- syslog-ng - lists.balabit.hu

error compiling syslog-ng-2.0.2 and syslog-ng-2.0.4+20070626
by Serge Torop 02 Jul '07

02 Jul '07

Hello, then I compiling the syslog-ng-2.0.2 on RedHat Enterpise Linux 4 (kernel 2.6.9-42.ELsmp) I see the message: .. [skip].. rm -f libsyslog-ng.a ar cru libsyslog-ng.a misc.o utils.o messages.o syslog-names.o cfg.o cfg-lex.o cfg-grammar.o macros.o filter.o logmsg.o logpipe.o logsource.o driver.o sgroup.o dgroup.o center.o templates.o logreader.o logwriter.o affile.o afstreams.o afuser.o afprog.o af socket.o afunix.o afinet.o afinter.o children.o stats.o gsockaddr.o fdwrite.o fdread.o memtrace.o dnscache.o ranlib libsyslog-ng.a if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo './'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -Wl,-Bdynamic libsyslog-ng.a(misc.o)(.text+0x3a9): In function `resolve_hostname': /home/tsp/syslog-ng-2.0.2/src/misc.c:185: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x6a): In function `log_stamp_format': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:110: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x2b2): In function `log_msg_ref': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:497: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x34e): In function `log_msg_unref': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:511: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xe02): In function `log_msg_ack_block_end': /home/tsp/syslog-ng-2.0.2/src/logmsg.c:631: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x4f): In function `log_pipe_ref': /home/tsp/syslog-ng-2.0.2/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0x9b): In function `log_pipe_unref': /home/tsp/syslog-ng-2.0.2/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x7d): In function `log_endpoint_free': /home/tsp/syslog-ng-2.0.2/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x175): In function `log_connection_new': /home/tsp/syslog-ng-2.0.2/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x2a6): In function `log_template_ref': /home/tsp/syslog-ng-2.0.2/src/templates.c:169: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x30e):/home/tsp/syslog-ng-2.0.2/src/templates.c:180: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error code 1 make[2]: Leaving directory `/home/tsp/syslog-ng-2.0.2/src' make[1]: *** [all-recursive] Error code 1 make[1]: Leaving directory `/home/tsp/syslog-ng-2.0.2' make: *** [all] Error code 2 the same error with syslog-ng-2.0.4+20070626. Is this possible to fix or solve this problem? Thanks for advance. -- Serge P. Torop St.Petersburg, Russia

3 6

AF_INET client dropped connection
by Pol Moal 28 Jun '07

28 Jun '07

Hi, when I restart syslog-ng on a client, the loghost prints these lines: Jun 28 12:28:38 loghost syslog-ng[7068]: AF_INET client dropped connection from w.x.y.z, port 38171 Jun 28 12:28:39 loghost syslog-ng[7068]: AF_INET client connected from w.x.y.z, port 38040 Do I lose some information from the client? If yes, what can I do? thanks ps: sorry for the first post -- Pol Moal - Comité Réseau des Universités |--> http://www.cru.fr

1 0

Assistance compiling 1.6.12
by tim.brown＠juno.com 26 Jun '07

26 Jun '07

Hello, I apologize in advance for my lack of experience and knowledge in this area but I keep encountering the following when I attempt to "make" the 1.6.12 distribution on Solaris 9: Making install in src Making install in . gcc -g -O2 -Wall -I/opt/syslog-ng-1.6.12/libol-0.3.18/src -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o getopt.o getopt1.o -lpthread -lrt -lnsl -lsocket -ldoor -lresolv -Wl,-Bstatic /opt/syslog-ng-1.6.12/libol-0.3.18/src/.libs/libol.a -lsocket -lnsl -lxnet -lfl -lsocket -lnsl -lnet -Wl,-Bdynamic ld: fatal: library -lxnet: not found ld: fatal: File processing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /opt/syslog-ng-1.6.12/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' Current working directory /opt/syslog-ng-1.6.12/src *** Error code 1 make: Fatal error: Command failed for target `install-recursive' I've scanned the net for references to "-lxnet" on Solaris and could only determine that is a library routine particular to Linux. I could not find how to provide this on a Solaris platform. Any assistance would be greatly appreciated. Tim _____________________________________________________________ Click here to find a massage therapy school near you. http://track.juno.com/s/lc?u=http://tagline.untd.us/fc/Ioyw6iieZBaNpvMSHkV5…

3 4

RE: syslog-ng 2.0.4 How can syslog-ng achieve this performance???
by Root Administrator 25 Jun '07

25 Jun '07

Geller, Sandor Balazs Scheidler Thanks 4 ur advise. Please pardon me for my short information. The scenario is this, ----- There is a network device which sends logs to syslog server over network at a pace of approx 4000 logs/sec. Syslog server has its own mission to handle them. In case, syslog server must write logs to local disk, the server in fact drops some logs in the local file. Consequently, I turned to think of tuning some tweak in syslog-ng parameter or kernel parameter. I have tuned kernel parameter by setting "udp_recv_hiwat" to its maximum value, and udp_max_buf to the value of 300 times of the default value. And, I have come up with this idea. 1. Increase "sync" parameter to buffer some logs and write logs , not at the pace of every second. I tried to increase sync as well as log_fifo_size. First, I set sync as 3000 , log_fifo_size as 10000. However, it was not liked, with the message " The value of flush_lines must be less than fifo_size; fifo_size='1000',flush_lines='3000' ". Syslog-ng is configured as follows; sync (3000); time_reopen (10); time_sleep(0); log_fifo_size (10000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); source s_test { udp(ip(0.0.0.0) port(514)); }; destination d_local4 { file("/var/log/local4"); }; filter f_local4_al { facility(local4) and level(info) and match("xxxxxx") and filter(test); }; filter test { match("10600[1267]") or match("10601[0-8]") or match ("10602[0124567]") or match("106100") or match("20900[345]") or match("500004"); }; log { source(s_test); filter(f_local4_al); destination(d_local4); }; Any advice about how sync works , and how log_fifo_size works will greatly help. Is there any other way than editing the logwriter.c file and re-compile it? Is there difference between setting sync and log_fifo_size in global option section and individual destination section in terms of its effect? 2. "fsync" parameter would be thouhgt as second chance to overcome this problem. However, no userful information cound not be found on web. I set fsync in destination section, but it was rejected when reloading the process. Any advice about how fsync works will greatly help. In addition, how can I get STATS information of syslog-ng? I have added "stats_freq (60);" in global option section, but I could not get any information in /var/adm/messages. Where does syslog-ng output the stats information? Thanks! Regards George ------------------------------ > > Message: 3 > Date: Wed, 20 Jun 2007 11:12:40 +0900 > From: "Root Administrator" <root.regist(a)gmail.com> > Subject: [syslog-ng] syslog-ng 2.0.4 How can syslog-ng achieve this > performance??? > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <8ee7d730706191912l357ecabfgb137b7297c1bfbf0(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi All, > > NEED HELP!!!!! > > [Environment] > SunOS 5.9 Generic_122300-07 sun4u sparc SUNW > syslog-ng 2.0.4 > disk : single disk (no RAID) > syslog-ng conf (global option part) > sync (3000); > time_reopen (10); > time_sleep(0); > log_fifo_size (10000); > long_hostnames (off); > use_dns (no); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > > [NEED] > I want syslog-ng to write logs to local disk at pace of about 4000 > lines per second without any lines losing. > However, lines were in fact lost in the local file. > I am trying to know the syslog-ng max performable point. > > [Consideration] > "log_fifo_size" in global option is set as 10000. > I tried to set sync() parameter, for instance 3000, in global option > section. > This did not succeed with this messages when reloading the process, > " The value of flush_lines must be less than fifo_size; fifo_size='1000', > flush_lines='3000' ". > The administration guide says "sync" is alias for "flush_lines". > > In addition, resource usage at 4000lines/s load was as below, > > result of vmstat > kthr memory page disk faults cpu > r b w swap free re mf pi po fr de sr s3 sd sd -- in sy cs us sy > id > 0 0 0 3954792 3895288 155 8 353 0 0 0 12 0 2 0 0 669 4368 857 4 3 > 93 > 0 0 0 3955248 3926424 3 8 0 0 0 0 0 0 2 0 0 4112 27017 5889 21 > 15 > 64 > 0 0 0 3955248 3925664 0 0 0 0 0 0 0 0 3 0 0 4120 27251 5653 16 > 19 > 64 > 0 0 0 3955248 3924528 0 0 0 0 0 0 0 0 1 0 0 4129 27251 5914 15 > 18 > 67 > 0 0 0 3955248 3923400 0 0 0 0 0 0 0 0 1 0 0 4113 27236 6052 17 > 15 > 68 > 0 0 0 3955176 3922568 0 0 0 0 0 0 0 0 32 0 0 4156 26028 5405 19 > 13 > 68 > 0 0 0 3955176 3921808 0 0 0 0 0 0 0 0 1 0 0 4161 27316 5757 16 > 18 > 66 > 0 0 0 3955176 3921056 0 0 0 0 0 0 0 0 1 0 0 4120 27254 6136 14 > 18 > 68 > 0 0 0 3955176 3920296 0 0 0 0 0 0 0 0 1 0 0 4110 27244 5648 18 > 17 > 65 > 0 0 0 3955176 3919544 0 0 0 0 0 0 0 0 1 0 0 4115 27253 6042 17 > 19 > 64 > 0 0 0 3955176 3918784 0 0 0 0 0 0 0 0 1 0 0 4108 27238 6469 18 > 16 > 65 > 0 0 0 3955176 3918032 0 0 0 0 0 0 0 0 1 0 0 4107 27235 6106 16 > 18 > 66 > 0 0 0 3955176 3917272 0 0 0 0 0 0 0 0 1 0 0 4139 27264 5850 17 > 18 > 65 > 0 0 0 3955176 3916520 0 0 0 0 0 0 0 0 1 0 0 4107 27259 5867 19 > 14 > 67 > > result of iostat > extended device statistics > r/s w/s kr/s kw/s wait actv wsvc_t asvc_t %w %b device > 0.0 1.0 0.0 775.9 0.0 0.0 0.0 27.3 0 3 c1t0d0s3 > 1.0 2.0 8.0 744.1 0.0 0.0 0.0 11.4 0 3 c1t0d0s3 > 0.0 2.0 0.0 864.0 0.0 0.0 0.0 15.7 0 3 c1t0d0s3 > 0.0 4.0 0.0 856.0 0.0 0.1 0.0 17.3 0 3 c1t0d0s3 > 0.0 1.0 0.0 456.0 0.0 0.0 0.0 19.5 0 2 c1t0d0s3 > 0.0 1.0 0.0 856.1 0.0 0.0 0.0 28.1 0 3 c1t0d0s3 > 0.0 1.0 0.0 855.9 0.0 0.0 0.0 24.4 0 2 c1t0d0s3 > 0.0 1.0 0.0 856.1 0.0 0.0 0.0 27.3 0 3 c1t0d0s3 > 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 c1t0d0s3 > 0.0 1.0 0.0 856.0 0.0 0.0 0.0 19.0 0 2 c1t0d0s3 > 0.0 1.0 0.0 856.0 0.0 0.0 0.0 26.9 0 3 c1t0d0s3 > 0.0 1.0 0.0 832.1 0.0 0.0 0.0 24.8 0 2 c1t0d0s3 > 0.0 1.0 0.0 735.9 0.0 0.0 0.0 26.4 0 3 c1t0d0s3 > 0.0 1.0 0.0 856.1 0.0 0.0 0.0 28.7 0 3 c1t0d0s3 > 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 c1t0d0s3 > > [Question] > Question 1. > Does the "fifo_size" in above message mean "log_fifo_size" in global > option ? > Is the value "fifo_size='1000'" max value ? > Is it possible to set "log_fifo_size" far more than 1000 ? > Is it possible to set "sync" far more than 1000 ? > If possible, then how do I do it ? > > Question 2. > To achieve the NEED, I am considering the parameters below, > sync() > log_fifo_size() > . > Are there any other parameters I MUST consider for syslog-ng > configuration? > > Regards > > George >

2 1

Cisco Loadbalancer and Syslog-ng
by Ajay Chenampara 21 Jun '07

21 Jun '07

Hi everyone, Our syslog-ng server is logging all our cisco css (arrowpoint) syslogs into a file called "5". For all the other network devices, it is getting correctly logged under the host IP. Has anyone experienced this behavior ? Is there a workaround? -ajay --------------------------------- Be a better Globetrotter. Get better travel answers from someone who knows. Yahoo! Answers - Check it out.

2 1

Re: [syslog-ng] Feature Request for Macros
by aero1967＠fastmail.fm 20 Jun '07

20 Jun '07

Yes, you are correct. As per the feature I'm asking for, 1-6 would be the correct range as you showed in your example. Hope you don't mind that I've CC'ed the list for this clarification. Thanks, V. R. On Wed, 20 Jun 2007 19:31:51 +0000 (UTC), "Leonard Mills" <lenm(a)ops.corpnet.sel.sony.com> said: > You wrote: > > >So the range > >of values this parameter would take is 1 - 5. > > > Did you not mean 1-6? Take, for example, December of this year. With > Sat > or Sun being the last day of a week, that month has 6 weeks, if I > understand your request. > > Len -- aero1967(a)fastmail.fm -- http://www.fastmail.fm - Send your email first class

1 0

Feature Request for Macros
by aero1967＠fastmail.fm 20 Jun '07

20 Jun '07

Hello, I'd like to submit two feature requests for macros in syslog-ng. 1. Week of the month. The WEEK macro gives the absolute week within the year. What I would like to see is a new macro parameter for the week within the month. An algorithm for this might be: the first day of the month falls in the first week. Thereafter the week counter is incremented the same way as the standard WEEK parameter. So the range of values this parameter would take is 1 - 5. Example use: file("var/log/$YEAR/$MONTH/$MONTHWEEK/some.log") where I've called the new macro parameter "MONTHWEEK" 2. A macro parameter for month "name", i.e. the common abbreviation for each month, e.g. Jan, Feb, Mar, etc. Thanks, V. R. -- aero1967(a)fastmail.fm -- http://www.fastmail.fm - Accessible with your email software or over the web

1 0

syslog-ng 2.0.4 How can syslog-ng achieve this performance???
by Root Administrator 20 Jun '07

20 Jun '07

Hi All, NEED HELP!!!!! [Environment] SunOS 5.9 Generic_122300-07 sun4u sparc SUNW syslog-ng 2.0.4 disk : single disk (no RAID) syslog-ng conf (global option part) sync (3000); time_reopen (10); time_sleep(0); log_fifo_size (10000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); [NEED] I want syslog-ng to write logs to local disk at pace of about 4000 lines per second without any lines losing. However, lines were in fact lost in the local file. I am trying to know the syslog-ng max performable point. [Consideration] "log_fifo_size" in global option is set as 10000. I tried to set sync() parameter, for instance 3000, in global option section. This did not succeed with this messages when reloading the process, " The value of flush_lines must be less than fifo_size; fifo_size='1000', flush_lines='3000' ". The administration guide says "sync" is alias for "flush_lines". In addition, resource usage at 4000lines/s load was as below, result of vmstat kthr memory page disk faults cpu r b w swap free re mf pi po fr de sr s3 sd sd -- in sy cs us sy id 0 0 0 3954792 3895288 155 8 353 0 0 0 12 0 2 0 0 669 4368 857 4 3 93 0 0 0 3955248 3926424 3 8 0 0 0 0 0 0 2 0 0 4112 27017 5889 21 15 64 0 0 0 3955248 3925664 0 0 0 0 0 0 0 0 3 0 0 4120 27251 5653 16 19 64 0 0 0 3955248 3924528 0 0 0 0 0 0 0 0 1 0 0 4129 27251 5914 15 18 67 0 0 0 3955248 3923400 0 0 0 0 0 0 0 0 1 0 0 4113 27236 6052 17 15 68 0 0 0 3955176 3922568 0 0 0 0 0 0 0 0 32 0 0 4156 26028 5405 19 13 68 0 0 0 3955176 3921808 0 0 0 0 0 0 0 0 1 0 0 4161 27316 5757 16 18 66 0 0 0 3955176 3921056 0 0 0 0 0 0 0 0 1 0 0 4120 27254 6136 14 18 68 0 0 0 3955176 3920296 0 0 0 0 0 0 0 0 1 0 0 4110 27244 5648 18 17 65 0 0 0 3955176 3919544 0 0 0 0 0 0 0 0 1 0 0 4115 27253 6042 17 19 64 0 0 0 3955176 3918784 0 0 0 0 0 0 0 0 1 0 0 4108 27238 6469 18 16 65 0 0 0 3955176 3918032 0 0 0 0 0 0 0 0 1 0 0 4107 27235 6106 16 18 66 0 0 0 3955176 3917272 0 0 0 0 0 0 0 0 1 0 0 4139 27264 5850 17 18 65 0 0 0 3955176 3916520 0 0 0 0 0 0 0 0 1 0 0 4107 27259 5867 19 14 67 result of iostat extended device statistics r/s w/s kr/s kw/s wait actv wsvc_t asvc_t %w %b device 0.0 1.0 0.0 775.9 0.0 0.0 0.0 27.3 0 3 c1t0d0s3 1.0 2.0 8.0 744.1 0.0 0.0 0.0 11.4 0 3 c1t0d0s3 0.0 2.0 0.0 864.0 0.0 0.0 0.0 15.7 0 3 c1t0d0s3 0.0 4.0 0.0 856.0 0.0 0.1 0.0 17.3 0 3 c1t0d0s3 0.0 1.0 0.0 456.0 0.0 0.0 0.0 19.5 0 2 c1t0d0s3 0.0 1.0 0.0 856.1 0.0 0.0 0.0 28.1 0 3 c1t0d0s3 0.0 1.0 0.0 855.9 0.0 0.0 0.0 24.4 0 2 c1t0d0s3 0.0 1.0 0.0 856.1 0.0 0.0 0.0 27.3 0 3 c1t0d0s3 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 c1t0d0s3 0.0 1.0 0.0 856.0 0.0 0.0 0.0 19.0 0 2 c1t0d0s3 0.0 1.0 0.0 856.0 0.0 0.0 0.0 26.9 0 3 c1t0d0s3 0.0 1.0 0.0 832.1 0.0 0.0 0.0 24.8 0 2 c1t0d0s3 0.0 1.0 0.0 735.9 0.0 0.0 0.0 26.4 0 3 c1t0d0s3 0.0 1.0 0.0 856.1 0.0 0.0 0.0 28.7 0 3 c1t0d0s3 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 c1t0d0s3 [Question] Question 1. Does the "fifo_size" in above message mean "log_fifo_size" in global option ? Is the value "fifo_size='1000'" max value ? Is it possible to set "log_fifo_size" far more than 1000 ? Is it possible to set "sync" far more than 1000 ? If possible, then how do I do it ? Question 2. To achieve the NEED, I am considering the parameters below, sync() log_fifo_size() . Are there any other parameters I MUST consider for syslog-ng configuration? Regards George

3 4

syslog-ng as a relay
by Moxey, Joel, VF UK - Technology (TS) 19 Jun '07

19 Jun '07

Hi! I am trying to work out if syslog-ng can act as a relay without doing "noticeable" changes to the syslog message in terms of what the syslog server sees. The problem: 1) The device sends non-standard syslog messages 2) The syslog needs to go to 2 end systems, the device supports 1 3) One of the end devices needs to receive the syslog in exactly the same for as originally sent by the device So, I have been trying destinations as follows: destination d_remote { udp("X.X.X.X" port(514) spoof_source(yes) template("$MESSAGE\n")); udp("Y.Y.Y.Y" port(514) spoof_source(yes) template("$MESSAGE\n")); }; I have also tried various combinations having "template" and adding FACILITY and LEVEL, but I am current failing to reproduce the original packet. My results: Template Result ========================================== None Relayed message has standard date and hostname added which weren't in original package. $MESSAGE\n Syslog facility and priority headers are stripped away from relayed messages. Adding $FACILITY and $LEVEL/$PRIORITY doesn't seem to do what I need as they don't appear to go into the right fields, and syslog-ng appears to put KERN.EMERG in instead... The version I am running on is 2.0.4. If anyone has managed to get this working like this, I would be grateful of any pointers. Thanks, Joel

4 5

Subscribe
by liuruihong 17 Jun '07

17 Jun '07

http://www.balabit.com/downloads/files/syslog-ng/ I want to download the syslog-ng for free On this page ,there are two directories : sources <http://www.balabit.com/downloads/files/syslog-ng/sources/> and binaries <http://www.balabit.com/downloads/files/syslog-ng/binaries/> , which directories should I download the syslog-ng packages from? Where can I find the functions provided by the syslog-ng (open-source-edition <http://www.balabit.com/downloads/files/syslog-ng/binaries/open-source-editi on/> )? Thanks! 刘蕊红 sys 6758 ============================================================================ 百度在线网络技术（北京）有限公司

2 1

problems with Cisco WiFi controller syslog messages
by Poley, Jason 15 Jun '07

15 Jun '07

We have upgraded our Cisco WiFi controller and now its syslog messages contain milliseconds which syslog-ng does not know how to handle. I am running version 1.6.9 of syslog-ng on RedHat version 3. TCP dump of first 96 bytes... 06:57:07.584716 IP (tos 0x0, ttl 59, id 0, offset 0, flags [DF], proto 17, length: 248) 161.213.8.243.32768 > 161.213.4.226.syslog: UDP, length 220 0x0000: 4500 00f8 0000 4000 3b11 ed75 a1d5 08f3 E.....@.;..u.... 0x0010: a1d5 04e2 8000 0202 00e4 660c 3c31 3238 ..........f.<128 0x0020: 3e20 4a75 6e20 3133 2030 363a 3536 3a31 >.Jun.13.06:56:1 0x0030: 362e 3732 3820 6170 665f 726f 6775 655f 6.728.apf_rogue_ 0x0040: 6465 7465 6374 2e63 3a35 3735 2041 5046 detect.c:575.APF 0x0050: 2d31 -1 Is this behavior different in a later version of syslog-ng and should I upgrade? Cheers, JDP --------------------------------- Jason D Poley Network Tech GS ITS Network County of Santa Barbara 805.568.2680 jpoley(a)co.santa-barbara.ca.us

2 3

Syslog-ng in Solaris 8
by Maurice Manurung 13 Jun '07

13 Jun '07

Dear All, I already install Syslog-NG on solaris 8 using pkg-add from www.sunfreeware.com. The package are: syslogng-1.6.11-sol8-sparc-local.gz and libol-0.3.18-sol8-sparc-local.gz. I used the standard pkg-add command on Solaris 8 and install succesfully with no error. How to make sure the package running success and working normal? Please advice. Thanks. Maurice

2 1

S_DATE apparently not working
by Giulio Botto 13 Jun '07

13 Jun '07

Hello, I'm new to both syslog-ng and the list so I first tried the docs and archives, but couldn't find anything enlightening. We have a syslog-ng 2.0.3 running on CentOS 5 and some Cisco PIX appliances sending their logs to it. If my understanding is correct I should be receiving the sender's timestamp and should be able to log it in my log files instead of the the receiving timestamp by application of the S_DATE macro. We tried changeing the time on one of the PIXes in the assumption we'd see it's timestamp on our logfile, but continued to see the receiving time no matter what macro we used in our template. Any hint to what I'me getting wrong will be very much appreciated. Below is the relevant configuration: options { use_dns(yes); dns_cache_hosts(/etc/hosts); dns_cache_expire(87600); chain_hostnames(no); use_time_recvd(no); }; source s_remote { tcp(ip(0.0.0.0) port(514) keep_timestamp(yes)); udp(ip(0.0.0.0) port(514) keep_timestamp(yes)); }; destination d_separatedbyhosts { file("/var/log/syslog-ng/$HOST.log" owner("root") group("root") perm(0640) dir_perm(0750) create_dirs(yes) template("<$PRI>$S_DATE $HOST $MSG\n") template-escape(no)); }; -- Giulio Botto -- madecto(a)sangria.org.il PGP fingerprint = 1979 A78A 8F82 DB5E 55E9 D6D6 6AB6 0BA9 FDB7 6789

2 4

/dev/log causing system to hang?
by Bill Horn 13 Jun '07

13 Jun '07

We deploy syslog-ng-1.6.2-1, the (non-destination) configuration is: -------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); }; -------- One of our support people reported: -------- 1. "EPROTOTYPE (Protocol wrong type for socket) ... pointing to /dev/log ... /dev/log is a socket 2. List all the socket on the sever .... via netstat ... found lot of socket still waiting to get connected .. indicating .. it couldnot establish new connection ... hence it ruled out the authentication issue 3. Tried to find out what was blocking the socket /dev/log .... found that syslog-ng was the culprit ... i had bounced syslog-ng and we were good thereafter -------- cat /proc/version gives: -------- Linux version 2.4.21-47.0.1.ELsmp (brewbuilder(a)hs20-bc2-2.build.redhat.com) (gcc version 3.2.3 20030502 (Red Hat Linux 3.2.3-56)) #1 SMP Fri Oct 13 17:56:20 EDT 2006 -------- That's all I've got so far. Any suggestions on next step? Thanks ... Bill

2 1

Re: syslog-ng Digest, Vol 26, Issue 10
by Shamim 11 Jun '07

11 Jun '07

Hope This will help you to compile Sysylog-ng for proper fuctioning. Compilation Procedure Below are the steps, which are required to complete the compilation. 1. Create the appropriate directory tree in /opt/soe/local for syslog-ng Note: Download the latest source code for eventlog and Syslog-ng. Before compiling the Syslog-ng we need to compile eventlog, which is required for Syslog-ng to function properly. Compiling eventlog 1. Go to eventlog source directory 2. Cd eventlog_src_dir 3. ./configure --prefix=/opt/soe/local/syslog-ng-2.0.2/eventlog 4. make 5. make install Compiling Syslog-ng 1. Go to Syslog-ng source directory 2. Cd syslog_ng_src_dir 3. ./configure --enable-static-linking --prefix=/opt/soe/local/syslog-ng-2.0.2 EVTLOG_CFLAGS=/opt/soe/local/syslog-ng-2.0.2/eventlog/include EVTLOG_LIBS=/opt/soe/local/syslog-ng-2.0.2/eventlog/lib 4. make 5. make install Note: on HP, it requires to be compiling with dynamic options as: ./configure --enable-dynamic-linking --prefix=/opt/soe/local/syslog-ng-2.0.2 EVTLOG_CFLAGS=/opt/soe/local/syslog-ng-2.0.2/eventlog/include EVTLOG_LIBS=/opt/soe/local/syslog-ng-2.0.2/eventlog/lib Shamim CSC Noida syslog-ng-request(a)lists.balabit.hu wrote: Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: configure error (ictforever) ---------------------------------------------------------------------- Message: 1 Date: Sun, 10 Jun 2007 17:09:26 +0800 From: ictforever Subject: Re: [syslog-ng] configure error To: syslog-ng(a)lists.balabit.hu Message-ID: Content-Type: text/plain; charset="iso-8859-1" > > Any advice and suggestion are appreciated.Thanks Did you export the environment variable? Check that # pkg-config eventlog --cflags returns anything at all. If it doesn't, investigate why (strace and friends could help here) here are envs: LD_LIBRARY_PATH=/usr/local/eventlog/lib PKG_CONFIG_PATH=/usr/local/eventlog/lib/pkgconfig/ [root@test syslog-ng-2.0.4]# pkg-config eventlog --cflags -I/usr/local/eventlog/include/eventlog but there is the same error: .............................. checking for GLIB... yes checking for EVTLOG... no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? why? Thanks Regards.

1 0

Re: [syslog-ng] configure error
by ictforever 10 Jun '07

10 Jun '07

> > Any advice and suggestion are appreciated.Thanks Did you export the environment variable? Check that # pkg-config eventlog --cflags returns anything at all. If it doesn't, investigate why (strace and friends could help here) here are envs: LD_LIBRARY_PATH=/usr/local/eventlog/lib PKG_CONFIG_PATH=/usr/local/eventlog/lib/pkgconfig/ [root@test syslog-ng-2.0.4]# pkg-config eventlog --cflags -I/usr/local/eventlog/include/eventlog but there is the same error: .............................. checking for GLIB... yes checking for EVTLOG... no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? why? Thanks Regards.

2 1

configure error
by ictforever 08 Jun '07

08 Jun '07

Hi, when I wanted to install syslog-ng-2.0.4,I met some troubles.I installed eventlog-0.2.4 at /usr/local/eventlog,and setted the PKG_CONFIG_PATH=/usr/local/eventlog/lib/pkgconfig,but when I run ./configure,there were errors: ........................................ checking whether to enable TCP wrapper support... yes checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... Requested 'eventlog >= 0.2' but version of EventLog is no configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? Any advice and suggestion are appreciated.Thanks Regards

2 1

patch for syslog-ng-2.0.4 to handle missing files in "follow" mode
by Charles G Waldman 07 Jun '07

07 Jun '07

The new "follow_freq" feature is nice, because you no longer have to do things like "tail -f | logger" to get external logfiles into syslog-ng. However, one case is not handled gracefully, and this is the case when a log file is not present when syslog-ng starts up. In this case, an error is reported, and the file is dropped from the list of sources. It is possible that the file just hasn't been created yet, because syslog-ng is starting before some other server which creates the file. The attached patch modifies the startup behavior, so that if an input file is nonexistent and follow mode is enabled (i.e. follow_freq > 0), then the open is "deferred" - a log reader object is created with a file descriptor set to -1, and the existing logic is used to periodically check if the file comes into existence: conceptually, it looks basically like a file move, where the file is being moved from non-existence into existence :-) Patch attached... comments welcome.

1 0

Simple Doubt
by Luiz Cruz 06 Jun '07

06 Jun '07

Hi all, I have a doubt about a process that i have. Maybe the solution is in the side of syslog-ng, i am searching. My process is: Log -> Perl Script -> Fifo -> Syslog-ng -------------- > Syslog-ng -> perl -> rrd The problem is when the application write to many lines in the fifo file (through the perl script), my syslog-ng (Standard Configuration) can't process all lines quickly, and the load of cpu rises a lot. Is there any parameters that i can use to optimize the reading? Someone have a similar solution? Thanks a lot. Att., Luiz

3 7

2.0.4 compilation issues
by Douglas J Hunley 04 Jun '07

04 Jun '07

I'm trying to compile 2.0.4 using: ./configure --prefix=/usr --sysconfdir=/etc --enable-dynamic-linking and right away, it fails telling me that libnet-config isn't found. Which is correct, I don't have it installed. There wasn't anything in the tarball that told me I needed to. A 'grep -ri libnet *' shows a bunch of check in the configure and this ChangeLog entry: ChangeLog: * configure.in: added --with-libnet and --enable-spoof-source Is there a reason this dependency isn't documented inside the tarball, or am I missing some file/reference somewhere? Moving on, I went and downloaded the latest libnet, only to find out that the latest doesn't include libnet-config (it's deprecated). So now I have to downgrade my libnet. Moving on again, the compile fails: if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O3 -march=k8 -mmmx -msse -msse2 -m3dnow -pipe -fomit-frame-pointer -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before 'libnet_t' afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to 'int' in declaration of 'AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y: In function 'yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:590: error: syntax error before ')' token /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:623: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/home/doug/syslog-ng-2.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/doug/syslog-ng-2.0.4' make: *** [all] Error 2 And there I'm stuck. On a whim, I 'upgrade' my libnet and it suddenly compiles w/o issue.. I think the libnet dependency needs to be re-examined -- Douglas J Hunley (doug at hunley.homeip.net) - Linux User #174778 http://doug.hunley.homeip.net I think, therefore, I am ... not related to you.

2 2

RE: [syslog-ng] undefined reference to `libnet_init'
by Tapas Mallick 04 Jun '07

04 Jun '07

Hello List, I am trying to install syslog-ng 2.0.4 on RHEL 4 (on top of VMWARE) and I am getting the same error message while "make" the software. ============================================= make all-recursive make[1]: Entering directory `/tmp/syslog-ng-2.0.4' Making all in src make[2]: Entering directory `/tmp/syslog-ng-2.0.4/src' gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lrt -Wl,-Bstatic -lfl -lglib-2.0 -L/usr/local/lib -levtlog -lwrap -Wl,-Bdynamic libsyslog-ng.a(afinet.o)(.text+0x776): In function `afinet_dd_init': /tmp/syslog-ng-2.0.4/src/afinet.c:338: undefined reference to `libnet_init' libsyslog-ng.a(afinet.o)(.text+0x895): In function `afinet_dd_queue': /tmp/syslog-ng-2.0.4/src/afinet.c:493: undefined reference to `libnet_write' libsyslog-ng.a(afinet.o)(.text+0x8d5):/tmp/syslog-ng-2.0.4/src/afinet.c:505: undefined reference to `libnet_geterror' libsyslog-ng.a(afinet.o)(.text+0x96f):/tmp/syslog-ng-2.0.4/src/afinet.c:364: undefined reference to `libnet_clear_packet' libsyslog-ng.a(afinet.o)(.text+0x9b3):/tmp/syslog-ng-2.0.4/src/afinet.c:366: undefined reference to `libnet_build_udp' libsyslog-ng.a(afinet.o)(.text+0x9ef):/tmp/syslog-ng-2.0.4/src/afinet.c:377: undefined reference to `libnet_build_ipv4' libsyslog-ng.a(afinet.o)(.text+0xa58):/tmp/syslog-ng-2.0.4/src/afinet.c:426: undefined reference to `libnet_clear_packet' libsyslog-ng.a(afinet.o)(.text+0xa98):/tmp/syslog-ng-2.0.4/src/afinet.c:428: undefined reference to `libnet_build_udp' libsyslog-ng.a(afinet.o)(.text+0xab5):/tmp/syslog-ng-2.0.4/src/afinet.c:442: undefined reference to `libnet_toggle_checksum' libsyslog-ng.a(afinet.o)(.text+0xaf6):/tmp/syslog-ng-2.0.4/src/afinet.c:444: undefined reference to `libnet_build_ipv6' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-2.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/tmp/syslog-ng-2.0.4' make: *** [all] Error 2 ========================================= Attaching config.log too for your reference. Thanks And Regards, Tapas Mallick ____________________________________________________________________________________ Need a vacation? Get great deals to amazing places on Yahoo! Travel. http://travel.yahoo.com/

3 3

Logging loop
by bryanh＠giraffe-data.com 01 Jun '07

01 Jun '07

My syslog-ng got into an infinite loop when it didn't have permission to write to a file destination. It tried to log to that same destination the fact that it failed to log. Is there a recommended way to configure syslog-ng to avoid this? Maybe I could route messages from Syslog itself to some relatively reliable destination or just turn them off? If not, what would be a good enhancement to the program to avoid loops? I had the problem with syslog-ng 2.0.2. -- Bryan Henderson San Jose, California

4 5

Distributed syslog architecture
by Raghu (Lists) 30 May '07

30 May '07

Hi all, I am working on a project to build distributed syslog-ing system for a very lager enterprise with offices all across the globe. Below are the main objectives: 1. Support for primarily network devices, like ciscos, netscreens, junipers etc 2. Minimum or no loss of messages when network fails 3. Central storage of all syslog messages Could you please give me your ideas or point me to any documentation that deals with such designs? Thank you!

4 5

compiling syslog-ng 2.0.4
by Folkert van Heusden 30 May '07

30 May '07

Hi, I'm trying to compile syslog-ng 2.0.4 but fail to. It gives the following errors: if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -march=pentium4 -fprefetch-loop-arrays -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:590: error: syntax error before ')' token /home/bazsi/zwa/git//syslog-ng/syslog-ng--mainline--2.0/src/cfg-grammar.y:623: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/usr/src/syslog-ng-2.0.4/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/src/syslog-ng-2.0.4' make: *** [all] Error 2 What could be the cause? And how do I fix this? Folkert van Heusden -- MultiTail is a versatile tool for watching logfiles and output of commands. Filtering, coloring, merging, diff-view, etc. http://www.vanheusden.com/multitail/ ---------------------------------------------------------------------- Phone: +31-6-41278122, PGP-key: 1F28D8AE, www.vanheusden.com

3 5

[PATCH] Added SElinux module for running syslog-ng on RHEL5.
by Jan-Frode Myklebust 26 May '07

26 May '07

Here's a small patch adding a small SElinux module that makes it possible to run syslog-ng on RHEL5 with SElinux in default enforcing mode. --- contrib/rhel-packaging/syslog_ng.te | 20 ++++++++++++++++++++ contrib/rhel-packaging/syslog_ng.te.README | 14 ++++++++++++++ 2 files changed, 34 insertions(+), 0 deletions(-) create mode 100644 contrib/rhel-packaging/syslog_ng.te create mode 100644 contrib/rhel-packaging/syslog_ng.te.README diff --git a/contrib/rhel-packaging/syslog_ng.te b/contrib/rhel-packaging/syslog_ng.te new file mode 100644 index 0000000..449756c --- /dev/null +++ b/contrib/rhel-packaging/syslog_ng.te @@ -0,0 +1,20 @@ +module syslog_ng 1.0; + +require { + class sock_file { getattr unlink }; + class tcp_socket { create bind setopt name_bind node_bind listen }; + class dir { write add_name }; + class file { create write getattr read }; + type device_t; + type syslogd_t; + type rsh_port_t; + type inaddr_any_node_t; + type var_t; +}; + +allow syslogd_t device_t:sock_file { getattr unlink }; +allow syslogd_t rsh_port_t:tcp_socket name_bind; +allow syslogd_t inaddr_any_node_t:tcp_socket node_bind; +allow syslogd_t self:tcp_socket { create listen bind setopt }; +allow syslogd_t var_t:dir { write add_name }; +allow syslogd_t var_t:file { create write getattr read }; diff --git a/contrib/rhel-packaging/syslog_ng.te.README b/contrib/rhel-packaging/syslog_ng.te.README new file mode 100644 index 0000000..df316a1 --- /dev/null +++ b/contrib/rhel-packaging/syslog_ng.te.README @@ -0,0 +1,14 @@ +"syslog_ng.te" is the necessary selinux module to allow syslog-ng +running on RHEL5 (with selinux in default enforcing mode). It's +necessary for up for letting the syslogd_t domain access /proc/kmsg, +listen on 514/tcp and write /var/syslog-ng.persist. + +To build and load it, execute: + + checkmodule -M -m -o syslog_ng.mod syslog_ng.te + semodule_package -o syslog_ng.pp -m syslog_ng.mod + semodule -i ./syslog_ng.pp + +The module can be removed from the system by executing: + + semodule --remove=syslog_ng -- 1.5.1

2 5