- syslog-ng - lists.balabit.hu

Restarting destination program is dangerous
by bryanh＠giraffe-data.com 30 Jan '07

30 Jan '07

The new feature that restarts a 'program' destination when it exits is pretty dangerous. Whatever caused the program to exit might be persistent, so that every time you start it you exit, causing an infinite loop of forking and execing. I discovered this the first time I tried to use current Syslog-ng, when the specified destination program didn't exist. I think this should be optional behavior. Another idea that would help with this is not to do the restart until you have a message to deliver. That way, you'd have at most one fork per message. In lieu of an option, I am presently running modified Syslog-ng in which I simply remove the log_pipe_init() from afprogram_dd_exit(). Is that sufficient? I also think that, philosophically, Syslog-ng shouldn't be involved in restarting failed programs, because it isn't a problem special to syslog. I think it's better done by a generic monitor/restarter program. For example, I have a program called 'respawn' that spawns a child and restarts it when it dies. It has various parameters to limit how often it's willing to fork. I tell Syslog-ng destination program(respawn logstuff ...). -- Bryan Henderson San Jose, California

1 0

Re: [syslog-ng] HAVE_GETUTENT not defined
by bryanh＠giraffe-data.com 30 Jan '07

30 Jan '07

>>> BTW, I recommend not using a standard function name for a local function. >>> E.g. in this case, the local version of getutent is called getutent. That >>> misled me for a while, because I assumed syslog-ng was actually calling >>> standard getutent. It would be better for it to call syslogng_getutent() >>> and have that call the real getutent() if it's available. > >I don't want to add #ifdefs to the calling side of things. I know I >could use macros, but then the calling side would not indicate that >there's a private function implemented. I'm with you on that, but I was suggesting something different. There is today an #ifdef in utils.c like this: #ifndef HAVE_GETUTENT struct utmp *getutent(void) { ... } #endif What I think works better is: #ifndef HAVE_GETUTENT struct utmp *my_getutent(void) { ... } #else struct utmp *my_getutent(void) { return getutent(); } #endif Or put the #ifdef inside my_getutent() or make my_getutent a macro. In any case, it eliminates more confusion and with less clutter than a comment saying "this getutent might not be the one you're thinking of". -- Bryan Henderson San Jose, California

2 1

running as non-root doesn't get kernel log
by carlos＠fisica.ufpr.br 29 Jan '07

29 Jan '07

I'm trying to run syslog-ng 2.0.0 as a user that's not root via the -u option. The problem is that it doesn't get the kernel log. Tracking with strace shows that it doesn't open the kernel destination file. I made sure that events were being generated. Running as root strace shows the kernel destination being opened, and the events are recorded in the file. Any ideas?

4 8

syslog-ng 2.0.2 released
by Balazs Scheidler 29 Jan '07

29 Jan '07

Hi, I have released syslog-ng 2.0.2, which is available at the usual places. (http://www.balabit.com/products/syslog-ng/) The NEWS entry for this release can be found below. One additional bug was fixed which is not included in the NEWS entry, the usertty() destination can crash in some circumstances. (I could squeze in this fix, as I had a build failure in one of our build systems.) 2.0.2 Fri, 26 Jan 2007 08:45:59 +0100 Bugfixes: * Fixed compilation problems in dnscache on non-Linux systems, such as Solaris and BSDs * Fixed an incompatibility between 1.6.x and 2.0.x when parsing user/group information from the configuration file. * Remove trailing \0 and \n characters from a message before processing, removes an unnecessary trailing space from messages. * Fixed handling utmp entries in the usertty() driver, which contain a full path to the tty. Features: * Readded missing tcp-keep-alive() option with a new name consistent with the rest of the socket options (so_keepalive). -- Bazsi

1 0

HAVE_GETUTENT not defined
by bryanh＠giraffe-data.com 29 Jan '07

29 Jan '07

configure.in needs "getutent" added to its AC_CHECK_FUNCS(). Otherwise, HAVE_GETUTENT doesn't get defined in config.h and util.c uses its own implementation of getutent instead of the system's. That's a problem with modern GNU C Library because the utmp database format has changed. (There's a complicated backward compatibility facility that can maintain a shadow database in the old format, but I don't use it). BTW, I recommend not using a standard function name for a local function. E.g. in this case, the local version of getutent is called getutent. That misled me for a while, because I assumed syslog-ng was actually calling standard getutent. It would be better for it to call syslogng_getutent() and have that call the real getutent() if it's available. -- Bryan Henderson San Jose, California

2 1

crash with destination usertty
by bryanh＠giraffe-data.com 29 Jan '07

29 Jan '07

I am experiencing an assertion failure when I log to first a usertty destination, then a file destination. (In the reverse order, things seem to be OK. Logging to two files seems OK). I did some tracing, and while I got rather lost in the reference counting and acking logic, I did find out that a call to log_msg_ack() in afuser_dd_queue() is dropping 2 references to a message when there apparently aren't 2 to drop, resulting in an eventual attempt to unreference the message when its reference count is zero, which the code asserts is impossible. I then noticed that none of the other af*.c files call log_msg_ack() at all, and thought maybe that call doesn't belong there. The message that's triggering the problem is the "syslog-ng starting up" message. The reason log_msg_ack() drops two references is that there are two ack thingies attached to the message: one with a log_center_ack() callback and one with a log_source_msg_ack() callback. I can add more details, such as a config file, if necessary, or do some more tracing. -- Bryan Henderson San Jose, California

2 1

strangeness regarding hostname parsing
by Wolfram Schlich 28 Jan '07

28 Jan '07

[ Repost due to mistakenly included In-Reply-To: header in original mail :-) ] I am using syslog-ng 2.0.1. Running the command... $ logger -t "foo bar" baz ...results in syslog-ng using "foo" as the hostname and "bar: baz" as the message! This is a problem, for example with gconfd, which uses a tag like "gconfd (USERNAME-PID)". So, something seems to be wrong regarding the message parsing and whitespaces -> file src/logmsg.c, function log_msg_parse(). -- Regards, Wolfram Schlich <wschlich(a)gentoo.org> Gentoo Linux * http://dev.gentoo.org/~wschlich/

2 1

udp Error binding socket;
by news gonzo news gonzo 25 Jan '07

25 Jan '07

Hello, I have an error when I try to use a remote source I'm under RedHas AS3 Syslog2rc1. my config is : source s_remote_fw { udp(ip(192.168.7.2) port(514)); }; And the error is : Error binding socket; addr='AF_INET(192.168.7.2:514)', error='Cannot assign requested address (99)' Error initializing source driver; source='s_remote_fw' Thanks for your help ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com

3 2

Re : [syslog-ng] udp Error binding socket;
by news gonzo news gonzo 25 Jan '07

25 Jan '07

192.168.7.2 is remote If I don't need to enter the IP how can I send it to a specfic log ? thx ----- Message d'origine ---- De : Mike <mike(a)jeke.fdns.net> À : Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Envoyé le : Jeudi, 25 Janvier 2007, 17h55mn 09s Objet : Re: [syslog-ng] udp Error binding socket; is 192.168.7.2 an IP address on your syslog-ng machine? or is the IP address of the remote machine? the source {} config option tells syslog-ng which IP address to listen on, you do not need to enter the IP address of the remote host. Mike On Thu, 25 Jan 2007, news gonzo news gonzo wrote: > Hello, I have an error when I try to use a remote source I'm under RedHas AS3 Syslog2rc1. my config is : source s_remote_fw { udp(ip(192.168.7.2) port(514)); }; And the error is : Error binding socket; addr='AF_INET(192.168.7.2:514)', error='Cannot assign requested address (99)' Error initializing source driver; source='s_remote_fw' Thanks for your help ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

Re : [syslog-ng] udp Error binding socket;
by news gonzo news gonzo 25 Jan '07

25 Jan '07

Thx for your explanation very clear and relevant ;) ----- Message d'origine ---- De : Bill Nash <billn(a)billn.net> À : Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Envoyé le : Jeudi, 25 Janvier 2007, 18h19mn 10s Objet : Re: [syslog-ng] udp Error binding socket; I think you've implemented this incorrectly. A 'remote source' is a sender, and your host will be a destination. In relative terms, syslog-ng will need a listening socket to receive the information, so you'll configure a source using an address that actually belongs to the server running syslog-ng. For this to work, you need to declare your source to be your local device. Your server cannot bind 192.168.7.2 because it's the address of the remote machine, and it can't find a local interface with that address. Look for, or create, a source in your syslog-ng config with this setting: udp(ip(0.0.0.0) port(514)); This would create a local listening socket that will receive syslog from *all* remote hosts, such as your firewall. On your firewall, configure the logging options to send to the address of your syslog server. [ Firewall ] ----> udp/514 ----> [Your syslog host] 192.168.7.2 192.168.7.10 (I'm making up the 192.168.7.10 address just to fill in my examples below.) So, on my log collector, I would have a source like this: source s_sys { file ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; The '0.0.0.0' address tells syslog-ng to use any network interface on your server, regardless of it's actual IP address. You can replace with the address of your network interface, if you prefer. For hosts sending to the log collector, for example, another syslog-ng device: destination loghost { udp("192.168.7.10" port(514)); }; Or a PIX firewall: logging host dmz1 192.168.7.10 Or a Cisco router: logging 192.168.7.10 Hope that helps, drop me a note if you need more info. - billn On Thu, 25 Jan 2007, news gonzo news gonzo wrote: > Hello, I have an error when I try to use a remote source I'm under RedHas AS3 Syslog2rc1. my config is : source s_remote_fw { udp(ip(192.168.7.2) port(514)); }; And the error is : Error binding socket; addr='AF_INET(192.168.7.2:514)', error='Cannot assign requested address (99)' Error initializing source driver; source='s_remote_fw' Thanks for your help ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

Is syslog-ng effected by the new Daylight Savings Time for 2007 ?
by KARAM Dean 25 Jan '07

25 Jan '07

Just wondering if syslog-ng needs to be patched before March 11th, or is syslog-ng dependent upon the operating system for its time/datestamp interpretation?

2 1

running a script with syslog-ng
by voorbeeld voorbeeld 25 Jan '07

25 Jan '07

Hello all, i wan't to filter my syslog messages, from a firewall, with a external script. So i was wondering if Syslog-ng has the ability to run a script like php when Syslog-ng receive a syslog message. Or does anyone know how to run a script (which uses the syslog data) when syslog-ng receive a message. greetings, Remco _________________________________________________________________ Windows Live Mail: Kies je eigen kleur, indeling en contacten! http://imagine-windowslive.com/mail/launch/default.aspx?Locale=nl-nl

2 1

glib2-static
by Harrison, Jonathan 24 Jan '07

24 Jan '07

I am attempting to compile syslog-ng-2.0.1 on a RHEL 4 machine. I have compiled and installed eventlog without problems. Where I am confused is glib2. The website says not GTK+. Where can I find the source to glib2? After reading some recent questions, I noticed that there were some issues with glib2-static. If someone can point me in the correct direction, I would appreciate it. Thanks. J.Harrison

1 1

Question about mark_freq()
by Paul Krizak 24 Jan '07

24 Jan '07

I am having some trouble understanding what constitutes conditions under which MARK messages will appear in log files. I recently brought up a log server on a fairly quiet network (less than one message/hour) and I was expecting to see at least one MARK message in my logs every five minutes, since I have mark_freq set to 300. However, the logs just sit there idle, sometimes for hours at a time, with no mark messages appearing at all. Perhaps I'm missing something in the log { } statement? The documentation is fairly sparse about what is required to enable the MARK stuff... I've attached my syslog-ng.conf -- any ideas? -- Paul Krizak 5900 E. Ben White Blvd. MS 625 Advanced Micro Devices Austin, TX 78741 Linux/Unix Systems Engineering Phone: (512) 602-8775 Silicon Design Division Cell: (512) 791-0686 # $Id: syslog-ng.conf,v 1.37 2007/01/19 17:34:51 skaven Exp $ ################################################ # OPTIONS # See http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/inde… for reference ################################################ options { #time_reopen(); # The time to wait before a killed/died connection is reestablished #time_reap(); # The time to wait before an idle destination file is closed. sync(0); # The number of lines buffered before written to file: we want immediate output to our destinations mark_freq(300); # The number of seconds between two MARK lines. stats_freq(60); # The number of seconds between two STATS. (number of dropped messages) log_fifo_size(10000); # The number of lines fitting to the output queue: we want to be able to handle a flood chain_hostnames(no); # Enable or disable the chained hostname format. keep_hostname(no); # Enable or disable hostname rewriting. We rewrite hostnames because our systems send all their names as IPs. #check_hostname(); # Enable or disable whether the hostname contains valid characters. #bad_hostname(); # A regexp which matches hostnames which should not be taken as such. owner("root"); group("root"); perm(0644); create_dirs(yes); dir_owner("root"); dir_group("root"); dir_perm(0755); use_dns(yes) ; # Enable or disable DNS usage. **syslog-ng blocks on DNS queries** dns_cache(yes); # Enable or disable DNS cache usage. (not implemented) dns_cache_size(10000); # Number of hostnames in the DNS cache: lets try to keep all hosts in the cache (not implemented) dns_cache_expire(3600); # Number of seconds while a successful lookup is cached: 1 hr seems reasonable (not implemented) dns_cache_expire_failed(30); # Number of seconds while a failed lookup is cached: 30 seconds seems reasonable (not implemented) #log_msg_size(); # Maximum length of message in bytes. use_fqdn(no); # Add Fully Qualified Domain Name instead of short hostname. }; ################################################ # GENERIC SOURCES # See http://www.balabit.com/products/syslog_ng/reference-2.0/syslog-ng.html/inde… for reference # Note that all sources get attached to rule engines. ################################################ # Syslog inputs source s_external_syslog { udp(port(514)); }; # Local syslog source s_internal_syslog { unix-dgram("/dev/log"); file("/proc/kmsg" log_prefix("kernel:")); }; # Sylog-ng's internal log source s_syslog-ng { internal(); }; # This template reformats incoming messages for use in human-readable logfiles # Don't rename this template! template t_human_readable { template("$R_FULLDATE $HOST $FACILITY.$PRIORITY $MESSAGE\n"); template-escape(no); }; # The big Y/M/D/host-messages tree destination d_host_messages { file( "/var/log/logs/$R_YEAR/$R_MONTH/$R_DAY/$HOST-messages.log" template(t_human_readable) create_dirs(yes) owner("root") group("root") perm(0644) dir_perm(0755) ); }; # The big monolithic syslog file destination d_big_messages { file ( "/var/log/logs/messages.log" template(t_human_readable) owner("root") group("root") perm(0644) ); }; # A named pipe that programs can read from destination d_syslog_pipe { pipe ( "/var/spool/vtec/syslog_pipe" template(t_human_readable) owner("root") group("root") perm(0644) ); }; # The "normal" syslog file (for local syslog) destination d_internal_syslog { file ( "/var/log/messages" template(t_human_readable) owner("root") group("root") perm(0644) ); }; # A syslog-ng logfile destination d_syslog-ng-log { file( "/var/log/syslog-ng.log" owner("root") group("root") perm(0644) ); }; # log syslog-ng's log to a special logfile log { source(s_syslog-ng); destination(d_syslog-ng-log); }; # log syslog messages to the host-messages tree and to the big monolithic messages file log { source(s_external_syslog); source(s_internal_syslog); destination(d_big_messages); destination(d_host_messages); destination(d_syslog_pipe); }; # log local syslog stuff to /var/log/messages log { source(s_internal_syslog); destination(d_internal_syslog); };

2 1

syslog-ng cvs / svn
by Brian A. Seklecki 24 Jan '07

24 Jan '07

Where is the repo? I want to submit a patch to a bad example in the docs. References to cvs.balabit.hu are clearly invalid. l8* -lava (Brian A. Seklecki - Pittsburgh, PA, USA) http://www.spiritual-machines.org/ "...from back in the heady days when "helpdesk" meant nothing, "diskquota" meant everything, and lives could be bought and sold for a couple of pages of laser printout - and frequently were."

3 4

external configuration file
by Michael Fernández M. 24 Jan '07

24 Jan '07

Hi... i have a big syslog-ng.conf file, because of the many filters and destinations that i´m already using. So my question is: can i use a file that`s contains all the filter for a specific device, another file for the destinations? something like: file_with_filter_a "(/etc/syslog-ng/filters/host_a)" file_with_filter_b "(/etc/syslog-ng/filters/host_b)" file_with_destinations "(/etc/syslog-ng/destinations/host_b)" then in the syslog-ng.conf only have to "call" those files?, and not put all the filters and destinations inside the same syslog-ng.conf? Thanks!!!! Michael.-

2 1

trailing spaces on udp messages ?
by Johan Fischer 24 Jan '07

24 Jan '07

Hi List, I'm using syslog-ng-2.0.1 on RHEL4 (centos4 actually) but I reproduced the same problem on debian unstable using the debian package (currently 2.0.0). The clients are using sysklogd 1.4.1-20 It seems that all my lines logs from udp() have one trailing space. The internal logs and /dev/log don't have that space so I'm currently assuming either the sender (sysklogd) or the receiver (udp module of syslog-ng) is not filtering that space. This also seem to happen with the internal() source. A wireshark of the packet will show this: Syslog message: USER.NOTICE: jfischer: blahklfdsfd\n I can see a \n at the end of the line but no space. I don't know what to think of this yet. I attached the configuration used (stripped as much), and the logs created. This problem is affecting mostly logwatch which do from time to time strict regex on the end of the string that I cannot match because of this trailing space. Cheers. J. -- Johan Fischer Capital Markets Surveillance Services Pty Limited Level 2, 9 Castlereagh Street, Sydney NSW 2000 Tel: +61 2 9233 7999 Direct: +61 2 9236 9150 Fax: +61 2 9236 9177 http://www.cmss-systems.com Capital Markets Surveillance Services Pty Ltd (CMSS) - Confidential Communication The information contained in this e-mail is confidential. It is intended solely for the addressee. If you receive this e-mail by mistake please promptly inform us by reply e-mail and then delete the e-mail and destroy any printed copy. You must not disclose or use in any way the information in the e-mail. There is no warranty that this e-mail is error or virus free. It may be a private communication, and if so, does not represent the views of the CMCRC and its associates. If it is a private communication, care should be taken in opening it to ensure that undue offence is not given. Jan 17 12:45:01 clamp CRON[8797]: (pam_unix) session opened for user root by (uid=0) Jan 17 12:45:01 clamp CRON[8799]: (pam_unix) session opened for user root by (uid=0) Jan 17 12:45:01 clamp CRON[8801]: (pam_unix) session opened for user jfischer by (uid=0) Jan 17 12:45:01 clamp /USR/SBIN/CRON[8798]: (root) CMD ([ -x /usr/lib/sysstat/sa1 ] && { [ -r "$DEFAULT" ] && . "$DEFAULT" ; [ "$ENABLED" = "true" ] && exec /usr/lib/sysstat/sa1 $SA1_OPTIONS 1 1 ; }) Jan 17 12:45:01 clamp /USR/SBIN/CRON[8800]: (root) CMD (if [ -x /usr/bin/mrtg ] && [ -r /etc/mrtg.cfg ]; then env LANG=C /usr/bin/mrtg /etc/mrtg.cfg >> /var/log/mrtg/mrtg.log 2>&1; fi) Jan 17 12:45:01 clamp /USR/SBIN/CRON[8802]: (jfischer) CMD (/home/jfischer/bin/chg_background >/dev/null) Jan 17 12:45:01 clamp CRON[8801]: (pam_unix) session closed for user jfischer Jan 17 12:45:01 clamp CRON[8797]: (pam_unix) session closed for user root Jan 17 12:45:02 clamp CRON[8799]: (pam_unix) session closed for user root Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: VCore 1: +0.00 V (min = +1.14 V, max = +1.55 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: VCore 2: +0.00 V (min = +1.14 V, max = +1.55 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: +3.3V: +0.00 V (min = +2.82 V, max = +3.79 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: +5V: +5.03 V (min = +4.01 V, max = +1.10 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: +12V: +0.00 V (min = +14.29 V, max = +11.31 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: -12V: -14.91 V (min = -4.55 V, max = -10.39 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: -5V: -7.71 V (min = -3.39 V, max = +5.00 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: V5SB: +5.59 V (min = +2.93 V, max = +2.53 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: VBat: +0.00 V (min = +2.99 V, max = +1.84 V) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: fan1: 0 RPM (min = 2812 RPM, div = 2) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: fan2: 0 RPM (min = 3183 RPM, div = 2) [ALARM] Jan 17 12:45:09 clamp sensord: Sensor alarm: Chip w83627hf-isa-0290: fan3: 0 RPM (min = 25000 RPM, div = 2) [ALARM] Jan 17 12:45:44 clamp fetchmail[2500]: awakened at Wed 17 Jan 2007 12:45:44 EST Jan 17 12:45:44 clamp fetchmail[2500]: Server CommonName mismatch: localhost.localdomain != pop.cmcrc.com Jan 17 12:45:44 clamp fetchmail[2500]: Server certificate verification error: self signed certificate Jan 17 12:45:44 clamp fetchmail[2500]: sleeping at Wed 17 Jan 2007 12:45:44 EST for 300 seconds Jan 17 12:45:01 192.168.15.19 CRON[2871]: (pam_unix) session opened for user root by (uid=0) Jan 17 12:45:01 192.168.15.19 /USR/SBIN/CRON[2872]: (root) CMD ([ -x /usr/lib/sysstat/sa1 ] && { [ -r "$DEFAULT" ] && . "$DEFAULT" ; [ "$ENABLED" = "true" ] && exec /usr/lib/sysstat/sa1 $SA1_OPTIONS 1 1 ; }) Jan 17 12:45:01 192.168.15.19 CRON[2871]: (pam_unix) session closed for user root Jan 17 12:45:59 192.168.15.19 sshd[3586]: Accepted password for jfischer from 192.168.15.17 port 49664 ssh2 Jan 17 12:45:59 192.168.15.19 sshd[3606]: (pam_unix) session opened for user jfischer by (uid=0) options { chain_hostnames(0); time_reopen(10); time_reap(360); log_fifo_size(2048); create_dirs(yes); group(adm); perm(0640); dir_perm(0755); use_dns(no); stats_freq(0); }; source s_internal { internal(); }; source s_local { unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); }; source s_remote { udp(); tcp(); }; destination df_internal { file("/var/log/test/internal.log"); }; destination df_local { file("/var/log/test/local.log"); }; destination df_remote { file("/var/log/test/remote.log"); }; log { source(s_internal); destination(df_internal); }; log { source(s_local); destination(df_local); }; log { source(s_remote); destination(df_remote); }; Jan 17 12:44:30 clamp syslog-ng[8783]: syslog-ng starting up; version='2.0.0'

3 9

parse error
by voorbeeld voorbeeld 23 Jan '07

23 Jan '07

Hello all, i'm a newbie with Syslog-ng and i've got aquestion about it. I'm installed syslog-ng version 1.6.11 with DarwinPorts (with command "sudo port install syslog-ng"). When i try to run syslog-ng (from the location "/opt/local/sbin/") i get the following error: "Cannot open configuration file /opt/local/etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. (line 1)". I don't know the solution for it, so can anyone help me out with this problem/error? Remco _________________________________________________________________ Nieuw: Live Mail. Mis het niet en profiteer direct van de voordelen! http://imagine-windowslive.com/mail/launch/default.aspx?Locale=nl-nl

3 4

file name for ttyname in utmp
by bryanh＠giraffe-data.com 23 Jan '07

23 Jan '07

When syslog-ng sends a terminal message for the 'usertty' destination, it looks in utmp to find what terminal the user is using. It gets the "line name" from utmp (e.g. "tty1") and appends it to "/dev/" to get the device special file name for the user's terminal, e.g. "/dev/tty1". utmp can also contain the device special file name itself as the line name. For example, on my system, logins use devices in /var/dev and utmp can say "/var/dev/tty1". The following modification makes Syslog work with such a utmp entry: --- syslog-ng/src/afuser.c 2007-01-21 23:11:26.000000000 +0000 +++ syslog-ng-2.0.1/src/afuser.c 2007-01-19 23:11:37.000000000 +0000 @@ -124,5 +74,2 @@ - if (ut->ut_line[0] == '/') - strcpy(line, ""); - else strcpy(line, "/dev/"); -- Bryan Henderson San Jose, California

2 1

RE: [syslog-ng] configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --e nable-dynamic-linking or install a static GLib
by PATEL, Leena, GBM 23 Jan '07

23 Jan '07

Hi You are missing the glib package which syslog-ng has a dependency upon, like eventlog. libglib-2.0.a can be found in the glib2-devel package which i obtained from Red Hat Advanced Server 3 installation cd's. I'm on Red Hat Linux so downloaded the package onto my machine and installed via RPM. You may get a conflict if another Glib version is installed that doesnt contain the library libglib-2.0.a but i just removed the older version first and then installed gli2-devel which worked for me once i complied syslog-ng again. Regards Leena _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Shamim Sent: 23 January 2007 07:44 To: syslog-ng(a)lists.balabit.hu; thupton2002(a)yahoo.com Subject: [syslog-ng] configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib Hi, checking for pthread_create in -lpthread... yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... yes checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib # Please suggest the solution. Thanks and Regards Shamim _____ Copy addresses and emails from any email account to Yahoo! Mail - quick, easy and free. Do <http://us.rd.yahoo.com/mail/uk/taglines/yahoo_com/trueswitch/*http://uk.doc s.yahoo.com/trueswitch2.html> it now... *********************************************************************************** The Royal Bank of Scotland plc. Registered in Scotland No 90312. Registered Office: 36 St Andrew Square, Edinburgh EH2 2YB. Authorised and regulated by the Financial Services Authority This e-mail message is confidential and for use by the addressee only. If the message is received by anyone other than the addressee, please return the message to the sender by replying to it and then delete the message from your computer. Internet e-mails are not necessarily secure. The Royal Bank of Scotland plc does not accept responsibility for changes made to this message after it was sent. Whilst all reasonable care has been taken to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that the onward transmission, opening or use of this message and any attachments will not adversely affect its systems or data. No responsibility is accepted by The Royal Bank of Scotland plc in this regard and the recipient should carry out such virus and other checks as it considers appropriate. Visit our websites at: www.rbs.com www.rbsgc.com www.rbsmarkets.com ***********************************************************************************

1 0

configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib
by Shamim 23 Jan '07

23 Jan '07

Hi, checking for pthread_create in -lpthread... yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB... yes checking for EVTLOG... yes checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib # Please suggest the solution. Thanks and Regards Shamim --------------------------------- Copy addresses and emails from any email account to Yahoo! Mail - quick, easy and free. Do it now...

1 0

Re: [syslog-ng] program1 destination
by bryanh＠giraffe-data.com 22 Jan '07

22 Jan '07

>It will be extremely easy to DoS the server >if you have, say 10 MSGs of your kind in a second (or 100, or 1000). Isn't that a problem in syslog-ng even without forking? I can see that forking means you can exhaust system resources with fewer messages, but there's no limit on how many messages syslog-ng can be made to handle, is there? I've long thought there should be some throttling of syslog activity; I haven't looked recently to see if syslog-ng provides any facilities for that, but whatever is right for logging to a file should be right for logging via fork, just with different numbers. >spawning a new process per MSG is probably a big overhead for >nothing. The overhead is insignificant in my case because 1) the cost of that one fork is a fraction of what is ultimately required to deliver an email; and 2) there would not normally be more than 1 per day. -- Bryan Henderson San Jose, California

1 0

RE: [syslog-ng] Syslog-ng Dead But PID exists
by Padmanabhan, Rajeesh (GE Healthcare) 22 Jan '07

22 Jan '07

Thanks a lot Bazsi. Will send you the core file. -Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Monday, January 22, 2007 4:41 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng Dead But PID exists On Mon, 2007-01-22 at 12:09 +0530, Padmanabhan, Rajeesh (GE Healthcare) wrote: > Hi All, > > I have configured a syslog-ng client(Syslog-ng 2.0rc1) on Linux. Afer > couple of hours it stops working. It happens quiet often. > If I check the daemen status( /etc/init.d/syslog-ng status), its says, > > Syslog-ng dead, but PID exists. > > Can anyone help me to resolve this issue. > Thanks in advance. first, please try using the latest stable release, which is 2.0.1 (not 2.0rc1). You can check the list of user-visible changes in the file named NEWS in the root of the distribution tarball. Second if it still crashes, compile syslog-ng with debugging symbols (--enable-debug configure option), enable core dumping (ulimit -c unlimited) before starting syslog-ng, and look for the core file once the daemon has crashed. (the core file is saved to the current directory of the daemon, it has to be writable by the user running syslog-ng) Once you have a core file: gdb /path/to/syslog-ng -c /path/to/core-file (gdb) bt And send its output to this list. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] Re: Syslog-ng Dead But PID exists
by Padmanabhan, Rajeesh (GE Healthcare) 22 Jan '07

22 Jan '07

Hi Ged, Thanks a lot for responding. How do I set verbose logging? -Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of G.W. Haywood Sent: Monday, January 22, 2007 5:10 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Re: Syslog-ng Dead But PID exists Hi there, On Mon, 22 Jan 2007 Padmanabhan, Rajeesh wrote: > I have configured a syslog-ng client(Syslog-ng 2.0rc1) on Linux. Afer > couple of hours it stops working. It happens quiet often. If I check > the daemen status( /etc/init.d/syslog-ng status), its says, > > Syslog-ng dead, but PID exists. I recommend upgrading to the latest syslog-ng to see if things improve. Set verbose logging to see if that helps shed any light on the problem. -- 73, Ged. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: Syslog-ng Dead But PID exists
by G.W. Haywood 22 Jan '07

22 Jan '07

Hi there, On Mon, 22 Jan 2007 Padmanabhan, Rajeesh wrote: > I have configured a syslog-ng client(Syslog-ng 2.0rc1) on > Linux. Afer couple of hours it stops working. It happens quiet > often. If I check the daemen status( /etc/init.d/syslog-ng status), > its says, > > Syslog-ng dead, but PID exists. I recommend upgrading to the latest syslog-ng to see if things improve. Set verbose logging to see if that helps shed any light on the problem. -- 73, Ged.

1 0