June 2015 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] Problems trying to compile syslog-ng 3.6.4 on Solaris 11.2 (SPARC)
by Cottington-Bray, Ian 25 Jun '15

25 Jun '15

Any suggestions ?? From: Cottington-Bray, Ian Sent: 23 June 2015 11:28 To: 'syslog-ng(a)lists.balabit.hu' Subject: Problems trying to compile syslog-ng 3.6.4 on Solaris 11.2 (SPARC) Have compiled and installed eventlog-0.2.12 (into /usr/local/syslog-ng). Now trying to compile syslog-ng I'm hitting the error shown at the end. Following commands were used to configure the environment for the compile export PKG_CONFIG_PATH=/usr/local/syslog-ng/lib/pkgconfig ./configure --prefix=/usr/local/syslog-ng --enable-sun-streams --enable-tcp-wrapper --enable-ipv6 --enable-sql --enable-ssh --with-ld-library-path=/usr/local/syslog-ng/lib --disable-amqp --enable-sun-door Any suggestions ? Thanks Ian CC modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-mapper-unix.lo CC modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-unix-socket.lo modules/afsocket/transport-unix-socket.c: In function â_format_proc_file_nameâ: modules/afsocket/transport-unix-socket.c:50:3: warning: format â%dâ expects argument of type âintâ, but argument 4 has type âpid_tâ [-Wformat=] g_snprintf(buf, buflen, "/proc/%d/%s", pid, proc_file); ^ modules/afsocket/transport-unix-socket.c: In function â_unix_socket_readâ: modules/afsocket/transport-unix-socket.c:219:6: error: âstruct msghdrâ has no member named âmsg_controlâ msg.msg_control = ctlbuf; ^ modules/afsocket/transport-unix-socket.c:220:6: error: âstruct msghdrâ has no member named âmsg_controllenâ msg.msg_controllen = sizeof(ctlbuf); ^ modules/afsocket/transport-unix-socket.c: In function âlog_transport_unix_dgram_socket_newâ: modules/afsocket/transport-unix-socket.c:261:3: warning: implicit declaration of function âsocket_set_pass_credentialsâ [-Wimplicit-function-declaration] socket_set_pass_credentials(fd); ^ modules/afsocket/transport-unix-socket.c: At top level: modules/afsocket/transport-unix-socket.c:36:1: warning: â_add_nv_pair_intâ defined but not used [-Wunused-function] _add_nv_pair_int(LogTransportAuxData *aux, const gchar *name, gint value) ^ modules/afsocket/transport-unix-socket.c:102:1: warning: â_add_nv_pair_proc_read_unless_unsetâ defined but not used [-Wunused-function] _add_nv_pair_proc_read_unless_unset(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file, const gchar *unset_value) ^ modules/afsocket/transport-unix-socket.c:115:1: warning: â_add_nv_pair_proc_read_argvâ defined but not used [-Wunused-function] _add_nv_pair_proc_read_argv(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file) ^ modules/afsocket/transport-unix-socket.c:135:1: warning: â_add_nv_pair_proc_readlinkâ defined but not used [-Wunused-function] _add_nv_pair_proc_readlink(LogTransportAuxData *aux, const gchar *name, pid_t pid, const gchar *proc_file) ^ gmake[2]: *** [modules/afsocket/modules_afsocket_libafsocket_notls_la-transport-unix-socket.lo] Error 1 gmake[1]: *** [all-recursive] Error 1 gmake: *** [all] Error 2 The contents of this e-mail are confidential and for the exclusive use of the intended recipient. If you are not the intended recipient you should not read, copy, retransmit or disclose its contents. If you have received this email in error please delete it from your system immediately and notify us either by email or telephone. The views expressed in this communication may not necessarily be the views held by McLaren Technology Group Limited. McLaren Technology Group Limited | McLaren Technology Centre | Chertsey Road | Woking | Surrey | GU21 4YH | UK | Company Number: 01967715

1 0

Re: [syslog-ng] I need assistance converting a syslog-ng.conf file from V 1.5.16 to 3.2.4...
by Mason, Tron 25 Jun '15

25 Jun '15

Hello... I'm getting the following errors. Please help. Thanks. bash-3.2# /usr/local/sbin/syslog-ng -v -s -f /usr/local/etc/syslog-ng/syslog-ng.conf WARNING: the match() filter without the use of the value() option is deprecated and hinders performance, please update your configuration; bash-3.2# /usr/local/etc/syslog-ng/syslog-ng.conf -a -f /usr/local/sbin/syslog-ng /usr/local/etc/syslog-ng/syslog-ng.conf: line 10: @version:: command not found /usr/local/etc/syslog-ng/syslog-ng.conf: line 12: syntax error near unexpected token `(' /usr/local/etc/syslog-ng/syslog-ng.conf: line 12: `options { use_dns(yes); ' Tron G Mason

2 1

mark-freq() and mark-mode() understanding
by Sergey Y. Afonin 24 Jun '15

24 Jun '15

Hello. I need an explanation of mark-freq() and mark-mode() works. === a part of syslog-ng.conf === options { ... mark-freq(300); ... } destination mesg { file("/var/log/syslog/messages" mark-mode(periodical)); }; === === a part of /var/log/syslog/messages === Jun 24 08:26:35 -- MARK -- Jun 24 08:30:01 crond[10512]: (root) CMD ( /usr/bin/freshclam --quiet --daemon-notify) Jun 24 08:31:30 -- MARK -- Jun 24 09:01:01 crond[10544]: (root) CMD (run-parts /etc/cron.hourly) Jun 24 09:25:30 syslog-ng[9983]: Log statistics ... === "MARK" label absent between 08:31:30 and 09:01:01 for example. Does it turns out that "idle" is checked for all file() globally ? Can I setup it for one file() ? -- Regards, Sergey.

1 0

3.6.4 in FreeBSD ports and for EPEL6
by Czanik, Péter 23 Jun '15

23 Jun '15

Hi, As promised: - FreeBSD ports now has 3.6.4: http://www.freshports.org/sysutils/syslog-ng/ - my unofficial EPEL6 (RHEL/CentOS/etc.) repo is also updated: https://copr.fedoraproject.org/coprs/czanik/syslog-ng36epel6/ Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

CzP in Boston @ Red Hat Summit
by Czanik, Péter 22 Jun '15

22 Jun '15

Hi, This week I'm in Boston at the Red Hat Summit: https://czanik.blogs.balabit.com/2015/06/red-hat-summit-syslog-ng-docker-co… If you are at the Summit or just in the Boston area and would like to talk to a BalaBit engineer about syslog-ng, contact me by e-mail or twitter (@PCzanik)! Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

my unofficial 3.6.4 packages for opensuse/sles/fedora/rhel7
by Czanik, Péter 22 Jun '15

22 Jun '15

Hi, Most of my unofficial syslog-ng packages are now ready: openSUSE/SLES: https://build.opensuse.org/project/show/home:czanik:syslog-ng36 Fedora/RHEL7: https://copr.fedoraproject.org/coprs/czanik/syslog-ng36/ RHEL6 and FreeBSD ports will hopefully follow later this week. As I'm off to the Red Hat Summit this week ( https://czanik.blogs.balabit.com/2015/06/red-hat-summit-syslog-ng-docker-co… ) my response time will be slower than usual. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

insider 2015-06: Red Hat Summit; EU Data Security; GSoC IRC; syslog-ng 3.6.3
by Czanik, Péter 18 Jun '15

18 Jun '15

Dear syslog-ng users, This is the 42th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng @ Red Hat Summit -------------------------- Come to visit the BalaBit booth (#301) at the Red Hat Summit in Boston! We hare happy to discuss the latest trends in log management, new features of syslog-ng, talk about Docker integration and the new BigData destinations. For details, read https://czanik.blogs.balabit.com/2015/06/red-hat-summit-syslog-ng-docker-co… GSoC IRC meeting ---------------- On the 4th of June we had a successful IRC meeting, which involved GSoC students and mentors, syslog-ng developers and users. Based on this experience we plan to have regular IRC meetings in the future. If you have a question you don't need to wait for a dedicated meeting, just join the channel and ask! The syslog-ng IRC channel is available on the freenode network: #syslog-ng on irc.freenode.net You can also use http://webchat.freenode.net/ to join if you don't have a dedicated client. EU Data Security Requirements and log management ------------------------------------------------ As technology changes, data security requirements needs to be adopted to it. After almost 20 years the EU updates its related regulations. Read about the implications for log management: https://jluby.blogs.balabit.com/2015/06/03/data-security-requirements-in-eu… syslog-ng 3.6.3 released ------------------------ A long awaited maintenance release for the 3.6 series was made available last week. It fixes many issues, including some long standing problems reported also for earlier versions. It is recommended to update to this version. A list of fixes is available at https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.3 NEW RELEASES syslog-ng 3.6.3: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.3 Your feedback and news tips about the next issue is welcome at documentation(a)balabit.com To read this newsletter on-line, visit: http://insider.blogs.balabit.com/ Peter Czanik (CzP) <peter.czanik(a)balabit.com> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik

1 0

errors compiling 3.7.0-beta 1 on rhe6.4
by Russell Fulton 18 Jun '15

18 Jun '15

compiling on RHE 6.4, ./configure make .. . . . CC lib/template/lib_libsyslog_ng_la-templates.lo In file included from ./lib/template/repr.h:28, from lib/template/templates.c:25: ./lib/template/function.h:31: error: redefinition of typedef 'LogTemplateOptions' ./lib/template/common-template-typedefs.h:27: note: previous declaration of 'LogTemplateOptions' was here ./lib/template/function.h:32: error: redefinition of typedef 'LogTemplate' ./lib/template/templates.h:70: note: previous declaration of 'LogTemplate' was here In file included from lib/template/templates.c:26: ./lib/template/compiler.h:30: error: redefinition of typedef 'LogTemplate' ./lib/template/function.h:32: note: previous declaration of 'LogTemplate' was here make[2]: *** [lib/template/lib_libsyslog_ng_la-templates.lo] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2

3 3

syslogng-web
by Rick Silacci 17 Jun '15

17 Jun '15

I have a 450 G database. It looks like syslogng-web only has the most recent 40 pages available. How do you access the older data through syslogng-web? Rick Silacci Velociter Wireless 1525 Second Street Escalon, CA 95320 Phone: 209.838.1221

2 1

substr function issues
by westlake 17 Jun '15

17 Jun '15

I'm stumped on a little problem with syslog-ng, basically what I'm trying to do is extract text from a string and place that into a new macro, eg -> set($(substr ${MSG} 7 12), value("${MACRO"); here the syntax checker stops short around the first dollar sign and i'm not sure how else I can apply this. thanks

2 4