- syslog-ng - lists.balabit.hu

Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 25 Apr '08

25 Apr '08

That is interesting, Evan! I did as you suggested (put the env AND the configure on the same command line) and it worked swimmingly... I don't really understand the "why", but I can't argue with the results. :o) For clarification sake, here is what I was doing before that did not work: 1.) PKG_CONFIG_PATH=/usr/local/lib/pkgconfig; export PKG_CONFIG_PATH 2.) sudo ./configure --enable-spoof-source Can someone tell me what the difference between that, and Evan's command below, would be? Thanks everyone, especially Evan and ScottO! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst 1120 Celebration Blvd. Celebration, FL 34747 (321) 939-6540 Office 8296-6540 Disney Tie-Line (407) 557-1072 Cell 162*326905*19 Nextel Direct Connect chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel Sent: Friday, April 25, 2008 1:21 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 >> the output from the configure command: >> >> sudo ./configure --enable-spoof-source >> ... >> checking for pkg-config... /usr/bin/pkg-config >> checking pkg-config is at least version 0.9.0... yes >> checking for GLIB... yes >> checking for EVTLOG... no >> configure: error: Cannot find eventlog version >= 0.2: is pkg-config in >> path? Note that the configure is using /usr/bin/pkg-config and your eventlog.pc is in /usr/local/lib/pkgconfig You need to set the PKG_CONFIG_PATH prior to running the .configure script so that this path gets built into the make process. I use env PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./configure --enable-spoof-source to get the guild right. Evan. >> >> I found the command the configure script runs, so I ran it manaully: >> >> sudo /usr/bin/pkg-config --exists --print-errors eventlog >> Package eventlog was not found in the pkg-config search path. >> Perhaps you should add the directory containing `eventlog.pc' >> to the PKG_CONFIG_PATH environment variable >> No package 'eventlog' found >> >> env | grep PKG >> PKG_CONFIG_PATH=/usr/local/lib/pkgconfig >> >> ls -al /usr/local/lib/pkgconfig/ >> -rw-r--r-- 1 root root 237 Apr 25 08:19 eventlog.pc >> >> Can anyone help me figure this issue out? Thanks in advance! >> >> Chris Ivey >> >> Affiliated Computer Services >> Enterprise Management Integration Services >> Infrastructure Management Senior Analyst >> >> chris.ivey(a)acs-inc.com >> >> "I have not failed, I have simply found 10,000 ways which do not work!" -- >> Thomas Edison >> "When you find yourself in a hole, the best thing to do is stop digging!" > -- >> Nick Stokes >> "I reject your reality, and substitute my own!" -- Adam Savage >> >> >> _____ >> >> From: syslog-ng-bounces(a)lists.balabit.hu >> [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO >> Sent: Wednesday, April 23, 2008 9:36 AM >> To: Syslog-ng users' and developers' mailing list >> Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 >> >> >> Those version numbers should obviously updated to the latest available, :) >> >> >> On Wed, Apr 23, 2008 at 9:35 AM, ScottO <skippylou(a)gmail.com >> <mailto:skippylou@gmail.com> > wrote: >> >> >> On various versions of CentOS and Fedora, all I do is: >> >> - ./configure;make;make install on eventlog-0.2.5.tar.gz (from syslog-ng >> site) >> - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig >> - ./configure;make;make install on syslog-ng-2.0.5.tar.gz (from syslog-ng >> site) >> >> I did also need to install the glib2-devel package, which I didn't have >> already installed. >> >> Hope that helps, >> >> Scott >> >> >> On Wed, Apr 23, 2008 at 8:36 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com >> <mailto:Chris.ivey@acs-inc.com> > wrote: >> >> >> Hi folks! I posted this question previously, but I am still not clear on >> the process involved in putting a newer version of syslog-ng on my Fedora >> Core 4 machines. I need to upgrade, because my version (1.6.11) does not >> support hi-res timestamps. Can anyone provide some guidance as to how to > go >> about this process? I got information previously to compile from source, >> but I am not 100% clear on the process. Any guidance from you fine folks >> would be terribly appreciated!!! Thanks, folks! >> >> Chris Ivey >> >> Affiliated Computer Services >> Enterprise Management Integration Services >> Infrastructure Management Senior Analyst >> >> chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> >> >> "I have not failed, I have simply found 10,000 ways which do not work!" -- >> Thomas Edison >> "When you find yourself in a hole, the best thing to do is stop digging!" > -- >> Nick Stokes >> "I reject your reality, and substitute my own!" -- Adam Savage >> >> >> > ____________________________________________________________________________ >> __ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >> <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >> Documentation: >> http://www.balabit.com/support/documentation/?product=syslog-ng >> <http://www.balabit.com/support/documentation/?product=syslog-ng> >> FAQ: http://www.campin.net/syslog-ng/faq.html >> <http://www.campin.net/syslog-ng/faq.html> >> >> >> >> >> >> >> > ____________________________________________________________________________ > __ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 25 Apr '08

25 Apr '08

Thanks, Evan, for the reply. I am already using bash as my shell, so I know that's not it. Thanks anyways, though! Any other thoughts? Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Evan Rempel Sent: Friday, April 25, 2008 10:20 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 Which shell ar you using? in some shells (csh and tcsh) the env is NOT propogated to children. in those you need to setenv PKG_CONFIG_PATH or you chould just use bash to start with. Evan. On Fri, 25 Apr 2008, Ivey, Chris wrote: > Date: Fri, 25 Apr 2008 08:50:35 -0500 > From: "Ivey, Chris" <Chris.ivey(a)acs-inc.com> > Reply-To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> > Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 > > Scott et. al., > > OK, I am following along with the directions from the "compile > syslog-ng" page but am getting errors. I have seen TONS of posts about > folks having this error, but I have not found a solution. Here is a snip of > the output from the configure command: > > sudo ./configure --enable-spoof-source > ... > checking for pkg-config... /usr/bin/pkg-config > checking pkg-config is at least version 0.9.0... yes > checking for GLIB... yes > checking for EVTLOG... no > configure: error: Cannot find eventlog version >= 0.2: is pkg-config in > path? > > I found the command the configure script runs, so I ran it manaully: > > sudo /usr/bin/pkg-config --exists --print-errors eventlog > Package eventlog was not found in the pkg-config search path. > Perhaps you should add the directory containing `eventlog.pc' > to the PKG_CONFIG_PATH environment variable > No package 'eventlog' found > > env | grep PKG > PKG_CONFIG_PATH=/usr/local/lib/pkgconfig > > ls -al /usr/local/lib/pkgconfig/ > -rw-r--r-- 1 root root 237 Apr 25 08:19 eventlog.pc > > Can anyone help me figure this issue out? Thanks in advance! > > Chris Ivey > > Affiliated Computer Services > Enterprise Management Integration Services > Infrastructure Management Senior Analyst > > chris.ivey(a)acs-inc.com > > "I have not failed, I have simply found 10,000 ways which do not work!" -- > Thomas Edison > "When you find yourself in a hole, the best thing to do is stop digging!" -- > Nick Stokes > "I reject your reality, and substitute my own!" -- Adam Savage > > > _____ > > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO > Sent: Wednesday, April 23, 2008 9:36 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 > > > Those version numbers should obviously updated to the latest available, :) > > > On Wed, Apr 23, 2008 at 9:35 AM, ScottO <skippylou(a)gmail.com > <mailto:skippylou@gmail.com> > wrote: > > > On various versions of CentOS and Fedora, all I do is: > > - ./configure;make;make install on eventlog-0.2.5.tar.gz (from syslog-ng > site) > - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig > - ./configure;make;make install on syslog-ng-2.0.5.tar.gz (from syslog-ng > site) > > I did also need to install the glib2-devel package, which I didn't have > already installed. > > Hope that helps, > > Scott > > > On Wed, Apr 23, 2008 at 8:36 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com > <mailto:Chris.ivey@acs-inc.com> > wrote: > > > Hi folks! I posted this question previously, but I am still not clear on > the process involved in putting a newer version of syslog-ng on my Fedora > Core 4 machines. I need to upgrade, because my version (1.6.11) does not > support hi-res timestamps. Can anyone provide some guidance as to how to go > about this process? I got information previously to compile from source, > but I am not 100% clear on the process. Any guidance from you fine folks > would be terribly appreciated!!! Thanks, folks! > > Chris Ivey > > Affiliated Computer Services > Enterprise Management Integration Services > Infrastructure Management Senior Analyst > > chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> > > "I have not failed, I have simply found 10,000 ways which do not work!" -- > Thomas Edison > "When you find yourself in a hole, the best thing to do is stop digging!" -- > Nick Stokes > "I reject your reality, and substitute my own!" -- Adam Savage > > > ____________________________________________________________________________ > __ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > <https://lists.balabit.hu/mailman/listinfo/syslog-ng> > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > <http://www.balabit.com/support/documentation/?product=syslog-ng> > FAQ: http://www.campin.net/syslog-ng/faq.html > <http://www.campin.net/syslog-ng/faq.html> > > > > > > > ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 25 Apr '08

25 Apr '08

Scott et. al., OK, I am following along with the directions from the "compile syslog-ng" page but am getting errors. I have seen TONS of posts about folks having this error, but I have not found a solution. Here is a snip of the output from the configure command: sudo ./configure --enable-spoof-source ... checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? I found the command the configure script runs, so I ran it manaully: sudo /usr/bin/pkg-config --exists --print-errors eventlog Package eventlog was not found in the pkg-config search path. Perhaps you should add the directory containing `eventlog.pc' to the PKG_CONFIG_PATH environment variable No package 'eventlog' found env | grep PKG PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ls -al /usr/local/lib/pkgconfig/ -rw-r--r-- 1 root root 237 Apr 25 08:19 eventlog.pc Can anyone help me figure this issue out? Thanks in advance! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO Sent: Wednesday, April 23, 2008 9:36 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 Those version numbers should obviously updated to the latest available, :) On Wed, Apr 23, 2008 at 9:35 AM, ScottO <skippylou(a)gmail.com <mailto:skippylou@gmail.com> > wrote: On various versions of CentOS and Fedora, all I do is: - ./configure;make;make install on eventlog-0.2.5.tar.gz (from syslog-ng site) - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig - ./configure;make;make install on syslog-ng-2.0.5.tar.gz (from syslog-ng site) I did also need to install the glib2-devel package, which I didn't have already installed. Hope that helps, Scott On Wed, Apr 23, 2008 at 8:36 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com <mailto:Chris.ivey@acs-inc.com> > wrote: Hi folks! I posted this question previously, but I am still not clear on the process involved in putting a newer version of syslog-ng on my Fedora Core 4 machines. I need to upgrade, because my version (1.6.11) does not support hi-res timestamps. Can anyone provide some guidance as to how to go about this process? I got information previously to compile from source, but I am not 100% clear on the process. Any guidance from you fine folks would be terribly appreciated!!! Thanks, folks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

2 1

how to change localhost to hostname
by D'Souza, Alfred 24 Apr '08

24 Apr '08

We have a bunch of servers whose applications write error/debug messages to 127.0.0.1 port 514. We want syslog-ng on each of the servers to forward the messages to a central logging server which also forwards the messages to zenoss running on the central logger server. The problem with our configuration (which I have copied here) is that no matter which server originates the message, they show up on the central server as originating from localhost - in both zenoss and in the /var/log files We want them to be shown as originating from the server that produced the messages. We can add a template on the central logger to log the messages as coming form $FROM_HOST, but while that solves the problem for the /var/log messages, zenoss still shows the messages as coming from localhost. Please help, we are new to using syslog-ng. We are using syslog-ng version 2.0.8 on Red Hat Linux. -----------------server syslog-ng.conf (slightly abbreviated) options { use_dns(yes); use_fqdn(no); chain_hostnames(no); keep_hostnames(yes); ::: }; source java { udp(ip(127.0.0.1) port(514)); }; destination remote { udp("192.168.99.105" port(514)); } log { source(java); destination(remote); }; ------------------central logger config file options { use_time_recvd( no ); time_reopen(1); long_hostnames(off); sync(0); use_dns(yes); use_fqdn(no); chain_hostnames(no); keep_hostname(yes); create_dirs(yes); stats(3600); }; source src { unix-stream("/dev/log"); pipe("/proc/kmsg"); internal(); udp(ip(0.0.0.0) port(514)); }; destination everything { file("/var/log/$HOST_FROM.$MONTH$DAY$YEAR" template("$HOST_FROM $HOUR:$MIN:$SEC $MSG\n")); }; destination zenoss { udp( "localhost" port(5514) ); #udp( "localhost" port(5514) template("<$PRI>$DATE $HOST_FROM $MSG\n") ); }; log { source(src); destination(everything); }; log { source(src); destination(zenoss); }; PLEASE READ: This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please delete it and all copies from your system, destroy any hard copies and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Nomura Holding America Inc., Nomura Securities International, Inc, and their respective subsidiaries each reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorized to state the views of such entity. Unless otherwise stated, any pricing information in this message is indicative only, is subject to change and does not constitute an offer to deal at any price quoted. Any reference to the terms of executed transactions should be treated as preliminary only and subject to our formal written confirmation.

3 2

Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 23 Apr '08

23 Apr '08

Thank you, Scott! I appreciate your assistance. I will take your guidance below, and start working on getting the latest syslog-ng working on my macines. Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ScottO Sent: Wednesday, April 23, 2008 9:36 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 2.0/2.1 on Fedora Core 4 Those version numbers should obviously updated to the latest available, :) On Wed, Apr 23, 2008 at 9:35 AM, ScottO <skippylou(a)gmail.com <mailto:skippylou@gmail.com> > wrote: On various versions of CentOS and Fedora, all I do is: - ./configure;make;make install on eventlog-0.2.5.tar.gz (from syslog-ng site) - export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig - ./configure;make;make install on syslog-ng-2.0.5.tar.gz (from syslog-ng site) I did also need to install the glib2-devel package, which I didn't have already installed. Hope that helps, Scott On Wed, Apr 23, 2008 at 8:36 AM, Ivey, Chris <Chris.ivey(a)acs-inc.com <mailto:Chris.ivey@acs-inc.com> > wrote: Hi folks! I posted this question previously, but I am still not clear on the process involved in putting a newer version of syslog-ng on my Fedora Core 4 machines. I need to upgrade, because my version (1.6.11) does not support hi-res timestamps. Can anyone provide some guidance as to how to go about this process? I got information previously to compile from source, but I am not 100% clear on the process. Any guidance from you fine folks would be terribly appreciated!!! Thanks, folks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com <mailto:chris.ivey@acs-inc.com> "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage ____________________________________________________________________________ __ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> FAQ: http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

Syslog-ng 2.0/2.1 on Fedora Core 4
by Ivey, Chris 23 Apr '08

23 Apr '08

Hi folks! I posted this question previously, but I am still not clear on the process involved in putting a newer version of syslog-ng on my Fedora Core 4 machines. I need to upgrade, because my version (1.6.11) does not support hi-res timestamps. Can anyone provide some guidance as to how to go about this process? I got information previously to compile from source, but I am not 100% clear on the process. Any guidance from you fine folks would be terribly appreciated!!! Thanks, folks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst chris.ivey(a)acs-inc.com "I have not failed, I have simply found 10,000 ways which do not work!" -- Thomas Edison "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes "I reject your reality, and substitute my own!" -- Adam Savage

2 2

reliability question (unix-dgram vs unix-stream)
by Geller, Sandor (IT) 21 Apr '08

21 Apr '08

Hi, I'm discussing the differences between unix-stream and unix-dgram on linux with my colleagues. It looks like the kernel-side and glibc-side implementation aren't different in the aspect of reliability. So why is it stated both in the reference guide and in the faq that unix-stream is more reliable? Thanks, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.

2 1

syslog-ng OSE 2.1beta1 release
by Balazs Scheidler 18 Apr '08

18 Apr '08

Dear syslog-ng users, I'd like to announce the release of syslog-ng Open Source Edition 2.1beta1. This release contains a couple of bugfixes back and forward ported from other branches and two functionality changes, much requested previously on this list. The first is a change in the TCP connection logic to move the DNS lookup be be part of the TCP reconnection logic, effectively solving the problem of non-resolvable hostnames, which caused syslog-ng to fail during startup. The same change also causes the destination hostname to be resolved again for each new connection attempt. The second important change was to handle file write error much more gracefully: whenever a write error occurs, writing to the destination file is suspended for some time, this way handling disk-full conditions better. I'd like to release 2.1.0 real soon now. The complete list of user-visible changes is below: 2.1beta1 Fri, 18 Apr 2008 18:00:59 +0200 Bugfixes: * Fixed a possible SIGABRT crash if the hosts file passed to dns-cache-hosts() had multiple entries with the same IP address. * Fixed a bug that caused the persistent DNS cache (e.g. /etc/hosts) to be reloaded for all name resolution requests. * Fixed a possible crash during startup if "-g" was specified without using "-u". * Fixed handling more than 256 destinations by changing the reference counter type of LogMessages to a 16 bit value. * Fixed door initialization on Solaris, the door portion of sun-streams() sources did not work in previous releases. * Fixed a possible segmentation fault in handling file sources that are marked optional and the source file does not exist. * Fixed the LinkSys style timestamp parser to avoid recognizing hostnames starting with numbers as the year value of the timestamp. * Fixed the year recognition heuristics as the older used the previous year in some cases when the client's clock was too fast. Other changes: * Backported end-of-message search algorithm from PE, which results in increased performance and the removal of vague interpretation of messages that contain both NUL and NL characters. * Removed destination files from the set of polled fds, they are always writable anyway and cause performance degradation when a lot of destination files are managed. * Fixed some FreeBSD and AIX portability issues. * Added the BSDTAG macro, implementation by Jung Christian. * Changed the reconnection logic in the TCP destination driver to reattempt connections for any kind of network problems. Therefore an unknown DNS name will not prevent syslog-ng to start up with an initialization error. * Changed the file write error handling logic to suspend writing to a file destination on write errors, but retry it some time later. This time interval is controlled by time_reopen() just like with other drivers. -- Bazsi

1 1

Centralised logging of nginx
by Ed W 18 Apr '08

18 Apr '08

Does anyone have any thoughts on centralising logging of nginx? Anyone used syslog-ng as part of a system to ship the logs to a central location? Thanks Ed W

2 1

About $HOST macro
by Yu Watanabe 16 Apr '08

16 Apr '08

Hello, I have a question regarding to the $HOST macro in the syslog.conf. Which value does the syslog-ng uses for the hostname? It seems that there are circumstatnses that it converts the SOURCEIP using the /etc/hosts and sometimes it gets the hostname somewhere else. I would like to know how does the syslog-ng defines this value. Yu Watanabe

2 1

Parsing tab characters
by Norman Elton 15 Apr '08

15 Apr '08

We've configured a host to send syslogs to our central repository running syslog-ng 2.0.3. This particular host is sending tab-delimited entries. The normal syslogd daemon parses and saves the messages correctly. Syslog-NG seems to save them encoded as \011. Can syslog-ng be configured to save the decoded ASCII characters? Or can the messages be shoved through something like sed to be massaged before saving? Thanks! Norman Elton

3 3

Logging to dirs with $HOST gives me strange results
by Markus Strangl 15 Apr '08

15 Apr '08

Hi syslog-ng users, I'm running a central syslog-ng 2.0.6 server with a rather simple ruleset, just to collect copies of the syslogs from a bunch of machines. They are running Solaris 9 and 10, with the onboard syslog, forwarding with syslog.conf "*.alert @logso01". Syslog-NG's logging targets are set up like that: source net { udp(); }; destination messages { file("/logs/$HOST/messages"); }; log { source(net); filter(f_high); destination(messages); }; Options are set to use the /etc/hosts file, and all hosts are listed there. In theory, this should give me one directory for each hosts that's forwarding its log messages. However, in practice, I get quite a lot of useless directories as well, that don't match any real host. root@logso01:/logs>ls \"/ \011Corrupt/ \011PLOGI/ \011SONY_AIT/ \011got/ \011offline/ \011/ \011Error/ \011SCSI/ \011failed/ \011i/ \011transport/ (C) SC admso01-qfs archso03-mgm nrgdev nrgstg jumpso01-qfs testso01 nrgso01 US archso01-mgm archsrv-qfs nrgprod1-qfs epldev logso01 testso02-qfs All Use archso01-xfcu by nrgprod2-qfs for prodso01-mgm IBM Use, archso02-mgm cutapsrv nrgprod3-qfs gconfd stgaoma Licensed Version archso02-xfcu delso01-sn nrgso01-qfs ddpso01-qfs svnso01-mgm It looks like under some condition, syslog-ng doesn't use the source hostname for the $HOST config directrive, but the first word of the log message. Is this a (known?) bug, or is there any way to circumvent that behaviour? Please advise. Yours Markus

2 1

What packages need?
by hi ro 13 Apr '08

13 Apr '08

Hi, What packages does it need to compile syslog-ng? Is it the same package when to make RPM? (bison, flex, gcc-c++, pkgconfig, glib2-devel, libevtlog-devel) (It needs only libc to compile eventlog, doesn't it?) And if it's not necessary to connect database, does it need to install libdbi8? Thanks hiro _________________________________________________________________ 【MSNビデオ】超貴重！驚きの大物対談が実現。作家村上龍が話題のあの人に迫る http://video.msn.co.jp/rvr/default.htm

4 14

[Bug 3] New: udp flood
by bugzilla＠bugzilla.balabit.com 13 Apr '08

13 Apr '08

https://bugzilla.balabit.com/show_bug.cgi?id=3 Summary: udp flood Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: manoo(a)manoo.hu Type of the Report: bug Estimated Hours: 0.0 I installed syslog-ng 2.0.5 (because there was no .rpm for a RHEL3 server I made it with rpmbuild). In the config file I placed two destination lines for the same filter, first for place the log locally and an other to send it to a remote loghost (udp/514). I had a typo in the path of the local logfile (started with "/vavr" instead of "/var") and syslog-ng cannot create/write the specified file (I made no "create_dirs(yes)") when I started the logging (with logger - that was an apache logging system) the result was the following: it did not checked the writability of the file but could start itself (resart of syslog-ng was successfull) and started to sends this errormessage to the loghost with full speed: Dec 13 09:56:07 192.168.0.2 syslog-ng[19315]: Error opening file for writing; filename='/vavr/log/apache/apache.log', error='No such file or directory (2)' within 20 minutes it sends cca 700mb of clear text to the loghost. There is a leased line between the two hosts via internet and this flooded the communication channel. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 2

[Bug 19] New: syslog-ng 2.0. x can not follow a change of IP at target syslog server
by bugzilla＠bugzilla.balabit.com 12 Apr '08

12 Apr '08

https://bugzilla.balabit.com/show_bug.cgi?id=19 Summary: syslog-ng 2.0.x can not follow a change of IP at target syslog server Product: syslog-ng Version: 2.0.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: enhancement Estimated Hours: 0.0 If the IP address of the destination for syslogging is changed, then all sending syslog-ng servers must be reloaded to figure out that the address has changed, even if the IP name has not changed. We recently moved one of our centralized syslog servers to a different building, resulting in a different network address. We took great pains (it was actually easy, but required planning) to maintain the IP name of the syslog server, but all of the sending hosts required a syslog-ng reload to resolve the IP name in the configuration file to the new IP address. The "reopen" logic should be changed to resolve the IP address of the hostname provided in the configuration file. Hopefully the reopen process should be relatively rare, and no significant load will be placed on the DNS servers during normal operation. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

5 6

STATS: high amount of dropped messages
by Jeffrey Chandler 10 Apr '08

10 Apr '08

Hello, I am using syslog-ng 1.6.12 on Solaris 10 (sparc). I am seeing a large amount of dropped message every time Apr 9 20:14:18 syslog syslog-ng[16754]: STATS: dropped 1068470 Apr 9 20:24:18 syslog syslog-ng[16754]: STATS: dropped 1031716 Apr 9 20:34:18 syslog syslog-ng[16754]: STATS: dropped 997105 Apr 9 20:44:18 syslog syslog-ng[16754]: STATS: dropped 943151 Apr 9 20:54:18 syslog syslog-ng[16754]: STATS: dropped 1016377 Apr 9 21:04:18 syslog syslog-ng[16754]: STATS: dropped 992911 In previous posts, I have seen that this does not relate to log entries written to disk, but rather to a different destination, ie a pipe. In the case of our environment, we pipe all of the data which comes into syslog-ng to a pipe which is then forwarded to ArcSight through an agent running on the system. With the number of entries showing up as "dropped," would you recommend a different method to achieve this same task? Is this also a 1 to 1 correlation of messages that are not sent to the pipe? Thanks, Jeff

2 1

Redhat Enterprise 3 compile of 2.0.9
by Sigurður Bjarnason 10 Apr '08

10 Apr '08

Hi All, I am trying to compile syslog-ng 2.0.9 for Redhat ES3, it is not going too good it complains about not have-ing glib 2.x ,now my problem is that I cannot complile this for glib v2 and I need to stick with the orginal glib of Redhat ES3. Can it be done that is compile Syslog-ng for RedhatEs with the old glib or I am forced to upgrade to glib version 2.x . Regards Siggi

2 2

Bug: Numeric digits stripped from source hostname and time mangled.
by Christopher Cashell 09 Apr '08

09 Apr '08

[Apologies if this has been reported before, but I couldn't find any mention of it. Also, my apologies if this shows up twice. I sent it yesterday, but after 24 hours, it hasn't hit the list yet, so I'm resending.] It appears that Syslog-NG 2.0.x (tested with 2.0.9) will mangle originating source hostname when it begins numerically hostnames, and this also causes errors with date/time handling. Verified with Syslog-NG 2.0.9 on Red Hat Enterprise Linux 3 To duplicate and display the bug (destination(d_log_expanded) and template added to more easily display what's going on): [root@logbox syslog-ng]# cat syslog-ng.conf options { sync(0); chain_hostnames(yes); }; source s_net { tcp(); }; destination d_log { file("/tmp/test.log") ; }; destination d_log_expanded { file("/tmp/test-long.log" template("Date: $DATE, Sender Unixtime: $S_UNIXTIME, Receiver Unixtime: $R_UNIXTIME, Host: $FULLHOST Message: $MSGONLY\n") template_escape(no)) ; }; log { source(s_net); destination(d_log); }; log { source(s_net); destination(d_log_expanded); }; [root@logbox tmp]# cat /tmp/problem-log <0d>Mar 31 04:41:57 1234-xxxx/192.168.1.1 TestLog: This is a test log that includes the relevant bits of the original log, before Syslog-NG mangles them: "Mar 31 04:41:57 1234-xxxx/192.168.1.1 TestLog: This is a test log. . ." [root@logbox tmp]# cat < /tmp/problem-log | nc localhost 514 [root@logbox tmp]# tail -1 *.log ==> test.log <== Dec 31 17:59:59 -xxxx/192.168.1.1/localhost TestLog: This is a test log that includes the relevant bits of the original log, before Syslog-NG mangles them: "Mar 31 04:41:57 1234-xxxx/192.168.1.1 TestLog: This is a test log. . ." ==> test-long.log <== Date: Dec 31 17:59:59, Sender Unixtime: -1, Receiver Unixtime: 1207676046, Host: -xxxx/192.168.1.1/localhost Message: This is a test log that includes the relevant bits of the original log, before Syslog-NG mangles them: "Mar 31 04:41:57 1234-xxxx/192.168.1.1 TestLog: This is a test log. . ." You can see from the above that the '1234' is being stripped from the originating hostname '1234-xxxx', and the sender timestamp is then being mangled to -1. It appears to only pull the first 4 numbers from the source hostname (assuming there are more numbers, such as '123456-xxxx'), and it only happens when the hostname starts numerically. If you add a non-numeric character to the beginning part of the hostname, it is handled correctly (such as 'z1234-xxxx' or '12z34-xxxx'). -- Christopher Cashell ____________________________________ Christopher Cashell Systems & Network Security Engineer phone: 402.361.3065 fax: 402.361.3165 e-mail: christophercashell(a)solutionary.com Solutionary, Inc. www.Solutionary.com Making Security Manageable _____________________________________ Confidentiality Notice The content of this communication, along with any attachments, is covered by federal and state law governing electronic communications and may contain confidential and legally privileged information. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, use or copying of the information contained herein is strictly prohibited. If you have received this communication in error, please immediately contact us by telephone at (402) 361-3000 or e-mail security(a)solutionary.com. Thank you. Copyright 2000-2007, Solutionary, Inc. All rights reserved. ActiveGuard, eV3, Solutionary and the Solutionary logo are registered marks of Solutionary, Inc. SecurCompass is a service mark of Solutionary, Inc.

3 4

io.c: bind_inet_socket() bind failed Address already inuse
by Lucky Y 09 Apr '08

09 Apr '08

> >We use syslog-ng 1.6.12 in RHEL4. > >As part of our system testing we restart syslog-ng 150 times in a loop > >along with other services in the server. > > > >syslog-ng fails to come up 3/4 times with the error : > >"io.c: bind_inet_socket() bind failed 192.168.128.1:601 >> Address already in use". >How do you restart syslog-ng? It takes some time to close sources/ >destinations and there is a chance that the new syslog-ng instance >tries to bind to the same address the not-yet-stopped instance >still uses. Does syslog-ng use SO_REUSEADDR option ?

3 3

syslog-ng logging with wrong year
by Jean-Sebastien Pilon 09 Apr '08

09 Apr '08

Hello, We have a log collector receiving logs from several nodes and it is logging in the wrong $YEAR directory every 1st of the month for some host for about 2 minutes... We have 75 nodes sending logs, and we have a directory created under /var/log/hosts/2007/*/01/hostname for about 3-4 host. As you can see below, the folder 01 (January 1st) was created at 23:59 on December 31st... Same thing for Feb. 1st to now... /var/log/hosts/2007/01# ls -l total 4 drwxr-xr-x 2 root root 4096 2007-12-31 23:59 01 Here are my destination and log rules destination d_local { file("/var/log/hosts/$YEAR/$MONTH/$DAY/$HOST"); }; log { source(s_tcp); source(s_udp); source(s_local); destination(d_local); }; Any one has any idea why this is happening? NOTICE: This email contains privileged and confidential information and is intended only for the individual to whom it is addressed. If you are not the named addressee, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this transmission by mistake and delete this communication from your system. E-mail transmission cannot be guaranteed to be secured or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. AVIS: Le pr�sent courriel contient des renseignements de nature privil�gi�e et confidentielle et n�est destin� qu'� la personne � qui il est adress�. Si vous n��tes pas le destinataire pr�vu, vous �tes par les pr�sentes avis�s que toute diffusion, distribution ou reproduction de cette communication est strictement interdite.� Si vous avez re�u ce courriel par erreur, veuillez en aviser imm�diatement l�exp�diteur et le supprimer de votre syst�me. Notez que la transmission de courriel ne peut en aucun cas �tre consid�r� comme inviolable ou exempt d�erreur puisque les informations qu�il contient pourraient �tre intercept�s, corrompues, perdues, d�truites, arriv�es en retard ou incompl�tes ou contenir un virus. �

4 8

Re: [syslog-ng] syslog-ng logging with wrong year
by G.W. Haywood 09 Apr '08

09 Apr '08

Hi there, On Wed, 9 Apr 2008 Balazs Scheidler wrote: > ...the timestamp of the message does not contain a year, there's a > heuristic in syslog-ng to determine that. > ... > I'm reluctant to change this in 2.0 (the current algorithm has been > in place for about a decade now), however I can commit a patch to 2.1. > What do others think? If you do, please make it optional, disabled by default. It could be enabled by a command-line switch or by the configuration file options. -- 73, Ged.

2 1

Re: [syslog-ng] TAG-Macro
by JUNG, Christian 07 Apr '08

07 Apr '08

Here's a new version of the BSDTAG macro patch which doesn't use a lookup-table for the facility anymore.

2 1

Re: [syslog-ng] TAG-Macro
by JUNG, Christian 07 Apr '08

07 Apr '08

> -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu]On Behalf Of > Balazs Scheidler > Sent: Tuesday, March 18, 2008 12:46 PM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] TAG-Macro > > Something like BSDTAG? > Attached is a patch to the 2.0.9 source tree of syslog-ng which implements the "BSDTAG" macro. bye Chris

2 2

changing the location of the disk buffer for log_disk_fifo_size()
by Lucky Y 07 Apr '08

07 Apr '08

Hi, Is there anyway to change the location of the disk buffer for log_disk_fifo_size() ? It buffers the messages in /var/lib/syslog-ng/ by default in Linux, but in our system this directory will not exist. Regards, Lucky

2 2

About Syslog-ng Macro
by Yu Watanabe 07 Apr '08

07 Apr '08

TO : Syslog-NG Developers Hello , I have a question regarding to the syslog-ng macros that is useful in the syslog.conf. I am using syslog-ng in the follwoing development. 1. Linux **** 2.6.9-42.EL #1 Sat Aug 12 09:17:58 CDT 2006 i686 i686 i386 GNU/Linux 2. CentOS release 4.4 (Final) 3. LANG=ja_JP.eucJP However, whenever I try to ouput the multibye code(EUC) through the macro such as $MSG the message do not show properly. I am defining the following template and destination function in the config file. template t_temp { template("$S_YEAR-$S_MONTH-$S_DAY $S_HOUR:$S_MIN:$S_SEC $SOURCEIP $MSG\n"); }; destination d_log { program("/tmp/stdin2phpsyslogng.pl > /tmp/stdin2phpsyslogng.log 2>&1" template(t_temp)); }; But in the log file which is created through the file driver the japanese code shows properly. I am defining the following definition destination host_splitter { file( "/tmp/$HOST.log" owner(root) group(root) perm(0644) dir_perm(0755) create_dirs(yes)); }; I am looking in the source code but I am having trouble with the investigation. If its possible, I would like to know why this is happening. Is there any way to modify the macro problem? Thank you! Yu Watanabe

3 5