- syslog-ng - lists.balabit.hu

Error compiling syslog-ng-3.0.1 on HP-UX 11.23 (Itanium)
by Monz Roswitha 22 Apr '09

22 Apr '09

Hi, I am trying to build syslog-ng-3.0.1 on HP-UX Itanium (64-bit) box. I am running ./configure CFLAGS="-U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE" and it is giving following error messages while 'make': if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/hpux32/glib-2.0/include -I/usr/local/include/eventlog -I/usr/local/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -MT compat.o -MD -MP -MF ".deps/compat.Tpo" -c -o compat.o compat.c; \ then mv -f ".deps/compat.Tpo" ".deps/compat.Po"; else rm -f ".deps/compat.Tpo"; exit 1; fi compat.c:35: error: redefinition of '__pread' /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/sys/unistd.h:584: error: previous definition of '__pread' was here compat.c:57: error: redefinition of '__pwrite' /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/sys/unistd.h:586: error: previous definition of '__pwrite' was here *** Error exit code 1 Stop. *** Error exit code 1 Stop. *** Error exit code 1 Stop. How can I solve this problem? Is a binary for HP-UX 11.23 Itanium (IA64) planed? Thanks for help. Kind regards, Roswitha Mit freundlichen Grüßen Roswitha Monz, OCP -- Systemadministratorin Unix & Oracle Server-Netzwerk-Betrieb _____________________________________________________________ Gemeinnützige Salzburger Landeskliniken Betriebsgesellschaft mbH Servicebereich Informatik und Medizintechnik Müllner Hauptstraße 48, A-5020 Salzburg Tel.: +43-(0)662-4482-4938 Mob.: +43(0)664-604141-4938 Fax +43(0)662 4482-4908 mailto:r.monz@salk.at Internet: http://www.salk.at

2 1

Failure to source one file prevents entire syslog-ng logger from running
by Hari Sekhon 22 Apr '09

22 Apr '09

Hi, While I was away on holiday, another sysadmin changed the path of a 3rd party application logfile that I was I sourcing in syslog-ng (it cannot log directly to syslog). This caused the whole syslog-ng logger to basically fail to work/(re)start, giving an the error: Starting syslog-ng: Persistent configuration file is in invalid format, ignoring; Error opening file for reading; filename='/path/to/file.log', error='No such file or directory (2)' Error initializing source driver; source='s_file_blah' And auto-restarting the logger of course didn't work either since every time a restart is initiated the thing simply bailed out with this error. Shouldn't this error simply throw up a warning and continue logging the rest of what's happening on the system, rather than leaving a hole in the audit trail because it cannot lock in one source??? (Even better: start regardless, do what it can and then periodically check the source again, and every time it cannot get the source open, log a warning in syslog so that it can be caught by the monitoring infrastructure) Any suggestions for a workaround/option to prevent anything like this ever happening again in future would be welcome. -h -- Hari Sekhon Always open to interesting opportunities http://www.linkedin.com/in/harisekhon

2 3

db-parser QSTRING delmiter limitations
by Martin Holste 20 Apr '09

20 Apr '09

Hi, I'm new to the list and syslog-ng in general. I'm building a centralized log collector and am very interested in the power of the db-parser() parsing module. It really has amazing potential, and I'm eager to implement it. I've been playing with it quite a bit with a proof-of-concept to parse firewall logs from Cisco FWSM blades. The $MSGONLY part looks like this for a firewall deny: Deny udp src OUTSIDE:10.0.0.0/1234 dst INSIDE:192.168.0.0/5678 by access-group "OUTSIDE" [0xb74026ad, 0x0] My working parser entry is thus: <patterndb version='1' pub_date='2009-04-17'> <program name='FWSM'> <pattern>%FWSM</pattern> <rule id='1' class='security'> <pattern>Deny@QSTRING:FIREWALL.DENY_PROTO: @src</pattern> </rule> </program> </patterndb> This works great and returns udp and tcp in the ${FIREWALL.DENY_PROTO} macro for logging, along with the ${.classifier.class} and ${.classifier.rule_id} macros. However, when I try to parse out the interface, IP, and port numbers from "OUTSIDE:10.0.0.0/1234" part, the delimiters fail to capture correctly and the whole pattern misses. Here's what I'm trying to do: <patterndb version='1' pub_date='2009-04-17'> <program name='FWSM'> <pattern>%FWSM</pattern> <rule id='1' class='security'> <pattern>Deny@QSTRING:FIREWALL.DENY_PROTO: @src@QSTRING:FIREWALL.DENY_O_INT: @:@IPv4$:FIREWALL.DENY_SRCIP:@/@NUMBER:FIREWALL.DENY_SRCPORT: @dst</pattern> </rule> </program> </patterndb> After much debugging, it appears that there is a problem using QSTRING to match non-space-delimited parsing boundaries. That is, you cannot parse arbitrarily, you have to match on space boundaries. Is this true, or am I doing something wrong? I even tried to parse the 'n' out of the word 'Deny' with a pattern like <pattern>De@QSTRING:test: @y</pattern> and that fails. >From the debug, it appears that unless there is a space present, the radix key is off by one: Looking up node in the radix tree; i='0', nodelen='0', keylen='138', root_key='', key='Deny udp src<snip></snip>' Looking up node in the radix tree; i='2', nodelen='2', keylen='138', root_key='De', key='Deny udp src<snip></snip>' It looks like the key for the second entry should be key='ny udp src<snip></snip>' since the original 'De' match already hit. I put a lot of printf debugging statements in the code to see if I could figure out what was going wrong, but I havent' been able to conclude what the problem is yet, assuming arbitrary pattern delimiting was the intended goal. Is anyone able to successfully get db-parser() to parse on arbitrary characters? Also, the source code refers to STRING and ESTRING, how are those different from QSTRING? It looked like ESTRING was probably just an offset-based version of QSTRING. Thanks, Martin

2 3

message source hostname not displayed relay's hostname displaied instedd
by gatfi sami 17 Apr '09

17 Apr '09

hi i have syslog-ng 2.O.9-27 on sles11 32bite (SUSE Entreprise server 11) on 3 virtual machine i use the following syslog organisation a *syslog clien*t (read error log and sends them to a relay) the *relay* frorwords the message to a syslog-server The *syslog server* writes the messages in a pipe binde to a mysql database untill now everithing is working perfectly but in the syslog server i olways founf the relai host name ip adress i tried HOST_FROM in the template writing to the pipe it is always the same the relay's hostname destination d_mysql { pipe("/opt/topnet/mnt/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST_FROM', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; imagine if i have aot of cilents with each one a diiferent error log i will see nothing but the relai's hostname need hepl here thks

2 1

GThread error when starting syslog-ng
by Scott Foster 17 Apr '09

17 Apr '09

I have installed syslog-ng on a CentOS v5.2 server. I have also installed the required dependency rpms. I am not using any database server for this (just plain old logging). When I attempt to start the syslog-ng service I get the below error: --------------------------------------------------------- [root@it188v ~]# service syslog-ng start Starting syslog-ng: GThread-ERROR **: file gthread-posix.c: line 140 (): error 'Operation not permitted' during 'pthread_getschedparam (pthread_self(), &policy, &sched)' aborting... /bin/bash: line 1: 8888 Aborted /sbin/syslog-ng [FAILED] [root@it188v ~]# --------------------------------------------------------- I've Googled anything about gthread and can't find anything useful. Any yes I am a newbie to Linux. Would someone clue me in on this issue? Froste ****************************************************************************This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to whom it is addressed. If you are not the intended recipient or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error, and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. If you received this e-mail in error, please return the e-mail to the sender at Merrick Bank and delete it from your computer. Although Merrick Bank attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses.

2 1

Regex and Syslog-ng
by Julien Vermet 16 Apr '09

16 Apr '09

Hello I have a problem with syslog-ng using match() in my filters. Here is the part of my syslog-ng.cong: " ###### # sources # all known message sources source s_all { file("/etc/syslog-ng/logtest" follow_freq(1)); }; ###### # destinations destination d_apache { file("/etc/syslog-ng/logapache"); }; destination d_system { file("/etc/syslog-ng/logsystem"); }; destination d_autres { file("/etc/syslog-ng/logautres"); }; ###### # filters filter f_apache { match(apache); }; filter f_system { match(system); }; filter f_autres { match((?!apache)); }; ###### # logs log { source(s_all); filter(f_apache); destination(d_apache); }; log { source(s_all); filter(f_system); destination(d_system); }; log { source(s_all); filter(f_autres); destination(d_autres); " As you can see, I want to search in lines if the string apache is present, if system is present or if apache is not present. The first two filters are OK, but the third doesn't work. Can you help me to solve the problem? Thanks.

2 1

Re: [syslog-ng] problem in writing to database 2
by Hahusseau, Thomas 14 Apr '09

14 Apr '09

Add a « & » at the end of the line with « mysql » to run the mysql client as a background task. _____ De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de gatfi sami Envoyé : dimanche 5 avril 2009 02:31 À : Syslog-ng users' and developers' mailing list Objet : [syslog-ng] problem in writing to database 2 i succefully added the folowing script to /etc/profile it recreates the pilpline but when i get access to the virtual machine by ssh it is blocked like this: Password: Last login: Sun Apr 5 03:08:51 2009 from linux-ux35.lan Have a lot of fun... i have to tape ctrl + c to have linux-test1:~ # i have to tape ctrl +c to get access to it here is the script #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u root --password= syslog< /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi i think the problem is from mysql -u root --password= syslog< /tmp/mysql.pipe 2009/4/4 gatfi sami <pfegatfi.sami(a)gmail.com <mailto:pfegatfi.sami@gmail.com> > hi i am configuring a centralised syslog server and when i arrived to the writing into the database there is some thing wrong because when i use a file as destination i see incoming logs when i restart apache2 or mysql in the client "tail - f /" i use syslog -ng 2.0 here is the client source my_src{ file("/var/log/apache2/error_log" follow_freq(1) ); file("/var/lib/mysql/mysqld.log" follow_freq(1) ); }; destination loghost { tcp("192.168.1.69" port(514)); }; log { source(my_src); destination(loghost); }; here is the server source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); #udp(); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(mysrc); destination(d_mysql); }; note that a databes names syslog is already created and contain a table logs; if itry the following command : syslog-ng -f /etc/syslog-ng/syslog-ng.conf Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (98)' Error initializing source driver; source='mysrc' ps i used to use the server as relai and send by udp using the same port 514 but now everinthing is commented like this # need help i added the following script to the file

3 2

match with value() never matches
by srainville＠videotron.ca 14 Apr '09

14 Apr '09

2 1

Installer feedback
by srainville＠videotron.ca 14 Apr '09

14 Apr '09

2 3

[Bug 41] New: make check uses non random tcp ports for testing
by bugzilla＠bugzilla.balabit.com 14 Apr '09

14 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=41 Summary: make check uses non random tcp ports for testing Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: enhancement Estimated Hours: 0.0 make check uses hardcoded/static tcp port numbers which means that make check will fail if building two syslog-ng in parallel. We have such situation here where two builder accounts are located on the same machine. Would be nice to see some PID-based randomness introduced there. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[PATCH] Cygwin: missing colon in default syslog-ng.conf
by Corinna Vinschen 14 Apr '09

14 Apr '09

Hi, The Cygwin service installer script creates a version entry without a colon, which leads to warnings. The below patch fixes that. Please apply. Thanks, Corinna --- contrib/cygwin-packaging/syslog-ng-config.ORIG 2009-03-25 17:08:34.000000000 +0100 +++ contrib/cygwin-packaging/syslog-ng-config 2009-03-19 19:21:34.000000000 +0100 @@ -205,7 +205,7 @@ if [ ! -f "${SYSCONFDIR}/syslog-ng.conf" then echo "Creating default ${SYSCONFDIR}/syslog-ng.conf file" cat > ${SYSCONFDIR}/syslog-ng.conf << EOF -@version 3.0 +@version: 3.0 options { keep_hostname(yes); owner("system"); -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

4 6

Database field types
by Liam Kirsher 14 Apr '09

14 Apr '09

Hi -- I notice that when the database tables get created all the fields are 'text' type. That is okay. However, it might in some cases be convenient for us to have different field types. Is there any problem with that? If we create the table with the desired field types, will that take care of it (assuming the data actually matches the type)? Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

2 7

Solaris 10 x86 configuration not working
by mwilson＠hjf.org 09 Apr '09

09 Apr '09

Hello, I've been using version 2 for a couple of years and decided to upgrade one of my systems to version 3, but my syslog-ng.conf file doesn't seem to work. I can't figure out the error and am hoping someone can give me a hand. Here's the error: # /usr/local/sbin/syslog-ng -v -s -f /etc/syslog-ng/syslog-ng.conf Error parsing command line arguments: Conversion from character set '646' to 'UTF-8' is not supported Here's a sanitized version of my conf file: /etc/syslog-ng/syslog-ng.conf options { stats(0); sync(0); time_reopen(1); log_fifo_size(4096); long_hostnames(off); use_dns(no); use_fqdn(no); create_dirs(yes); keep_hostname(yes); }; source sys { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); tcp(ip("0.0.0.0") port(5150) max-connections(300)); }; filter notdebug { level(info...emerg); }; destination perhost { file("/var/log/perhost/$HOST.log.$YEAR$MONTH$DAY"); }; log { source(sys); filter(notdebug); destination(perhost); }; destination syslogserver { tcp("10.1.1.20" port(5150)); }; log { source(sys); filter(notdebug); destination(syslogserver); }; Any suggestions?

3 3

syslog-ng does notnwrite in the database
by gatfi sami 07 Apr '09

07 Apr '09

i use syslog-ng 2.0 Hi in my syslog-ng server i can write log comming from the client to a file > > source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); > #udp(); > }; > > destination std { > > > file("/var/log/syslog-ng1/$HOST/messages" owner("root") group("root") > perm(0640) dir_perm(0750) create_dirs(yes)); > > }; > > > log {source(mysrc); destination(std);}; > > destination std1 { > udp("192.168.1.66" port(514)); > > }; > #filter my_filter {match("Apache"); }; > > > #log { > # source(mysrc); > # filter(my_filter); > # destination(std); > #}; > > > log { > source(mysrc); > > destination(std1); > }; > > but when i use a pipe destination d_mysql { > pipe("/tmp/mysql.pipe" > template("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', > '$TAG', > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") > template-escape(yes)); > }; > log { source(mysrc); destination(d_mysql); the wired thing is that when i : 1 runed the script that binds the pipe to the database ./mysql.bash& *# !/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u root -D syslog< /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi* 2 created a test sql script request.sql *INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( 'testhost1', 'testfacility1', 'testpriority1', '0','TestTag1', '2009-04-07', '19:00:00', 'Apache', 'Test Message' );* * * ** 3 injected it into the pipe cat request.sql > /tmp/mysql.pipe* * 4 tetsted a *select * from tags; * i found the values on request.sql strange isn't it? so what can i do

1 0

Question about logStore alternative ..
by fredzy padzy 07 Apr '09

07 Apr '09

Hy everyone I'm wondering if it's could be possible to make the same thing that the logStore does (even if it's not as strong as, or as efficient as). Actually, it seems that the PreniumVersion of SyslogNG isn't ready yet for my plateform, and i just though about building a kind of 'homemade' logStore. (but of course, not declared in my syslog-ng.conf ... but acting in my txt log file, in a another directory) I'm using AIDE for a few days, but it doesn't look to handle chunks of file, which Prenium Edition seems to use Moreover, it has to be launched every time a log is written, and i'm pretty sure it will warn about a lot of false positive. any idea ???? bye :)

1 0

problem in writing to database 2
by gatfi sami 05 Apr '09

05 Apr '09

i succefully added the folowing script to /etc/profile it recreates the pilpline but when i get access to the virtual machine by ssh it is blocked like this: Password: *Last login: Sun Apr 5 03:08:51 2009 from linux-ux35.lan Have a lot of fun... *i have to tape ctrl + c to have linux-test1:~ # i have to tape ctrl +c to get access to it here is the script #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u root --password= syslog< /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi i think the problem is from mysql -u root --password= syslog< /tmp/mysql.pipe 2009/4/4 gatfi sami <pfegatfi.sami(a)gmail.com> > hi > > i am configuring a centralised syslog server and when i arrived to the > writing into the database there is some thing wrong > > because when i use a file as destination i see incoming logs when i restart > apache2 or mysql in the client > > "tail - f /" > i use syslog -ng 2.0 > > here is the client > *source my_src{ > file("/var/log/apache2/error_log" follow_freq(1) ); > > file("/var/lib/mysql/mysqld.log" follow_freq(1) ); > > }; > > > destination loghost { > tcp("192.168.1.69" port(514)); > }; > log { > source(my_src); > destination(loghost); > };* > > > > here is the server > > * source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); > #udp(); > }; > > destination d_mysql { > pipe("/tmp/mysql.pipe" > template("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', > '$TAG', > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") > template-escape(yes)); > }; > log { source(mysrc); destination(d_mysql); > }; > * > > note that a databes names syslog is already created and contain a table > logs; > > > > if itry the following command : syslog-ng -f /etc/syslog-ng/syslog-ng.conf > > Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already > in use (98)' > Error initializing source driver; source='mysrc' > > > ps i used to use the server as relai and send by udp using the same port > 514 but now everinthing is > > commented like this # > > need help > i added the following script to the file

1 0

problem in writing to database
by gatfi sami 04 Apr '09

04 Apr '09

hi i am configuring a centralised syslog server and when i arrived to the writing into the database there is some thing wrong because when i use a file as destination i see incoming logs when i restart apache2 or mysql in the client "tail - f /" i use syslog -ng 2.0 here is the client *source my_src{ file("/var/log/apache2/error_log" follow_freq(1) ); file("/var/lib/mysql/mysqld.log" follow_freq(1) ); }; destination loghost { tcp("192.168.1.69" port(514)); }; log { source(my_src); destination(loghost); };* here is the server * source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); #udp(); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(mysrc); destination(d_mysql); }; * note that a databes names syslog is already created and contain a table logs; if itry the following command : syslog-ng -f /etc/syslog-ng/syslog-ng.conf Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (98)' Error initializing source driver; source='mysrc' ps i used to use the server as relai and send by udp using the same port 514 but now everinthing is commented like this # need help

1 0

[PATCH] typo in misc.c, function resolve_user?
by Corinna Vinschen 01 Apr '09

01 Apr '09

Hi, a Cygwin user got a message in the syslog every time the syslog-ng service started up: Error resolving user; user='system' He also found why this message was generated. The function resolve_user() in misc.c appears to have a typo. If the incoming user argument points to a non-empty string, resolve_user() just returns NULL. So, the following getpwnam is only called for an empty user string. This looks like a typo. One possible fix below. However, maybe the intention was actually to test for if (!user) instead of if (!*user) ??? Corinna --- src/misc.c.ORIG 2009-03-25 17:01:15.000000000 +0100 +++ src/misc.c 2009-03-25 17:01:29.000000000 +0100 @@ -274,7 +274,7 @@ resolve_user(const char *user, uid_t *ui struct passwd *pw; *uid = 0; - if (*user) + if (!*user) return FALSE; pw = getpwnam(user); -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 3

INCLUDE not working for me :(
by Charles Jennings 01 Apr '09

01 Apr '09

I have implemented the following version: syslog-ng -V syslog-ng 3.0.1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline-- 3.0#master#93a342dae3a2b0cb15811d0c34ea7f58b3fba14e Compile-Date: Mar 13 2009 16:29:42 Enable-Threads: off Enable-Debug: on Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: off When I try to implement file inclusion, I get an error at the point where I include the file. I essentially cut the section out of the main syslog-ng.conf file, place it into a new file and replace the area cut in the main syslog-ng.conf file with: include "/etc/syslog-ng/syslog-ng-local.conf"; When I do this I get the following error on service start: service syslog-ng start Starting syslog-ng: syntax error in /etc/syslog-ng/syslog-ng.conf at line 114. [FAILED] Charles Jennings | Network Security Engineer "There is one safeguard known generally to the wise, which is an advantage and security to all, but especially to democracies as against despots. What is it? Distrust." Demosthenes (c 384-322 B.C.), Greek orator. Second Philippic, sct. 24 (344 B.C.)

2 6

syslog 3.0 and fra_digits()
by Joe Hansen 01 Apr '09

01 Apr '09

I just installed syslog 3.0 and added fra_digits(3) in my options, and restarted syslog-ng. I still don't see the milliseconds in the logs. I don't want to use ISO format. Can anyone suggest a solution? Thanks, Jo __________________________________________________________________ Yahoo! Canada Toolbar: Search from anywhere on the web, and bookmark your favourite sites. Download it now http://ca.toolbar.yahoo.com.

2 2

syslog-ng using ssl
by Luigi Augello 27 Mar '09

27 Mar '09

Hello some days ago I sent this message ello I try to use ssl ad I have the follow scenario: but just now i not solved. Anyone may help me Tanks Luigi One server (192.168.1.2) with this syslog.ng.conf ########################################### @version:3.0 source s_sk{file("/var/log/messages");}; source s_ssl{ tcp(ip("0.0.0.0") port (1999) tls(key_file("/root/Scaricati/certificati/privkey.pem") cert_file("/root/Scaricati/certificati/cacert.pem")));}; destination d_file{file("/var/log/syslog-ng.log");}; log{source(s_sk);destination(d_file);}; log{source(s_ssl);destination(d_file);}; One client (192.168.1.3) with this syslog.ng.conf ################################################### @version:3.0 source s_sk{file("/var/log/messages");}; destination d_file{file("/var/log/syslog-ng.log");}; destination d_ssl{tcp("192.168.1.2" port (1999) tls(ca_dir("/root/software/ca/")));}; log{source(s_sk);destination(d_file);}; log{source(s_sk);destination(d_ssl);}; I haven't a CA certificate and I use a self-signed certificate created by these instructions opennsl genrsa -out privkey.pem opennsl req -new -x509 -key prixkey.pem -out cacert.pem -days 1095 I follow step by step the instructions on "The syslog-ng Administrators guide " page 58 and so on and I copied the cacert.pem generated in the server in the client and I use ln -s .... When I try to start the server it starts. Though the client doesn't give me any errors it doesn't start. I suppose the certificate may crate some problems. tanks for help Luigi

2 3

[PATCH] autocreate fifo
by Peter Warasin 27 Mar '09

27 Mar '09

Hi list If you define a pipe as log destination, the pipe must exist before syslog starts, otherwise syslog logs that it cannot write to the pipe. That should be fine normally, but if *all* messages go to that pipe syslog will cause a log-loop with those error messages. The attached patch creates the fifo automatically. kind regards peter -- :: e n d i a n :: open source - open minds :: peter warasin :: http://www.endian.com :: peter(a)endian.com

2 1

source file wildcard problems
by Dan Gunter 27 Mar '09

27 Mar '09

Hi, I am having trouble getting the new file wildcard option to work. I am testing it with the following very simple file-to-file configuration: @version: 3.0 options { time_sleep(500); # polling interval, in ms (make this once per second) use_fqdn(yes); # use fully qualified domain names ts_format(iso); # use ISO8601 timestamps # for normal load flush_lines (10); # number of lines to buffer before writing to disk flush_timeout (1000); # 1 second timeout log_fifo_size(100); stats_freq(3600); # number of seconds between syslog-ng internal stats events; these are useful # for ensuring syslog-ng is not getting overloaded }; # Debugging source syslog_ng { internal(); }; destination debug_dest { file("/u/dang/local/var/log/syslog-ng- internal.log" perm(0644) ); }; log { source(syslog_ng); destination(debug_dest); }; # Other source simple_src { file("/u/dang/local/var/log/myfile.log" follow_freq(1) flags(no-parse) program_override("my_log ") ); }; source test_src { file ("/u/dang/local/var/log/test*.log" follow_freq(1) flags(no-parse) program_override("test_log ") ); }; destination test_dest { file ("/u/dang/local/var/log/collected.log" perm(0644) ); }; log { source(simple_src); destination(test_dest); }; log { source(test_src); destination(test_dest); }; The behavior I am seeing is that anything appended to the static file "myfile.log" shows up in "collected.log" a second later. But new files of the pattern "test-1.log", etc. are never forwarded, and if there are existing files of this name at startup they are ignored. The internal log says: 2009-03-25T10:02:20-07:00 host.org syslog-ng[29624]: Follow-mode file source not found, deferring open; filename='/u/dang/local/var/log/ test*.log' 2009-03-25T10:02:20-07:00 host.org syslog-ng[29626]: syslog-ng starting up; version='3.0.1' My syslog-ng version is: -bash-3.1$ syslog-ng -V syslog-ng 3.0.1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng- ose--mainline--3.0#master#93a342dae3a2b0cb15811d0c34ea7f58b3fba14e Compile-Date: Mar 25 2009 09:08:54 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: off Any help or tips would be appreciated. Thanks, -Dan

4 5

Re: [syslog-ng] Constant syslog-ng startup message
by chris packham 27 Mar '09

27 Mar '09

On Thu, 2009-03-26 at 15:56 -0400, srainville(a)videotron.ca wrote: > syslog-ng keeps logging the following message. I installed it using > the HEAD RPM for Linux RHEL4. Is there a problem with the startup, or > just a message that can be ignored? > > Mar 26 15:30:16 testserver syslog-ng[22090]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:18 testserver syslog-ng[22092]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:20 testserver syslog-ng[22094]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:21 testserver syslog-ng[22095]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:22 testserver syslog-ng[22097]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:23 testserver syslog-ng[22098]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:24 testserver syslog-ng[22099]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:25 testserver syslog-ng[22100]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:26 testserver syslog-ng[22101]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:28 testserver syslog-ng[22103]: syslog-ng starting up; > version='3.0.1+binpkg4' > Mar 26 15:30:29 testserver syslog-ng[22104]: syslog-ng starting up; > version='3.0.1+binpkg4' That looks like either multiple instances of syslog-ng are being started or its being stopped and started multiple times ('ps | grep syslog-ng' should tell you which). Either way it's probably not good. At best its adding unnecessary system load, at worst its losing messages. Does RHEL4 use upstart or some other special init system that tries to keep things running if they exit? You may see this kind of thing if there was an error in your config file which would cause syslog-ng to exit only to be re-started by init.

3 3

Constant syslog-ng startup message
by srainville＠videotron.ca 26 Mar '09

26 Mar '09

1 0