system at line 1, column 1: included from /etc/syslog-ng/syslog-ng.conf line 10, column 9 unix-dgram ^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng The service does not start because of errors while loading modules. Given "-V" syslog-ng reports: $ /usr/sbin/syslog-ng.exe -V syslog-ng 3.2.5 Installer-Version: 3.2.5 Revision: Compile-Date: Apr 3 2012 14:52:24 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on Enable-Pacct: off Files installed by cygwin are: $ cygcheck.exe -l syslog-ng /etc/postinstall/syslog-ng.sh /etc/defaults/etc/syslog-ng/syslog-ng.conf /etc/defaults/etc/syslog-ng/scl.conf /etc/defaults/etc/syslog-ng/modules.conf /usr/bin/update-patterndb /usr/bin/loggen.exe /usr/bin/syslog-ng-config /usr/bin/cygsyslog-ng-0.dll /usr/bin/pdbtool.exe /usr/lib/syslog-ng/cygdbparser.dll /usr/lib/syslog-ng/cygcsvparser.dll /usr/lib/syslog-ng/cygafsocket-tls.dll /usr/lib/syslog-ng/cygbasicfuncs.dll /usr/lib/syslog-ng/cygafprog.dll /usr/lib/syslog-ng/cygconvertfuncs.dll /usr/lib/syslog-ng/cygafuser.dll /usr/lib/syslog-ng/cygconfgen.dll /usr/lib/syslog-ng/cygsyslogformat.dll /usr/lib/syslog-ng/cygafsocket-notls.dll /usr/lib/syslog-ng/cygdummy.dll /usr/lib/syslog-ng/cygafsocket.dll /usr/lib/syslog-ng/cygaffile.dll /usr/sbin/syslog-ng.exe /usr/sbin/syslog-ng-ctl.exe /usr/share/syslog-ng/include/scl/syslogconf/plugin.conf /usr/share/syslog-ng/include/scl/syslogconf/convert-syslogconf.awk /usr/share/syslog-ng/include/scl/syslogconf/README /usr/share/syslog-ng/include/scl/system/plugin.conf /usr/share/syslog-ng/include/scl/system/generate-system-source.sh /usr/share/syslog-ng/include/scl/pacct/plugin.conf /usr/share/syslog-ng/xsd/patterndb-1.xsd /usr/share/syslog-ng/xsd/patterndb-2.xsd /usr/share/syslog-ng/xsd/patterndb-3.xsd /usr/share/man/man5/syslog-ng.conf.5.gz /usr/share/man/man8/syslog-ng.8.gz /usr/share/man/man1/pdbtool.1.gz /usr/share/man/man1/syslog-ng-ctl.1.gz /usr/share/man/man1/loggen.1.gz /usr/share/doc/syslog-ng/AUTHORS /usr/share/doc/syslog-ng/README /usr/share/doc/syslog-ng/COPYING /usr/share/doc/syslog-ng/ChangeLog /usr/share/doc/syslog-ng/NEWS /usr/share/doc/Cygwin/syslog-ng.README The generated config-file "/etc/syslog-ng/syslog-ng.conf" holds: $ cat /etc/syslog-ng/syslog-ng.conf ############################################################################# # Default syslog-ng.conf file which collects all local logs into a # single file called /var/log/messages. # @version: 3.2 @include "scl.conf" source s_local { system(); internal(); }; source s_network { udp(); }; destination d_local { file("/var/log/messages"); }; log { source(s_local); # uncomment this line to open port 514 to receive messages #source(s_network); destination(d_local); }; Looks like a bug analyzing the installed files correctly and creating a not working setup. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

Re: [syslog-ng] supervisor not restarting a failed daemon process
by Balazs Scheidler 07 May '13

07 May '13

Hi, No kernel source handy but my guess is that the kernel is logging the tid value, which is the same as pid as long as the process is single threaded. I've checked the supervisor code and the only way this could happen is a fork/pipe error which is not logged. It should be logged but who knows that message can be lost. The supervisor attempts to restart 3 times then gives up. Hmmm the supervisor messages may be redirected to syslog after the first startup which might explain why they don't get logged. But why does fork/pipe fail? Hope this helps. Evan Rempel <erempel(a)uvic.ca> wrote: >The logs below show a "standard" syslog-ng processID=15017 that reads /dev/log /proc/kmsg >The second instance of syslog-ng is what we call our "server" which just listens on the network ports >and does all of the complex patterndb, filtering and routing to destination processes > >kern.info kernel: syslog-ng[1561]: segfault at 7f65c0000078 ip 00007f65c0000078 sp 00007f65e1385a48 error 15 >--- this is the server instance segfaulting (I assume, see WAIT below) > >syslog.notice syslog-ng[15017]: Syslog connection closed; fd='20', client='AF_INET(142.104.47.145:49803)', local='AF_INET(127.0.0.1:1514)' >syslog.notice syslog-ng[15017]: Syslog connection broken; fd='14', server='AF_INET(142.104.47.146:514)', time_reopen='5' >--- this was the standard syslog loosing connection to the server, and detecting the drop of the server instance destination to it. > >daemon.info syslog-ng-stats: server stopping on socket "/var/local/syslog-ng.server.ctl" >daemon.info msgid_profiler[832]: committing residual data >local0.info flare-timer[834]: stopping >local0.info action-handler[833]: stopping >--- these are all program destinations of the server instance shutting down gracefully after the close of their stdin. > >daemon.crit supervise/syslog-ng[27221]: Daemon exited due to a deadlock/signal/failure, restarting; exitcode='11' >syslog.err syslog-ng[15017]: Syslog connection failed; fd='14', server='AF_INET(142.104.47.146:514)', error='Connection refused (111)', time_reopen='5' > >This "connection failed" message repeats every 5 seconds until I restart the server instance. > >syslog.notice syslog-ng[1911]: syslog-ng starting up; version='3.4.1' > >So it does not look like there is anything in the logs about attempted restarts. > > >WAIT... > >This is really odd. The line > >kern.info kernel: syslog-ng[1561]: segfault at 7f65c0000078 ip 00007f65c0000078 sp 00007f65e1385a48 error 15 > >implies that there was a process ID 1561 that segfaulted, but that line is the ONLY logged line with that process ID. >We take ps snapshots every 15 minutes, and those snapshots don't show anything for that process ID. >Also, the supervisor processID is shown > > USER PID PPID NI PRI CPU VSZ ELAPSED TIME COMMAND >root 27221 1 0 19 - 26556 9-04:00:59 00:00:00 supervising syslog-ng >root 27222 27221 0 19 - 977064 9-04:00:59 1-02:52:35 /usr/local/sbin/syslog-ng --cfgfile= ... > >which matches the line >daemon.crit supervise/syslog-ng[27221]: Daemon exited due to a deadlock/signal/failure, restarting; exitcode='11' > >so its child which dies should have been processID 27222 so why is the log line >kern.info kernel: syslog-ng[1561]: segfault at 7f65c0000078 ip 00007f65c0000078 sp 00007f65e1385a48 error 15 > > >I conclude that the 1561 is not the process ID. > >Can you shed any light on this? > >Evan. > >On 04/26/2013 11:00 PM, Balazs Scheidler wrote: > > >> Strange, indeed. The supervisor gives up if the restarted daemon exits for some reason. Eg. If there's an initialization error it gives up. Any indication in the logs? >> >> Evan Rempel <erempel(a)uvic.ca> wrote: >> >>> We are sing the log line >>> >>> supervise/syslog-ng[27221]: Daemon exited due to a deadlock/signal/failure, restarting; exitcode='11' >>> >>> >>> and it looks like it should restart, but instead of restarting, >>> the supervisor terminates and then no syslog-ng process is running. >>> >>> Is this a bug in the supervisor? >>> ______________________________________________________________________________ >>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >>> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >>> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >>> >> ______________________________________________________________________________ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.balabit.com/wiki/syslog-ng-faq >> > > >-- >Evan Rempel erempel(a)uvic.ca >Senior Systems Administrator 250.721.7691 >Data Centre Services, University Systems, University of Victoria >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

2 3

Re: [syslog-ng] Can not get DBParse match macro result (syslog-ng 3.13 debian squeeze)
by 不坏阿峰 06 May '13

06 May '13

thanks to your reply. i do not understand how to do now. it puzzle and trouble me some days. i read the balabit syslog-ng OSE guide documents and only have simple information in there. how to do on this ----->>>> If you change the patterndb ruleset pattern to use a program of system rather than ESXI I think it would work. 2013/4/28 <syslog-ng-request(a)lists.balabit.hu> > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Can not get DBParse match macro result (syslog-ng 3.13 > debian squeeze) (????) > 2. Re: Can not get DBParse match macro result (syslog-ng 3.13 > debian squeeze) (Evan Rempel) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 27 Apr 2013 22:34:50 +0800 > From: ???? <onlydebian(a)gmail.com> > Subject: [syslog-ng] Can not get DBParse match macro result (syslog-ng > 3.13 debian squeeze) > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <CA+SSH2oBB2-WWvQksbchVVoyhfZbdVvDR= > V7wJ1EJdvE6Zx9zg(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > when use pdbtool do match test, it is success. but from syslog-ng can not > return result of macro > i can not get macro result. for example, ${.esxi.month} no value, same > as ${.esxi.host_ip} ${.esxi.time} > > test log output ,just like this. > === system,error,critical, HOST IP , > === system,error,critical, HOST IP , > === system,error,critical, HOST IP , > === system,error,critical, HOST IP , > === system,error,critical, HOST IP , > === system,error,critical, HOST IP , > === system,error,critical, HOST IP , > === system,error,critical, HOST IP , > === system,error,critical, HOST IP , > > > do the pdbtool test, it's ok. wish someone can give me some solution and > help. i have search some mail list but i can not get the right solution. > thanks a lot. > > root@debian:~# pdbtool match -D -c -p > /etc/syslog-ng/patterndb/esxi_pattern.xml -P ESXI -M "Apr 26 15:17:31 > 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd > 0x1a (0x4124444a6280, 0) to dev "mpx.vmhba0:C0:T0:L0" on path > "vmhba0:C0:T0:L0" Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. > Act:NONE" > Pattern matching part: > @STRING:.esxi.month=Apr@ @STRING:.esxi.date=26@ > @STRING:.esxi.time=15:17:31@@IPv4:.esxi.host_ip=192.168.88.71@ > @ESTRING:.esxi.program= > vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a > (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 > Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. > Act:NONE@@ANYSTRING:.esxi.message=cpu11:8203)NMP: > nmp_ThrottleLogForDevice:2319: Cmd > 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 > Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@ > Matching part: > Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: > nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev > mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid > sense data: 0x5 0x20 0x0. Act:NONE > Values: > MESSAGE=Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: > nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev > mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid > sense data: 0x5 0x20 0x0. Act:NONE > PROGRAM=ESXI > .classifier.class=esxi > .classifier.rule_id=182437592347598 > .esxi.month=Apr > .esxi.date=26 > .esxi.time=15:17:31 > .esxi.host_ip=192.168.88.71 > .esxi.program= vmkernel > .esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a > (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 > Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE > root@debian:~# > > > my configuration like as below > > ######## esxi_pattern.xml ############ > <?xml version="1.0" encoding="utf-8"?> > <patterndb version='3' pub_date='2009-04-17'> > <ruleset name='esxi' id='123456678'> > <pattern>ESXI</pattern> > <rules> > <rule provider='Fone Bro' id='182437592347598' class='esxi'> > <patterns> > <pattern>@STRING:.esxi.month:@ @STRING:.esxi.date:@ > @STRING:.esxi.time::@@IPv4:.esxi.host_ip:@ > @ESTRING:.esxi.program::@ @ANYSTRING:.esxi.message@</pattern> > </patterns> > </rule> > </rules> > </ruleset> > </patterndb> > > ######## syslog-ng.conf ######## > > #####Parser##### > parser pattern_db { > db_parser( file("/etc/syslog-ng/patterndb/esxi_pattern.xml")); > }; > > #Check pattern matching > destination udp_esxi_output { > file("/var/log/pattern_output" > template("=== $PROGRAM,${.esxi_month} ${.esxi.date} ${.esxi.time} HOST > IP ${.esxi.host_ip},${.esxi.message}\n") > template_escape(no)); > }; > > #####Log##### > log { > source(s_network); > parser(pattern_db); > destination(udp_esxi_output); > }; >

3 7

syslog-ng 3.3.6 Hangs on Solaris 8 sparc
by Rakesh Rajasekharan 02 May '13

02 May '13

Hi All, I have compiled the syslog-ng version 3.3.6 on a Solaris Sparc machine . The compilation went through fine but when I try to run syslog-ng .. though the daemon gets running somehow the unix prompt is not returned.. and it hangs... For ex:- # ps -ef|grep -i syslog root 14073 11758 0 07:11:37 pts/4 0:00 vi syslog-ng.d root 14097 13526 0 07:15:48 pts/1 0:00 grep -i syslog Now if I start the daemon using the below options... # /opt/soe/local/syslog-ng-3.3.6/sbin/syslog-ng -f /opt/soe/local/syslog_ng/etc/syslog-ng/syslog-ng.conf -p /var/run/syslog-ng.pid I never get back the prompt.. but if on another window I check.. the daemon has started.. ps -ef|grep -i syslog root 14099 11758 0 07:16:17 pts/4 0:00 grep -i syslog root 14098 13526 23 07:16:04 pts/1 0:13 /opt/soe/local/syslog-ng-3.3.6/sbin/syslog-ng -f /opt/soe/local/syslog_ng/etc/s though I guess... i should expect one more child to this... can someone please help me address this issue please... Thanks, Rkaesh.

3 10

[Bug 233] New: openssl CAfile configuration option
by bugzilla＠bugzilla.balabit.com 30 Apr '13

30 Apr '13

https://bugzilla.balabit.com/show_bug.cgi?id=233 Summary: openssl CAfile configuration option Product: syslog-ng Version: unspecified Platform: All OS/Version: All Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: james(a)chatid.com Type of the Report: enhancement Estimated Hours: 0.0 Today I was trying to set up syslog-ng on some servers and encountered trouble configuring the server to send intermediary certificates. >From what I can see[1], the ca_dir option is the only way to get intermediary certs attached. I can only assume that this maps down to a call to the `SSL_CTX_load_verify_locations` function in the openssl library[2] with a `NULL` CAfile argument and `ca_path` as the third argument Can a configuration option that maps to CAfile be added to syslog-ng? [1] http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-guid… [2] https://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 229] New: json parser does not maintain all json object data
by bugzilla＠bugzilla.balabit.com 30 Apr '13

30 Apr '13

https://bugzilla.balabit.com/show_bug.cgi?id=229 Summary: json parser does not maintain all json object data Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 Then the json parser is used parser p_json { json-parser(); }; log { source(mysource); parser(p_json); ... } tag-value pairs are not maintained if they are ones that are normally populated by syslog-ng. Even with a source that has flags(no-parse) man macros are populated by syslog-ng C_* S_* R_* YEAR_DAY YEAR WEEKDAY_NAME WEEK_DAY_ABBREV WEEK_DAY WEEKDAY WEEK USEC UNIXTIME TZOFFSET TZ TAGS SYSUPTIME STAMP SEC MSEC MONTH_WEEK MONTH_NAME MONTH_ABBREV MONTH MIN LOGHOST ISODATE HOUR12 HOUR FULLDATE DAY DATE AMPM the json parser should populate the macros after the initial population allowing the json data to overwrite/control all of the macros. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

Re: [syslog-ng] supervisor not restarting a failed daemon process
by Balazs Scheidler 29 Apr '13

29 Apr '13

Strange, indeed. The supervisor gives up if the restarted daemon exits for some reason. Eg. If there's an initialization error it gives up. Any indication in the logs? Evan Rempel <erempel(a)uvic.ca> wrote: >We are sing the log line > >supervise/syslog-ng[27221]: Daemon exited due to a deadlock/signal/failure, restarting; exitcode='11' > > >and it looks like it should restart, but instead of restarting, >the supervisor terminates and then no syslog-ng process is running. > >Is this a bug in the supervisor? >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

2 1

Can not get DBParse match macro result (syslog-ng 3.13 debian squeeze)
by 不坏阿峰 27 Apr '13

27 Apr '13

when use pdbtool do match test, it is success. but from syslog-ng can not return result of macro i can not get macro result. for example, ${.esxi.month} no value, same as ${.esxi.host_ip} ${.esxi.time} test log output ,just like this. === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , === system,error,critical, HOST IP , do the pdbtool test, it's ok. wish someone can give me some solution and help. i have search some mail list but i can not get the right solution. thanks a lot. root@debian:~# pdbtool match -D -c -p /etc/syslog-ng/patterndb/esxi_pattern.xml -P ESXI -M "Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev "mpx.vmhba0:C0:T0:L0" on path "vmhba0:C0:T0:L0" Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE" Pattern matching part: @STRING:.esxi.month=Apr@ @STRING:.esxi.date=26@ @STRING:.esxi.time=15:17:31@@IPv4:.esxi.host_ip=192.168.88.71@@ESTRING:.esxi.program= vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@@ANYSTRING:.esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@ Matching part: Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE Values: MESSAGE=Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE PROGRAM=ESXI .classifier.class=esxi .classifier.rule_id=182437592347598 .esxi.month=Apr .esxi.date=26 .esxi.time=15:17:31 .esxi.host_ip=192.168.88.71 .esxi.program= vmkernel .esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE root@debian:~# my configuration like as below ######## esxi_pattern.xml ############ <?xml version="1.0" encoding="utf-8"?> <patterndb version='3' pub_date='2009-04-17'> <ruleset name='esxi' id='123456678'> <pattern>ESXI</pattern> <rules> <rule provider='Fone Bro' id='182437592347598' class='esxi'> <patterns> <pattern>@STRING:.esxi.month:@ @STRING:.esxi.date:@ @STRING:.esxi.time::@@IPv4:.esxi.host_ip:@ @ESTRING:.esxi.program::@ @ANYSTRING:.esxi.message@</pattern> </patterns> </rule> </rules> </ruleset> </patterndb> ######## syslog-ng.conf ######## #####Parser##### parser pattern_db { db_parser( file("/etc/syslog-ng/patterndb/esxi_pattern.xml")); }; #Check pattern matching destination udp_esxi_output { file("/var/log/pattern_output" template("=== $PROGRAM,${.esxi_month} ${.esxi.date} ${.esxi.time} HOST IP ${.esxi.host_ip},${.esxi.message}\n") template_escape(no)); }; #####Log##### log { source(s_network); parser(pattern_db); destination(udp_esxi_output); };

2 1