- syslog-ng - lists.balabit.hu

[patch] Add follow_freq_ms option
by Joe Shaw 16 Jan '09

16 Jan '09

Hi, As I mentioned in the last thread, I've found myself wanting to have better than one second resolution for the follow_freq() option. Attached is a patch which adds a follow_freq_ms option, which takes its value in milliseconds rather than full seconds. follow_freq() continues to work as it did previously. Thanks, Joe

3 7

Too Many Open Files
by Zeek Anow 14 Jan '09

14 Jan '09

We are running Solaris 9, syslog-ng 2.0.5, We are getting: Error opening file for writing; filename='/logs/combo/combo.log.01', error='Too many open files (24)' I went into the startup script, /etc/init.d/syslog-ng and tried to up the limit by putting this in the startup section: ulimit -n 4096. When I stop and start syslog-ng and look at the ulimit settings, it still shows 256. core file size (blocks, -c) unlimited data seg size (kbytes, -d) unlimited file size (blocks, -f) unlimited open files (-n) 256 pipe size (512 bytes, -p) 10 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 29995 virtual memory (kbytes, -v) unlimited Any ideas on how to set this? Thanks,

3 2

Make throws link errors over glib2 when compiling syslog-ng 3.0.1
by Joost De Cock 14 Jan '09

14 Jan '09

Hello all, I know that the issue of rewriting syslog messages is a recurring debate here on the list :-) but I'm trying to get 3.0.1 up and running as we need to strip out some info to protect the privacy of our users (there, good cause flag set). I'm having a go under Cygwin and configure runs fine, but make dies on me in a flurry of messages (see below). I'm not much of a devhead, but these seem to be glib2 issue to me. Yet I'm a but stumped on how to beat some sense into it, and any pointer would be hugely appreciated. Thanks in advance, Joost tail of configure output: syslog-ng Open Source Edition 3.0.1 configured Compiler options: compiler : gcc compiler options : -g -O2 -Wall -I/usr/include/glib-2.0 -I/usr/lib /glib-2.0/include -I/usr/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOU RCE -D_FILE_OFFSET_BITS=64 linker flags : prefix : /usr/local Features: Sun STREAMS support : no Sun Door support : no Debug symbols : no GCC profiling : no Memtrace : no IPV6 support : no spoof-source support : no tcp-wrapper support : no SSL support : yes SQL support : no Linux capability support : no PCRE support : no Env wrapper support : no the part where make goes of the rails: gcc -g -O2 -Wall -o syslog-ng.exe main.o libsyslog-ng.a -Wl,-Bstatic -lfl -lglib-2.0 -lintl -liconv -levtlog -lssl -lcrypto -Wl,-Bdynamic -ld l /usr/lib/gcc/i686-pc-cygwin/3.4.4/../../../libcrypto.a(cryptlib.o):cryptlib.c:(. text+0x260): multiple definition of `_DllMain@12' /usr/lib/gcc/i686-pc-cygwin/3.4.4/../../../libglib-2.0.a(gutils.o):gutils.c:(.te xt+0x2c0): first defined here main.o: In function `main_loop_wakeup': /download/syslog-ng-3.0.1/src/main.c:119: undefined reference to `__imp__g_threa ds_got_initialized' /download/syslog-ng-3.0.1/src/main.c:119: undefined reference to `__imp__g_threa d_use_default_impl' /download/syslog-ng-3.0.1/src/main.c:119: undefined reference to `__imp__g_threa d_functions_for_glib_use' /download/syslog-ng-3.0.1/src/main.c:122: undefined reference to `__imp__g_threa ds_got_initialized' /download/syslog-ng-3.0.1/src/main.c:122: undefined reference to `__imp__g_threa d_use_default_impl' /download/syslog-ng-3.0.1/src/main.c:122: undefined reference to `__imp__g_threa d_functions_for_glib_use' main.o: In function `main_loop_run': /download/syslog-ng-3.0.1/src/main.c:195: undefined reference to `__imp__g_threa ds_got_initialized' /download/syslog-ng-3.0.1/src/main.c:195: undefined reference to `__imp__g_threa d_use_default_impl' /download/syslog-ng-3.0.1/src/main.c:195: undefined reference to `__imp__g_threa d_functions_for_glib_use' /download/syslog-ng-3.0.1/src/main.c:198: undefined reference to `__imp__g_threa ds_got_initialized' /download/syslog-ng-3.0.1/src/main.c:198: undefined reference to `__imp__g_threa d_use_default_impl' /download/syslog-ng-3.0.1/src/main.c:198: undefined reference to `__imp__g_threa d_functions_for_glib_use' libsyslog-ng.a(messages.o): In function `msg_event_create': /download/syslog-ng-3.0.1/src/messages.c:140: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/messages.c:140: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/messages.c:140: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/messages.c:149: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/messages.c:149: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/messages.c:149: undefined reference to `__imp__g_t hread_functions_for_glib_use' libsyslog-ng.a(messages.o): In function `msg_event_send': /download/syslog-ng-3.0.1/src/messages.c:167: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/messages.c:167: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/messages.c:167: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/messages.c:169: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/messages.c:169: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/messages.c:169: undefined reference to `__imp__g_t hread_functions_for_glib_use' libsyslog-ng.a(timeutils.o): In function `cached_mktime': /download/syslog-ng-3.0.1/src/timeutils.c:77: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:77: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:77: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:77: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:92: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:92: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:92: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:92: undefined reference to `__imp__g_t hreads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:95: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:95: undefined reference to `__imp__g_t hread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:90: undefined reference to `__imp__g_t hread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:90: undefined reference to `__imp__g_t hread_functions_for_glib_use' libsyslog-ng.a(timeutils.o): In function `cached_localtime': /download/syslog-ng-3.0.1/src/timeutils.c:105: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:105: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:105: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:112: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:114: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:114: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:114: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:114: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:117: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:117: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:112: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:112: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:109: undefined reference to `__imp__g_ threads_got_initialized' libsyslog-ng.a(timeutils.o): In function `get_local_timezone_ofs': /download/syslog-ng-3.0.1/src/timeutils.c:134: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:134: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:134: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:134: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:144: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:144: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:165: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:165: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:165: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:165: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:169: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:169: undefined reference to `__imp__g_ thread_functions_for_glib_use' libsyslog-ng.a(timeutils.o): In function `clean_time_cache': /download/syslog-ng-3.0.1/src/timeutils.c:177: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:177: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:177: undefined reference to `__imp__g_ thread_functions_for_glib_use' /download/syslog-ng-3.0.1/src/timeutils.c:177: undefined reference to `__imp__g_ threads_got_initialized' /download/syslog-ng-3.0.1/src/timeutils.c:179: undefined reference to `__imp__g_ thread_use_default_impl' /download/syslog-ng-3.0.1/src/timeutils.c:179: undefined reference to `__imp__g_ thread_functions_for_glib_use' libsyslog-ng.a(radix.o): In function `r_parser_string': /download/syslog-ng-3.0.1/src/radix.c:42: undefined reference to `__imp__g_ascii _table' libsyslog-ng.a(radix.o): In function `r_parser_ipv4': /download/syslog-ng-3.0.1/src/radix.c:108: undefined reference to `__imp__g_asci i_table' libsyslog-ng.a(radix.o): In function `r_parser_number': /download/syslog-ng-3.0.1/src/radix.c:135: undefined reference to `__imp__g_asci i_table' /download/syslog-ng-3.0.1/src/radix.c:135: undefined reference to `__imp__g_asci i_table' collect2: ld returned 1 exit status make[2]: *** [syslog-ng.exe] Error 1 make[2]: Leaving directory `/download/syslog-ng-3.0.1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/download/syslog-ng-3.0.1' make: *** [all] Error 2

2 2

Configure glitch in 3.0
by Corinna Vinschen 14 Jan '09

14 Jan '09

Hi, I think there's sort of a bug in the configury: if test "x$prefix" = "xNONE"; then prefix=$ac_default_prefix pidfiledir="/var/run" else pidfiledir="${prefix}/var/run" fi This evaluation of the pidfiledir does not take the defaults of autoconf into account. The pidfiledir should rather always default to pidfiledir="${localstatedir}" instead of fiddeling with the prefix itself. Does that make sense? Corinna -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

2 1

are nested quotes possible in parser
by Michael Hocke 14 Jan '09

14 Jan '09

Hi there, my Avocent console servers are sending console port output via syslog to my syslog server running syslog-ng 3.0.1. Console output looks like this: Jan 13 00:18:39 sysl@cyc2 Buffering: S39.gwa [Jan 13 00:14:04.379: % EARL_NETFLOW-SP-4-TCAM_THRLD: Netflow TCAM threshold exceeded, TCAM Utilization [97%]] Jan 13 00:18:53 sysl@cyc2 Buffering: S42.sw2f [2009 Jan 13 00:18:53 EST -05:00 %ETHC-5-PORTTOSTP:Port 3/27 joined bridge port 3/27] Jan 13 00:18:53 sysl@cyc2 Buffering: S42.sw2f [2009 Jan 13 00:18:53 EST -05:00 %DTP-7-PORTLINKDOWN:Port 3/27 Link down] Jan 13 00:18:53 sysl@cyc2 Buffering: S42.sw2f [2009 Jan 13 00:18:53 EST -05:00 %ETHC-5-PORTFROMSTP:Port 3/27 left bridge port 3/27] The goal is to store the console output within square brackets into separate files named after the server that created this output. The first line of the example above should go into the file "gwa" while the others go into "sw2f". This is what I have so far: > source s_udp { udp (); }; > > # --- parse console server output > # separate port description from message > parser p_console_output { > csv-parser (columns ("CONSOLE.SOURCE", "CONSOLE.MSG") > delimiters (" ") > quote-pairs ("[]") > template ("${MSGONLY}")); > }; > > # extract port label from port description > parser p_console_source { > csv-parser (columns ("CONSOLE.PORT", "CONSOLE.LABEL") > delimiters (".") > template ("${CONSOLE.SOURCE}")); > }; > > # --- destination of console output > destination d_console_output { > file ("/usr/local/var/log/remote/${HOST_FROM}/console/$ > {CONSOLE.LABEL}" > template ("${CONSOLE.MSG}\n")); > }; > > # --- filter console output > filter f_console_output { > facility (local7) and host ("^sysl(a)cyc.*"); > }; > > # --- log console output > log { > source (s_udp); > filter (f_console_output); > parser (p_console_output); > parser (p_console_source); > destination (d_console_output); > }; This works just fine with the last three lines of my example data above. The problem I am having is that if the console output (the text between square brackets) contains its own square brackets the message will cut off right after the first occurrence of the closing bracket. The first line of my example data will look like this: Jan 13 00:14:04.379: %EARL_NETFLOW-SP-4-TCAM_THRLD: Netflow TCAM threshold exceeded, TCAM Utilization [97% instead of Jan 13 00:14:04.379: %EARL_NETFLOW-SP-4-TCAM_THRLD: Netflow TCAM threshold exceeded, TCAM Utilization [97%] I could probably get around this by using a rewrite rule using PCRE but considering the amount of data that needs to be looked at this solution is going to be very expensive. Is there a way to make syslog-ng aware of nested quotes? If not, is there something in the pipeline to support this in future releases? If not, I will be willing to take a shot and implement this. Any pointers or suggestions are welcome. Thanks. - Michael

2 1

include branch merged
by Balazs Scheidler 14 Jan '09

14 Jan '09

Hi, After the release of syslog-ng OSE 3.0.1, I merged include file support to mainline. It is already pushed to the git repository, but also should be in tomorrow's snapshot. The syntax is: include "file-or-directory-to-be-included"; If you specify a directory, syslog-ng is going to include the files in alphabetical order. The same rules apply to as to run-parts(8). -- Bazsi

1 0

Getting named pipes to work
by Mike Rykowski 13 Jan '09

13 Jan '09

Hello, I'm new to syslog-ng and trying to get named pipes to work. I'm running version 2.0.2. I get the following messages in the log on start up: Jan 12 10:09:02 netlog-e0 netlog syslog-ng[11791]: syslog-ng starting up; version='2.0.2' Jan 12 10:09:02 netlog-e0 netlog syslog-ng[11791]: Error opening file for writing; filename='/var/log/netlog/sec-pipe', error='No such file or directory (2)' In my conf file I have: destination dst_sec { pipe("/var/log/netlog/sec-pipe")}; On the host I have the pipe setup as: prw-r--r-- 1 syslog-ng syslog-ng 0 Jan 12 10:05 sec-pipe The syslog-ng process is run with user 'syslog-ng'. So I added the owner and group options for the pipe command and set them to syslog-ng and that resulted in the same message. Any ideas? -- Mike Rykowski NU-IT Telecommunications and Network Services

4 7

syslog-ng graceful shutdown
by Rosenblum, Jason 13 Jan '09

13 Jan '09

I have recently compiled syslog-ng open source edition. I noticed that the install does not create a startup/shutdown script in /etc/init.d. What is the proper way to shutdown or reload syslog-ng gracefully? Thanks, Jason

2 1

Re: [syslog-ng] Fw: Error encountered while building syslog-ng-2.1.3 on RHEL3
by Chanchal Verma 12 Jan '09

12 Jan '09

Hi Balazs, Thanks for your expert advise. I have successfully compiled syslog-ng-2.1.3 with --enable-static-linking option. I were using old version of gcc (3.2.3) which causing compilation (make) fail. I upgraded my gcc to 4.1.2 to get rid of compilation errors. Though it is working fine till now, I have faced some error messages on standard video output while doing 'make'. I am not sure if this will impact new build syslog-ng application in terms of created problem in logging features. I am here pasting the error output: ************************************************* macros.c: In function âresult_appendâ: macros.c:137: warning: pointer targets in passing argument 2 of âg_string_append_lenâ differ in signedness macros.c: In function âlog_macro_expandâ: macros.c:149: warning: pointer targets in passing argument 2 of âresult_appendâ differ in signedness macros.c:218: warning: pointer targets in passing argument 2 of âresult_appendâ differ in signedness macros.c:238: warning: pointer targets in passing argument 2 of âresult_appendâ differ in signedness macros.c:246: warning: pointer targets in passing argument 2 of âresult_appendâ differ in signedness macros.c:268: warning: pointer targets in passing argument 2 of âresult_appendâ differ in signedness macros.c:413: warning: pointer targets in passing argument 2 of âresult_appendâ differ in signedness macros.c:432: warning: pointer targets in passing argument 2 of âresult_appendâ differ in signedness macros.c:450: warning: pointer targets in passing argument 2 of âresult_appendâ differ in signedness filter.c: In function âfilter_netmask_evalâ: filter.c:452: warning: âaddr.s_addrâ may be used uninitialized in this function logmsg.c: In function âlog_msg_parseâ: logmsg.c:151: warning: pointer targets in assignment differ in signedness logmsg.c:216: warning: pointer targets in passing argument 2 of âg_string_assign_lenâ differ in signedness logmsg.c:224: warning: pointer targets in assignment differ in signedness logmsg.c:242: warning: pointer targets in passing argument 1 of âstrlenâ differ in signedness logmsg.c:283: warning: pointer targets in passing argument 2 of âg_string_assign_lenâ differ in signedness logmsg.c:309: warning: pointer targets in passing argument 2 of âg_string_assign_lenâ differ in signedness logmsg.c:335: warning: pointer targets in passing argument 2 of âg_string_assign_lenâ differ in signedness logmsg.c:394: warning: pointer targets in assignment differ in signedness logmsg.c:398: warning: pointer targets in assignment differ in signedness logmsg.c:429: warning: pointer targets in assignment differ in signedness logmsg.c:463: warning: pointer targets in assignment differ in signedness logmsg.c:474: warning: pointer targets in assignment differ in signedness logmsg.c:486: warning: pointer targets in assignment differ in signedness logmsg.c:499: warning: pointer targets in assignment differ in signedness logmsg.c:520: warning: pointer targets in assignment differ in signedness logmsg.c:525: warning: pointer targets in assignment differ in signedness logmsg.c:530: warning: pointer targets in passing argument 2 of âg_string_assign_lenâ differ in signedness main.o(.text+0x133): In function `setup_creds': /home/soetest1/syslog-ng-2.1.3/src/main.c:324: Using 'initgroups' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o)(.text+0xc4): In function `resolve_group': /home/soetest1/syslog-ng-2.1.3/src/misc.c:283: Using 'getgrnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o)(.text+0x144): In function `resolve_user': /home/soetest1/syslog-ng-2.1.3/src/misc.c:258: Using 'getpwnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xbd8): In function `g_get_any_init_do': /home/soetest1/glib-2.16.0/glib/gutils.c:1646: Using 'getpwuid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xbc8):/home/soetest1/glib-2.16.0/glib/gutils.c:1645: Using 'setpwent' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xbe3):/home/soetest1/glib-2.16.0/glib/gutils.c:1647: Using 'endpwent' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0x9d1):/home/soetest1/glib-2.16.0/glib/gutils.c:1589: Using 'getpwnam_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xa10):/home/soetest1/glib-2.16.0/glib/gutils.c:1595: Using 'getpwuid_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(afinet.o)(.text+0xcbb): In function `afinet_resolve_name': /home/soetest1/syslog-ng-2.1.3/src/afinet.c:103: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o)(.text+0x50a): In function `resolve_hostname': /home/soetest1/syslog-ng-2.1.3/src/misc.c:166: Using 'gethostbyaddr' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o)(.text+0x464): In function `getlonghostname': /home/soetest1/syslog-ng-2.1.3/src/misc.c:71: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libnet.a(libnet_resolve.o)(.text+0x4dc): In function `libnet_name2addr6': : Using 'gethostbyname2' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(afinet.o)(.text+0x6bb): In function `afinet_set_port': /home/soetest1/syslog-ng-2.1.3/src/afinet.c:58: Using 'getservbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking loggen.o(.text+0x6cc): In function `main': /home/soetest1/syslog-ng-2.1.3/tests/loggen/loggen.c:236: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking ************************************************ Grateful if anybody put their comment on this. With Regards, Chanchal Verma Balazs Scheidler <bazsi(a)balabit.hu> 01/12/2009 08:44 PM To Chanchal Verma/GIS/CSC@CSC cc Subject Re: Fw: [syslog-ng] Error encountered while building syslog-ng-2.1.3 on RHEL3 add -lnsl to the end of your linking command. On Mon, 2009-01-12 at 19:37 +0530, Chanchal Verma wrote: > > Hi Bazsi, > > Could you please help me is resolving error message coming to > syslog-ng, when I am trying to build is with --enable-static-linking? > > Please refer to mail tail for detail. > > > With Regards, > Chanchal Verma > > ----- Forwarded by Chanchal Verma/GIS/CSC on 01/12/2009 07:35 PM > ----- > Chanchal Verma/GIS/CSC@CSC > Sent by: > syslog-ng-bounces(a)lists.balabit.hu > > 01/09/2009 07:25 PM > Please respond to > "Syslog-ng users' and developers' > mailing list" > <syslog-ng(a)lists.balabit.hu> > > > > > To > Kostyantyn > Gushtin > <kgushtin(a)n-ix.com.ua>, syslog-ng(a)lists.balabit.hu > cc > > Subject > Re: [syslog-ng] > Error encountered > while building > syslog-ng-2.1.3 > on > RHEL3 > > > > > > > > > > Hi Kostyantyn, > > I have checked that all required static libraries (.a) are available > at /usr/lib location. I also created linked at /usr/local/lib for all > requried libraries. It is giving same error messages. > Following libraries are checked available at /usr/lib: > > libnsl.a > librt.a > libfl.a > libevtlog.a (Created linked > from /opt/soe/local/syslog-ng-2.1.3/eventlog/lib/libevtlog.a) > libnet.a > libwrap.a > > Here below is error messages: > > ----------------------------------------------------------- > Here below is error messge: > > Compilation option: > [champ@ankit-lin syslog-ng-2.1.3]# ./configure > --enable-static-linking --prefix=/opt/soe/local/syslog-ng-2.1.3 > > Make works fine uptill (Pasted last few lines): > .. > .. > if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 > -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/ > syslog-ng-2.1.3/eventlog/include/eventlog -D_BSD_SOURCE > -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -D_GNU_SOUR > CE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT > globals.o -MD -MP -MF ".deps/globals.Tpo" \ > -c -o globals.o `test -f 'globals.c' || echo './'`globals.c; \ > then mv -f ".deps/globals.Tpo" ".deps/globals.Po"; \ > else rm -f ".deps/globals.Tpo"; exit 1; \ > fi > rm -f libsyslog-ng.a > ar cru libsyslog-ng.a misc.o utils.o messages.o syslog-names.o cfg.o > cfg-lex.o cfg-grammar.o macros.o filter.o logmsg.o l > ogpipe.o logsource.o driver.o sgroup.o dgroup.o center.o templates.o > logreader.o logwriter.o affile.o afstreams.o afuser. > o afprog.o afsocket.o afunix.o afinet.o afinter.o children.o stats.o > gsockaddr.o fdwrite.o fdread.o memtrace.o dnscache.o > apphook.o serialize.o logqueue.o afsql.o alarms.o globals.o > ranlib libsyslog-ng.a > if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 > -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/ > syslog-ng-2.1.3/eventlog/include/eventlog -D_BSD_SOURCE > -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -D_GNU_SOUR > CE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT main.o > -MD -MP -MF ".deps/main.Tpo" \ > -c -o main.o `test -f 'main.c' || echo './'`main.c; \ > then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ > else rm -f ".deps/main.Tpo"; exit 1; \ > fi > gcc -g -O2 -Wall -o syslog-ng main.o libsyslog-ng.a -static -lnsl > -lrt -lfl -L/usr/local/lib -lglib-2.0 -L/opt/soe > /local/syslog-ng-2.1.3/eventlog/lib -levtlog -lnet -lwrap > make[2]: Leaving directory `/home/soetest1/syslog-ng-2.1.3/src' > make[1]: Leaving directory `/home/soetest1/syslog-ng-2.1.3' > > Showing error message on standard output device: > > main.o(.text+0x5ec): In function `setup_creds': > /home/soetest1/syslog-ng-2.1.3/src/main.c:324: Using 'initgroups' in > statically linked applications requires at runtime t > he shared libraries from the glibc version used for linking > libsyslog-ng.a(misc.o)(.text+0x44d): In function `resolve_group': > /home/soetest1/syslog-ng-2.1.3/src/misc.c:283: Using 'getgrnam' in > statically linked applications requires at runtime the > shared libraries from the glibc version used for linking > /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/../../../libwrap.a(options.o)(.text+0x53c): In function `group_option': > : Using 'endgrent' in statically linked applications requires at > runtime the shared libraries from the glibc version used > for linking > libsyslog-ng.a(misc.o)(.text+0x3ed): In function `resolve_user': > /home/soetest1/syslog-ng-2.1.3/src/misc.c:258: Using 'getpwnam' in > statically linked applications requires at runtime the > shared libraries from the glibc version used for linking > /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xbd8): In function > `g_get_any_init_do': > /home/soetest1/glib-2.16.0/glib/gutils.c:1646: Using 'getpwuid' in > statically linked applications requires at runtime the > shared libraries from the glibc version used for linking > /usr/local/lib/libglib-2.0.a(gutils.o)(.text > +0xbc8):/home/soetest1/glib-2.16.0/glib/gutils.c:1645: Using > 'setpwent' in st > atically linked applications requires at runtime the shared libraries > from the glibc version used for linking > /usr/local/lib/libglib-2.0.a(gutils.o)(.text > +0xbe3):/home/soetest1/glib-2.16.0/glib/gutils.c:1647: Using > 'endpwent' in st > atically linked applications requires at runtime the shared libraries > from the glibc version used for linking > /usr/local/lib/libglib-2.0.a(gutils.o)(.text > +0x9d1):/home/soetest1/glib-2.16.0/glib/gutils.c:1589: Using > 'getpwnam_r' in > statically linked applications requires at runtime the shared > libraries from the glibc version used for linking > /usr/local/lib/libglib-2.0.a(gutils.o)(.text > +0xa10):/home/soetest1/glib-2.16.0/glib/gutils.c:1595: Using > 'getpwuid_r' in > statically linked applications requires at runtime the shared > libraries from the glibc version used for linking > libsyslog-ng.a(afinet.o)(.text+0x163): In function > `afinet_resolve_name': > /home/soetest1/syslog-ng-2.1.3/src/afinet.c:103: Using 'getaddrinfo' > in statically linked applications requires at runtim > e the shared libraries from the glibc version used for linking > libsyslog-ng.a(misc.o)(.text+0x1d1): In function `resolve_hostname': > /home/soetest1/syslog-ng-2.1.3/src/misc.c:166: Using 'gethostbyaddr' > in statically linked applications requires at runtim > e the shared libraries from the glibc version used for linking > libsyslog-ng.a(misc.o)(.text+0xbd): In function `getlonghostname': > /home/soetest1/syslog-ng-2.1.3/src/misc.c:71: Using 'gethostbyname' in > statically linked applications requires at runtime > the shared libraries from the glibc version used for linking > /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/../../../libnet.a(libnet_resolve.o)(.text+0x4dc): In function `libnet_name2addr6 > ': > : Using 'gethostbyname2' in statically linked applications requires at > runtime the shared libraries from the glibc versio > n used for linking > libsyslog-ng.a(afinet.o)(.text+0xb2): In function `afinet_set_port': > /home/soetest1/syslog-ng-2.1.3/src/afinet.c:58: Using 'getservbyname' > in statically linked applications requires at runti > me the shared libraries from the glibc version used for linking > /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/../../../libwrap.a(hosts_access.o)(.text+0x862): In function `host_match': > : undefined reference to `yp_get_default_domain' > collect2: ld returned 1 exit status > make[2]: *** [syslog-ng] Error 1 > make[1]: *** [all-recursive] Error 1 > make: *** [all] Error 2 > ---------------------------------------------------- > > With Regards, > Chanchal Verma > > > Kostyantyn Gushtin > <kgushtin(a)n-ix.com.ua> > > 01/09/2009 06:08 PM > > > > To > Chanchal > Verma/GIS/CSC@CSC > cc > > Subject > Re: [syslog-ng] > Error encountered > while building > syslog-ng-2.1.3 > on RHEL3 > > > > > > > > > > > Chanchal Verma wrote: > > Hi Kostyantyn, > > Yes my compilation with --enable-dynamic-linking option works fine. I > am facing problem while doing static compilation. I have followed the > given steps but still getting error while doing 'make'. > I am not sure how to use 'glib' option for compilation, I have > libglib-2.0.a in '/usr/lib'. > Now you really have problems with glibc :) . glib is just abstraction > (on unix systems it use glibc). > gcc -g -O2 -Wall -o syslog-ng main.o libsyslog-ng.a -static -lnsl > -lrt -lfl -L/usr/local/lib -lglib-2.0 -L/opt/soe > /local/syslog-ng-2.1.3/eventlog/lib -levtlog -lnet -lwrap > make[2]: Leaving directory `/home/soetest1/syslog-ng-2.1.3/src' > make[1]: Leaving directory `/home/soetest1/syslog-ng-2.1.3' > > From this command line you can retrieve info which static libraries > you need (some of them are glibc libraries, some not ). > So you must have thous libraries : libnsl.a (I saw linker error > message that it can't find this library), librt.a, libfl.a, > libevtlog.a, libnet.a, libwrap.a . Maybe you need to install > glibc-devel package and/or others that contains such libraries. > > -- > Kostyantyn Gushtin > Software engineer > N-iX LLC > Solutions for Your success > http://www.n-ix.com________________________________________________________… > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > -- Bazsi

2 1

Re: [syslog-ng] Error encountered while building syslog-ng-2.1.3 on RHEL3
by Chanchal Verma 12 Jan '09

12 Jan '09

Hi Kostyantyn, I have checked that all required static libraries (.a) are available at /usr/lib location. I also created linked at /usr/local/lib for all requried libraries. It is giving same error messages. Following libraries are checked available at /usr/lib: libnsl.a librt.a libfl.a libevtlog.a (Created linked from /opt/soe/local/syslog-ng-2.1.3/eventlog/lib/libevtlog.a) libnet.a libwrap.a Here below is error messages: ----------------------------------------------------------- Here below is error messge: Compilation option: [champ@ankit-lin syslog-ng-2.1.3]# ./configure --enable-static-linking --prefix=/opt/soe/local/syslog-ng-2.1.3 Make works fine uptill (Pasted last few lines): .. .. if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/ syslog-ng-2.1.3/eventlog/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -D_GNU_SOUR CE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT globals.o -MD -MP -MF ".deps/globals.Tpo" \ -c -o globals.o `test -f 'globals.c' || echo './'`globals.c; \ then mv -f ".deps/globals.Tpo" ".deps/globals.Po"; \ else rm -f ".deps/globals.Tpo"; exit 1; \ fi rm -f libsyslog-ng.a ar cru libsyslog-ng.a misc.o utils.o messages.o syslog-names.o cfg.o cfg-lex.o cfg-grammar.o macros.o filter.o logmsg.o l ogpipe.o logsource.o driver.o sgroup.o dgroup.o center.o templates.o logreader.o logwriter.o affile.o afstreams.o afuser. o afprog.o afsocket.o afunix.o afinet.o afinter.o children.o stats.o gsockaddr.o fdwrite.o fdread.o memtrace.o dnscache.o apphook.o serialize.o logqueue.o afsql.o alarms.o globals.o ranlib libsyslog-ng.a if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/opt/soe/local/ syslog-ng-2.1.3/eventlog/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -D_GNU_SOUR CE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo './'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi gcc -g -O2 -Wall -o syslog-ng main.o libsyslog-ng.a -static -lnsl -lrt -lfl -L/usr/local/lib -lglib-2.0 -L/opt/soe /local/syslog-ng-2.1.3/eventlog/lib -levtlog -lnet -lwrap make[2]: Leaving directory `/home/soetest1/syslog-ng-2.1.3/src' make[1]: Leaving directory `/home/soetest1/syslog-ng-2.1.3' Showing error message on standard output device: main.o(.text+0x5ec): In function `setup_creds': /home/soetest1/syslog-ng-2.1.3/src/main.c:324: Using 'initgroups' in statically linked applications requires at runtime t he shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o)(.text+0x44d): In function `resolve_group': /home/soetest1/syslog-ng-2.1.3/src/misc.c:283: Using 'getgrnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/../../../libwrap.a(options.o)(.text+0x53c): In function `group_option': : Using 'endgrent' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o)(.text+0x3ed): In function `resolve_user': /home/soetest1/syslog-ng-2.1.3/src/misc.c:258: Using 'getpwnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xbd8): In function `g_get_any_init_do': /home/soetest1/glib-2.16.0/glib/gutils.c:1646: Using 'getpwuid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xbc8):/home/soetest1/glib-2.16.0/glib/gutils.c:1645: Using 'setpwent' in st atically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xbe3):/home/soetest1/glib-2.16.0/glib/gutils.c:1647: Using 'endpwent' in st atically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0x9d1):/home/soetest1/glib-2.16.0/glib/gutils.c:1589: Using 'getpwnam_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/local/lib/libglib-2.0.a(gutils.o)(.text+0xa10):/home/soetest1/glib-2.16.0/glib/gutils.c:1595: Using 'getpwuid_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking libsyslog-ng.a(afinet.o)(.text+0x163): In function `afinet_resolve_name': /home/soetest1/syslog-ng-2.1.3/src/afinet.c:103: Using 'getaddrinfo' in statically linked applications requires at runtim e the shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o)(.text+0x1d1): In function `resolve_hostname': /home/soetest1/syslog-ng-2.1.3/src/misc.c:166: Using 'gethostbyaddr' in statically linked applications requires at runtim e the shared libraries from the glibc version used for linking libsyslog-ng.a(misc.o)(.text+0xbd): In function `getlonghostname': /home/soetest1/syslog-ng-2.1.3/src/misc.c:71: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/../../../libnet.a(libnet_resolve.o)(.text+0x4dc): In function `libnet_name2addr6 ': : Using 'gethostbyname2' in statically linked applications requires at runtime the shared libraries from the glibc versio n used for linking libsyslog-ng.a(afinet.o)(.text+0xb2): In function `afinet_set_port': /home/soetest1/syslog-ng-2.1.3/src/afinet.c:58: Using 'getservbyname' in statically linked applications requires at runti me the shared libraries from the glibc version used for linking /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/../../../libwrap.a(hosts_access.o)(.text+0x862): In function `host_match': : undefined reference to `yp_get_default_domain' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 ---------------------------------------------------- With Regards, Chanchal Verma Kostyantyn Gushtin <kgushtin(a)n-ix.com.ua> 01/09/2009 06:08 PM To Chanchal Verma/GIS/CSC@CSC cc Subject Re: [syslog-ng] Error encountered while building syslog-ng-2.1.3 on RHEL3 Chanchal Verma wrote: Hi Kostyantyn, Yes my compilation with --enable-dynamic-linking option works fine. I am facing problem while doing static compilation. I have followed the given steps but still getting error while doing 'make'. I am not sure how to use 'glib' option for compilation, I have libglib-2.0.a in '/usr/lib'. Now you really have problems with glibc :) . glib is just abstraction (on unix systems it use glibc). gcc -g -O2 -Wall -o syslog-ng main.o libsyslog-ng.a -static -lnsl -lrt -lfl -L/usr/local/lib -lglib-2.0 -L/opt/soe /local/syslog-ng-2.1.3/eventlog/lib -levtlog -lnet -lwrap make[2]: Leaving directory `/home/soetest1/syslog-ng-2.1.3/src' make[1]: Leaving directory `/home/soetest1/syslog-ng-2.1.3' >From this command line you can retrieve info which static libraries you need (some of them are glibc libraries, some not ). So you must have thous libraries : libnsl.a (I saw linker error message that it can't find this library), librt.a, libfl.a, libevtlog.a, libnet.a, libwrap.a . Maybe you need to install glibc-devel package and/or others that contains such libraries. -- Kostyantyn Gushtin Software engineer Solutions for Your success http://www.n-ix.com

2 1

syslog-ng 3.0.1 has been released
by devel＠balabit.hu 12 Jan '09

12 Jan '09

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.0.1 SUMMARY : new stable release DATE : Jan 12, 2009 ------------------------------------------------------------------------------ DESCRIPTION: A new major version of syslog-ng Open Source Edition 3.0 has been released. The news and highlights of this version are summarized below. CHANGES: 3.0.1 Wed, 24 Dec 2008 12:16:08 +0100 NEWS: Communication: * Version 3.0 of syslog-ng supports the new syslog protocol standards developed by the Internet Engineering Task Force (IETF). The details of these protocols can be found at http://www.ietf.org/internet-drafts/draft-ietf-syslog-protocol-23.txt and http://www.ietf.org/internet-drafts/draft-ietf-syslog-transport-tls-11.txt. * The capability to encrypt log connections using TLS has been added. Configuration: * Log statements can be embedded into each other, making it possible to design complex log paths. That way for example the results of a filter can be sent to multiple destinations, or it can be sent to a destination unchanged, and partly rewritten for the other destination. Log files: * The encoding of source files can be set for proper character conversion (internally syslog-ng represents every message in UTF-8). Log messages: * The syslog-ng application assigns a unique message identification number to every log message, making it easy to detect if any messages are lost. * The syslog-ng application can read, process, and rewrite structured messages (e.g., Apache webserver logs) using templates and regular expressions. Both messages with fixed field sizes and fields separated with delimiters (e.g., comma-separated values) are supported. DOWNLOAD: This is a source code only release, no binary packages are available at this time. Those will be provided at a later date. The documentation of syslog-ng OSE 3.0, including the installation and user guides is available at: http://www.balabit.com/support/documentation/?product=syslog-ng Best Regards, BalaBit IT Security DOWNLOAD: You can download the latest source and binary packages of syslog-ng from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system…

1 0

Re: [syslog-ng] Host/IP Macros in relay chains
by Paul Robert Marino 10 Jan '09

10 Jan '09

I have one thing to add to this. I know this probably goes without saying but the reverse lookup should not be reliant on DNS. It should use the the systems native name resolution. I've often seen application programed to use only DNS for reverse resolution and in many of the secure environments I've worked in hosts files are used on loggers (also bastions, and firewalls) and DNS support is removed via the nsswhich.conf to make them impervious to DNS spoofing. DNS reliance is often a deal breaker on these hosts. -----Original Message----- From: Balazs Scheidler <bazsi(a)balabit.hu> Subj: Re: [syslog-ng] Host/IP Macros in relay chains Date: Fri Jan 9, 2009 1:09 pm Size: 1K To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> On Fri, 2009-01-09 at 10:46 +0000, Pennington, Philip wrote: > Sandor, > > > Thanks for your comments and useful suggestions. > > The requirement is somewhat complicated in that at a point along the > chain, I need to have the originating hostname for host filtering > purposes, whereas at the end of the chain, I need syslog-ng to present > the IP. That's why I began talking about reverse name resolution on the > last relay. well, with syslog-ng 3.0 and parse/rewrite you could probably encode all the needed information into the message payload and the change it back at the endpoints. see my blog about parse/rewrite capabilities: http://bazsi.blogs.balabit.com/2008/10/syslog-ng-message-parsing.html or the what's new document: http://www.balabit.com/dl/guides/syslog-ng-v3.0-guide-whatsnew-en.pdf the open source version of syslog-ng 3.0 is already released, although the official announcement is still due. -- Bazsi ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

Host/IP Macros in relay chains
by Pennington, Philip 09 Jan '09

09 Jan '09

Question on Host/IP Macros in relay chains. Is there a way to present the original sender IP on a final relay in a chain of several relays ? With hostname, the FULLHOST and HOST macros are capable of doing this (with tuning of keep_hostname() and chain_hostnames() ) Their corresponding FULLHOST_FROM and HOST_FROM marcos exhibit the same behaviours as the SOURCEIP macro in the sense that they only provide the NAME/IP of the previous relay . I have read Michael Gehrmann's post " https://lists.balabit.hu/pipermail/syslog-ng/2004-November/006695.html " which discusses the compile time option "--enable-spoof-source" feature which spoofs the sourceip using UDP but this doesn't really help as I need to use tcp and retain the relay's source (firewalls in the chain). Presumably this setting would also be required on all members of the relay chain. I guess I am really looking for an alternative way to achieve similar effect to Michael's solution using the first (original) entry in the chain (rather than spoofing the last entry in the chain at all points through the chain) however to force an IP from the original sender's entry in the chain (Reverse/PTR DNS resolution perhaps ??). What HOST_FROM is-to HOST, SOURCEIP is-to what I want. Does anyone know whether this is currently possible (or pipeline development) ? Maybe in the premium version (although I can't see it documented there either)??? Thanks, Philip Excerpts from the syslog-ng-v2.0 admin guide (section 9.5 Macros) FULLHOST: The full FQDN of the host name chain (without trimming chained hosts), including the domain name. To use this macro, make sure that the keep_hostname() option is enabled. FULLHOST_FROM: FQDN of the host that sent the message to syslog-ng as resolved by syslogng using DNS. If the message traverses several hosts, this is the last host in the chain. To use this macro, make sure that the keep_hostname() option is enabled. HOST: The name of the source host where the message originates from. If the message traverses several hosts and the chain_hostnames() option is on, the first host in the chain is used. To use this macro, make sure that the keep_hostname() option is enabled. HOST_FROM: Name of the host that sent the message to syslog-ng, as resolved by syslogng using DNS. If the message traverses several hosts, this is the last host in the chain. To use this macro, make sure that the keep_hostname() option is enabled. SOURCEIP: IP address of the host that sent the message to syslog-ng. (I.e. the IP address of the host in the FULLHOST_FROM macro.) Please note that when a message traverses several relays, this macro contains the IP of the last relay. ============================================================================== Please access the attached hyperlink for an important electronic communications disclaimer: http://www.credit-suisse.com/legal/en/disclaimer_email_ib.html ==============================================================================

3 3

syslog-ng loses hostname information on some syslog logs sent via UDP
by D S, Manu (STSD) 09 Jan '09

09 Jan '09

Hi, I am running syslog-ng on a HP-UX server listening on UDP port 514. It is receiving logs from syslogd running on another server. For some messages syslog-ng does not log the hostname information found in the UDP packet. Rather, it mistakes some data in UDP as the hostname information. Here is the complete information. syslog-ng 2.0.9 on HP-UX. Syslogd on node01 sends logs to syslog-ng on node02. The logs in node02 are, Jan 9 11:55:11 node01 root: testing1 Jan 9 11:55:32 above message repeats 5 times Jan 9 11:55:32 node01 root: testing4 Notice that hostname is missing in the second message. tcpdump on UDP port 514 for the above logs 11:57:26.183996 00:30:6e:4b:26:37 (oui Unknown) > 00:30:6e:4a:32:44 (oui Unknown), ethertype IPv4 (0x0800), length 76: (tos 0x0, ttl 64, id 39220, offset 0, flags [DF], proto UDP (17), length 62) node01.xxx.com.57403 > node02.xxx.com.syslog: [udp sum ok] SYSLOG, length: 34 Facility user (1), Severity notice (5) Msg: Jan 9 11:55:11 root: testing1 0x0000: 3c31 333e 4a61 6e20 2039 2031 313a 3535 0x0010: 3a31 3120 726f 6f74 3a20 7465 7374 696e 0x0020: 6731 0x0000: 0030 6e4a 3244 0030 6e4b 2637 0800 4500 .0nJ2D.0nK&7..E. 0x0010: 003e 9934 4000 4011 3c2c 10b5 a1f0 10b5 .>.4@.@.<,...... 0x0020: a1f4 e03b 0202 002a a973 3c31 333e 4a61 ...;...*.s<13>Ja 0x0030: 6e20 2039 2031 313a 3535 3a31 3120 726f n..9.11:55:11.ro 0x0040: 6f74 3a20 7465 7374 696e 6731 ot:.testing1 11:57:26.185727 00:30:6e:4b:26:37 (oui Unknown) > 00:30:6e:4a:32:44 (oui Unknown), ethertype IPv4 (0x0800), length 92: (tos 0x0, ttl 64, id 39221, offset 0, flags [DF], proto UDP (17), length 78) node01.xxx.com.57403 > node02.xxx.com.syslog: [udp sum ok] SYSLOG, length: 50 Facility user (1), Severity notice (5) Msg: Jan 9 11:55:32 above message repeats 5 times 0x0000: 3c31 333e 4a61 6e20 2039 2031 313a 3535 0x0010: 3a33 3220 2061 626f 7665 206d 6573 7361 0x0020: 6765 2072 6570 6561 7473 2035 2074 696d 0x0030: 6573 0x0000: 0030 6e4a 3244 0030 6e4b 2637 0800 4500 .0nJ2D.0nK&7..E. 0x0010: 004e 9935 4000 4011 3c1b 10b5 a1f0 10b5 .N.5@.@.<....... 0x0020: a1f4 e03b 0202 003a b3b0 3c31 333e 4a61 ...;...:..<13>Ja 0x0030: 6e20 2039 2031 313a 3535 3a33 3220 2061 n..9.11:55:32..a 0x0040: 626f 7665 206d 6573 7361 6765 2072 6570 bove.message.rep 0x0050: 6561 7473 2035 2074 696d 6573 eats.5.times 11:57:26.186879 00:30:6e:4b:26:37 (oui Unknown) > 00:30:6e:4a:32:44 (oui Unknown), ethertype IPv4 (0x0800), length 76: (tos 0x0, ttl 64, id 39222, offset 0, flags [DF], proto UDP (17), length 62) node01.xxx.com.57403 > node02.xxx.com.syslog: [udp sum ok] SYSLOG, length: 34 Facility user (1), Severity notice (5) Msg: Jan 9 11:55:32 root: testing4 0x0000: 3c31 333e 4a61 6e20 2039 2031 313a 3535 0x0010: 3a33 3220 726f 6f74 3a20 7465 7374 696e 0x0020: 6734 0x0000: 0030 6e4a 3244 0030 6e4b 2637 0800 4500 .0nJ2D.0nK&7..E. 0x0010: 003e 9936 4000 4011 3c2a 10b5 a1f0 10b5 .>.6@.@.<*...... 0x0020: a1f4 e03b 0202 002a a86e 3c31 333e 4a61 ...;...*.n<13>Ja 0x0030: 6e20 2039 2031 313a 3535 3a33 3220 726f n..9.11:55:32.ro 0x0040: 6f74 3a20 7465 7374 696e 6734 ot:.testing4 When I change keep_hostname(yes) to keep_hostname(no) and add the chain_hostnames(yes) option I get the following logged. Jan 9 11:55:22 node01/node01 root: testing3 Jan 9 11:57:13 above/node01 message repeats 6 times Jan 9 11:57:13 node01/node01 root: testing8 I would say, syslog-ng is confusing 'above' as the hostname before rewriting hostname. The tcpdump for these logs are 11:59:06.362374 00:30:6e:4b:26:37 (oui Unknown) > 00:30:6e:4a:32:44 (oui Unknown), ethertype IPv4 (0x0800), length 76: (tos 0x0, ttl 64, id 39223, offset 0, flags [DF], proto UDP (17), length 62) node01.xxx.com.57403 > node02.xxx.com.syslog: [udp sum ok] SYSLOG, length: 34 Facility user (1), Severity notice (5) Msg: Jan 9 11:55:22 root: testing3 0x0000: 3c31 333e 4a61 6e20 2039 2031 313a 3535 0x0010: 3a32 3220 726f 6f74 3a20 7465 7374 696e 0x0020: 6733 0x0000: 0030 6e4a 3244 0030 6e4b 2637 0800 4500 .0nJ2D.0nK&7..E. 0x0010: 003e 9937 4000 4011 3c29 10b5 a1f0 10b5 .>.7@.@.<)...... 0x0020: a1f4 e03b 0202 002a a870 3c31 333e 4a61 ...;...*.p<13>Ja 0x0030: 6e20 2039 2031 313a 3535 3a32 3220 726f n..9.11:55:22.ro 0x0040: 6f74 3a20 7465 7374 696e 6733 ot:.testing3 11:59:06.364052 00:30:6e:4b:26:37 (oui Unknown) > 00:30:6e:4a:32:44 (oui Unknown), ethertype IPv4 (0x0800), length 92: (tos 0x0, ttl 64, id 39224, offset 0, flags [DF], proto UDP (17), length 78) node01.xxx.com.57403 > node02.xxx.com.syslog: [udp sum ok] SYSLOG, length: 50 Facility user (1), Severity notice (5) Msg: Jan 9 11:57:13 above message repeats 6 times 0x0000: 3c31 333e 4a61 6e20 2039 2031 313a 3537 0x0010: 3a31 3320 2061 626f 7665 206d 6573 7361 0x0020: 6765 2072 6570 6561 7473 2036 2074 696d 0x0030: 6573 0x0000: 0030 6e4a 3244 0030 6e4b 2637 0800 4500 .0nJ2D.0nK&7..E. 0x0010: 004e 9938 4000 4011 3c18 10b5 a1f0 10b5 .N.8@.@.<....... 0x0020: a1f4 e03b 0202 003a b2af 3c31 333e 4a61 ...;...:..<13>Ja 0x0030: 6e20 2039 2031 313a 3537 3a31 3320 2061 n..9.11:57:13..a 0x0040: 626f 7665 206d 6573 7361 6765 2072 6570 bove.message.rep 0x0050: 6561 7473 2036 2074 696d 6573 eats.6.times 11:59:06.364302 00:30:6e:4b:26:37 (oui Unknown) > 00:30:6e:4a:32:44 (oui Unknown), ethertype IPv4 (0x0800), length 76: (tos 0x0, ttl 64, id 39225, offset 0, flags [DF], proto UDP (17), length 62) node01.xxx.com.57403 > node02.xxx.com.syslog: [udp sum ok] SYSLOG, length: 34 Facility user (1), Severity notice (5) Msg: Jan 9 11:57:13 root: testing8 0x0000: 3c31 333e 4a61 6e20 2039 2031 313a 3537 0x0010: 3a31 3320 726f 6f74 3a20 7465 7374 696e 0x0020: 6738 0x0000: 0030 6e4a 3244 0030 6e4b 2637 0800 4500 .0nJ2D.0nK&7..E. 0x0010: 003e 9939 4000 4011 3c27 10b5 a1f0 10b5 .>.9@.@.<'...... 0x0020: a1f4 e03b 0202 002a a76a 3c31 333e 4a61 ...;...*.j<13>Ja 0x0030: 6e20 2039 2031 313a 3537 3a31 3320 726f n..9.11:57:13.ro 0x0040: 6f74 3a20 7465 7374 696e 6738 ot:.testing8 Is this a bug on how syslogd sends the message or is it a syslog-ng logging problem? Thanks, Manu P.S: Apologies for the long mail

3 2

Re: [syslog-ng] importing old syslog-ng messages
by Daniel L. Spells Sr. 08 Jan '09

08 Jan '09

Joe, I tried catting the whole file to a named pipe, and echoing one line at a time. Both methods do the same thing. Daniel On Mon, January 5, 2009 04:18, Fegan, Joe wrote: > Then I would guess that whatever method you are using to send the old log > files to syslog-ng is stripping the newline characters, making it look > like one gigantic message. > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Daniel L. Spells > Sr. > Sent: 29 December 2008 15:59 > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] importing old syslog-ng messages > > > I have pushed that number to 90K, and get the same message, except the > "log_msg_size=XXXX" changes to the what ever value the XXXX is set to in > the log, and nothing is written the the database. > > > On Mon, December 29, 2008 05:36, Balazs Scheidler wrote: > >> On Tue, 2008-12-16 at 11:44 -0600, Daniel L. Spells Sr. wrote: >> >> >>> I am getting: >>> >>> >>> >>> "syslog-ng[18859]: Message length overflow, line is split, >>> log_msg_size=4096" >>> >>> When I try to cat the log files to the named pipe. It repeats until >>> it completes the lines in the log file. >>> >>> This is on a base install on a Suse box. >>> >>> >>> >>> >> >> the message above says that you have messages over 4096 bytes in >> length. increase log_msg_size(). >> >> -- >> Bazsi >> >> >> >> _______________________________________________________________________ >> __ >> _____ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> FAQ: http://www.campin.net/syslog-ng/faq.html >> >> >> >> > > > _________________________________________________________________________ > _____ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > > > _________________________________________________________________________ > _____ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > > >

2 1

Syslog-NG Openssh RHEL 4
by Christopher Bland 08 Jan '09

08 Jan '09

Hi guys, Having a bit of trouble logging sshd messages to my host. Sshd logs fine using syslog but I get nothing using Syslog-NG. I tried changing the SyslogFacility to DAEMON in sshd_config and still nothing. I have the following lines in my config which should have caught something: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_local { file ("/proc/kmsg" log_prefix("kernel: ")); unix-dgram("/dev/log"); # unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); internal(); }; destination secure { file("/var/log/secure"); }; destination messages { file("/var/log/messages"); }; filter f_daemon { facility(daemon); }; filter f_authpriv { facility(auth, authpriv); }; log { source(s_local); filter(f_authpriv); destination(secure); }; log { source(s_local); filter(f_daemon); destination(messages); }; log { source(s_local); destination(loghost); }; My sshd config looks like this: Protocol 2 SyslogFacility AUTHPRIV PasswordAuthentication yes ChallengeResponseAuthentication no GSSAPIAuthentication yes GSSAPICleanupCredentials yes UsePAM yes AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL Subsystem sftp /usr/libexec/openssh/sftp-server Any help is apprciated -Chris

2 1

Message length
by G. Rayot 08 Jan '09

08 Jan '09

Hi! Using logger command, I'm trying to send long messages to syslog-ng. I'm aware that messages cannot be too long (UDP limitation). The problem is that logger doesn't just cut my log, it also remove some part of the log replacing it with the syslog header. Needless to say, this information is crucial to me. Is there a way to change this or must I change my log generation creating shorter logs ? Thanks. G.

3 3

bug in http://www.balabit.com/downloads/files/syslog-ng/sources/3.0.1/source/syslog-ng_3.0.1.tar.gz
by Joseph Pietras 08 Jan '09

08 Jan '09

There is, as far as I know, only a 1 character bug! (and it is missing a "!") The file is src/misc.c $ diff -c misc.c misc.c.orig *** misc.c 2008-12-30 12:12:36.000000000 -0600 --- misc.c.orig 2008-12-30 12:24:00.000000000 -0600 *************** *** 274,280 **** struct passwd *pw; *uid = 0; ! if (!*user) return FALSE; pw = getpwnam(user); --- 274,280 ---- struct passwd *pw; *uid = 0; ! if (*user) return FALSE; pw = getpwnam(user); Hope this helps, hope it gets to someone who can fix it, thanks for syslog-ng. -joseph This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the originator of the message. This footer also confirms that this e-mail message has been scanned for the presence of computer viruses. Any views expressed in this message are those of the individual sender, except where the sender specifies and with authority, states them to be the views of Iowa Student Loan.

2 1

Error encountered while building syslog-ng-2.1.3 on RHEL3
by Chanchal Verma 08 Jan '09

08 Jan '09

Hi, I am facing problem while builing syslog-ng-2.1.3 on RHEL3 operating system. Configuration goes fine but it shows error while doing 'make'. Here is details of configuration option: champ@localhost syslog-ng-2.1.3]# ./configure --enable-static-linking --prefix=/opt/soe/local/syslog-ng-2.1.3 EVTLOG_CFLAGS="-I/opt/soe/local/syslog-ng-2.1.3/eventlog/include/eventlog" EVTLOG_LIBS="-L/opt/soe/local/syslog-ng-2.1.3/eventlog/lib" checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes . . . checking for EVTLOG... yes checking for LIBNET... yes checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... yes checking whether to enable spoof source support... yes checking whether to enable IPv6 support... yes checking whether to enable SQL support... no checking for pkg-config... (cached) /usr/local/bin/pkg-config checking pkg-config is at least version 0.14... yes checking for GLIB - version >= 2.4.0... yes (version 2.16.0) checking for static GLib libraries... yes checking sanity checking Glib headers... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating syslog-ng.spec.bb config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating solbuild/Makefile config.status: creating tgzbuild/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating tests/loggen/Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands . . **************************************************************** While doing 'make' following error encountered: champ@localhost syslog-ng-2.1.3]#make (I have pasted last few lines of error message) . . libsyslog-ng.a(afinet.o)(.text+0x78a):/home/soetest1/syslog-ng-2.1.3/src/afinet.c:342: undefined reference to `evt_tag_str' libsyslog-ng.a(afinet.o)(.text+0xae7): In function `afinet_dd_queue': /home/soetest1/syslog-ng-2.1.3/src/afinet.c:522: undefined reference to `evt_tag_str' libsyslog-ng.a(stats.o)(.text+0xd3): In function `stats_register_counter': /home/soetest1/syslog-ng-2.1.3/src/stats.c:97: undefined reference to `evt_tag_str' libsyslog-ng.a(stats.o)(.text+0x1aa):/home/soetest1/syslog-ng-2.1.3/src/stats.c:140: more undefined references to `evt_tag_str' follow libsyslog-ng.a(stats.o)(.text+0x3a8): In function `stats_generate_log': /home/soetest1/syslog-ng-2.1.3/src/stats.c:230: undefined reference to `evt_tag_printf' libsyslog-ng.a(stats.o)(.text+0x3b2):/home/soetest1/syslog-ng-2.1.3/src/stats.c:230: undefined reference to `evt_rec_add_tag' libsyslog-ng.a(fdwrite.o)(.text+0xad): In function `fd_write_write_method': /home/soetest1/syslog-ng-2.1.3/src/fdwrite.c:49: undefined reference to `evt_tag_int' libsyslog-ng.a(fdwrite.o)(.text+0xbe):/home/soetest1/syslog-ng-2.1.3/src/fdwrite.c:49: undefined reference to `evt_tag_int' libsyslog-ng.a(fdwrite.o)(.text+0x16e): In function `fd_write_free_method': /home/soetest1/syslog-ng-2.1.3/src/fdwrite.c:80: undefined reference to `evt_tag_int' libsyslog-ng.a(fdread.o)(.text+0x9d): In function `fd_do_read': /home/soetest1/syslog-ng-2.1.3/src/fdread.c:49: undefined reference to `evt_tag_int' libsyslog-ng.a(fdread.o)(.text+0xae):/home/soetest1/syslog-ng-2.1.3/src/fdread.c:49: undefined reference to `evt_tag_int' libsyslog-ng.a(fdread.o)(.text+0x1be):/home/soetest1/syslog-ng-2.1.3/src/fdread.c:103: more undefined references to `evt_tag_int' follow libsyslog-ng.a(dnscache.o)(.text+0x2db): In function `dns_cache_check_hosts': /home/soetest1/syslog-ng-2.1.3/src/dnscache.c:221: undefined reference to `evt_tag_errno' libsyslog-ng.a(dnscache.o)(.text+0x2f0):/home/soetest1/syslog-ng-2.1.3/src/dnscache.c:221: undefined reference to `evt_tag_str' libsyslog-ng.a(apphook.o)(.text+0x47): In function `register_application_hook': /home/soetest1/syslog-ng-2.1.3/src/apphook.c:38: undefined reference to `evt_tag_int' libsyslog-ng.a(apphook.o)(.text+0x5c):/home/soetest1/syslog-ng-2.1.3/src/apphook.c:38: undefined reference to `evt_tag_int' libsyslog-ng.a(apphook.o)(.text+0x114): In function `run_application_hook': /home/soetest1/syslog-ng-2.1.3/src/apphook.c:56: undefined reference to `evt_tag_int' libsyslog-ng.a(serialize.o)(.text+0x43): In function `serialize_archive_read_bytes': /home/soetest1/syslog-ng-2.1.3/src/serialize.c:33: undefined reference to `evt_tag_str' libsyslog-ng.a(serialize.o)(.text+0xcb): In function `serialize_archive_write_bytes': /home/soetest1/syslog-ng-2.1.3/src/serialize.c:49: undefined reference to `evt_tag_str' libsyslog-ng.a(logreader.o)(.text+0xce): In function `log_reader_fd_check': /home/soetest1/syslog-ng-2.1.3/src/logreader.c:104: undefined reference to `evt_tag_errno' libsyslog-ng.a(logreader.o)(.text+0x19a):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:112: undefined reference to `evt_tag_errno' libsyslog-ng.a(logreader.o)(.text+0x30d): In function `log_reader_handle_line': /home/soetest1/syslog-ng-2.1.3/src/logreader.c:195: undefined reference to `evt_tag_printf' libsyslog-ng.a(logreader.o)(.text+0x6cf): In function `log_reader_fetch_log': /home/soetest1/syslog-ng-2.1.3/src/logreader.c:450: undefined reference to `evt_tag_int' libsyslog-ng.a(logreader.o)(.text+0x6e6):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:450: undefined reference to `evt_tag_int' libsyslog-ng.a(logreader.o)(.text+0x6f7):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:450: undefined reference to `evt_tag_int' libsyslog-ng.a(logreader.o)(.text+0x774):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:440: undefined reference to `evt_tag_int' libsyslog-ng.a(logreader.o)(.text+0x7c2):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:425: undefined reference to `evt_tag_errno' libsyslog-ng.a(logreader.o)(.text+0x7d3):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:425: undefined reference to `evt_tag_int' libsyslog-ng.a(logreader.o)(.text+0x8a5): In function `log_reader_init': /home/soetest1/syslog-ng-2.1.3/src/logreader.c:479: undefined reference to `evt_tag_int' libsyslog-ng.a(logreader.o)(.text+0x8ba):/home/soetest1/syslog-ng-2.1.3/src/logreader.c:479: undefined reference to `evt_tag_int' /usr/lib/gcc-lib/i386-redhat-linux/3.2.3/../../../libwrap.a(hosts_access.o)(.text+0x862): In function `host_match': : undefined reference to `yp_get_default_domain' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/home/soetest1/syslog-ng-2.1.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/soetest1/syslog-ng-2.1.3' make: *** [all] Error 2 I am building it on - RHEL 3.0 - Operating system. Any help will be highly appreciated. With Regards, Chanchal Verma

2 1

Extra characters at beginning of line
by Florian Hines 07 Jan '09

07 Jan '09

Hi Everyone, I'm running into an issue where syslog-ng is adding extra characters to beginning of every line. Specifically, "<134>" is getting inserted right before the time stamp: <134>Jan 7 13:06:17 host1 kernel: device eth0 entered promiscuous mode This syslog-ng server is sending traffic to a remote Splunk instance (using TCP, not UDP), at first I though it was Splunk adding the characters but when I did a tcpdump on syslog-ng's outbound connection I found that they where already present. In addition to sending this traffic to Splunk the syslog-ng instance also log's local to a file. The <134> doesn't show up in the local file. Anyone have any ideas where this is coming from ? Thanks! Florian

2 2

Issues with SYSLOG-NG 2.0.10 and relaying via a SSH tunnel
by Dean Thompson 07 Jan '09

07 Jan '09

Hi Everybody, I was wondering whether somebody might be able to help me with a problem which appears to have been discussed before but is still continuing to be a problem for an environment that I am working within. The issue relates to one host forwarding SYSLOG messages to another host via a SSH tunnel. Scenario: ========= <Device> --SYSLOG MESSAGE--> Machine A <--SSH Tunnel--> Machine B Items to note include Machine B setting up a reverse SSH tunnel with Machine A. Machine A has a local port of 5514 that it uses to forward syslog messages to which sents them to machine B. This connectivity is working without any problems. The issue that I am currently experiencing is on Machine B when looking at the logs delivered via Machine A. It would appear that Machine B thinks that all the logs are coming from the IP address of 127.0.0.1. I have checked the configuration of syslog-ng on machine A and machine B and they look as if they are configured correctly. Syslog-NG 2.0.10 on Machine A is configured as follows: ======================================================= options { log_fifo_size(1000); long_hostnames(off); use_dns(no); use_fqdn(no); keep_hostname(yes); check_hostname(yes); log_msg_size(16384); }; source s_network { udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514) max_connections(1000)); }; destination d_syslogmgr { tcp("127.0.0.1" port(5514)); }; [...] Syslog-NG 2.0.10 on Machine B is configured as follows: ======================================================= options { log_fifo_size(1000); long_hostnames(off); use_dns(no); use_fqdn(no); keep_hostname(yes); check_hostname(yes); log_msg_size(16384); }; [...] Output that is being observed: ============================== Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 3317162: 3339552: Jan 7 12:37:09.608: %LINK-3-UPDOWN: Interface FastEthernet0/7, changed state to up Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 3317163: 3339553: Jan 7 12:37:10.457: %LINK-3-UPDOWN: Interface FastEthernet0/7, changed state to down Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 23:37:07 accept 172.XX.YY.242 > >eth-s2p2c3 src: 192.168.17.48; dst: 192.168.19.167; proto: tcp; rule: 22; product: VPN-1 & FireWall-1; service: 9999; s_port: 3310; Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 23:37:07 accept 172.XX.YY.242 > >eth-s2p4c1 src: XXX.YYY.235.195; dst: 192.168.108.1; proto: udp; rule: 5; product: VPN-1 & FireWall-1; service: 53; s_port: 5707; Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 23:37:07 accept 172.XX.YY.242 > >eth-s2p4c1 src: XXX.YYY.235.197; dst: 192.168.108.1; proto: udp; rule: 5; product: VPN-1 & FireWall-1; service: 53; s_port: 11639; Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 23:37:08 accept 172.XX.YY.242 > >eth-s2p4c1 src: XXX.YYY.235.196; dst: 192.168.108.1; proto: udp; rule: 5; product: VPN-1 & FireWall-1; service: 53; s_port: 1325; Jan 7 12:32:34 127.0.0.1 172.XX.YY.1 8023816: Jan 7 23:37:09.028: %SYS-CFC8-2-MMAP: mmap failed for size 24576 bytes Caller PC 0x72B12BCC errno 12 : ios-base : (PID=20499, TID=23) : -Traceback=(c6lc2-sp-4-dso-b.so+0x1F9AD0) ([19:0]+0x204790) ([19:0]+0x20CEDC) ([16:-2]np.+0x84BD4) ([21:0]+0x855B8) ([9:-3]1-dso-b+0x1FE904) ([9:-3]0-dso-bn+0xD354C) ([20:0]+0xD2658) ([20:0]+0xD29D0) ([9:-3]2-dso-b+0x4E4684) ([19:0]+0x4E465C) Ideally, I would prefer that the 127.0.0.1 was actually the 172.XX.YY.1 IP address, but it appears that there is a re-write of IP addresses going on. I have placed a packet sniffer on the line and I can see that the packet which is actually sent to MACHINE B is correct (including the correct IP addresses). To me it would appear that the issue is in the processing of the message at MACHINE B, but the issue may lie elsewhere. Is there anything obvious with the configurations which would be contributing to this problem, or is my basic understanding of how SYSLOG-NG works when wanting to keep hostnames and IP addresses flawed ? Regards, Dean

3 2

Solaris Client Not sending to Central Log Host
by Zeek Anow 05 Jan '09

05 Jan '09

We are running Solaris 9 on various Sun servers. I need to be able to send logs from the clients to the Central loghost using UDP. Below is a partial Client config file. Note that I don't have a Filter for this. If that is the problem, what kind of filter would I need to send all logs? Any help or suggestions would be appreciated. # GLOBAL OPTIONS ########################################################### options { keep_hostname(yes); chain_hostnames(no); create_dirs(yes); use_time_recvd(yes); use_dns(no); use_fqdn(no); }; # Source source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination d_centralhost { udp("10.5.2.3") port(514); }; log { source(local); destination (d_centralhost); }; ################################################################## Thanks, Zeek

3 4

underscore issue
by Stefan Varga 05 Jan '09

05 Jan '09

Hi all, I'm using syslog-ng 2.0.9 as a central logging server with destination like this: destination r_messages { file ("/logpool/logs/$DAY$MONTH$YEAR/$HOST_$DAY$MONTH$YEAR$_$HOUR"); }; But I get this: #ls /logpool/logs/05012009 0501200910 HOST is not expanded and _ before $HOUR is missing . What is special about underscore ? While using destination r_messages { file ("/logpool/logs/$DAY$MONTH$YEAR/$HOST-$DAY$MONTH$YEAR$-$HOUR"); }; everything is fine: # ls /logpool/logs/05012009/ 10.96.47.233-05012009-10 I would prefer to use an underscore if I could. Thank you, Stefan

2 3

importing old syslog-ng messages
by Daniel L. Spells Sr. 05 Jan '09

05 Jan '09

Sirs, Is there a way to import /var/log/messages, created by syslog-ng, into syslog-ng to be placed into a database? Daniel

5 11

Syslog-NG, log4j, tabs, whitespace, indent
by John Skopis 31 Dec '08

31 Dec '08

Hello, I believe that the log4j SyslogAppender is sending logs to syslog-ng that begin with a '\t' (or four spaces). The leading whitespace is trimmed either because it's not allowed per the syslog RFC, or for some other (hopefully) good reason. Can I turn this behavior off? an example would be a message: Dec 10 16:17:52 testbox at java.lang.Thread.run(Thread.java:619) which should be Dec 10 16:17:52 testbox \tat java.lang.Thread.run(Thread.java:619) Thanks, John Skopis Systems Administrator

3 7