- syslog-ng - lists.balabit.hu

syslog-ng +bash history
by Marcin Niskiewicz 05 Feb '09

05 Feb '09

Hello Everything that is written by users on console (my system is gentoo) is logged in 3 different files (debug , syslog, messages) ... I'd like to route all history logs to one file only... i made a filter and it works fine (it writes history to history.log) but still it writes it to those 3 files (debug , syslog, messages) as well ... so now everything I type is written to 4 files (debug , syslog, messages and history.log) ... is there possibility to configure syslog-ng to log history only to one file (for example history.log) and leave others files clean? best regards nichu My standard configuration (with my modifiication to route history to history.log) looks like this: # Copyright 2005 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.conf.gentoo.hardened,v 1.5 2007/10/30 17:16:15 solar Exp $ # # Syslog-ng configuration file, compatible with default hardened installations. # options { chain_hostnames(off); sync(0); stats(43200); }; source src { unix-stream("/dev/log"); internal(); }; source kernsrc { file("/proc/kmsg"); }; destination authlog { file("/var/log/auth.log"); }; destination syslog { file("/var/log/syslog"); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); file("/dev/tty12"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination mail { file("/var/log/mail/mail.log"); }; destination avc { file("/var/log/avc.log"); }; destination audit { file("/var/log/audit.log"); }; destination pax { file("/var/log/pax.log"); }; destination grsec { file("/var/log/grsec.log"); }; destination historia { file("/var/log/history.log"); }; destination mailinfo { file("/var/log/mail/mail.info"); }; destination mailwarn { file("/var/log/mail/mail.warn"); }; destination mailerr { file("/var/log/mail/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_avc { match(".*avc: .*"); }; filter f_audit { match("^audit.*") and not match(".*avc: .*"); }; filter f_pax { match("^PAX:.*"); }; filter f_grsec { match("^grsec:.*"); }; filter f_history { match(".*HISTORY*"); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(kernsrc); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_history); destination(history); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); };

2 3

Postgres database questions
by Liam Kirsher 05 Feb '09

05 Feb '09

Hi -- I'm considering using syslog-ng to log to a postgres database, and just wanted to make sure I could do what I want to do before I spend a lot of time discovering that I can't. So, some of these questions probably have obvious answers. The client and loghost systems are running CentOS 5.2, which comes with syslog-ng v. 1.6. I believe I will need to upgrade to syslog-ng 3.0 (OSE) to use the database logging functionality. Correct? I noticed there was a recent message regarding difficulty compiling on CentOS 5.2 -- I hope this is not a problem. It looked like the suggested fix *should* have worked. I just don't want to end up in the syslog-ng Heartbreak Hotel! The only examples of database logging to Postgres I could find were to log the entire message, and/or were for older versions of syslog-ng. What I want to do is break the message up into columns and just log those columns. Reading the documentation, it seems like what I need to do is create a parser which will split the message up as desired. From there, I should be able to log to a database table with the desired fields. Right? Is this the correct approach, and are there any examples of how to do this, other than the cursory descriptions in the documentation? Thanks, Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

2 1

syslog-ng vs. SEC problems after upgrading to 2.1.3
by Jyri Hovila 05 Feb '09

05 Feb '09

Hi everyone! I've been running syslog-ng and SEC (Simple Event Correlator, http://www.estpak.ee/~risto/sec/) on several Arch Linux (www.archlinux.org) servers for few years now. After upgrading to syslog-ng 2.1.3 things suddenly stopped working on all five servers with identical configuration. Here's what's going on: The syslog-ng part of the deal goes like this (from /etc/syslog- ng.conf): destination d_sec { program("/usr/bin/perl /usr/share/sec/sec.pl - input=\"-\" -conf=/usr/local/etc/sec.conf"); }; log { source(src); destination(d_sec); }; This setup has been working fine all these years; it's been sending all incoming syslog messages to SEC, which has been parsing the messages just fine. After upgrading to syslog-ng 2.1.3, SEC stopped receiving anything from syslog-ng. These messages are being logged to /var/log/everything every 10 minutes: Jan 28 13:36:14 2 syslog-ng[19411]: Log statistics; dropped='program(/ usr/bin/perl /usr/share/sec/sec.pl -input="-" -conf=/usr/local/etc/ sec.conf)=0', processed='center(queued)=255119', processed='center(received)=123603', processed='destination(d_sec)=123603', processed='destination(acpid)=0', processed='destination(console)=0', processed='destination(debug)=0', processed='destination(mail)=5485', processed='destination(user)=309', processed='destination(uucp)=0', processed='destination(messages)=1163', processed='destination(ppp)=0', processed='destination(news)=0', processed='destination(iptables)=92399', processed='destination(everything)=6778', processed='destination(lpr)=0', processed='destination(cron)=0', processed='destination(syslog)=123', processed='destination(authlog)=24426', processed='destination(errors)=5', processed='destination(kernel)=147', processed='destination(daemon)=681', processed='destination(console_all)=0', processed='source(src)=123603', suppressed='program(/usr/bin/perl /usr/ share/sec/sec.pl -input="-" -conf=/usr/local/etc/sec.conf)=0' ps aux tells me that SEC is running fine, but it seems syslog-ng doesn't want to speak to it properly. I have no idea where to go from here. Any tips, anyone? Thanks in advance! Yours, Jyri

2 1

Getting warnings while building syslog-ng-2.1.3 on HP-UX ITA64
by Chanchal Verma 05 Feb '09

05 Feb '09

Hi, I am trying to build syslog-ng-2.1.3 on HP-UX Itenium (64-bit) box. I am doing '--enable-dynamic-linking' and it is giving following warning messages while 'make'. ************************Warning messages during 'make' ******************* .. .. gcc -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -lcl -o loggen loggen.o -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap ld: (Warning) Unsatisfied symbol "yyleng" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylenguc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyinput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyunput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyolsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytext" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyoutput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextuc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyextra" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyfnd" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyprevious" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylex" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyout" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "deny_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "allow_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "yylstate" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextarr" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyback" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "rfc931_timeout" in file /usr/lib/hpux32/libwrap.so 20 warnings. ******************************************************************************* It is giving me similar error message while running syslog-nd daemon and fail. I have installed flex to get rid of libl.so but no success. # swlist |grep -i flex flex 2.5.4a flex # gcc -v Using built-in specs. Target: ia64-hp-hpux11.31 Configured with: ../gcc/configure Thread model: posix gcc version 4.2.3 Here is configure result: ================================ syslog-ng Open Source Edition 2.1.3 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -I/usr/local/include/glib-2.0 -I/usr/local/lib/hpux32/glib-2.0/include -I/opt/soe/local/syslog-ng-2.1.3/eventlog/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lcl -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap prefix : /opt/soe/local/syslog-ng-2.1.3 Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SQL support : no ================================ Any help will be highly appreciated. -- Chanchal

2 1

Re: [syslog-ng] Writing to a named Pipe
by Pedro Rafael Alves Simoes 05 Feb '09

05 Feb '09

The patch worked. Is there any way to create the pipes on the fly? Date: Thu, 22 Jan 2009 19:39:48 +0100 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [syslog-ng] Writing to a named Pipe To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <1232649588.15998.177.camel(a)bzorp.balabit> Content-Type: text/plain On Thu, 2009-01-22 at 15:26 +0000, Pedro Rafael Alves Simoes wrote: > Hello, > > In my syslog-ng configuration I'm writing messages to named pipes > which name is given dynamically by the $PRI macro: > > destination d_test { > pipe("/tmp/$PRI.log"); > }; > > All the possible PRI.log pipes were created previously with mkfifo. > > With this configuration the messages aren't being written to the > pipes. It simply does nothing. Doing a strace on the syslog-ng > process, it shows an error : > > open("/tmp/$PRI.log", O_RDWR|O_NONBLOCK|O_NOCTTY|O_LARGEFILE) = -1 > ENOENT (No such file or directory) > > It seems that the PRI macro isn't being interpolated in the string. well, the pipe() driver does not support macros, thus it uses the string literally. More exactly the pipe driver explicitly disallows that. Since I don't remember exactly why I did this, here's a patch that removes the restriction. Please let me know how it works out for you, if it seems to work, I'm also willing to integrate it. Patch is against OSE 3.0, but is trivial to backport to 2.1 diff --git a/src/cfg-grammar.y b/src/cfg-grammar.y index 761bb56..fdfa18f 100644 --- a/src/cfg-grammar.y +++ b/src/cfg-grammar.y @@ -801,7 +801,7 @@ dest_afpipe dest_afpipe_params : string { - last_driver = affile_dd_new($1, AFFILE_NO_EXPAND | AFFILE_PIPE); + last_driver = affile_dd_new($1, AFFILE_PIPE); free($1); last_writer_options = &((AFFileDestDriver *) last_driver)->writer_options; last_writer_options->flush_lines = 0; -- Bazsi

3 3

Re: [syslog-ng] filter killing logging
by Len Conrad 03 Feb '09

03 Feb '09

>the log statement below works > >the #log statement logs nothing > >source src { unix-dgram("/var/run/log"); > unix-dgram("/var/run/logpriv" perm(0640)); > tcp(); > udp(); > internal(); > file("/dev/klog"); > }; > >### smtp postfix > >filter f_mail { facility(mail); }; > >filter f_postfix {match (" postfix"); }; > >destination d_postfix { file("/var/log/$HOST/maillog"); }; > >log { source (src) ; filter (f_mail); filter(f_m_info); destination (d_postfix); }; > >#log { source (src) ; filter (f_mail); filter(f_m_info); filter (f_postfix); destination (d_postfix); }; > >Thanks >Len Sorry about previous msg's null subject and missing version syslog-ng -V syslog-ng 2.0.9 (from FreeBSD pkg, not ver 3 yet) I enabled the postfix, imap3d, sasl, pop3d logging by trimming the trailing/leading spaces of " string " in the filter definitions. huh? Len

1 0

[Bug 31] New: sources are opened after dropping capabilities which prevents opening some
by bugzilla＠bugzilla.balabit.com 03 Feb '09

03 Feb '09

https://bugzilla.balabit.com/show_bug.cgi?id=31 Summary: sources are opened after dropping capabilities which prevents opening some Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: regression Estimated Hours: 0.0 mkdir /test/ mkfifo /test/fifo chmod 0 /test and use pipe('/test/fifo') as source. syslog-ng 3.0.1 will fail with permission denied because it can't access /test/fifo due to dropped capabilities. This is real example from Linux Vserver based system where /vservers has always 0 permission. The solution would be probably to not drop some caps until sources are opened. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

(no subject)
by Len Conrad 03 Feb '09

03 Feb '09

the log statement below works the #log statement logs nothing source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0640)); tcp(); udp(); internal(); file("/dev/klog"); }; ### smtp postfix filter f_mail { facility(mail); }; filter f_postfix {match (" postfix"); }; destination d_postfix { file("/var/log/$HOST/maillog"); }; log { source (src) ; filter (f_mail); filter(f_m_info); destination (d_postfix); }; #log { source (src) ; filter (f_mail); filter(f_m_info); filter (f_postfix); destination (d_postfix); }; Thanks Len

1 0

loggen
by nexact 03 Feb '09

03 Feb '09

Hello, I'm looking for 'loggen' utility to benchmark my current infrastructure, I can't find it in the website download section... Anyone could help me ? Thanks.

3 2

Getting warnings while building syslog-ng-2.1.3 on HP-UX ITA64
by Chanchal Verma 03 Feb '09

03 Feb '09

Hi, I am trying to build syslog-ng-2.1.3 on HP-UX Itenium (64-bit) box. I am doing '--enable-dynamic-linking' and it is giving following warning messages while 'make'. ************************Warning messages during 'make' ******************* .. .. gcc -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -lcl -o loggen loggen.o -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap ld: (Warning) Unsatisfied symbol "yyleng" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylenguc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyinput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyunput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyolsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytext" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyoutput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextuc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyextra" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyfnd" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyprevious" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylex" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyout" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "deny_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "allow_severity" in file /usr/lib/hpux32/libwrap.so ld: (Warning) Unsatisfied symbol "yylstate" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextarr" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyback" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "rfc931_timeout" in file /usr/lib/hpux32/libwrap.so 20 warnings. ******************************************************************************* It is giving me similar error message while running syslog-nd daemon and fail. I have installed flex to get rid of libl.so but no success. # swlist |grep -i flex flex 2.5.4a flex # gcc -v Using built-in specs. Target: ia64-hp-hpux11.31 Configured with: ../gcc/configure Thread model: posix gcc version 4.2.3 Here is configure result: ================================ syslog-ng Open Source Edition 2.1.3 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -I/usr/local/include/glib-2.0 -I/usr/local/lib/hpux32/glib-2.0/include -I/opt/soe/local/syslog-ng-2.1.3/eventlog/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lcl -lnsl -lrt -ll -L/usr/local/lib/hpux32 -lglib-2.0 -lintl -liconv -L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib -levtlog -lwrap prefix : /opt/soe/local/syslog-ng-2.1.3 Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SQL support : no ================================ Any help will be highly appreciated. -- Chanchal

1 0

[Bug 29] New: syslog-ng segfault when HUP signal arrives
by bugzilla＠bugzilla.balabit.com 02 Feb '09

02 Feb '09

https://bugzilla.balabit.com/show_bug.cgi?id=29 Summary: syslog-ng segfault when HUP signal arrives Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: bug Estimated Hours: 0.0 If there are two udp driver in the config file syslog-ng will segfault when a HUP signal arrive. Example config: source s_network_1 { udp(); }; source s_network { udp(); }; I know that this is not a valid config, but the segfault is not the humble way to tell me. :) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Errors compiling syslog-ng from source on Centos 5.2
by Ezra Taylor 02 Feb '09

02 Feb '09

All: I'm having problems installing syslog-ng-2.1.1 from source on Centos 5.2. I installed eventlog successfully. Eventlog is located at /usr/local/eventlog. My configure script is below. Note, make is failing. The output is below. ./configure EVTLOG_CFLAGS=/usr/local/eventlog/include EVTLOG_LIBS=/usr/local/eventlog/lib. syslog-ng Open Source Edition 2.1.1 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include /usr/local/eventlog/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 linker flags : -lnsl -lrt -lfl -L/lib64 -lglib-2.0 /usr/local/eventlog/lib -lwrap prefix : /usr/local Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no Memtrace : no IPV6 support : yes spoof-source support : no tcp-wrapper support : yes SQL support : no [etaylor@mytest syslog-ng-2.1.1]$ make make all-recursive make[1]: Entering directory `/home/etaylor/syslog-ng-2.1.1' Making all in src make[2]: Entering directory `/home/etaylor/syslog-ng-2.1.1/src' if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include /usr/local/eventlog/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT misc.o -MD -MP -MF ".deps/misc.Tpo" \ -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ else rm -f ".deps/misc.Tpo"; exit 1; \ fi gcc: /usr/local/eventlog/include: linker input file unused because linking not done if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include /usr/local/eventlog/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT utils.o -MD -MP -MF ".deps/utils.Tpo" \ -c -o utils.o `test -f 'utils.c' || echo './'`utils.c; \ then mv -f ".deps/utils.Tpo" ".deps/utils.Po"; \ else rm -f ".deps/utils.Tpo"; exit 1; \ fi gcc: /usr/local/eventlog/include: linker input file unused because linking not done if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib64/glib-2.0/include /usr/local/eventlog/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT messages.o -MD -MP -MF ".deps/messages.Tpo" \ -c -o messages.o `test -f 'messages.c' || echo './'`messages.c; \ then mv -f ".deps/messages.Tpo" ".deps/messages.Po"; \ else rm -f ".deps/messages.Tpo"; exit 1; \ fi In file included from messages.c:24: messages.h:28:20: error: evtlog.h: No such file or directory In file included from messages.c:24: messages.h:54: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token messages.h:55: error: expected ')' before '*' token messages.c:41: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token messages.c: In function 'msg_send_internal_message': messages.c:47: error: 'EVT_PRI_WARNING' undeclared (first use in this function) messages.c:47: error: (Each undeclared identifier is reported only once messages.c:47: error: for each function it appears in.) messages.c: At top level: messages.c:63: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token messages.c:81: error: expected ')' before '*' token messages.c: In function 'msg_log_func': messages.c:99: error: 'EVT_PRI_INFO' undeclared (first use in this function) messages.c:102: error: 'EVT_PRI_DEBUG' undeclared (first use in this function) messages.c:104: error: 'EVT_PRI_WARNING' undeclared (first use in this function) messages.c:106: error: 'EVT_PRI_ERR' undeclared (first use in this function) messages.c:108: error: 'EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c: In function 'msg_init': messages.c:123: error: 'evt_context' undeclared (first use in this function) messages.c:123: warning: implicit declaration of function 'evt_ctx_init' messages.c:123: error: 'EVT_FAC_SYSLOG' undeclared (first use in this function) messages.c: In function 'msg_deinit': messages.c:133: warning: implicit declaration of function 'evt_ctx_free' messages.c:133: error: 'evt_context' undeclared (first use in this function) make[2]: *** [messages.o] Error 1 make[2]: Leaving directory `/home/etaylor/syslog-ng-2.1.1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/etaylor/syslog-ng-2.1.1' make: *** [all] Error 2 -- Ezra Taylor

2 2

syslog-ng Filter expression help
by cod3fr3ak 28 Jan '09

28 Jan '09

Is there anyway I can combine these filters into a single line per host? filter f_host-dns1 { host ("SVR006*") or host ("dns1*"); }; filter f_host-dns2 { host ("SVR015*") or host ("dns2*"); }; filter f_host-dns21 { host ("SVR138*") or host ("dns21*"); }; filter f_query-dns1 { filter (f_local0) and filter (f_host-dns1); }; filter f_query-dns2 { filter (f_local0) and filter (f_host-dns2); }; filter f_query-dns21 { filter (f_local0) and filter (f_host-dns21); }; I think I can but I am unsure of how syslog-ng handles ANDs and ORs

2 1

SSL compile errors even when configured without ssl support
by Chris Fabri 27 Jan '09

27 Jan '09

Greetings- I'm trying to compile syslog-ng 3.0.1 on RH 3 (yes, I know), and am unable to compile due to what appear to be openssl related errors: In file included from tlscontext.h:12, from tlscontext.c:1: /usr/include/openssl/ssl.h:909: syntax error before "KSSL_CTX" /usr/include/openssl/ssl.h:931: syntax error before '}' token Are the last set. However, I ran configure with "--disable-ssl." Reviewing some of the archives, it appears this was fixed in v3.0 back in Nov '08: https://lists.balabit.hu/pipermail/syslog-ng/2008-November/012234.html I've tried the 11202008 build just in case, and that didn't 'seem to resolve the problem. I really don't need SSL, so it would be much simpler to just skip the SSL part than try to get it working to get around this error. Various searches of the archives have mentioned that this was fixed a few other times, but I'm not having any luck. Help? :) chris

3 7

Cannot find init.d.AIX in contrib folder
by Chanchal Verma 23 Jan '09

23 Jan '09

Hi, I am building syslog-ng-2.1.3 on AIX 5.1. I compiled it successfully and tool is working fine. I am in process to automate the start script. I cannot find init.d.AIX script in <..>/syslog-ng-2.1.3/contrib folder. It is available for other OS (solaris, SunOS,HP-UX,RedHat..). The startup script which I have created is not 100% compliance with the AIX OS. Like syslog-ng is running on server and it is still showing status 'inoperative' as Subsystem status. I need startup script for AIX OS. Any help will be highly appreciated. With Regards, Chanchal Verma

3 5

Fixed number fd-limit doesn't scale
by Corinna Vinschen 23 Jan '09

23 Jan '09

Hi, in 3.0.1, in src/gprocess.c, line 112, the fd_limit_min is set to the fixed value 4096. This doesn't work well on systems which have a hard limit smaller than 4K. While there's a command line option --fd-limit (but unfortunately no equivalent config file option), the default on those systems is to get an error message at startup: syslog-ng: Error setting file number limit; limit='4096'; error='Too many open files' Wouldn't it be better to choose a system specifc default like OPEN_MAX instead or better, to call sysconf(_SC_OPEN_MAX) to fetch the system default and only use 4096 as fallback if none of the two is available or the values are larger than 4K? Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 9

New files for contrib/cygwin-packaging
by Corinna Vinschen 23 Jan '09

23 Jan '09

Hi, so far I didn't upgrade Cygwin's syslog-ng beyond 2.1.x. The changes in 3.0 require to change the Cygwin specific files in the contrib directory. Both files are attached. Could these both please applied to the syslog-ng repository? Thanks in advance, Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 3

Writing to a named Pipe
by Pedro Rafael Alves Simoes 22 Jan '09

22 Jan '09

Hello, In my syslog-ng configuration I'm writing messages to named pipes which name is given dynamically by the $PRI macro: destination d_test { pipe("/tmp/$PRI.log"); }; All the possible PRI.log pipes were created previously with mkfifo. With this configuration the messages aren't being written to the pipes. It simply does nothing. Doing a strace on the syslog-ng process, it shows an error : open("/tmp/$PRI.log", O_RDWR|O_NONBLOCK|O_NOCTTY|O_LARGEFILE) = -1 ENOENT (No such file or directory) It seems that the PRI macro isn't being interpolated in the string. Any help?

2 1

[Bug 27] New: 3.0.1: syntax check (-s) overwrites syslog-ng.pid
by bugzilla＠bugzilla.balabit.com 20 Jan '09

20 Jan '09

https://bugzilla.balabit.com/show_bug.cgi?id=27 Summary: 3.0.1: syntax check (-s) overwrites syslog-ng.pid Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 syslog-ng -s overwrites syslog-ng.pid which makes no sense because we loose information about pid of running syslog-ng daemon. Then "stop" action in many init scripts is not able to find out pid of original syslog-ng this making "stop" no longer working. ps. version form in bugzilla missess 3.x.x versions -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

YACC Stack Overflow
by Cauchi, Geoffrey, VF-MT 19 Jan '09

19 Jan '09

Hi I am using syslog version 2.0.8 and all is running well. I am using it to log a number of Cisco devices. Recently I tried to add an additional number of devices that I would like to have their syslog sent to the Syslog-NG server. This is the syntax used in the config file: destination CAT1 { file("/var/log/switches/CAT1/log.txt" dir_perm(0755) perm(0755));}; filter f_filter73 { netmask(192.168.150.25);}; log { source(s_udp); filter(f_filter73); destination(CAT1); }; However, when I restart syslog-ng I get the following error: Stopping syslog-ng: [OK] Starting syslog-ng: yacc stack overflow at 314 YACC is complaining of a stack overflow. Syslog-ng is running on Fedora Core 8. Did anyone encounter this problem before? Any help would be appreciated. Thanks Gef ------------------------------------------------------------------------------------- Vodafone Life is Now ------------------------------------------------------------------------------------- This email is intended only for the use of individuals to whom it is addressed, as it may contain confidential or privileged information. If you are not a named addressee, intended recipient, or the person responsible for delivering the message to the named addressee, be advised that you have received this email in error and that you should not disseminate, distribute, print, copy this mail or otherwise divulge its contents. In such instances, please notify Vodafone Malta Limited on telephone number +356 99999247 and delete this email from your system. Since this transmission was affected via email, Vodafone Malta Limited cannot guarantee that it is secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Vodafone Malta Limited does not accept liability for any errors or omissions in the contents of this message which arise as a result of email transmission. Save the environment for our children - Print e-mail only when necessary.

2 7

syslog-ng-2.1.3: 'Configure' failed on Solaris 8 using --enable-static-linking
by Chanchal Verma 19 Jan '09

19 Jan '09

Hi, I have successfully build syslog-ng-2.1.3 with --enable-dynamic-linking on Solaris 8. While trying to build using --enable-static-linking option, it is not allowing me to configure syslog-ng-2.1.3 version on my Solaris 8 box (sparc). It is not able to find glib-2.0.a (Static library), though it is available in /usr/local/lib path. -rw-r--r-- 1 root 2822036 Jan 15 06:21 /usr/local/lib/libglib-2.0.a Here is error message while doing compilation: ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- ./configure --enable-static-linking --prefix=/opt/syslog-ng-2.1.3 .... .... checking whether to enable TCP wrapper support... no checking whether to enable spoof source support... no checking whether to enable IPv6 support... yes checking whether to enable SQL support... no checking for pkg-config... (cached) /usr/local/bin/pkg-config checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.4.0... yes (version 2.13.0) checking for static GLib libraries... no checking sanity checking Glib headers... yes configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- I have compiled glib-2.13.1 witn --enable-static option to get libglib-2.0.a library using gcc-3.4.6 compiler (same I am using for syslog-ng). Somehow syslog-ng is not able to find Static Glib during configure. Any help will be highly appreciated. Thanks, Chanchal Verma

4 9

Drops?
by Mike Rykowski 16 Jan '09

16 Jan '09

I configured syslog-ng to pass messages to SEC via named pipes. When I did I saw in the log statistics: Jan 13 09:10:00 syslog-ng[13736]: Log statistics; dropped='pipe(sec- pipe)=1607', dropped='unix-dgram(AF_UNIX(/dev/log))=0', processed='center(queued)=1794661', processed='center (received)=1718990', I then called SEC using the 'program' option instead of named pipes and I got: Jan 13 10:14:13 syslog-ng[14031]: Log statistics; dropped='program (/usr/local/bin/sec.pl -input="-" -conf=/usr/local/etc/my-sec.conf)=0', dropped='unix-dgram(AF_UNIX(/dev/log))=0', processed='center (queued)=2552863', processed='center(received)=2447130', The drops were zero but the queued and received were not equal. Does this mean messages are getting dropped? When I don't call SEC at all I get queued and received to be equal: Jan 14 09:26:44 syslog-ng[14119]: Log statistics; dropped='unix-dgram (AF_UNIX(/dev/log))=0', processed='center(queued)=70516726', processed='center(received)=70516726', -- Mike Rykowski NU-IT Telecommunications and Network Services

2 1

[Bug 26] New: 3.0.1: syslog facility is not recognized
by bugzilla＠bugzilla.balabit.com 16 Jan '09

16 Jan '09

https://bugzilla.balabit.com/show_bug.cgi?id=26 Summary: 3.0.1: syslog facility is not recognized Product: syslog-ng Version: unspecified Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: regression Estimated Hours: 0.0 Config contains: filter f_systlog { facility(syslog); }; and syslog-ng 3.0.1 yells: syntax error in /etc/syslog-ng/syslog-ng.conf at line 75. Replacing "facility(syslog)" with "facility(news)" and problem is gone which suggests problems with parsing "syslog" correctly. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

syslog-ng MIB table
by Riza Kamalie 16 Jan '09

16 Jan '09

Hi, Does syslog-ng have a MIB that can be quered using snmp? Regards Riza

2 1

Error resolving user error 3.0.1
by Riza Kamalie 16 Jan '09

16 Jan '09

Hi there, I have recently installed syslog-ng 3.0.1 OSE on fedora 9 running on a SUN X2100. I have an issue when using owner(username) and dir_owner(username) parameters and received the following error when starting up and the logs files don't have the desired ownership. [root@]# /usr/local/syslog-ng/sbin/syslog-ng -F -e -f /usr/local/syslog-ng/etc/syslog-ng.conf *Error resolving user; user='username' Error resolving user; user='username'* syslog-ng starting up; version='3.0.1' Any advise would be great. Excellent application + documentation. Regards Riza

4 6