- syslog-ng - lists.balabit.hu

Filters to sort by host then service?
by Ryan 02 May '07

02 May '07

I am working on setting up a central syslog-ng server running on FreeBSD 6-STABLE. I have local logging setup. I also have the service listening on udp and tcp ports. I need help to figure out how to have a filter so it filters by hostname then by service. syslog-ng.conf #################### # Options #################### options { keep_hostname(yes); long_hostnames(off); sync(0); }; #################### # Sources #################### source local { file("/dev/klog" log_prefix("kernel: ")); unix-dgram("/var/run/log"); internal(); tcp(keep-alive(yes)); udp(); }; #################### # Destinations #################### # Destination Files from Local Host destination all { file("/var/log/all.log"); }; destination la_cron { file("/var/log/cron.log"); }; destination la_sudo { file("/var/log/sudo.log"); }; destination ld_sshd { file("/var/log/sshd.log"); }; destination ls_kernel { file("/var/log/kernel.log"); }; #################### # Filters #################### filter fa_cron { match("cron[\[0-9]+\]"); }; filter fa_sudo { match("sudo:"); }; filter fd_sshd { match("sshd[\[0-9]+\]") and match("Server listening") or match("Connection from") or match("client software version") or match("Accepted password") or match("Failed password") or match("Connection closed") or match("Closing connection") or match("subsystem request") or match("Received signal 15"); }; filter f_kernel { match("kernel: "); }; filter f_status { host("status"); }; filter f_terms { not match("cron[\[0-9]+\]") and not match("sudo:") and not match("sshd[\[0-9]+\]") and not match("kernel: "); }; #################### # Logs #################### # Logs for Local Host log { source(local); filter(f_status); filter(f_terms); destination(all); }; log { source(local); filter(f_status); filter(fa_cron); destination(la_cron); }; log { source(local); filter(f_status); filter(fa_sudo); destination(la_sudo); }; log { source(local); filter(f_status); filter(fd_sshd); destination(ld_sshd); }; log { source(local); filter(f_status); filter(f_kernel); destination(ls_kernel); }; ---------- With the above I can sort by the local machine which is named status, then it filters by service. I would like logs to go in the following format. /storage/logs/$YEAR/$MONTH/$DAY/$HOST/$service_filter.log So, I could use my service level filters like for sshd or whatever. Examples would be like the following. FQDN: server1.test.com, running sshd FQDN: server2.test.com, running named /storage/logs/2007/05/02/server1.test.com/sshd.log /storage/logs/2007/05/02/server2.test.com/named.log How would I go about doing this? I would appreciate any suggestions. Thanks. Phusion

1 0

Filtering Howto's
by Corey Bobb 02 May '07

02 May '07

I am looking for some detailed howto's on writing my own filters. I am trying to dump syslog-ng logs / date into splunk, but want to filter that which only I need to index into splunk. If anyone has any good howto's or have worked with splunk before I would certainly be open to any ideas or input they might have on the topic. Thanks cb

2 1

RE: [syslog-ng] Syslog-ng 2.0.3 make error
by Justin Randall 02 May '07

02 May '07

Hello, I am also experiencing this compile error when building Syslog-NG-2.0.3 on a CentOS (Linux) 4.4 host. Regards, Justin. -----Original Message----- From: Ravi Papisetti -X (rpapiset - HCL at Cisco) [mailto:rpapiset@cisco.com] Sent: Wednesday, April 25, 2007 3:34 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Syslog-ng 2.0.3 make error Hi, I see below error when I run make && make install make all-recursive make[1]: Entering directory `/usr/local/syslog-ng/syslog-ng-2.0.3' Making all in src make[2]: Entering directory `/usr/local/syslog-ng/syslog-ng-2.0.3/src' if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:30:20: libnet.h: No such file or directory In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:592: error: syntax error before ')' token /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:626: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/usr/local/syslog-ng/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/syslog-ng/syslog-ng-2.0.3' make: *** [all] Error 2 Some one could tell me the reason. Thanks, Ravi Kumar P. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

turn off case sensitivity for match regex filter
by stucky 30 Apr '07

30 Apr '07

Guys Playing around with ng 2 and I started looking at the match filter again. Simple question that I cannot find an answer to anywhere on the net. How do I turn off case sensitivity for the match target ? I'd like the following line to match "error' or 'ERROR' or 'Error' filter logparse { match("error"); }; but of course it only matches 'error' since by default regex is case sensitive. Basically I'm trying to emulate 'grep -i' I guess I could do this : filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo much simpler to turn off case sensitivity. And while we're talking regex. Shouldn't the above line actually read like this : filter logparse { match(".+error.+"); }; ? meaning "anything followed by 'error' followed by anything" Both appear to work so I assume the first line is interpreted by syslog-ng like the second line correct ? Help is appreciated stucky

2 4

Re: syslog-ng Digest, Vol 24, Issue 33
by Fabian Pucciarelli 30 Apr '07

30 Apr '07

I appreciate the help Bazsi, I receive around 600 of this messages daily, do you know when this messages are generated? I there any way to change that time to lets say one message/hour? TIA! On Sun, 2007-04-29 at 10:25 -0600, Fabian Pucciarelli wrote: > I have syslog ng writing to a mysql pipe and then a little script > reading the pipe and writing to the db. I currently receive many > messages like the following, I wonder if somenone can help me figure > out what this message is saying..... thanks. > > > | mailux | syslog | notice | notice | 2d | 2007-04-13 | 01:16:40 > | syslog-ng | syslog-ng[30548]: Log statistics; > dropped='pipe(/tmp/mysql.pipe)=0', processed='center(queued)=40295', > processed='center(received)=13206', > processed='destination(d_mysql)=40295', processed='source(net_tcp)=0', > processed='source(src)=8962', processed='source(net_udp)=4244' | > 46674 | This contains the various message counters that syslog-ng maintains internally. 'processed' counters just count how much messages were processed at the given point, 'dropped' counters indicate how much log messages were dropped by syslog-ng itself. The string in the parenthesis tell were the given counter is counting inside syslog-ng. 'center' is the main log message dispatching mechanism, it received 13206 messages from various sources and then sent 40295 messages out, e.g. you are probably sending individual messages to multiple destinations. You have two sources, one named 'src' generated 8962, the other called 'net_udp' 4244 messages. -- Bazsi On 4/30/07, syslog-ng-request(a)lists.balabit.hu < syslog-ng-request(a)lists.balabit.hu> wrote: > > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: syslog-ng Digest, Vol 24, Issue 32 (Fabian Pucciarelli) > 2. Re: turn off case sensitivity for match regex filter > (Balazs Scheidler) > 3. Re: Re: syslog-ng Digest, Vol 24, Issue 32 (Balazs Scheidler) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 29 Apr 2007 10:25:18 -0600 > From: "Fabian Pucciarelli" <fabiangp(a)gmail.com> > Subject: [syslog-ng] Re: syslog-ng Digest, Vol 24, Issue 32 > To: syslog-ng(a)lists.balabit.hu > Message-ID: > <1e6757090704290925n541deb73t13eace5731aced3b(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > I have syslog ng writing to a mysql pipe and then a little script reading > the pipe and writing to the db. I currently receive many messages like the > following, I wonder if somenone can help me figure out what this message > is > saying..... thanks. > > > | mailux | syslog | notice | notice | 2d | 2007-04-13 | 01:16:40 | > syslog-ng | syslog-ng[30548]: Log statistics; > dropped='pipe(/tmp/mysql.pipe)=0', processed='center(queued)=40295', > processed='center(received)=13206', > processed='destination(d_mysql)=40295', > processed='source(net_tcp)=0', processed='source(src)=8962', > processed='source(net_udp)=4244' | 46674 | > > On 4/29/07, syslog-ng-request(a)lists.balabit.hu < > syslog-ng-request(a)lists.balabit.hu> wrote: > > > > Send syslog-ng mailing list submissions to > > syslog-ng(a)lists.balabit.hu > > > > To subscribe or unsubscribe via the World Wide Web, visit > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > or, via email, send a message with subject or body 'help' to > > syslog-ng-request(a)lists.balabit.hu > > > > You can reach the person managing the list at > > syslog-ng-owner(a)lists.balabit.hu > > > > When replying, please edit your Subject line so it is more specific > > than "Re: Contents of syslog-ng digest..." > > > > > > Today's Topics: > > > > 1. Re: turn off case sensitivity for match regex filter > > (Balazs Scheidler) > > 2. Re: turn off case sensitivity for match regex filter (stucky) > > > > > > ---------------------------------------------------------------------- > > > > Message: 1 > > Date: Sat, 28 Apr 2007 12:42:06 +0200 > > From: Balazs Scheidler <bazsi(a)balabit.hu> > > Subject: Re: [syslog-ng] turn off case sensitivity for match regex > > filter > > To: Syslog-ng users' and developers' mailing list > > <syslog-ng(a)lists.balabit.hu> > > Message-ID: <1177756926.14925.17.camel(a)bzorp.balabit> > > Content-Type: text/plain > > > > On Sat, 2007-04-28 at 01:52 -0700, stucky wrote: > > > Guys > > > > > > Playing around with ng 2 and I started looking at the match filter > > > again. > > > Simple question that I cannot find an answer to anywhere on the net. > > > How do I turn off case sensitivity for the match target ? > > > I'd like the following line to match "error' or 'ERROR' or 'Error' > > > > > > filter logparse { match("error"); }; > > > > > > but of course it only matches 'error' since by default regex is case > > > sensitive. > > > Basically I'm trying to emulate 'grep -i' > > > I guess I could do this : > > > > > > filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo > > > much simpler to turn off case sensitivity. > > > > Yes, you are right. But it's not currently possible. It should be > > however, I'll try to add it in the nearfuture. > > > > > > > > And while we're talking regex. Shouldn't the above line actually read > > > like this : > > > > > > filter logparse { match(".+error.+"); }; ? > > > > > > meaning "anything followed by 'error' followed by anything" > > > Both appear to work so I assume the first line is interpreted by > > > syslog-ng like the second line correct ? > > > > syslog-ng interprets "match" the same as grep, e.g. it does not care > > where the pattern is found. if you want to match the beginning or the > > end of line, you need to use explicit ^ and $ characters. > > > > -- > > Bazsi > > > > > > > > ------------------------------ > > > > Message: 2 > > Date: Sat, 28 Apr 2007 12:44:04 -0700 > > From: stucky <stucky101(a)gmail.com> > > Subject: Re: [syslog-ng] turn off case sensitivity for match regex > > filter > > To: "Syslog-ng users' and developers' mailing list" > > <syslog-ng(a)lists.balabit.hu> > > Message-ID: > > <30997e260704281244g6f1225bfwc7da2b4e05fdfd9f(a)mail.gmail.com> > > Content-Type: text/plain; charset="utf-8" > > > > Baszi > > > > Cool. I'm in the middle of building a new infrastructure and would like > to > > use this feature. I'm not a programmer but I assume adding this feature > > shouldn't be very hard at all right ? > > If you had a rough ETA that'd help me. > > > > thx > > > > On 4/28/07, Balazs Scheidler <bazsi(a)balabit.hu> wrote: > > > > > > On Sat, 2007-04-28 at 01:52 -0700, stucky wrote: > > > > Guys > > > > > > > > Playing around with ng 2 and I started looking at the match filter > > > > again. > > > > Simple question that I cannot find an answer to anywhere on the net. > > > > How do I turn off case sensitivity for the match target ? > > > > I'd like the following line to match "error' or 'ERROR' or 'Error' > > > > > > > > filter logparse { match("error"); }; > > > > > > > > but of course it only matches 'error' since by default regex is case > > > > sensitive. > > > > Basically I'm trying to emulate 'grep -i' > > > > I guess I could do this : > > > > > > > > filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo > > > > much simpler to turn off case sensitivity. > > > > > > Yes, you are right. But it's not currently possible. It should be > > > however, I'll try to add it in the nearfuture. > > > > > > > > > > > And while we're talking regex. Shouldn't the above line actually > read > > > > like this : > > > > > > > > filter logparse { match(".+error.+"); }; ? > > > > > > > > meaning "anything followed by 'error' followed by anything" > > > > Both appear to work so I assume the first line is interpreted by > > > > syslog-ng like the second line correct ? > > > > > > syslog-ng interprets "match" the same as grep, e.g. it does not care > > > where the pattern is found. if you want to match the beginning or the > > > end of line, you need to use explicit ^ and $ characters. > > > > > > -- > > > Bazsi > > > > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > > > > > > > > -- > > stucky > >

2 1

upgraded to 2.0.3 and still time zone problems
by Guy Fleegman 30 Apr '07

30 Apr '07

Hello: I have several sources that are all reporting to a syslog-ng 2.0.3 server My source is source all_routers { udp(ip(0.0.0.0) port(514)); }; My problem is that I have one source that is isolated to a separate file I isolate the file with the following filter f_pd_snort { host(intsnort1); }; and have this destination destination d_pd_snort { file("/var/log/syslog-ng-logs/pd_snort.1" perm(0644) template(t_default)); }; then i use the following command log { source(all_routers); filter(f_pd_snort); destination(d_pd_snort); }; The problem is the format the data is arriving in. It send data in UTC time as follows Apr 30 14:04:35 2007 intsnort1 SFIMS: [119:13:1] Snort Alert [Classification: Unknown] [Priority: 3] Apr 30 14:04:35 2007 intsnort1 SFIMS: [119:4:1] Snort Alert [Classification: Unknown] [Priority: 3] Apr 30 14:04:35 2007 intsnort1 SFIMS: [122:3:0] Snort Alert [Classification: Unknown] [Priority: 3] This is UTC. It is the time that is being sent in the actual packet (I verified with wireshark) I want syslog-ng to modify the times going into this file (and this file only) to reflect EST time. Based upon the documentation The following algorithm is used. 1. The sender can specify the timezone of the messages. If the incoming message includes a timezone it is associated with the message. Otherwise, the local timezone is assumed. 2. The administrator specifies the *time_zone()* <#sourcecommonopts>parameter for the source driver that reads the message. This parameter overrides the original timezone of the message. Each source defaults to the value of the *recv_time_zone()* <#reference_options>global option. 3. The destination driver specifies the timezone via the *time_zone()* <#destcommonopts>parameter. Each destination driver might have an associated timezone value to which message timestamps are converted before they are sent to the final destination (file or network socket). Each destination defaults to the value of the *send_time_zone()* <#reference_options>global option. A message can be sent to multiple destination zones. 4. When macro expansions are used in the destination filenames, the local timezone is used So option #1 is not being done I can't use #2 because my source is defined for all devices I tried using #3..... with the line modified as destination d_pd_snort { file("/var/log/syslog-ng-logs/pd_snort.1" perm(0644) time_zone(-04:00) template(t_default)); }; However.. this does not seem to make any difference... Can you please tell me why option #3 is not working .... and also... why is it that in #1 it is not defauling to just adding the local timezone since the incoming message does not have a timezone specified. Please help and thank you :)

1 0

Re: syslog-ng Digest, Vol 24, Issue 32
by Fabian Pucciarelli 29 Apr '07

29 Apr '07

I have syslog ng writing to a mysql pipe and then a little script reading the pipe and writing to the db. I currently receive many messages like the following, I wonder if somenone can help me figure out what this message is saying..... thanks. | mailux | syslog | notice | notice | 2d | 2007-04-13 | 01:16:40 | syslog-ng | syslog-ng[30548]: Log statistics; dropped='pipe(/tmp/mysql.pipe)=0', processed='center(queued)=40295', processed='center(received)=13206', processed='destination(d_mysql)=40295', processed='source(net_tcp)=0', processed='source(src)=8962', processed='source(net_udp)=4244' | 46674 | On 4/29/07, syslog-ng-request(a)lists.balabit.hu < syslog-ng-request(a)lists.balabit.hu> wrote: > > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: turn off case sensitivity for match regex filter > (Balazs Scheidler) > 2. Re: turn off case sensitivity for match regex filter (stucky) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 28 Apr 2007 12:42:06 +0200 > From: Balazs Scheidler <bazsi(a)balabit.hu> > Subject: Re: [syslog-ng] turn off case sensitivity for match regex > filter > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <1177756926.14925.17.camel(a)bzorp.balabit> > Content-Type: text/plain > > On Sat, 2007-04-28 at 01:52 -0700, stucky wrote: > > Guys > > > > Playing around with ng 2 and I started looking at the match filter > > again. > > Simple question that I cannot find an answer to anywhere on the net. > > How do I turn off case sensitivity for the match target ? > > I'd like the following line to match "error' or 'ERROR' or 'Error' > > > > filter logparse { match("error"); }; > > > > but of course it only matches 'error' since by default regex is case > > sensitive. > > Basically I'm trying to emulate 'grep -i' > > I guess I could do this : > > > > filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo > > much simpler to turn off case sensitivity. > > Yes, you are right. But it's not currently possible. It should be > however, I'll try to add it in the nearfuture. > > > > > And while we're talking regex. Shouldn't the above line actually read > > like this : > > > > filter logparse { match(".+error.+"); }; ? > > > > meaning "anything followed by 'error' followed by anything" > > Both appear to work so I assume the first line is interpreted by > > syslog-ng like the second line correct ? > > syslog-ng interprets "match" the same as grep, e.g. it does not care > where the pattern is found. if you want to match the beginning or the > end of line, you need to use explicit ^ and $ characters. > > -- > Bazsi > > > > ------------------------------ > > Message: 2 > Date: Sat, 28 Apr 2007 12:44:04 -0700 > From: stucky <stucky101(a)gmail.com> > Subject: Re: [syslog-ng] turn off case sensitivity for match regex > filter > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > <30997e260704281244g6f1225bfwc7da2b4e05fdfd9f(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Baszi > > Cool. I'm in the middle of building a new infrastructure and would like to > use this feature. I'm not a programmer but I assume adding this feature > shouldn't be very hard at all right ? > If you had a rough ETA that'd help me. > > thx > > On 4/28/07, Balazs Scheidler <bazsi(a)balabit.hu> wrote: > > > > On Sat, 2007-04-28 at 01:52 -0700, stucky wrote: > > > Guys > > > > > > Playing around with ng 2 and I started looking at the match filter > > > again. > > > Simple question that I cannot find an answer to anywhere on the net. > > > How do I turn off case sensitivity for the match target ? > > > I'd like the following line to match "error' or 'ERROR' or 'Error' > > > > > > filter logparse { match("error"); }; > > > > > > but of course it only matches 'error' since by default regex is case > > > sensitive. > > > Basically I'm trying to emulate 'grep -i' > > > I guess I could do this : > > > > > > filter logparse { match("[Ee][Rr][Rr][Oo][Rr]"); }; but it'd be soo > > > much simpler to turn off case sensitivity. > > > > Yes, you are right. But it's not currently possible. It should be > > however, I'll try to add it in the nearfuture. > > > > > > > > And while we're talking regex. Shouldn't the above line actually read > > > like this : > > > > > > filter logparse { match(".+error.+"); }; ? > > > > > > meaning "anything followed by 'error' followed by anything" > > > Both appear to work so I assume the first line is interpreted by > > > syslog-ng like the second line correct ? > > > > syslog-ng interprets "match" the same as grep, e.g. it does not care > > where the pattern is found. if you want to match the beginning or the > > end of line, you need to use explicit ^ and $ characters. > > > > -- > > Bazsi > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > > > -- > stucky >

2 1

Trying to define my sources
by Guy Fleegman 27 Apr '07

27 Apr '07

Let me add to what i have changed.... My config now looks like this options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); ts_format (rfc3164); recv_time_zone(+05:00); }; template t_default { template("${DATE} ${YEAR} ${HOST} ${MSG}\n"); template_escape(no); }; source all_routers { udp(ip(0.0.0.0) port(514) time_zone(+05:00)); }; Even when I add the recv_time_zone and then time_zone options the log entries are still showing up in the file as UTC? Here is an example of how they are being logged Apr 27 20:46:59 2007 intsnort1 SFIMS: [119:17:1] Snort Alert [Classification: Unknown] [Priority: 3] {TCP} Why will the date not change? This is how the date look when i sniff iton wireshark.. so i know that is how it is being sent(as UTC) please advise and thanks.

1 0

Trying to define my sources
by Guy Fleegman 27 Apr '07

27 Apr '07

Hello: I am new to syslog-ng I have multiple network devices all sending me their syslog data to a single Linux server. I break the syslog data out to individual files based upon IP addresses. My problem is that I have a few devices that are sending out data in with no timezone information. The simply assume GMT. Is there any way to define my sources so that 1) I can have a default "bucket" source that cathces all syslog data send vi IP unless defined otherwise 2) I can define out individual IP's as "sources" 3) I can have one of the sources automatically apply a timezone i specify? Please advise and thanks, This is my source definition source all_routers { udp(ip(0.0.0.0) port(514)); };

1 0

Mailing list etiquette.
by G.W. Haywood 26 Apr '07

26 Apr '07

Hi there, On Thu, 26 Apr 2007 Shamim wrote: > Message: 1 > Date: Thu, 26 Apr 2007 06:22:00 +0100 (BST) > From: Shamim <shamim_99(a)yahoo.com> > Subject: [syslog-ng] Re: syslog-ng Digest, Vol 24, Issue 28 > To: syslog-ng(a)lists.balabit.hu > Message-ID: <663041.91562.qm(a)web32907.mail.mud.yahoo.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Ravi, > > Download pkgconfig-0.20-sol10-sparc-local.gz fron sunfreeware.com and install on your system. And copy eventlog.pc to path of pkg-config libray path. > > > > Thanks > Shamim > syslog-ng-request(a)lists.balabit.hu wrote: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > [snip,snip,snip] Please read for example (especially section 2.4) http://www.freebsd.org/doc/en_US.ISO8859-1/articles/mailing-list-faq/etique… -- 73, Ged.

1 0

Re: syslog-ng Digest, Vol 24, Issue 28
by Shamim 26 Apr '07

26 Apr '07

Hi Ravi, Download pkgconfig-0.20-sol10-sparc-local.gz fron sunfreeware.com and install on your system. And copy eventlog.pc to path of pkg-config libray path. Thanks Shamim syslog-ng-request(a)lists.balabit.hu wrote: Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Syslog-ng 2.0.3 compile error (Ravi Papisetti -X (rpapiset - HCL at Cisco)) 2. Syslog-ng 2.0.3 make error (Ravi Papisetti -X (rpapiset - HCL at Cisco)) 3. Re: weird messages from syslog. ()\(@sS) ---------------------------------------------------------------------- Message: 1 Date: Wed, 25 Apr 2007 22:58:07 +0530 From: "Ravi Papisetti -X (rpapiset - HCL at Cisco)" Subject: [syslog-ng] Syslog-ng 2.0.3 compile error To: "Syslog-ng users' and developers' mailing list" Message-ID: <6499201801FBC6419ED8C910302F67AC02EC283B(a)xmb-blr-417.apac.cisco.com> Content-Type: text/plain; charset="us-ascii" Hi, I am trying to configure syslog-ng 2.0.3 on solaris 10 and below is the error checking for EVTLOG... Package eventlog was not found in the pkg-config search path. Perhaps you should add the directory containing `eventlog.pc' to the PKG_CONFIG_PATH environment variable No package 'eventlog' found configure: error: Cannot find eventlog version >= 0.2: is pkg-config in path? I have installed libnet-1.20 and libol-0.3.18, then ran ./configure from /syslog-ng-2.0.3. Am I missing something? Thanks, Ravi Kumar P. ------------------------------ Message: 2 Date: Thu, 26 Apr 2007 01:04:06 +0530 From: "Ravi Papisetti -X (rpapiset - HCL at Cisco)" Subject: [syslog-ng] Syslog-ng 2.0.3 make error To: "Syslog-ng users' and developers' mailing list" Message-ID: <6499201801FBC6419ED8C910302F67AC02EC284D(a)xmb-blr-417.apac.cisco.com> Content-Type: text/plain; charset="us-ascii" Hi, I see below error when I run make && make install make all-recursive make[1]: Entering directory `/usr/local/syslog-ng/syslog-ng-2.0.3' Making all in src make[2]: Entering directory `/usr/local/syslog-ng/syslog-ng-2.0.3/src' if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -g -O2 -Wall -g -MT cfg-grammar.o -MD -MP -MF ".deps/cfg-grammar.Tpo" \ -c -o cfg-grammar.o `test -f 'cfg-grammar.c' || echo './'`cfg-grammar.c; \ then mv -f ".deps/cfg-grammar.Tpo" ".deps/cfg-grammar.Po"; \ else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:30:20: libnet.h: No such file or directory In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:592: error: syntax error before ')' token /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:626: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/usr/local/syslog-ng/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/syslog-ng/syslog-ng-2.0.3' make: *** [all] Error 2 Some one could tell me the reason. Thanks, Ravi Kumar P. ------------------------------ Message: 3 Date: Thu, 26 Apr 2007 01:23:05 +0300 From: ")\\(@sS" Subject: Re: [syslog-ng] weird messages from syslog. To: "Syslog-ng users' and developers' mailing list" Message-ID: <770db8dc0704251523q280820d3jdfabc2af9f4f11b7(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" well thats definitely abit of a relief considering all the pc hardware parts are completely new. i don't mind doing a reinstallation of the OS... but here is smth new: i noticed that some of the messages talked abit about 'smbd' and 'printers'.. i decided to comment out 'load printers' from smb.conf and so far (half a day later) i haven't got the messages i ported before... i have some new ones though:) here is a dmesg dump: : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] _nv003589rm+0x26/0x2c [nvidia] [] _nv007223rm+0x23/0x28 [nvidia] [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] _nv002554rm+0xa8/0xb4 [nvidia] [] fcntl_setlk64+0x203/0x290 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] autoremove_wake_function+0x0/0x50 [] dput+0x8a/0x140 [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_alloc_refill+0xcc/0x1e0 [] fcntl_setlk64+0x203/0x290 [] invalidate_inode_buffers+0x1a/0xe0 [] schedule+0x465/0x7a0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] _nv003589rm+0x26/0x2c [nvidia] [] _nv007223rm+0x23/0x28 [nvidia] [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_alloc_refill+0xcc/0x1e0 [] fcntl_setlk64+0x203/0x290 [] invalidate_inode_buffers+0x1a/0xe0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] sock_sendmsg+0xbf/0x110 [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_alloc_refill+0xcc/0x1e0 [] fcntl_setlk64+0x203/0x290 [] invalidate_inode_buffers+0x1a/0xe0 [] hrtimer_run_queues+0x47/0xe0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] sock_sendmsg+0xbf/0x110 [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] change_clocksource+0x12b/0x170 [] update_wall_time+0x190/0x280 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] autoremove_wake_function+0x0/0x50 [] dput+0x8a/0x140 [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] devinet_ioctl+0x2db/0x570 [] inet_sock_destruct+0xbe/0x200 [] _spin_lock_bh+0x8/0x20 [] invalidate_inode_buffers+0x1a/0xe0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb [] rpc_unlink+0xc3/0xf0 ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] _nv003589rm+0x26/0x2c [nvidia] [] _nv007223rm+0x23/0x28 [nvidia] [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_alloc_refill+0xcc/0x1e0 [] fcntl_setlk64+0x203/0x290 [] update_wall_time+0x190/0x280 [] schedule+0x465/0x7a0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] _nv003589rm+0x26/0x2c [nvidia] [] _nv007223rm+0x23/0x28 [nvidia] [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_alloc_refill+0xcc/0x1e0 [] fcntl_setlk64+0x203/0x290 [] invalidate_inode_buffers+0x1a/0xe0 [] hrtimer_run_queues+0x47/0xe0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] autoremove_wake_function+0x0/0x50 [] dput+0x8a/0x140 [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_alloc_refill+0xcc/0x1e0 [] fcntl_setlk64+0x203/0x290 [] schedule+0x465/0x7a0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] sock_sendmsg+0xbf/0x110 [] _nv007225rm+0x28/0x44 [nvidia] [] autoremove_wake_function+0x0/0x50 [] rm_set_interrupts+0x129/0x15c [nvidia] [] rm_set_interrupts+0x142/0x15c [nvidia] [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] fcntl_setlk64+0x203/0x290 [] invalidate_inode_buffers+0x1a/0xe0 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb ======================= : hw csum failure. [] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [] udp_recvmsg+0x135/0x280 [] sock_common_recvmsg+0x45/0x70 [] sock_recvmsg+0xd8/0x130 [] sock_sendmsg+0xbf/0x110 [] autoremove_wake_function+0x0/0x50 [] dput+0x8a/0x140 [] copy_to_user+0x2b/0x40 [] sys_recvfrom+0xd5/0x160 [] cache_grow+0x102/0x170 [] sys_socketcall+0x1c5/0x250 [] syscall_call+0x7/0xb [] rpc_unlink+0xc3/0xf0 ======================= root@Stargaze:~# im actually reading somewhere that sky2 network driver for Yukon2 PCI-E Marvell based controllers seems to have hw csum failures... the dump of those is not exactly the same... nass On 4/25/07, Balazs Scheidler wrote: > > On Wed, 2007-04-25 at 14:54 +0300, )\(@sS wrote: > > im sorry i understood nothing of your explanation... :) > > thats due to my lack of any knowledge on the matter.. > > i will get ksymoops but could you break down what you mean by back > > traces and what by 'bogus' > > Oopses basically happen for two reasons: software and hardware failure. > Hardware failures tend to cause mystic and nondeterministic behaviour, > crashing at random locations. On the consistent backtraces I meant that > several of the Oopses that you posted had the same backtrace (e.g. the > same crash location), which indicates that it's more likely a software > related problem. > > The listing I gave you, is the direct x86 dissassembly of the code found > at the crash location, this is reported as a sequence of bytes in the > Oops output, right after the "Code:" label. > > I said it was bogus as it made no sense. This is not valid code, so > either something corrupted the instruction pointer (by jumping to an > invalid function pointer), or something overwrote the stack. > > I checked the oopses again, don't go to LKML, your kernel is tainted > (e.g. it has a proprietary module loaded, they will not help you). > > -- > Bazsi > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

weird messages from syslog.
by )\(＠sS 26 Apr '07

26 Apr '07

hello everyone, i am really weirded out by some of the messages that appear on stdout from syslog and the kernel. i dunno where to turn in order to interpret the messages so i ask if you please take a look.. and perhaps direct me to someone. thank you in advance im setting up a pc that i want to use as server. its characteristics are m/b: Gigabyte - GA965P -DQ6. Northbridge: Intel P965 chipset; Southbridge: Intel ICH8R chipset; supports 6x Sata2 drives in; simple, AHCI, or raid 0,1,5,10,JBOD Gigabyte Sata controller; an additional controller (dunno what driver goes with it in linux kernel) supports 2 additional sata2 ports and raid 0,1 configurations. also: 1x WD 40GB raptor hard drive for the OS and 4x 320GB caviar hard drivers in RAID5 for data. ok i have setup the raid5 and i think it is working fine - it is not of much interest anyway.. i just note it in case you know of smth that is slipping me... also im running slackware 11. with a kernel that compile on my own from v. 2.6.20.7 the important and the reason im writing , is cause im trying to download some files from another pc through an sftp session.. im saving to the 40GB drive. thats /dev/sda1. the name of the pc is 'stargaze' .. now some history: last night twice in trying to copy a big tar.bz2 (100MB) from that pc to stargaze. and at some point it froze ( the pc that is). so i restarted and redid the sftp session.. the file arrived. then i also tried to download with mget ... about 200 photos of size 1MB each. the pc crashed again (btw not even reset button would restart the pc). reboot the pc.. (it took ages cause it would find that the file system is NOT clean and it would initiate 'journal transactions'. ok well that message was perhaps intented for sda1.. but its possible it was for /dev/md0.... anyhow today i tried again the same 2 sftp sessions.. trying to download the same files... it worked the couple of times i tried it... but here is the weird messages im getting... on stdout and /var/log/syslog BUG: unable to handle kernel paging request at virtual address 6dcecdd9 printing eip: c02eb417 *pde = 00000000 Oops: 0000 [#1] SMP Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss appletalk psnap llc ide_scsi generic nvidia(P) snd_hda_intel snd_hda_codec jmicron snd_pcm snd_timer snd snd_page_alloc CPU: 0 EIP: 0060:[<c02eb417>] Tainted: P VLI EFLAGS: 00210046 (2.6.20.7C2D6400,2x1GBRAM800,P965-ICH8R,Marv8056,1x40GB+3x320GBr5 #5) EIP is at radix_tree_lookup+0x37/0x60 eax: 00000000 ebx: 8b372010 ecx: 434ac05a edx: 6dcecdc9 esi: 00000000 edi: 00000000 ebp: f3ccd494 esp: f2f1bd7c ds: 007b es: 007b ss: 0068 Process smbd (pid: 3739, ti=f2f1a000 task=f4243550 task.ti=f2f1a000) Stack: 00000000 00000000 c01488c0 00000052 f3ccd4a4 00000000 00000001 00000000 f7b37cc0 f2f1bda0 f2f1bda0 f2f1be3c f3ccd494 00000000 f7b37cc0 c0148add 00000004 f2f1be3c 00000000 00000001 00000020 c0148d3b 00000004 f2f1be3c Call Trace: [<c01488c0>] __do_page_cache_readahead+0x90/0x160 [<c0148add>] blockable_page_cache_readahead+0x4d/0xd0 [<c0148d3b>] page_cache_readahead+0x10b/0x1c0 [<c01424e2>] do_generic_mapping_read+0x482/0x540 [<c0142824>] generic_file_aio_read+0x194/0x1f0 [<c01425a0>] file_read_actor+0x0/0xf0 [<c0162c7d>] do_sync_read+0xbd/0x110 [<c016bd7a>] open_namei+0xda/0x550 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0162d64>] vfs_read+0x94/0x170 [<c0163111>] sys_read+0x41/0x70 [<c0102eb8>] syscall_call+0x7/0xb ======================= Code: 3a f6 c2 01 75 3e 8b 1a 31 c0 39 34 9d f0 ed 75 c0 72 28 8d 04 5b 8d 4c 00 fa 8d 76 00 8d bc 27 00 00 00 00 89 f0 d3 e8 83 e0 3f <8b> 54 82 10 85 d2 74 1c 83 e9 06 4b 75 eb 89 d0 5b 5e c3 8d b6 EIP: [<c02eb417>] radix_tree_lookup+0x37/0x60 SS:ESP 0068:f2f1bd7c <1>BUG: unable to handle kernel paging request at virtual address 6dcecdd9 printing eip: c02eb417 *pde = 00000000 Oops: 0000 [#2] SMP Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss appletalk psnap llc ide_scsi generic nvidia(P) snd_hda_intel snd_hda_codec jmicron snd_pcm snd_timer snd snd_page_alloc CPU: 0 EIP: 0060:[<c02eb417>] Tainted: P VLI EFLAGS: 00210046 (2.6.20.7C2D6400,2x1GBRAM800,P965-ICH8R,Marv8056,1x40GB+3x320GBr5 #5) EIP is at radix_tree_lookup+0x37/0x60 eax: 00000000 ebx: 8b372010 ecx: 434ac05a edx: 6dcecdc9 esi: 00000000 edi: 00000000 ebp: f3ccd494 esp: f2f93d7c ds: 007b es: 007b ss: 0068 Process smbd (pid: 3769, ti=f2f92000 task=f2f33030 task.ti=f2f92000) Stack: 00000000 00000000 c01488c0 00000052 f3ccd4a4 00000000 00000001 00000000 f437b9c0 f2f93da0 f2f93da0 f2f93e3c f3ccd494 00000000 f437b9c0 c0148add 00000004 f2f93e3c 00000000 00000001 00000020 c0148d3b 00000004 f2f93e3c Call Trace: [<c01488c0>] __do_page_cache_readahead+0x90/0x160 [<c0148add>] blockable_page_cache_readahead+0x4d/0xd0 [<c0148d3b>] page_cache_readahead+0x10b/0x1c0 [<c01424e2>] do_generic_mapping_read+0x482/0x540 [<c0142824>] generic_file_aio_read+0x194/0x1f0 [<c01425a0>] file_read_actor+0x0/0xf0 [<c0162c7d>] do_sync_read+0xbd/0x110 [<c016bd7a>] open_namei+0xda/0x550 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0162d64>] vfs_read+0x94/0x170 [<c0163111>] sys_read+0x41/0x70 [<c0102eb8>] syscall_call+0x7/0xb ======================= Code: 3a f6 c2 01 75 3e 8b 1a 31 c0 39 34 9d f0 ed 75 c0 72 28 8d 04 5b 8d 4c 00 fa 8d 76 00 8d bc 27 00 00 00 00 89 f0 d3 e8 83 e0 3f <8b> 54 82 10 85 d2 74 1c 83 e9 06 4b 75 eb 89 d0 5b 5e c3 8d b6 EIP: [<c02eb417>] radix_tree_lookup+0x37/0x60 SS:ESP 0068:f2f93d7c <1>BUG: unable to handle kernel paging request at virtual address 6dcecdd9 printing eip: c02eb417 *pde = 00000000 Oops: 0000 [#3] SMP Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss appletalk psnap llc ide_scsi generic nvidia(P) snd_hda_intel snd_hda_codec jmicron snd_pcm snd_timer snd snd_page_alloc CPU: 0 EIP: 0060:[<c02eb417>] Tainted: P VLI EFLAGS: 00210046 (2.6.20.7C2D6400,2x1GBRAM800,P965-ICH8R,Marv8056,1x40GB+3x320GBr5 #5) EIP is at radix_tree_lookup+0x37/0x60 eax: 00000000 ebx: 8b372010 ecx: 434ac05a edx: 6dcecdc9 esi: 00000000 edi: 00000000 ebp: f3ccd494 esp: f2f4fd7c ds: 007b es: 007b ss: 0068 Process smbd (pid: 3801, ti=f2f4e000 task=f7087030 task.ti=f2f4e000) Stack: 00000000 00000000 c01488c0 00000052 f3ccd4a4 00000000 00000001 00000000 f437b3c0 f2f4fda0 f2f4fda0 f2f4fe3c f3ccd494 00000000 f437b3c0 c0148add 00000004 f2f4fe3c 00000000 00000001 00000020 c0148d3b 00000004 f2f4fe3c Call Trace: [<c01488c0>] __do_page_cache_readahead+0x90/0x160 [<c0148add>] blockable_page_cache_readahead+0x4d/0xd0 [<c0148d3b>] page_cache_readahead+0x10b/0x1c0 [<c01424e2>] do_generic_mapping_read+0x482/0x540 [<c0142824>] generic_file_aio_read+0x194/0x1f0 [<c01425a0>] file_read_actor+0x0/0xf0 [<c0162c7d>] do_sync_read+0xbd/0x110 [<c016bd7a>] open_namei+0xda/0x550 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0162d64>] vfs_read+0x94/0x170 [<c0163111>] sys_read+0x41/0x70 [<c0102eb8>] syscall_call+0x7/0xb ======================= Code: 3a f6 c2 01 75 3e 8b 1a 31 c0 39 34 9d f0 ed 75 c0 72 28 8d 04 5b 8d 4c 00 fa 8d 76 00 8d bc 27 00 00 00 00 89 f0 d3 e8 83 e0 3f <8b> 54 82 10 85 d2 74 1c 83 e9 06 4b 75 eb 89 d0 5b 5e c3 8d b6 EIP: [<c02eb417>] radix_tree_lookup+0x37/0x60 SS:ESP 0068:f2f4fd7c <3><unknown>: hw csum failure. [<c04d056d>] skb_copy_and_csum_datagram_iovec+0x10d/0x120 [<c0511a05>] udp_recvmsg+0x135/0x280 [<c04cc195>] sock_common_recvmsg+0x45/0x70 [<c04c8038>] sock_recvmsg+0xd8/0x130 [<c04c7ebf>] sock_sendmsg+0xbf/0x110 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0173b2a>] dput+0x8a/0x140 [<c02ee77b>] copy_to_user+0x2b/0x40 [<c04c92e5>] sys_recvfrom+0xd5/0x160 [<c015fc3c>] cache_alloc_refill+0xcc/0x1e0 [<c01730e3>] fcntl_setlk64+0x203/0x290 [<c01278e0>] update_wall_time+0x190/0x280 [<c04c9b75>] sys_socketcall+0x1c5/0x250 [<c0102eb8>] syscall_call+0x7/0xb ======================= BUG: unable to handle kernel paging request at virtual address 6dcecdd9 printing eip: c02eb417 *pde = 00000000 Oops: 0000 [#4] SMP Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss appletalk psnap llc ide_scsi generic nvidia(P) snd_hda_intel snd_hda_codec jmicron snd_pcm snd_timer snd snd_page_alloc CPU: 0 EIP: 0060:[<c02eb417>] Tainted: P VLI EFLAGS: 00210046 (2.6.20.7C2D6400,2x1GBRAM800,P965-ICH8R,Marv8056,1x40GB+3x320GBr5 #5) EIP is at radix_tree_lookup+0x37/0x60 eax: 00000000 ebx: 8b372010 ecx: 434ac05a edx: 6dcecdc9 esi: 00000000 edi: 00000000 ebp: f3ccd494 esp: f2615d7c ds: 007b es: 007b ss: 0068 Process smbd (pid: 3856, ti=f2614000 task=f4243550 task.ti=f2614000) Stack: 00000000 00000000 c01488c0 00000052 f3ccd4a4 00000000 00000001 00000000 f7b36800 f2615da0 f2615da0 f2615e3c f3ccd494 00000000 f7b36800 c0148add 00000004 f2615e3c 00000000 00000001 00000020 c0148d3b 00000004 f2615e3c Call Trace: [<c01488c0>] __do_page_cache_readahead+0x90/0x160 [<c0148add>] blockable_page_cache_readahead+0x4d/0xd0 [<c0148d3b>] page_cache_readahead+0x10b/0x1c0 [<c01424e2>] do_generic_mapping_read+0x482/0x540 [<c0142824>] generic_file_aio_read+0x194/0x1f0 [<c01425a0>] file_read_actor+0x0/0xf0 [<c0162c7d>] do_sync_read+0xbd/0x110 [<c016bd7a>] open_namei+0xda/0x550 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0162d64>] vfs_read+0x94/0x170 [<c0163111>] sys_read+0x41/0x70 [<c0102eb8>] syscall_call+0x7/0xb ======================= Code: 3a f6 c2 01 75 3e 8b 1a 31 c0 39 34 9d f0 ed 75 c0 72 28 8d 04 5b 8d 4c 00 fa 8d 76 00 8d bc 27 00 00 00 00 89 f0 d3 e8 83 e0 3f <8b> 54 82 10 85 d2 74 1c 83 e9 06 4b 75 eb 89 d0 5b 5e c3 8d b6 EIP: [<c02eb417>] radix_tree_lookup+0x37/0x60 SS:ESP 0068:f2615d7c <1>BUG: unable to handle kernel paging request at virtual address 6dcecdd9 printing eip: c02eb417 *pde = 00000000 Oops: 0000 [#5] SMP Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss appletalk psnap llc ide_scsi generic nvidia(P) snd_hda_intel snd_hda_codec jmicron snd_pcm snd_timer snd snd_page_alloc CPU: 0 EIP: 0060:[<c02eb417>] Tainted: P VLI EFLAGS: 00210046 (2.6.20.7C2D6400,2x1GBRAM800,P965-ICH8R,Marv8056,1x40GB+3x320GBr5 #5) EIP is at radix_tree_lookup+0x37/0x60 eax: 00000000 ebx: 8b372010 ecx: 434ac05a edx: 6dcecdc9 esi: 00000000 edi: 00000000 ebp: f3ccd494 esp: f2629d7c ds: 007b es: 007b ss: 0068 Process smbd (pid: 3886, ti=f2628000 task=c2282550 task.ti=f2628000) Stack: 00000000 00000000 c01488c0 00000052 f3ccd4a4 00000000 00000001 00000000 f4a25380 f2629da0 f2629da0 f2629e3c f3ccd494 00000000 f4a25380 c0148add 00000004 f2629e3c 00000000 00000001 00000020 c0148d3b 00000004 f2629e3c Call Trace: [<c01488c0>] __do_page_cache_readahead+0x90/0x160 [<c0148add>] blockable_page_cache_readahead+0x4d/0xd0 [<c0148d3b>] page_cache_readahead+0x10b/0x1c0 [<c01424e2>] do_generic_mapping_read+0x482/0x540 [<c0142824>] generic_file_aio_read+0x194/0x1f0 [<c01425a0>] file_read_actor+0x0/0xf0 [<c0162c7d>] do_sync_read+0xbd/0x110 [<c016bd7a>] open_namei+0xda/0x550 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0162d64>] vfs_read+0x94/0x170 [<c0163111>] sys_read+0x41/0x70 [<c0102eb8>] syscall_call+0x7/0xb ======================= Code: 3a f6 c2 01 75 3e 8b 1a 31 c0 39 34 9d f0 ed 75 c0 72 28 8d 04 5b 8d 4c 00 fa 8d 76 00 8d bc 27 00 00 00 00 89 f0 d3 e8 83 e0 3f <8b> 54 82 10 85 d2 74 1c 83 e9 06 4b 75 eb 89 d0 5b 5e c3 8d b6 EIP: [<c02eb417>] radix_tree_lookup+0x37/0x60 SS:ESP 0068:f2629d7c <1>BUG: unable to handle kernel paging request at virtual address 6dcecdd9 printing eip: c02eb417 *pde = 00000000 Oops: 0000 [#6] SMP Modules linked in: snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss appletalk psnap llc ide_scsi generic nvidia(P) snd_hda_intel snd_hda_codec jmicron snd_pcm snd_timer snd snd_page_alloc CPU: 0 EIP: 0060:[<c02eb417>] Tainted: P VLI EFLAGS: 00210046 (2.6.20.7C2D6400,2x1GBRAM800,P965-ICH8R,Marv8056,1x40GB+3x320GBr5 #5) EIP is at radix_tree_lookup+0x37/0x60 eax: 00000000 ebx: 8b372010 ecx: 434ac05a edx: 6dcecdc9 esi: 00000000 edi: 00000000 ebp: f3ccd494 esp: f2681d7c ds: 007b es: 007b ss: 0068 Process smbd (pid: 3916, ti=f2680000 task=f2657030 task.ti=f2680000) Stack: 00000000 00000000 c01488c0 00000052 f3ccd4a4 00000000 00000001 00000000 f7b36080 f2681da0 f2681da0 f2681e3c f3ccd494 00000000 f7b36080 c0148add 00000004 f2681e3c 00000000 00000001 00000020 c0148d3b 00000004 f2681e3c Call Trace: [<c01488c0>] __do_page_cache_readahead+0x90/0x160 [<c0148add>] blockable_page_cache_readahead+0x4d/0xd0 [<c0148d3b>] page_cache_readahead+0x10b/0x1c0 [<c01424e2>] do_generic_mapping_read+0x482/0x540 [<c0142824>] generic_file_aio_read+0x194/0x1f0 [<c01425a0>] file_read_actor+0x0/0xf0 [<c0162c7d>] do_sync_read+0xbd/0x110 [<c016bd7a>] open_namei+0xda/0x550 [<c0132370>] autoremove_wake_function+0x0/0x50 [<c0162d64>] vfs_read+0x94/0x170 [<c0163111>] sys_read+0x41/0x70 [<c0102eb8>] syscall_call+0x7/0xb ======================= Code: 3a f6 c2 01 75 3e 8b 1a 31 c0 39 34 9d f0 ed 75 c0 72 28 8d 04 5b 8d 4c 00 fa 8d 76 00 8d bc 27 00 00 00 00 89 f0 d3 e8 83 e0 3f <8b> 54 82 10 85 d2 74 1c 83 e9 06 4b 75 eb 89 d0 5b 5e c3 8d b6 EIP: [<c02eb417>] radix_tree_lookup+0x37/0x60 SS:ESP 0068:f2681d7c thank you very much for your time... what i am looking for is some directiong as to whom to ask about it... nass

3 5

syslog-ng 2 and bandwidth limiting
by jrhendri＠maine.rr.com 25 Apr '07

25 Apr '07

Hi, Is there a way to limit the bandwidth of an ng server? If so, does it work with UDP or only TCP? I have seen the log_fifo_size() option, but don't easily see how this would limit the amount of bandwidth used (seems like it is designed to provide a larger output buffer for slow links, but does not actually limit the bandwidth used by NG) I am also looking at the flow-control flag, but again it is not clear how to use it to limit the bandwidth. Ideally I would like something that would allow NG to be limited to a specific amount of bandwidth (packets/sec or kb/s, etc.) for each log path. This way if a service started generating an excessive amount of log data (e.g. if a daemon were put into debug mode) it would help prevent the log server from choking the network trying to send all the packets (it would be especially nice if you could configure how large an output buffer were available, so if you wanted to deal with *bursty* services, you could limit them to a small amount of bandwidth, but provide them with a larger output buffer so you would be less likely to drop messages. Thoughts? Thanks! Jim Hendrick

5 8

Re: syslog-ng Digest, Vol 23, Issue 20
by wayne yu 25 Apr '07

25 Apr '07

Please delete me from list server syslog-ng-request(a)lists.balabit.hu wrote: Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng filtering capabilities (Bruno Vieira) 2. Log rotate without log rotate. (Bruno Vieira) 3. Re: Log rotate without log rotate. (Alexander Clouter) 4. Re: Log rotate without log rotate. (Valdis.Kletnieks(a)vt.edu) 5. Re: Log rotate without log rotate. (Bruno Vieira) 6. Re: Where is the download link for 2.0 ? (Jose Pedro Oliveira) ---------------------------------------------------------------------- Message: 1 Date: Fri, 16 Mar 2007 14:51:26 +0000 From: "Bruno Vieira" Subject: Re: [syslog-ng] syslog-ng filtering capabilities To: "Syslog-ng users' and developers' mailing list" Message-ID: Content-Type: text/plain; charset="iso-8859-1" Hi there. Yes, syslog-ng has of those features that you want. Check the syslog-ng.conf expanded file. Here you can see those kind of things being used. Using templates it is possible for syslog-ng to create dirs and files based on templates. http://www.campin.net/syslog-ng/expanded-syslog-ng.conf Regards, Bruno. On 3/15/07, Ramesh Uppuluri wrote: > > I am new to syslog-ng product which has been working great so far. > My question is on filtering unwanted syslog messages during collection. > Can I accomplish this using syslog-ng? If so, can some one tell me its > possible to filter out messages from specific host or a wildcard > (subnet) etc. > > Thanks > Ramesh > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > >

1 0

Problems writing to a file if destination is not/var/log
by Luc Evers 23 Apr '07

23 Apr '07

Sandor, Thank you very much, the problem was indeed caused by AppArmor. Kind Regards, Luc.

1 0

Syslog-ng central logging server
by Shamim 23 Apr '07

23 Apr '07

Server ----------------------------- [root@plggd020 etc]# more syslog-ng.conf #sample syslog-ng.conf for a central logging server options { sync (0); log_fifo_size (2048); create_dirs (yes); group (root); dir_group (root); perm (0640); dir_perm (0750); }; source s_local { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); }; destination d_auth { file("/var/log/auth.log"); }; filter f_auth { facility(auth, authpriv); }; source s_remote { tcp(); }; destination d_clients { file("/var/log/HOSTS/$HOST"); }; log { source(s_remote); destination(d_clients); }; log { source(s_local); filter(f_auth); destination(d_auth); }; Client ----------------- -bash-3.00# more syslog-ng.conf #sample syslog-ng.conf for a remote client source s_local { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); }; destination d_loghost {tcp("20.5.68.82" port(514));}; log { source(s_local); destination(d_loghost); }; destination messages { file("/var/log/messages-ng"); }; log { source(s_local); destination(messages); }; -bash-3.00# And there is no message going to Server However at Client side log files shows the message as below: -bash-3.00# logger "test " -bash-3.00# tail /var/log/messages-ng Apr 23 08:44:38 s_local@zlggd052 syslog-ng[9935]: syslog-ng starting up; version='2.0.2' Apr 23 08:44:38 s_local@zlggd052 syslog-ng[9935]: Connection failed; error='No route to host (113)', time_reopen='60' Apr 23 08:45:12 s_local@zlggd052 syslog-ng[9935]: SIGTERM received, terminating; Apr 23 08:45:12 s_local@zlggd052 syslog-ng[9935]: syslog-ng shutting down; version='2.0.2' Apr 23 08:45:13 s_local@zlggd052 syslog-ng[9945]: syslog-ng starting up; version='2.0.2' Apr 23 08:45:13 s_local@zlggd052 syslog-ng[9945]: Connection failed; error='No route to host (113)', time_reopen='60' Apr 23 08:45:18 s_local@zlggd052 soetest1: test Apr 23 08:46:13 s_local@zlggd052 syslog-ng[9945]: Connection failed; error='No route to host (113)', time_reopen='60' Apr 23 08:47:13 s_local@zlggd052 syslog-ng[9945]: Connection failed; error='No route to host (113)', time_reopen='60' Apr 23 08:47:46 s_local@zlggd052 soetest1: test -bash-3.00# Please suggest what will be the reason. Thanks & Regards Shamim --------------------------------- Yahoo! Answers - Got a question? Someone out there knows the answer. Tryit now.

3 3

RE: [syslog-ng] Syslog-ng central logging server
by Geller, Sandor (IT) 23 Apr '07

23 Apr '07

[ Please reply to the list so others can follow up ] > Thanks for your prompt reply, however the output for your > "netstat -r -n" > Client: > ============ > -bash-3.00# netstat -r -n > Kernel IP routing table > Destination Gateway Genmask Flags MSS > Window irtt Iface > 20.5.68.0 0.0.0.0 255.255.255.0 U 0 0 > 0 eth1 > 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 > 0 eth1 > 0.0.0.0 20.5.68.1 0.0.0.0 UG 0 0 > 0 eth1 > -bash-3.00# > > Server: > =============== > > [root@plggd020 root]# netstat -r -n > Kernel IP routing table > Destination Gateway Genmask Flags MSS > Window irtt Iface > 20.5.68.0 0.0.0.0 255.255.255.0 U 0 0 > 0 eth0 > 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 > 0 eth0 > 0.0.0.0 20.5.68.1 0.0.0.0 UG 0 0 > 0 eth0 > [root@plggd020 root]# So the routing is OK. Could you use telnet/netcat/whatever from the client to check whether the port is open on the server and use lsof that syslog-ng is actually listening on port 514? Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.

1 0

Problems writing to a file if destination is not /var/log
by Luc Evers 23 Apr '07

23 Apr '07

Hi, Before I used Suse 10.0 ( syslog-ng-1.6.8-3.2) , the router logfiles were send to another directoy /log/syslog. Via php-syslog-ng, the messages were also send via a pipe to a MySql database. -> no problems. Now I setup a new server withe Suse 10.2 (syslog-ng-1.6.11-23) but the logfiles outsite /var/log are not working: I get a Permission denied message, also no permission to write to the /var/log/pipe connection (php-ssylog-ng). When I send the log messages to another directory/file in /var/log than it works. How can I solve the permission problem? Rem: A chmod like 777 don't help, its like the daemons checks if the directory /var/log used + pipes or links are not allowed!

2 1

syslog-ng experimental git tree
by Balazs Scheidler 21 Apr '07

21 Apr '07

Dear syslog-ng users, I have started migrating syslog-ng from an internal GNU arch repository to a new version control system, also used by the Linux kernel project called git. For more information on git, please check out the git homepage at: http://git.or.cz/ and the numerous git tutorials available on the web. I'm still getting familiar to git, so mistakes might happen. Thus contents of this git tree are considered experimental, if something goes wrong I might need to rebuild this repository. Please take that into consideration when cloning my repository. git-web and other fancies are not yet available, just a plain dummy HTTP transport, this will change in the future. The URL of my public repository is: http://people.balabit.hu/bazsi/git/syslog-ng-2.0.git/ To clone this repository to your local hard-drive, issue the following command: git clone http://people.balabit.hu/bazsi/git/syslog-ng-2.0.git syslog-ng-2.0 -- Bazsi

1 0

syslog-ng 2.0.x bug - facility(auth) fails to match any messages
by Evan Rempel 21 Apr '07

21 Apr '07

I posted the message below a couple of weeks ago and did not get a response from anyone. Can anyone else confirm that this configuration fails to match the facility(auth) fails to match messages with a facility of auth? Balazs - can you make a comment on why this happens? Evan. -------- Original Message -------- Date: Wed, 28 Mar 2007 13:19:27 -0700 From: Evan Rempel <erempel(a)uvic.ca> Subject: 2.0.x bug - filter(auth) fails to match With the following configuration source local { unix-stream("/dev/log" max-connections(200)); file("/proc/kmsg" log_prefix("kernel: ")); internal(); }; template standard_file { template("$ISODATE $FULLHOST $FACILITY.$LEVEL $PRI $MESSAGE\n"); template_escape(no); }; destination auth.log { file("/var/syslog/auth.log.$YEAR$MONTH$DAY.000000" perm(0640) template(standard_file) ); }; destination unknown.log { file("/var/syslog/unknown.log.$YEAR$MONTH$DAY.000000" perm(0640) template(standard_file) ); }; destination test.log { file("/var/syslog/test.log.$YEAR$MONTH$DAY.000000" perm(0640) template(standard_file) ); }; filter f_auth { facility(auth); }; filter f_local1 { facility(local1); }; filter f_ldap { program(^slapd); }; # ****** PROBLEM LOG LINE **** log { source(local); filter(f_local1); filter(f_ldap); destination(test.log); }; # ****** PROBLEM LOG LINE **** log { source(local); filter(f_auth); destination(auth.log); }; # safegaurd to catch anything missed by other filters log { source(local); destination(unknown.log); flags(fallback); }; all of the log messages with the facility of auth go into the unknown.log file. If I remove the problematic log line (to test.log) or change the order of its filters or change the first filter to be other than f_local1 (even changing the f_local1 filter to match a different facility) then everything works as expected. All of these work fine # ------------- use other than filter f_local1 filter f_auth { facility(auth); }; filter f_local1 { facility(local1); }; filter f_ldap { program(slapd); }; log { source(local); filter(f_auth); filter(f_ldap); destination(test.log); }; # ------------ comment out the log line filter f_auth { facility(auth); }; filter f_local1 { facility(local1); }; filter f_ldap { program(slapd); }; # log { source(local); filter(f_local1); filter(f_ldap); destination(test.log); }; # ------------------ match facility local0 in the f_local1 filter filter f_auth { facility(auth); }; filter f_local1 { facility(local0); }; filter f_ldap { program(^slapd); }; log { source(local); filter(f_local1); filter(f_ldap); destination(test.log); }; # ----------------- make a more complex single filter rather than multiple filter item in the log line filter f_auth { facility(auth); }; filter f_local1 { facility(local1); }; filter f_ldap { program(^slapd); }; filter f_test { facility(local1) and program(^sldapd); }; log { source(local); filter(f_test); destination(test.log); }; So, how is the first example going wrong? Evan.

2 4

BUG in syslog-ng-1.6.12
by S. Schulz 19 Apr '07

19 Apr '07

Hi, 1) I found a bug in syslog-ng-1.6.12. If i use the MSGONLY macro the first char of the message is missing. Here is the patch: -snip-------------------------------- 426,427c426,428 < colon++; < ofs = (colon - (char *) msg->msg->data); --- > ofs = (colon - (char *) msg->msg->data) + 2; > if (ofs > msg->msg->length) > ofs = msg->msg->length; -snap-------------------------------- 2) And I have an other problem with a regexp in a filter. I want to log all messages that contains the "[ERR]" string to a separate err log. My filter, destination and log looks like this: filter f_usererr { facility(user) and match('\[ERR\]'); }; destination d_usererr {file("/var/log/$SOURCEIP_$PROGRAM.err"); }; log { source(s_net); filter(f_usererr); destination(d_usererr); }; What I get is a line like test[1234]:[ERR] fopen failed but also test[1234]:Event 1 or test[1234]:Released So it seems to be that the backslash before the [ is ignored. If I change the filter to filter f_usererr { facility(user) and match('ERR\]'); }; I get only the line test[1234]:[ERR] fopen failed as expected 3) And I have a third problem with creation of a filename based on the IP destination d_usererr {file("/var/log/$SOURCEIP_$PROGRAM.err"); }; The created filename is "/var/log/bla.err" and the $SOURCEIP is missing If I change the destination to destination d_usererr {file("/var/log/$SOURCEIP-$PROGRAM.err"); }; the created filename is "/var/log/192.168.1.1-bla.err" as expected Best regards Stefan Schulz -- "Feel free" - 10 GB Mailbox, 100 FreeSMS/Monat ... Jetzt GMX TopMail testen: http://www.gmx.net/de/go/topmail

3 2

Syslog-ng RPM
by steven colaco 19 Apr '07

19 Apr '07

Hello All, I'm a newbie to Syslog-ng. I want to test syslog-ng on RHEL5. Can anyone provide me the RPM format of Syslog-ng. Is eventlog also required to be installed saperately of its included within Syslog-ng. Please provide some Docs links too. Thanks in Adcance, Stevan Colaco __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 3

syslog-ng dumps core on SLES i586
by Matthur, Ananda (STSD) 19 Apr '07

19 Apr '07

Hi All, I am trying to use syslog-ng (default on SLES) on a SLES 10 i586 machine. When I try to execute a kill -s HUP 'pid-of-syslog-ng', it is crashing, dumping core. Gdb shows the following info: sgmlx1:/ # ls 1 boot core etc lib mnt proc sbin subdomain test usr bin clog dev home media opt root srv sys tmp var sgmlx1:/ # gdb /sbin/syslog-ng core GNU gdb 6.4 Copyright 2005 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i586-suse-linux"...(no debugging symbols found) Using host libthread_db library "/lib/libthread_db.so.1". (no debugging symbols found) Core was generated by `/sbin/syslog-ng'. Program terminated with signal 11, Segmentation fault. warning: Can't read pathname for load map: Input/output error. (no debugging symbols found) Loaded symbols for /sbin/syslog-ng Reading symbols from /lib/libnsl.so.1...(no debugging symbols found)...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/libresolv.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/libresolv.so.2 Reading symbols from /lib/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2... (no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 #0 0x8000f9a6 in do_handle_afinet_dest () from /sbin/syslog-ng (gdb) Looks like it is doing some invalid operation to cause segmentation fault. I tested the same scenario on both ia64 and x86_64 architectures. Segmentation fault occurs only on i586. Is this a known bug in syslog-ng? Is a patch available for this? Thanks and regards, ++++++++++++++++++++++++++++++++++++++ Ananda Matthur MSL Bangalore - 91 80 2205 3202 ++++++++++++++++++++++++++++++++++++++

2 1

klogd back for syslog-ng-2.x ?
by stucky 19 Apr '07

19 Apr '07

Guys I haven't touched syslog-ng since I last installed 1.6 2 years ago on RHEL4. I'm trying to upgrade to 2.x and I noticed that the init script for RH you provided in the contrib dir actually starts up syslon-ng and klogd. I thought syslog-ng was a total replacement for syslog including klodg ? I checked the older script I have for version 1.6 and sure enough it doesn't start klogd. I'm confused now as to whether I've been running this the wrong way or if you simply rewrote syslog-ng to rely on klogd again. Can anyone elaborate ? thx -- stucky

2 1

Configure error on AIX
by James B Horwath 17 Apr '07

17 Apr '07

I am trying to get syslog-ng-2.0rc4 running on AIX 5.3 I was able to compile eventlog and libol without any problems. When I configure syslog-ng I am receiving errors I need help with. I get this configuration error: ============================================================================= checking for GLIB... Package glib-2.2 was not found in the pkg-config search path. Perhaps you should add the directory containing `glib-2.2.pc' to the PKG_CONFIG_PATH environment variable No package 'glib-2.2' found configure: error: Package requirements (glib-2.2) were not met: Consider adjusting the PKG_CONFIG_PATH environment variable if you installed software in a non-standard prefix. Alternatively, you may set the environment variables GLIB_CFLAGS and GLIB_LIBS to avoid the need to call pkg-config. See the pkg-config man page for more details. ================================================================== Checking for glib ============================================= rpm -qa | grep glib glib2-2.2.3-3 rpm -ql glib2-2.2.3-3 | grep -v local /opt/freeware/doc/glib2-2.2.3 /opt/freeware/doc/glib2-2.2.3/AUTHORS /opt/freeware/doc/glib2-2.2.3/COPYING /opt/freeware/doc/glib2-2.2.3/ChangeLog /opt/freeware/doc/glib2-2.2.3/NEWS /opt/freeware/doc/glib2-2.2.3/README /opt/freeware/lib/charset.alias /opt/freeware/lib/libglib-2.0.a /opt/freeware/lib/libgmodule-2.0.a /opt/freeware/lib/libgobject-2.0.a /opt/freeware/lib/libgthread-2.0.a /usr/lib/libglib-2.0.a /usr/lib/libgmodule-2.0.a /usr/lib/libgobject-2.0.a /usr/lib/libgthread-2.0.a =========================================== The code appears to be resident. How do I get around this configuration error? Regards, Jim ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you.

2 1