- syslog-ng - lists.balabit.hu

can't make syslog 2.0.3 on rhel 4 x64_86
by Tom H 12 Apr '07

12 Apr '07

Hi, I get the following error when making syslog 2.0.3 on rhel 4 es x64_86; else rm -f ".deps/cfg-grammar.Tpo"; exit 1; \ fi In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:30:20: libnet.h: No such file or directory In file included from /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:15: afinet.h:61: error: syntax error before "libnet_t" afinet.h:61: warning: no semicolon at end of struct or union afinet.h:63: warning: type defaults to `int' in declaration of `AFInetDestDriver' afinet.h:63: warning: data definition has no type or storage class /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y: In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:592: error: syntax error before ')' token /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:626: error: syntax error before ')' token make[2]: *** [cfg-grammar.o] Error 1 make[2]: Leaving directory `/root/syslog-ng-2.0.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/root/syslog-ng-2.0.3' make: *** [all] Error 2

2 1

More then one application running on syslog server
by ashish talati 11 Apr '07

11 Apr '07

Hi, I have more then one applications which generate the logs in the host and all these logs are sent to central server through syslog. I dont know how I can differentiate these logs based on individual application? below are the few logs generated in my local machine for your reference. In that first 2 logs are generated through one application and last log generated through second application. But as you can see all logs have the originating source as the pc196070/pc196070 which is the last 5 digits of my machine's ip address. I want to differentiate the logs coming from different application!! How can it possible?? ...I am blank now what to do? 05/Apr/2007 11:18:36 pc196070/pc196070 DEBUG: - [Thread- 62/Client-0] Response: RESP:0; 05/Apr/2007 11:18:36 pc196070/pc196070 Thread-62/Client-0] received: Enter command 05/Apr/2007 11:18:36 pc196070/pc196070 INFO: -N piListener.Listener - Port 12346 successfully opened. Waiting for connecti... I will appreciate your help. Thank you. B.R. Ash. --------------------------------- Check out what you're missing if you're not on Yahoo! Messenger

1 0

Trouble with switches and syslog-ng
by Jean-Michel Philippon-Nadeau 11 Apr '07

11 Apr '07

Good day everyone, We use syslog-ng to store and organize the logs of our machines (~3900). For every host we have, syslog-ng creates a folder with the hostname or the ip address (if it couldn't determine the hostname) of the machine and then stores the logs. We also have 5 switches that can report logs with standard syslog capabilities (udp on port 514). The problem is that syslog-ng doesn't create the folder for these switches and doesn't store their logs. I made sure there was no network problems by using tcpdump - the packets correctly made it to the central syslog-ng host. Yes, of course, I made sure udp(); was in my source declaration. Does anyone know how I can make sure syslog-ng receives the logs? Thanks for your help. -- Jean-Michel Philippon-Nadeau Centre de Calcul Scientifique

2 5

syslog-ng2 conf path default changed; pkg-plist out of date
by Brian A. Seklecki 10 Apr '07

10 Apr '07

Okay...who broke this: The path in the binary to the default config file has changed but the pkg-list hasn't and aside from the 2.0.2 patch level bump I dont see where else it came from: [seklecki@web05 ~]$ strings /usr/local/sbin/syslog-ng |egrep "\.conf" -f <fname>, --cfgfile=<fname> Set config file name, default=/usr/local/etc/syslog-ng.conf /usr/local/etc/syslog-ng.conf [seklecki@web05 /usr/local/cf]$ sudo bash -x /usr/local/etc/rc.d/syslog-ng restart [...snip...] ++ /usr/local/sbin/syslog-ng -p /var/run/syslog.pid Error opening configuration file; filename='/usr/local/etc/syslog-ng.conf', error='No such file or directory (2)' The work-around for the mean time is: syslog_ng_flags="-f /usr/local/etc/syslog-ng/syslog-ng.conf" I need to see a CVS changelog of certain files, but Balavid doesn't have a cvsweb, viewvc, etc. or public CVS archive? l8* -lava (Brian A. Seklecki - Pittsburgh, PA, USA) http://www.spiritual-machines.org/ "...from back in the heady days when "helpdesk" meant nothing, "diskquota" meant everything, and lives could be bought and sold for a couple of pages of laser printout - and frequently were."

2 1

test
by Chris Nelson 10 Apr '07

10 Apr '07

Initial email

1 0

syslog-ng + rhel5 + selinux
by Jan-Frode Myklebust 10 Apr '07

10 Apr '07

(Reposting now that I'm subscribed) I've created an RPM package of syslog-ng that installs the necessary selinux module to work on RHEL5. This is not creating a whole new selinux domain for syslog-ng (like I expect the reference policy to do), but rather a small extention of the RHEL5 provided syslogd domain to allow syslogd_t opening /dev/kmsg, 514/tcp and creating some files under /var. http://tanso.net/yum/repodata/repoview/syslog-ng-0-2.0.3-1.el5.html http://tanso.net/selinux/ The selinux rules installed by this RPM is http://tanso.net/selinux/syslog_ng.te and can be installed separately by saving that file to /root/syslog_ng.te and running: checkmodule -M -m -o syslog_ng.mod syslog_ng.te semodule_package -o syslog_ng.pp -m syslog_ng.mod restorecon ./syslog_ng.pp semodule -i ./syslog_ng.pp It can later be removed by "semodule --remove=syslog_ng". -jf

1 0

Compressing syslog traffic across a WAN?
by K K 10 Apr '07

10 Apr '07

Has anybody found a good way to take a high-volume stream of UDP syslog packets, aggregate and compress the packets, and then recreate them, with the original source IPs, at the other end of a WAN circuit? Looks like Riverbed cannot optimize UDP syslog?. Encapsulating the packets in an IPSEC tunnel with compression would make the packets smaller, but not reduce the packets-per-second. Tolstoy Version: I have a number of 'appliance' hosts on the west coast which generate high volumes of syslog events, which I need to forward to an 'appliance' log analysis server (EIQ) in the midwest. The version of EIQ we're stuck with only supports UDP, and uses the source IP of the packet to decide which host the event occurred on -- it cannot take the embedded hostname in the packet and use that. What we're doing right now is configuring all the west coast appliances send their syslog events to a syslog-ng server locally on the same network, which then filters out the junk events and uses spoof-source to forward these UDP packets across the slow WAN circuit to the EIQ appliances in the Midwest: Source \ Source --UDP-- syslog-ng --UDP-over-WAN-- EIQ Source / I could consider sending these events via TCP syslog to a syslog-ng server in the Midwest, and that would then send a copy of the packets via UDP to EIQ, but in this approach, I gather that we wouldn't be able to use spoof-source to regenerate the UDP packet with the original source IP? Thanks, Kevin

3 3

RE: [syslog-ng] More then one application on same server
by ashish talati 09 Apr '07

09 Apr '07

Hi, below are the few logs generated in my local machine. In that first 2 logs are generated through one application and last log generated through second application. But as you can see all logs have the originating source as the pc196070/pc196070 which is the last 5 digits of my machine's ip address. I want to differentiate the logs coming from different application!! How can it possible?? ..You suggest me program filter...So is that a solution??...if yes then please let me know how to use it exactly...I am blank in how to use it.. 05/Apr/2007 11:18:36 pc196070/pc196070 DEBUG: - [Thread- 62/Client-0] Response: RESP:0; 05/Apr/2007 11:18:36 pc196070/pc196070 Thread-62/Client-0] received: Enter command 05/Apr/2007 11:18:36 pc196070/pc196070 INFO: -NpiListener.Listener - Port 12346 successfully opened. Waiting for connecti... Thank you. B.R. Ash. --------------------------------- From: syslog-ng-bounces(a)lists.balabit.hu on behalf of Geller, Sandor (IT) Sent: Wed 4/4/2007 11:37 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] More then one application on same server > Hi, > Thank you very much for your reply. > But as I am new in this so can you please be more specific > that how can I use the Program() filter?? > Let me again tell you my specific issue- I have a Tomcat > server running and in that server I have 3 application or > nodes that generates the logs and dump into tomcat > server....Now when I use the syslog it gives me all the logs > mix with the generating source name as the hostname (tomcat > server)....but I want that syslog should give me the logs > which has the field in it from which I can identify that this > log is generated in this application and this is in other... > So I hope I describe the problem to give you exact idea!! > I will be thankful to you if you help me in this. Could you show some lines from your log originating from different programs? I'm not familiar with tomcat, so I don't understand your issue exactly... Maybe the logs have a field which could be used to differentiate between your tomcat apps. Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

Re: tailing real files
by G.W. Haywood 08 Apr '07

08 Apr '07

Hi there, On Sat, 7 Apr 2007 Balazs Scheidler wrote: > source s_tail { file("/var/log/apache/access.log" follow_freq(1) flags(no-parse)); }; > ... > * reads the access.log file (starting with the first line), > * checks every 1 second to see if there are new records > * notices when access.log gets renamed ... > * remembers the last file position across restarts Oh, cool! Thanks!! -- 73, Ged.

1 0

capture messages from linksys router
by Robert Buecheler 08 Apr '07

08 Apr '07

please forgive me, I'm fairly new in this and don't understand much of syslog-ng. I am trying to log messages from my linksys router (192.168.1.1) The port that linksys mentions is (514), but when I run ethereal, the destination port seems to be [snmptrap (162)] (the origin port on the router varies) this is the ethereal output of 3 messages (each "line" with its IP# and UDP ports including the "packet size" of the message): --------------------------- No. Time Source Destination Protocol Info 1 0.000000 192.168.1.1 192.168.1.150 SNMP TRAP-V1 1.3.6.1.4.1.3955.1.1.0 Frame 1 (179 bytes on wire, 179 bytes captured) Internet Protocol, Src: 192.168.1.1 (192.168.1.1), Dst: 192.168.1.150 (192.168.1.150) User Datagram Protocol, Src Port: adobeserver-1 (1102), Dst Port: snmptrap (162) No. Time Source Destination Protocol Info 2 4.000204 192.168.1.1 192.168.1.150 SNMP TRAP-V1 1.3.6.1.4.1.3955.1.1.0 Frame 2 (187 bytes on wire, 187 bytes captured) Internet Protocol, Src: 192.168.1.1 (192.168.1.1), Dst: 192.168.1.150 (192.168.1.150) User Datagram Protocol, Src Port: adobeserver-2 (1103), Dst Port: snmptrap (162) No. Time Source Destination Protocol Info 3 8.000308 192.168.1.1 192.168.1.150 SNMP TRAP-V1 1.3.6.1.4.1.3955.1.1.0 Frame 3 (181 bytes on wire, 181 bytes captured) Internet Protocol, Src: 192.168.1.1 (192.168.1.1), Dst: 192.168.1.150 (192.168.1.150) User Datagram Protocol, Src Port: xrl (1104), Dst Port: snmptrap (162) --------------------------- syslog-ng (1.6.8) is running on IP 192.168.1.150 (SUSE 10.0 linux, 2.6.13-15.15-smp kernel). from different sources, I got the following lines in the syslog-ng.conf file: ####################################### source src-linksys { internal(); unix-dgram("/dev/log"); unix-dgram("/var/lib/named/dev/log"); udp(ip("192.168.1.150") port(162)); udp(ip("192.168.1.150") port(514)); }; filter f_user { facility(user); }; destination linksys { file("/var/log/linksys.log"); }; log { source(src-linksys); filter(f_user); destination(linksys); }; ####################################### unfortunately /var/log/linksys.log doesn't exist and/or is never written can somebody help? thx, Robi

2 1

Disconnected access/tailing real files/web interface
by J Bridge 06 Apr '07

06 Apr '07

Hello. I would like to centralise logs from many different hosts into one place. It's possible that the network connectivity between the log server and the hosts is not reliable. Therefore: 1. Can I get syslog-ng to send new log entries once it can see the central log server again? I would also like to centralise logs from non-syslog programs such as some big database apps. 2. Can syslog-ng work similarly to tail -f logging to the central server? And finally (but least importantly).. 3. Does anyone know a good web interface for viewing or searching the files from a web interface? The logs must remain as files, not be put in a mysql database. Thanks, jbj

2 2

Syslog-ng version 2.0.3 memory problems
by James Long 06 Apr '07

06 Apr '07

I've installed syslog-ng-.2.0.3 on a Red Hat Enterprise Linux 5 server. I'm using eventlog-0.2.5 and libnet 1.1.2.1. I compiled syslog-ng without any problems. I've got a fairly generic config file. Whenever I start the service; the process will chew through all of the available ram on the server (2 gb) then terminate with the following error Glib-ERROR gmem.c:514: failed to allocated ### bytes. This usually takes about 15 minutes to happen. Any thoughts? Thanks Jim

2 6

problem with accents in log messages
by Nagy Daniel 05 Apr '07

05 Apr '07

Hello, syslog-ng version: 2.0.2 System: RHEL4, locale: en_US.UTF-8 Without a template in the destionation, the accented characters appear well: Using this config: source s_net { tcp(); udp(); }; destination d_nettest { file("/var/log/nettest.log"); }; filter f_nettest { host(localhost); }; log {source(s_net); filter(f_nettest); destination(d_nettest); }; Then I do a 'nc localhost 514' and type 'abbé', I properly receive 'Apr 5 10:49:59 localhost/localhost abbé' in /var/log/nettest.log. However, using this config: source s_net { tcp(); udp(); }; destination d_nettest { file("/var/log/nettest.log" template ("$YEAR.$MONTH.$DAY $HOUR:$MIN:$SEC $TZOFFSET $HOST $MSG\n")); ); }; filter f_nettest { host(localhost); }; log {source(s_net); filter(f_nettest); destination(d_nettest); }; I receive this: 2007.04.05 10:48:51 +02:00 localhost abb\37777777751 Thus, 'é' is converted to '\37777777751' Is it a known bug or am I missing something? Thanks, Daniel ps: eljenek a veszpremi infosok

2 2

Localport() & localip() cause syntax error in 2.0.2
by simonst＠wellsfargo.com 05 Apr '07

05 Apr '07

Localip() and localport() parms still causing a syntax error, after straightening out semicolons (thanks to Evan Rempel). # syslog-ng -V syslog-ng 2.0.2 # cat -n syslog-ng.test #Show syslog-ng.test without localip() & localport() 1 options { long_hostnames(off); sync(0); }; 2 source src { unix-stream("/dev/log"); internal(); }; 3 source kernsrc { file("/proc/kmsg"); }; 4 destination logger { tcp("10.11.12.13" port(5678) template("$UNIXTIME $HOST $MESSAGE\n") ); }; 5 log { source(src); source(kernsrc); destination(logger); }; # syslog-ng -dFsf syslog-ng.test # No syntax error without localip() & localport() # cat -n syslog-ng.test #Add localip() & localport() to syslog-ng.test 1 options { long_hostnames(off); sync(0); }; 2 source src { unix-stream("/dev/log"); internal(); }; 3 source kernsrc { file("/proc/kmsg"); }; 4 destination logger { tcp("10.11.12.13" port(5678) localip(10.9.8.7) localport(5678) template("$UNIXTIME $HOST $MESSAGE\n") ); }; 5 log { source(src); source(kernsrc); destination(logger); }; # syslog-ng -dFsf syslog-ng.test syntax error at 4 # SYNTAX ERROR with localip() & localport()

3 6

More then one application on same server
by Talati, Ashish J 04 Apr '07

04 Apr '07

Hi, I have more then one applications running on my server which generates and sends logs to central server using syslog-ng, and I need to identify in the syslog that which log is coming from which application?? currently I can only identify the server name (as the source of orginating all logs) which mix all the logs. Can anybody please help me in solving my issue?? I am kind of stuck at this point. I will be thankful for any kind of help. B.R. Ash.

2 3

More then one application running on same server
by Talati, Ashish J 04 Apr '07

04 Apr '07

Hi, Thank you very much for your reply. But as I am new in this so can you please be more specific that how can I use the Program() filter?? Let me again tell you my specific issue- I have a Tomcat server running and in that server I have 3 application or nodes that generates the logs and dump into tomcat server....Now when I use the syslog it gives me all the logs mix with the generating source name as the hostname (tomcat server)....but I want that syslog should give me the logs which has the field in it from which I can identify that this log is generated in this application and this is in other... So I hope I describe the problem to give you exact idea!! I will be thankful to you if you help me in this. B.R. Ash

1 0

new manuals
by Balazs Scheidler 04 Apr '07

04 Apr '07

Hi, My fellow tech-writer collegue has worked on a new, updated and extended syslog-ng manual, and we are now ready to publish a non-final version, available at the following URLs: PDF: http://www.balabit.com/common-dl/syslog-ng-admin-guide_en_draft.pdf HTML: http://www.balabit.com/common-dl/syslog-ng-admin-guide_en.html/bk01-toc.html Any feedback is appreciated, please send comments to the list, or to documentation(a)balabit.com Thanks. -- Bazsi

3 3

RE: Possible bug due to unusual configuration
by Matthur, Ananda (STSD) 04 Apr '07

04 Apr '07

Hi All, I am using syslog-ng on SLES linux (shipped by default from SLES). I found out a rather unusual behaviour, which seems to be a bug in syslog-ng: Excerpt from my configuration file: I have the definition of a single source two times, in different places of my configuration file, as follows: . . source s_clog_tail { pipe("/dev/log_consolidation_fifo"); }; .. .. source s_clog_tail { pipe("/dev/log_consolidation_fifo"); }; .. .. When I try to use syslog-ng with -s option, it does not complain, but if I run syslog-ng, it does not log messages from this source. i.e., it fails to log messages from this source. Should I file this as a bug in syslog-ng? The duplicate definition is probably a msitake and definitely not needed, and after removing the duplicate definition, everything works fine. Just wondering why double definition fails, though. Thanks and regards, ++++++++++++++++++++++++++++++++++++++ Ananda Matthur MSL Bangalore - 91 80 2205 3202, 919448721794 ++++++++++++++++++++++++++++++++++++++

1 0

syslog-ng Premium Edition
by Balazs Scheidler 03 Apr '07

03 Apr '07

Dear syslog-ng users, As some of you might already know from my blog, BalaBit has started working on a commercial fork of syslog-ng, named "syslog-ng Premium Edition". While the number of differences between the current premium and open source versions is marginal, it is expected to grow over time. We are planning to use dual-licensing: * the free edition will be available under the GPL, just as it's been in the past, * the commercial edition will be covered by a conventional, commercial license The two editions will be released from the same source tree, ensuring that non-differentiating changes will become part of both the free and commercial versions. I hope the syslog-ng community finds this change acceptable in the direction of syslog-ng, as it will result in more choices and a better syslog-ng. I - as the author of syslog-ng - personally think that this change will make it possible to allocate more resources to syslog-ng itself which will also benefit the users of the free edition of syslog-ng. This change is going to trigger some changes as the current syslog-ng development infrastructure goes: * this mailing list remains The list of the open source version of syslog-ng, apart from this single time posting BalaBit does not plan to use it as a "marketing" resource. * the syslog-ng-announce mailing list will become a more "traditional" product announcement mailing list for all editions of syslog-ng, so commercial announcements will be sent there too. * the website will be restructured in the near-future to include a spot for both editions, a separate page for syslog-ng open source edition will remain active though I think those are about the things that I wanted to inform you in advance. We'll see how things work out. If you have questions, please feel free to ask, either on the mailing list, or by sending a personal email to me. -- Bazsi

2 1

./configure: line 6998: --defines: command not found
by Mr. James W. Laferriere 30 Mar '07

30 Mar '07

Hello All , THis one is kind of interesting . ./configure seems to have a variable that remains or becomes null . dug it out ... $ grep -n . ./configure | grep -C3 -n 6998 6267-6995: LIBNET_CONFIG=$with_libnet/libnet-config 6268-6996: fi 6269-6997: if test -x $LIBNET_CONFIG; then 6270:6998: LIBNET_CFLAGS="`$LIBNET_CONFIG --defines`" 6271-6999: LIBNET_LIBS="`$LIBNET_CONFIG --libs`" 6272-7000: { echo "$as_me:$LINENO: result: yes" >&5 6273-7001:echo "${ECHO_T}yes" >&6; } Commandling used for ./configure $ LDFLAGS="-static" PKG_CONFIG_PATH="${PKG_CONFIG_PATH}:../eventlog-0.2.5" ./configure --enable-static-linking --enable-tcp-wrapper --enable-spoof-source The output from the above . ...snip... checking for getaddrinfo... yes checking for getutent... yes checking for TCP wrapper library... checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... yes checking for LIBNET... which: no libnet-config in (/usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin:/home/jlaferri/bin) ./configure: line 6998: --defines: command not found ./configure: line 6999: --libs: command not found yes checking for static GLib libraries... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating syslog-ng.spec.bb config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating solbuild/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating config.h config.status: executing depfiles commands -- +-----------------------------------------------------------------+ | James W. Laferriere | System Techniques | Give me VMS | | Network Engineer | 663 Beaumont Blvd | Give me Linux | | babydr(a)baby-dragons.com | Pacifica, CA. 94044 | only on AXP | +-----------------------------------------------------------------+

1 0

60 second delay when log rotates, can this be avoided?
by Michael Toy 30 Mar '07

30 Mar '07

I have a log which is received over TCP and is being written to a local file name which changes (with syslog ng macros) once per hour. I am also sending that same stream to a program. When the log rotates, all data seems to stop flowing for exactly 60 seconds, both to the log file and to program. Is there any way to change this?

6 10

syslog-ng 1.6 and 2.0
by Pol Moal 29 Mar '07

29 Mar '07

Hi, Is it possible to use syslog-ng 1.6 for the loghost and syslog-ng 2.0 for the client? nb: client use only option that exists in 1.6. thanks -- Pol Moal - Comité Réseau des Universités |--> http://www.cru.fr

3 3

Re: [syslog-ng] problem in compiling "syslog-ng-2.0.2" on SunOS 5.9 sparc
by Root Administrator 28 Mar '07

28 Mar '07

> > These are the package information about GLIB. > > # pkginfo -l SUNWGlib > PKGINST: SUNWGlib > NAME: GLIB - Library of useful routines for C programming > CATEGORY: system > ARCH: sparc > VERSION: 11.9.0,REV=2002.03.02.00.35 > BASEDIR: / > VENDOR: Sun Microsystems, Inc. > DESC: GLIB - Library of useful routines for C programming > PSTAMP: sfw8120020302003551 > INSTDATE: Aug 27 2004 19:50 > HOTLINE: Please contact your local service provider > STATUS: completely installed > FILES: 33 installed pathnames > 8 shared pathnames > 11 directories > 7 executables > 779 blocks used (approx) > > # pkginfo -l SMCglib > PKGINST: SMCglib > NAME: glib > CATEGORY: application > ARCH: sparc > VERSION: 2.6.2 > BASEDIR: /usr/local > VENDOR: The GLIB Project > PSTAMP: Steve Christensen > INSTDATE: 3月 05 2007 15:50 > EMAIL: steve(a)smc.vnet.net > STATUS: completely installed > FILES: 780 installed pathnames > 8 shared pathnames > 163 directories > 17 executables > 42974 blocks used (approx) > > SUNWGlib is the pre-installed package. > SMCglib is that I did pkgadd successfully. > file is : > ftp://ftp.sunfreeware.com/pub/freeware/sparc/9/glib-2.6.2-sol9-sparc-local.… > > > -------------------------------------------------------------------------------- > > Further information about the package is as, > > # cat /usr/local/lib/pkgconfig/glib-2.0.pc > prefix=/usr/local > exec_prefix=${prefix} > libdir=${exec_prefix}/lib > includedir=${prefix}/include > > glib_genmarshal=glib-genmarshal > gobject_query=gobject-query > glib_mkenums=glib-mkenums > > Name: GLib > Description: C Utility Library > Version: 2.6.2 > Libs: -L${libdir} -lglib-2.0 -liconv > Cflags: -I${includedir}/glib-2.0 -I${libdir}/glib-2.0/include > > and, > > # export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/:/usr/lib/pkgconfig/ > # pkg-config --cflags glib-2.0 > -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include > > but, > > # ls /usr/local/lib/g* > /usr/local/lib/g*: No such file or directory > > Therefore, it seems that the installed package does NOT create the > directories > which are necessary to compile syslog-ng-2.0.2. > Further, the package does NOT create the file "glibconfig.h" which should > exist > in /usr/local/lib/glib-2.0/include. > > I simply tried to copy the file "/usr/sfw/lib/glib/include/glibconfig.h" > into > "/usr/local/lib/glib-2.0/include/" , and done make again. > Then, it passes the problem regarding "file does not exist" , although it > errors out > a lot more elsewhere since the file "glibconfig.h" belongs to the original > package. > > > -------------------------------------------------------------------------------- > > find /usr/local -name glibconfig.h -ls > returns > none > > find /usr/local -name gtypes.h -ls > returns > 135296 15 -rw-r--r-- 1 root bin 15241 Mar 1 2005 > /usr/local/include/glib-2.0/glib/gtypes.h > > > -------------------------------------------------------------------------------- > > About the missing blank space, > there IS a space before the second -I. > There was a space in the text before sending. > It was deleted somehow at the mail archive. > I do not know why,,, > > > -------------------------------------------------------------------------------- > > Questions are,,, > Q1. Is the package I have installed appropriate in order to compile > syslog-ng-2.0.2 ? > Q2. Are there any package dependencies associated with this package ? > > Please help out. > > Regards, > > George > > ------------------------------ > > Message: 4 > Date: Tue, 27 Mar 2007 03:01:06 -0400 > From: Valdis.Kletnieks(a)vt.edu > Subject: Re: [syslog-ng] problem in compiling "syslog-ng-2.0.2" on > SunOS 5.9 sparc > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: <200703270701.l2R716nZ014513(a)turing-police.cc.vt.edu> > Content-Type: text/plain; charset="us-ascii" > > On Tue, 27 Mar 2007 11:57:42 +0900, Root Administrator said: > > > > ftp://ftp.sunfreeware.com/pub/freeware/sparc/9/glib-2.6.2-sol9-sparc-local.… > > > > The package information is ; > > > > # pkginfo | grep -i glib > > application SMCglib glib > > system SUNWGlib GLIB - Library of > > useful routines for C programming > > Humor me, part one - can you get pkginfo to tell you what release(s) of > glib > this is? And is the sol9-sparc-local file referenced above actually the > one you did a successful pkgadd with? (I'm suspecting that there's > something > wrong here, as later on you look to see what the pkginfo database has in > it, and we *don't* see anything referencing /usr/local, even though: > > > gcc -DHAVE_CONFIG_H -I. -I. -I.. > > -I/usr/local/include/glib-2.0-I/usr/local/lib/glib- > > 2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 > -Wall -g > > -c `test -f 'misc.c' || echo './'`misc.c > > We see a reference to /usr/local/include, and /usr/local/lib/include. > > Also, please double-check if you had a cut-n-paste error - there's a > missing blank before the second -I. > > What does this command return: > > % pgk-config --cflags glib-2.0 > > (If this has 2 -I flags with a missing space, that's your problem). > > > In file included from /usr/local/include/glib-2.0/glib/galloca.h:30, > > from /usr/local/include/glib-2.0/glib.h:30, > > from syslog-ng.h:37, > > from misc.h:27, > > from misc.c:24: > > OK, here we've found a glib include in /usr/local/include, somehow. > > > /usr/local/include/glib-2.0/glib/gtypes.h:30: glibconfig.h: No such > file > > or directory > > but something is fishy about it. > > > # find /usr -name glibconfig.h -exec grep {} > /var/sadm/install/contents \; > > Humor me, part two: > > What does this return: > > # find /usr/local -name glibconfig.h -ls > # find /usr/local -name gtypes.h -ls > > (We skip the grep because I'm curious what's actually on the system, as > opposed to what files pgkadd *thinks* are on the system...) > >

2 1

syslog-ng and cisco's problem
by Rębelski, Michał 28 Mar '07

28 Mar '07

Hi all, I'm trying to set up a syslog-ng 2.0.0 on Red Hat Enterprise 4.0 i386 edition. I have already set up my /etc/syslog-ng.conf file in following way: [root@swlogg02 cisco]# cat /etc/syslog-ng.conf # syslog-ng configuration file. # # This should behave pretty much like the original syslog on RedHat. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(5) for more information. # options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_cisco { udp(ip(0.0.0.0) port(514)); }; destination d_cisco_d { file("/var/log/cisco/$HOST/$YEAR/$MONTH/$DAY/log"); }; destination d_cisco_c { file("/var/log/cisco/$HOST/$YEAR/$MONTH/$DAY/log"); }; filter f_cisco_d { level(debug); }; filter f_cisco_c { level(crit); }; log { source(s_cisco); filter(f_cisco_d); destination(d_cisco_d); }; log { source(s_cisco); filter(f_cisco_c); destination(d_cisco_c); }; but I only got logs from only one machine, for your information from ASA5520. I would liek to receive messages from almost 50 machines (routers/switches/firewalls, etc). As general I set up on firewalls critical level of logging and on router/switches debug. Could you please tell me what I did wrong? regards -- Michał Rębelski

1 0

Re: [syslog-ng] Log rotate without log rotate.
by G.W. Haywood 28 Mar '07

28 Mar '07

Hi there, On Wed, 28 Mar 2007 Bruno Vieira wrote: > ... In the project I'm in, I won't have the time to do it in a low > level (kernel) as you refer and as I also thought it would be great > if Linux already had a device like this (a rotation file with > parameters of lines and/or size). Have you looked at dmesg? -- 73, Ged.

1 0