- syslog-ng - lists.balabit.hu

compilation errors with --enable-spoof-source
by Ravi Papisetti -X (rpapiset - HCL＠Cisco) 06 Mar '07

06 Mar '07

Hi, I am using syslog-ng 1.6.11 and trying to compile this package with ./configure --enable-spoof-source, it throws errors as below checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... ./configure: test: too many arguments configure: error: libnet-config not found It compiles fine without --enable-spoof-source this option. Could you do the needful. Thanks, Ravi Kumar P.

3 11

Re: [syslog-ng] MySQL syslog-ng regex
by Fat Wallet 06 Mar '07

06 Mar '07

Thanks Bazsi, I'd appreciate if you could send me a patch. Currently, I need to parse upto 18 arguments to before inserting into MySQL database. muchas gracius. ----- Original Message ---- From: Balazs Scheidler <bazsi(a)balabit.hu> To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Sent: Thursday, March 1, 2007 2:38:32 AM Subject: Re: [syslog-ng] MySQL syslog-ng regex On Thu, 2007-03-01 at 10:24 +0000, Hari Sekhon wrote: > one more thought, did you try ${10} or something? > > This works in shell so it's worth a try. currently syslog-ng supports max $9. It's not too difficult to add more, I'll look into it. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ____________________________________________________________________________________ Need Mail bonding? Go to the Yahoo! Mail Q&A for great tips from Yahoo! Answers users. http://answers.yahoo.com/dir/?link=list&sid=396546091

3 5

Incorrect message: SIGTERM received
by bryanh＠giraffe-data.com 05 Mar '07

05 Mar '07

If you send a SIGINT signal to Syslog-ng, it issues the message SIGTERM received, terminating Looking at the code, it uses the same code for both SIGTERM and SIGINT. I suggest the message be reworded as SIGTERM or SIGINT received, terminating -- Bryan Henderson San Jose, California

2 2

Unix datagram
by Bruno Vieira 03 Mar '07

03 Mar '07

Hello fellows. I will try to be brief with my question. I am integrating a team that is developing a system where syslog will receive messages and according to some match expressions will have to send those messages to another process. So, to do this, I have tried unix-dgram. I use Linux Ubuntu and what happens is that when I reload or stop/start syslog I get CORE DUMPED. I have made some research in the documents trying to find out the reason. What I understood was that unix.dgram only works in BSD. Is this the truth? My solution so far is to use a named pipe instead of an unix datagram socket. Tell me your opinion please. Regards, Bruno.

2 3

? Message encryption
by Andy 02 Mar '07

02 Mar '07

Hello sysloggers, Forgive my ignorance and lack of mailing list experience - I failed to figure out how to dig for information in the archives, and could find nothing in the docs. Please give some links to the archive search, or to archive FAQ, if any exist. I am responsible for monitoring and audit log collection in a very sensitive project. No cleartext communication is allowed between any nodes. Log collection server will be a Solaris based cluster (Veritas or SC or homegrown failover/loadalancing method) Under certain circumstances, tunnelling the traffic may introduce more than prevent vulnerabilities, specifically, by hiding the traffic from firewals and local packet filters. Therefore, an ideal solution for syslog so far looks like numbering and encrypting/signing each individual syslog message (obviously, on the fly, to prevent local tampering), and broadcast it to the syslog subnet for stealth pickup by both nodes of the syslog cluster. Is it something that can be acieved using syslog-ng, or the effort of building the relevant extentions for syslog-ng and to a vanilla Solaris syslog is equal? Many thanks in advance for any pointers, hints and suggestions Regards, Andrei

3 2

afinet.c:: Compilation help needed on HP-UX 11i
by Shamim 02 Mar '07

02 Mar '07

afunix.c: In function 'afunix_sd_init': afunix.c:73: warning: comparison is always true due to limited range of data type if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT afinet.o -MD -MP -MF ".deps/afinet.Tpo" \ -c -o afinet.o `test -f 'afinet.c' || echo './'`afinet.c; \ then mv -f ".deps/afinet.Tpo" ".deps/afinet.Po"; \ else rm -f ".deps/afinet.Tpo"; exit 1; \ fi afinet.c: In function 'afinet_setup_socket': afinet.c:156: error: storage size of 'mreq' isn't known afinet.c:156: warning: unused variable 'mreq' *** Error exit code 1 Stop. *** Error exit code 1 Stop. *** Error exit code 1 Stop. # uname -a HP-UX wlggh010 B.11.23 U 9000/785 2006586620 unlimited-user license # Packages installed on my Machine are # swlist |grep gcc gcc 4.1.1 gcc libgcc 4.1.1 libgcc # swlist |grep glib glib 1.2.10 glib glib2 2.12.8 glib2 # --------------------------------- New Yahoo! Mail is the ultimate force in competitive emailing. Find out more at the Yahoo! Mail Championships. Plus: play games and win prizes.

2 9

Re: syslog-ng.1.6.11
by Balazs Scheidler 02 Mar '07

02 Mar '07

On Wed, 2007-02-28 at 16:43 +0000, Michael, Desiree wrote: > > > I am installing syslog-ng on Solaris 9, and have downloaded it, and > libol, from the sunfreeware site, and have run a pkgadd to install > both. On advice from my colleague, I did not follow the INSTALL > instructions in /usr/local/doc/syslogng/INSTALL, because it did look > as though it had already been compiled. Is it correct that I think I > should end up with > > > > 1) /usr/local/sbin/syslog-ng > > 2) /etc/init.d/syslog-ng > > 3) /etc/syslog-ng/syslog.conf > > > > > > BUG 1: I only have the first file in place. The others need to be > renamed and moved out of some subdirectories. Is there any reason why > the pkgadd could not move each of the files into place? (And any > others I need, as I am left only guessing what I need to do to install > it.) > > > > BUG 2: The file /usr/local/doc/syslogng/solbuild/syslog-ng.init.d, > assuming this is the one to go in /etc/init.d, contains the following > lines which I think need editing, because we don’t > have /opt/syslog-ng. > > > > DAEMON=/opt/syslog-ng/sbin/syslog-ng > > CONFFILE=/opt/syslog-ng/etc/syslog-ng/syslog-ng.conf > > > > I do not mind doing this manually, but it seems unusual nowadays to > have to do this sort of modifying, as pkgadd usually does this. This > makes me wonder if there is a reason, for example, that I have missed > something? The sunfreeware packages are not maintained by BalaBit, please contact their maintainer. OTOH our Solaris packages do not perform init script installations either, as: 1) to replace syslogd on the system, you need a script that removes the stock syslogd configuration, this can be difficult as syslogd is not a separate package on Solaris, and it is tied into the base system. 2) once you add a postinstall script, the package cannot be installed automatically, as pkgadd will request some answers by the administrator who performs the installation from its console These might be the same reasons why the sfw packages don't add the init script, however I have no information about that. -- Bazsi

1 0

MySQL syslog-ng regex
by Fat Wallet 01 Mar '07

01 Mar '07

Hi, I am having problem inserting logs into MySQL using match() that returns more than 10 arguements. destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO mydatabase (content_name) VALUES ('$10');\n") template-escape(yes)); }; filter f_filter { match ("^.*?: \"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)\",\"(.*)$"); }; log { source(s_stunnel); filter(f_filter); destination(d_mysql); }; incoming log message is as followed: "test1","test2","test3","test4","test5","test6","test7","test8","test9","testN","testN1" catting mysql.pipe: $>cat /tmp/mysql.pipe INSERT INTO mydatabase (content_name) VALUES ('test10'); So instead of 'testN', I am getting the 'test1' appends with 0 which is 'test10' Thanks for the help! ____________________________________________________________________________________ Any questions? Get answers on any topic at www.Answers.yahoo.com. Try it now.

4 4

Observation of syslog-ng on HP-UX
by Shamim 28 Feb '07

28 Feb '07

Hi, Thanks for the help. It works now. My Observation are for HP-UX : 1. If both syslog and syslog-ng daemons are running on the system, then message sent through logger are being captured by syslog daemon only. 2. While in other OS like, AIX, Linux, Solaris message goes to both the file defined in syslog.conf and syslog-ng.conf. 3. So to captured all message on HP-UX to syslog-ng, I need to stop HP-UX's syslog daemon? Please any further comment on my Observation. Am I correct? Thanks and Regards Shamimuddin CSC India olivier rolland <madmax2010fr(a)yahoo.fr> wrote: Hi You can use logger on HP-UX using priority and Tag option For exemple logger -p local4.info -t WHATIHAVETOCATCH "My message " and you create a match filter like filter f_what {match (WHATIHAVETOCATCH);}; filter f_infolocal { level(info) and facility(local4);}; destination d_what { file(/place/fileyouwant.log);}; log { source(s_sys) ; filter(f_what); filter(infolocal) ; destination(d_what);}; Now you catch your regexp and you log messages into the file that you want. Shamim a écrit : > Hi > > Please can anyone help me how to log message to syslog-ng manually. > e.g. in Linux I can log message as # logger "test message" > ; and it goes to file defined in > syslog-ng.conf(/var/adm/messages), > > However in case of HP-UX it is not working as describe above for > Linux. Is there any other method to log message manually in HP-UX? > Or messages are dropping? > > Please suggest. > > Thanks > Shamimuddin > CSC Noida > > */olivier rolland /* wrote: > > You have to put the log device with the pad_size into your system > source. > source s_sys {pipe("/dev/log" pad_size(2048)); > internal(); }; > It's working on my system so you can try. > You can also add the klog device (/dev/klog) with same options than > /dev/log. > > Shamim a écrit : > > > > Hi, > > I've compile syslog-ng-2.0.2 on HP-UX-11.11, however messages > are not > > going to desired destinations as defined in the syslog-ng.conf . > > > > my syslog-ng.conf > > --------------------------------------------- > > # syslog-ng configuration file. > > # > > # This should behave pretty much like the original syslog on > HP-UX. But > > # it could be configured a lot smarter. > > # > > # See syslog-ng(8) and syslog-ng.conf(8) for more information. > > # > > # 20000925 gb(a)sysfive.com > > options { sync (0); > > time_reopen (10); > > log_fifo_size (1000); > > long_hostnames (off); > > use_dns (no); > > use_fqdn (no); > > create_dirs (no); > > keep_hostname (yes); > > }; > > source s_sys {internal();pipe("/dev/log"); }; > > destination d_cons { file("/dev/console1"); }; > > destination d_mesg { file("/var/adm/syslog/syslog-ng.log"); }; > > destination d_mail { file("/var/adm/syslog/mail-ng.log"); }; > > destination d_mlrt { usertty("root"); }; > > destination d_mlal { usertty("*"); }; > > filter f_filter1 { facility(mail) and level(debug); }; > > filter f_filter2 { (facility(mail) and level(debug)) or > > level(info); }; > > filter f_filter3 { level(alert); }; > > filter f_filter4 { level(emerg); }; > > log { source(s_sys); destination(d_mail); }; > > log { source(s_sys); destination(d_mesg); }; > > log { source(s_sys); destination(d_cons);destination(d_mlrt); }; > > log { source(s_sys); destination(d_mlal); }; > > # > > -------------------------------------------- > > Now If I generate message using "logger" utility on system, message > > should go to "/var/adm/syslog/syslog-ng.log", though they are > not going... > > Is there anything wrong with .conf file? > > > > What should be the conf file for central server and client on HP-UX? > > > > > > syslog-ng daemon is running like: > > > ------------------------------------------------------------------------------- > > syslog-ng service starting. > > # ps -eaf |grep syslog-ng > > root 14437 1 0 10:22:30 ? 0:00 > > /opt/soe/local/syslog-ng-2.0.2/sbin/syslog-ng -f /opt/soe/local > > # > > > ------------------------------------------------------------------------------ > > > > Thanks > > Shamim --------------------------------- What kind of emailer are you? Find out today - get a free analysis of your email personality. Take the quiz at the Yahoo! Mail Championship.

2 1

syslog-ng.conf problem on HP-UX-11.11
by Shamim 26 Feb '07

26 Feb '07

Hi, I've compile syslog-ng-2.0.2 on HP-UX-11.11, however messages are not going to desired destinations as defined in the syslog-ng.conf . my syslog-ng.conf --------------------------------------------- # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys {internal();pipe("/dev/log"); }; destination d_cons { file("/dev/console1"); }; destination d_mesg { file("/var/adm/syslog/syslog-ng.log"); }; destination d_mail { file("/var/adm/syslog/mail-ng.log"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(mail) and level(debug); }; filter f_filter2 { (facility(mail) and level(debug)) or level(info); }; filter f_filter3 { level(alert); }; filter f_filter4 { level(emerg); }; log { source(s_sys); destination(d_mail); }; log { source(s_sys); destination(d_mesg); }; log { source(s_sys); destination(d_cons);destination(d_mlrt); }; log { source(s_sys); destination(d_mlal); }; # -------------------------------------------- Now If I generate message using "logger" utility on system, message should go to "/var/adm/syslog/syslog-ng.log", though they are not going... Is there anything wrong with .conf file? What should be the conf file for central server and client on HP-UX? syslog-ng daemon is running like: ------------------------------------------------------------------------------- syslog-ng service starting. # ps -eaf |grep syslog-ng root 14437 1 0 10:22:30 ? 0:00 /opt/soe/local/syslog-ng-2.0.2/sbin/syslog-ng -f /opt/soe/local # ------------------------------------------------------------------------------ Thanks Shamim syslog-ng-request(a)lists.balabit.hu wrote: Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Is this possible in syslog-ng.conf . (v2.0.2) (Balazs Scheidler) 2. Re: Setting permissions on log files (Balazs Scheidler) 3. Re: Is this possible in syslog-ng.conf . (v2.0.2) (Evan Rempel) 4. compilation errors with --enable-spoof-source (Ravi Papisetti -X (rpapiset - HCL at Cisco)) 5. Re: Is this possible in syslog-ng.conf . (v2.0.2) (Balazs Scheidler) 6. Re: compilation errors with --enable-spoof-source (Balazs Scheidler) 7. RE: compilation errors with --enable-spoof-source (Ravi Papisetti -X (rpapiset - HCL at Cisco)) 8. RE: compilation errors with --enable-spoof-source (Balazs Scheidler) ---------------------------------------------------------------------- Message: 1 Date: Mon, 19 Feb 2007 17:14:12 +0100 From: Balazs Scheidler Subject: Re: [syslog-ng] Is this possible in syslog-ng.conf . (v2.0.2) To: Syslog-ng users' and developers' mailing list Message-ID: <1171901652.11781.7.camel(a)bzorp.balabit> Content-Type: text/plain On Sun, 2007-02-18 at 16:48 -0800, Mr. James W. Laferriere wrote: > Ok . IMO counter intuitive , Tho reasonable with your explanation . > One is very used to the 'source' in FW/router/...'s as being the source > device(s) IP from where a packet came from . syslog-ng is not a firewall :) this is sometimes strange to me as well, being involved in firewall products as well. But putting the joke aside, syslog-ng is a "syslog message pipe" processor: sources generate messages, destinations serve as message sinks. Some filtering here and there, that's about syslog-ng's internal structure. So, naming source as a source is consistent with syslog-ng itself. > An aside , Can one do the 'Formatting' like my example above , again > no examples show up like that , but I am hopeful . > > > > To do that you need the netmask() filter. > > Next time I'll go looking at the Blog at Gmane first before shooting my > mouth off . netmask was just the hint I needed . > Tho it sure would be nice for netmask() to support the /xx bits netmask > format . It does support this format. -- Bazsi ------------------------------ Message: 2 Date: Mon, 19 Feb 2007 17:15:57 +0100 From: Balazs Scheidler Subject: Re: [syslog-ng] Setting permissions on log files To: Syslog-ng users' and developers' mailing list Message-ID: <1171901757.11781.10.camel(a)bzorp.balabit> Content-Type: text/plain On Mon, 2007-02-19 at 01:45 +0000, Bryan Henderson wrote: > With the 'file' destination, Syslog-ng modifies the ownership and > permissions of the file when it opens it. There are configuration > file options to choose what it sets them to, but AFAICT, no way to > have Syslog-ng just leave the files as it finds them. > > I prefer to maintain permissions and ownership separately; I set them > when I create the file and expect them to stick. Could there be a > configuration file option for that? > IIRC, you can use -1 for various options, which means "do not touch". But I would need to test it. The code in the C part is there, the only question that remains whether the parser accepts "-1" in the place of owner/group/permissions. -- Bazsi ------------------------------ Message: 3 Date: Mon, 19 Feb 2007 09:02:15 -0800 From: Evan Rempel Subject: Re: [syslog-ng] Is this possible in syslog-ng.conf . (v2.0.2) To: "Syslog-ng users' and developers' mailing list" Message-ID: <45D9D817.7050309(a)uvic.ca> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Balazs Scheidler wrote: > On Sun, 2007-02-18 at 16:48 -0800, Mr. James W. Laferriere wrote: > >> Ok . IMO counter intuitive , Tho reasonable with your explanation . >> One is very used to the 'source' in FW/router/...'s as being the source >> device(s) IP from where a packet came from . > > syslog-ng is not a firewall :) this is sometimes strange to me as well, > being involved in firewall products as well. But putting the joke aside, > syslog-ng is a "syslog message pipe" processor: sources generate > messages, destinations serve as message sinks. Some filtering here and > there, that's about syslog-ng's internal structure. > > So, naming source as a source is consistent with syslog-ng itself. I think that the author of the original comment was refereing to the IP address binding in the source definition source network { tcp( ip(xxxx) ); }; where the IP address is NOT the source at all, it is a local IP address to bind the listener to. Perhaps the syntax should be source network { tcp( bind(xxxx) ); }; since the bind address MUST be ip since the definition is already defined to be tcp. I think it is a little counter intuitive even within the scope of syslog-ng. Evan. > >> An aside , Can one do the 'Formatting' like my example above , again >> no examples show up like that , but I am hopeful . >> >> >>> To do that you need the netmask() filter. >> Next time I'll go looking at the Blog at Gmane first before shooting my >> mouth off . netmask was just the hint I needed . >> Tho it sure would be nice for netmask() to support the /xx bits netmask >> format . > > It does support this format. > -- Evan Rempel erempel(a)uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria ------------------------------ Message: 4 Date: Mon, 19 Feb 2007 13:09:41 -0600 From: "Ravi Papisetti -X (rpapiset - HCL at Cisco)" Subject: [syslog-ng] compilation errors with --enable-spoof-source To: "syslog-ng(a)lists.balabit.hu" Message-ID: <5A8F8213-CAC5-4190-A902-FE91C0DC844D@mimectl> Content-Type: text/plain; charset="iso-8859-1" Hi, I am using syslog-ng 1.6.11 and trying to compile this package with ./configure --enable-spoof-source, it throws errors as below checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... ./configure: test: too many arguments configure: error: libnet-config not found It compiles fine without --enable-spoof-source this option. Could you do the needful. Thanks, Ravi Kumar P.

4 4

Problems configuring syslog-ng
by "Marcus Vinícius S. Mendes" 26 Feb '07

26 Feb '07

Hello, I'm trying to configure syslog-ng to log messages from local0 into a directory under the /usr tree. I'm sure that my configuration is correct, but the syslog-ng cannot write the file. When I switch to logging in /var tree, it works. My question is: Cannot I log into another directory? -- Att. Marcus Vinícius S. Mendes Pré-Processamento CPTEC/INPE Ramal 8676

3 3

syslog-ng compiling with static--link option
by Shamim 23 Feb '07

23 Feb '07

Hi, I'm trying to compile syslog-ng with static linking as below: # ./configure --enable-static-linking --prefix=/opt/soe/local/syslog-ng-2.0.2 checking for a BSD-compatible install... ./install-sh -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc option to accept ANSI C... none needed checking for bison... bison -y checking for flex... flex checking for yywrap in -lfl... yes checking lex output file root... lex.yy checking whether yytext is a pointer... yes checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking how to enable static linking for certain libraries... HP-UX checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking getopt.h usability... no checking getopt.h presence... no checking for getopt.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... yes checking sys/strlog.h presence... yes checking for sys/strlog.h... yes checking door.h usability... no checking door.h presence... no checking for door.h... no checking whether struct tm is in sys/time.h or time.h... time.h checking for struct tm.tm_gmtoff... no checking for I_CONSLOG... no checking for O_LARGEFILE... yes checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for nanosleep in -lrt... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for strdup... yes checking for strtol... yes checking for inet_aton... yes checking for inet_ntoa... yes checking for getopt_long... no checking for getaddrinfo... yes checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... yes checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib # find / -name libglib-2.0.a /usr/local/lib/libglib-2.0.a # echo $PATH /usr/include:/opt/soe/local:/usr/local/doc/libgcc:/usr/local/bin:/usr/local/lib:/usr/sbin:/usr/bin:/usr/ccs/bin:/usr/contrib/bin:/usr/contrib/Q4/bin:/opt/hparray/bin:/opt/nettladm/bin:/opt/fcms/bin:/opt/atok/bin:/usr/bin/X11:/usr/contrib/kwdb/bin:/opt/graphics:/opt/soe/bos/bin:/opt/tng/services/bin:/opt/tng/services/tools:/opt/tng/agents/bin # --------------------------------- What kind of emailer are you? Find out today - get a free analysis of your email personality. Take the quiz at the Yahoo! Mail Championship.

1 0

compiling with --enable-static-linking?
by Shamim 23 Feb '07

23 Feb '07

Hello I managed to compile syslog-ng-2.0.2 on Solaris machine(SUN 10 SPARC), but the options ----enable-dynamic-linking, When I install it on other machine it search for dependent library and didn't start the daemon. However when I try to compile it with --enable-static-linking, it gives below errors. ############################################################### checking for pthread.h... yes checking for pthread_create in -lpthread... yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... yes checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib ##################################################################### Is this possible it to compile with statis linking libraries? I've installed glib-1.2.10 glib-2.6.2 downloaded from sunfreeware.com Please advise. Thanks --------------------------------- What kind of emailer are you? Find out today - get a free analysis of your email personality. Take the quiz at the Yahoo! Mail Championship.

1 0

Spoofing syslog message in syslog-ng
by Ravi Papisetti -X (rpapiset - HCL＠Cisco) 22 Feb '07

22 Feb '07

Hi, Is there any way to append some text to syslog message in syslog-ng.conf and forward to NMS system. I would like to append a pre-defined text for every syslog message coming to syslog-ng and forward to NMS. Could you tell me the possible ways of doing it. Thanks, Ravi Kumar P.

3 2

/dev/log/ recreated when reloading syslog-ng?
by Per Jessen 21 Feb '07

21 Feb '07

I've been investigating a problem with rbldnsd - when syslog-ng is reloaded (via logrotate), the /dev/log device is reopened/recreated, which causes a chrooted rbldnsd to lose touch and essentially stop logging. It was suggested to me to create a /dev/log inside the rnbldsdn chroot jail, but that seems sub-optimal. Is syslog-ngs behaviour correct? /Per Jessen, Zürich

1 1

Is this possible in syslog-ng.conf . (v2.0.2)
by Mr. James W. Laferriere 19 Feb '07

19 Feb '07

Hello All , While I haven't seen any examples of this type of definition of a 'source net' around I am hoping we can do something like ... Not the formatting BUT the /24 &/or the netmask'ing . source net { udp( ip( 199.33.245.0/24, # or 199.33.245.0/255.255.255.0, ... 205.141.166.0/24 ) port(514) ); }; The structured formatting would also be kind cool , I come from a heavy backgroud in GateD , And much later JunOS . Tia , JimL -- +-----------------------------------------------------------------+ | James W. Laferriere | System Techniques | Give me VMS | | Network Engineer | 663 Beaumont Blvd | Give me Linux | | babydr(a)baby-dragons.com | Pacifica, CA. 94044 | only on AXP | +-----------------------------------------------------------------+

3 5

Setting permissions on log files
by bryanh＠giraffe-data.com 19 Feb '07

19 Feb '07

With the 'file' destination, Syslog-ng modifies the ownership and permissions of the file when it opens it. There are configuration file options to choose what it sets them to, but AFAICT, no way to have Syslog-ng just leave the files as it finds them. I prefer to maintain permissions and ownership separately; I set them when I create the file and expect them to stick. Could there be a configuration file option for that? -- Bryan Henderson San Jose, California

2 1

Syslog-ng tcpip & RHEL4, sending only NLs
by simonst＠wellsfargo.com 16 Feb '07

16 Feb '07

On RHEL3 servers, 2 of my syslog-ng 2.0rc4 daemons are working fine, sending logs from one daemon to the other. The same syslog-ng on 2 RHEL4 servers connects with a tcpip session, but sends across only newlines, instead of the actual syslog line data. Has anyone seen this before? My syslog-ng was compiled under RHEL3, but it made no difference when I recompiled both sides under RHEL4. Here's the sending syslog-ng.conf: options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; source kernsrc { file("/proc/kmsg"); }; destination messages { file("/var/log/messages" owner(root) group(logger) perm(0640)); }; destination logger1 { tcp("10.11.12.13" port(5678) template("$UNIXTIME $HOST $MESSAGE\n") ); }; log { source(src); source(kernsrc); destination(logger1); destination(messages); }; And here's the receiving syslog-ng.conf: options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; source kernsrc { file("/proc/kmsg"); }; source PROD_SRVRS { tcp(port(syslog-ng)); } ; destination messages { file("/var/log/messages"); }; destination LOGGER { file("/var/log/LOGGER/$YEAR/$MON$DAY" owner(root) group(logger) perm(0640) dir_perm(0750) create_dirs(yes) template("$MESSAGE\n")); }; log { source(src); source(kernsrc); destination(messages); }; log { source(PROD_SRVRS); destination(LOGGER); };

2 1

pipe or unix-stream to feed another program ?
by Yves D'Astous 16 Feb '07

16 Feb '07

Hello, I am doing a new syslog-ng log server setup and I want to find the more robust way (minize lost messages) to feed a perl script with log messages "in real-time". In case the perl script die during the process of the messages there while be a process to restart it, But what mechanism between the "pipe" or the "unix-stream" while give me more control on the number of messages that can be buffer during the restart of my perl script ? Thanks

2 1

RE: [syslog-ng] Not able to compile syslog-ng with Solaris
by Padmanabhan, Rajeesh (GE Healthcare) 16 Feb '07

16 Feb '07

Hi Bazsi Thanks a lot for your help. I am trying static linking of Syslog-ng. Now I have libglib-2.0.a under /usr/local/lib. Still I get the same error when I do './configure --enable-static-linking' Please help. Thanks, Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Wednesday, February 14, 2007 5:48 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Not able to compile syslog-ng with Solaris On Tue, 2007-02-13 at 15:05 +0530, Padmanabhan, Rajeesh (GE Healthcare) wrote: > Hi All, > > Please find the attached config.log file. I could find only > 'libglib-2.0.la' file under /usr/local/lib directory. > if you don't need static linking, you could pass the --enable-dynamic-linking option as suggested by the configure script. If you do want dynamic linking, compile glib with --enable-static option. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Need help to compile syslog-ng for Solaris
by Padmanabhan, Rajeesh (GE Healthcare) 15 Feb '07

15 Feb '07

Hi Bazsi, Need your help in compiling syslog-ng for Solaris. Im getting the following error when i 'make'. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "./messages.h", line 33: syntax error in macro parameters "./messages.h", line 34: syntax error in macro parameters "./messages.h", line 35: syntax error in macro parameters "./messages.h", line 37: syntax error in macro parameters "./messages.h", line 43: syntax error in macro parameters cc: acomp failed for messages.c *** Error code 2 make: Fatal error: Command failed for target `messages.o' Current working directory /syslog-ng-2.0.1/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /syslog-ng-2.0.1 *** Error code 1 make: Fatal error: Command failed for target `all' cc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -g -c `test -f 'messages.c' || echo './'`messages.c *** Error code 2 make: Fatal error: Command failed for target `messages.o' Current working directory /syslog-ng-2.0.1/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /syslog-ng-2.0.1 *** Error code 1 make: Fatal error: Command failed for target `all' ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~ I suspect problem with macro defenition in message.h. #define msg_fatal(desc, tag1, tags, ...)msg_event_send(msg_event_create(EVT_PRI_CRIT, desc, tag1, ##tags )) #define msg_error(desc, tag1, tags, ...)msg_event_send(msg_event_create(EVT_PRI_ERR, desc, tag1, ##tags )) #define msg_notice(desc, tag1,tags, ... ) msg_event_send(msg_event_create(EVT_PRI_NOTICE, desc, tag1, ##tags )) Please help. Thanks, Rajeesh

3 2

(no subject)
by Fabian Pucciarelli 14 Feb '07

14 Feb '07

#Hello, #I'm trying to configure syslog-ng to log messages from local0 into a #directory under the /usr tree. #I'm sure that my configuration is correct, but the syslog-ng cannot #write the file. #When I switch to logging in /var tree, it works. #My question is: Cannot I log into another directory? # #-- #Att. #Marcus Vinícius S. Mendes #Cachoeira Paulista / SP - Brazil #National Institute for Space Research - INPE #Center for Weather Forecast and Climatic Analysis - CPTEC #(+55) 3186-8676 I haven't tried doing that but I guess it would work well as long as you create the destination facility for that directory and the daemon user has the correct permissions on the file. -- Regards, Fabian Pucciarelli

2 1

syslog-ng formatting of log events
by PATEL, Leena, GBM 14 Feb '07

14 Feb '07

Hi The line below is an extract from my log file Jan 19 15:10:38 lonrs00341/lonrs00341 2007-01-19 15:10:38,046 [main] INFO - Looking for Spring SingletonBeanFactoryLocator resources : config/beanRefFactory.xml The hostname lonrs00341 is being written out twice as lonrs00341/lonrs00341 and I am not sure why this is happening or where i can change this feature. Another program i'm using to scan the logs cannot do hostname extraction whilst the hostname keeps writing out in this format. When i look at the logs written to a file on their original servers they are not being written out this way so i'm convinced its only happening once syslog-ng has written out the logs remotely to my logging server. Pointers would be appreciated. Regards Leena Regards Leena Patel | Royal Bank of Scotland Global Banking & Markets | E-Commerce | Desk: +44 (0) 207 085 0692 *********************************************************************************** The Royal Bank of Scotland plc. Registered in Scotland No 90312. Registered Office: 36 St Andrew Square, Edinburgh EH2 2YB. Authorised and regulated by the Financial Services Authority This e-mail message is confidential and for use by the addressee only. If the message is received by anyone other than the addressee, please return the message to the sender by replying to it and then delete the message from your computer. Internet e-mails are not necessarily secure. The Royal Bank of Scotland plc does not accept responsibility for changes made to this message after it was sent. Whilst all reasonable care has been taken to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that the onward transmission, opening or use of this message and any attachments will not adversely affect its systems or data. No responsibility is accepted by The Royal Bank of Scotland plc in this regard and the recipient should carry out such virus and other checks as it considers appropriate. Visit our websites at: www.rbs.com www.rbsgc.com www.rbsmarkets.com ***********************************************************************************

2 1

RE: [syslog-ng] Not able to compile syslog-ng with Solaris
by Padmanabhan, Rajeesh (GE Healthcare) 14 Feb '07

14 Feb '07

Hi All, Please find the attached config.log file. I could find only 'libglib-2.0.la' file under /usr/local/lib directory. Thanks, Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Padmanabhan, Rajeesh (GE Healthcare) Sent: Tuesday, February 13, 2007 3:00 PM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Not able to compile syslog-ng with Solaris Hi All, Im getting an error, when I ./configure syslog-ng.2.0.1 in Solaris 8. configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static Glib I have updated Glib with version 2.6.2. Still same issue. Please help me to resolve this. Thanks, Rajeesh _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Not able to compile syslog-ng with Solaris
by Padmanabhan, Rajeesh (GE Healthcare) 13 Feb '07

13 Feb '07

Hi All, Im getting an error, when I ./configure syslog-ng.2.0.1 in Solaris 8. configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static Glib I have updated Glib with version 2.6.2. Still same issue. Please help me to resolve this. Thanks, Rajeesh

1 0