- syslog-ng - lists.balabit.hu

Syslog-ng Dead But PID exists
by Padmanabhan, Rajeesh (GE Healthcare) 22 Jan '07

22 Jan '07

Hi All, I have configured a syslog-ng client(Syslog-ng 2.0rc1) on Linux. Afer couple of hours it stops working. It happens quiet often. If I check the daemen status( /etc/init.d/syslog-ng status), its says, Syslog-ng dead, but PID exists. Can anyone help me to resolve this issue. Thanks in advance. -Rajeesh

2 1

program1 destination
by bryanh＠giraffe-data.com 22 Jan '07

22 Jan '07

I'm thinking about adding a destination type "program1" that is like "program" except it runs a separate process for each message and passes the message as an argument instead of Standard Input. Does this sound like a good idea? I'm expecting to use it run a program that emails the message to me, and use it for "alert" level messages. -- Bryan Henderson San Jose, California

2 1

unsubscribe
by Jeff Gates 17 Jan '07

17 Jan '07

unsubscribe

2 1

php-syslog-ng error
by gutorjo 17 Jan '07

17 Jan '07

I'm asking for help on php-syslog-ng installation. I'm using Gentoo kernel 2.6.18 with apache2, php5, mysql 5.0.26 and php-syslog-ng 2.8. I configured a syslog database with a sysloguser and his password so he can connect to mysql database through CLI. But when I use the bronswer to http://<IP address>/phpsyslogng/index.php I get the login screen, but cannot use the sysloguser and his password because I receive a message Username and password combination does not exist!. I already edited the config.php file to insert sysloguser password and the IP address for mysql database. I don't have any idea where to fix this problem

2 1

syslog configuration
by jawed abbasi 17 Jan '07

17 Jan '07

Hi I am wondering if there is a way to config syslog-ng so that * it receives data from multiple processes running on the same source hosts and writting top the same port, without using (facility or severity levels) and still syslog writes a separate logfile for each process? for example: HOST A runs all follwing processes which all write to same port 908 proces A process b process c but different log files are created for each process. thanks --------------------------------- Don't pick lemons. See all the new 2007 cars at Yahoo! Autos.

4 11

RE: [syslog-ng] syslog configuration
by Padmanabhan, Rajeesh (GE Healthcare) 16 Jan '07

16 Jan '07

Hi Bazsi, By default syslog-ng requires eventlog libraries only for compilation right? Thanks, Rajeesh -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, January 16, 2007 6:58 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] syslog configuration On Tue, 2007-01-16 at 16:23 +0530, Padmanabhan, Rajeesh (GE Healthcare) wrote: > Hi All, > > How do I link eventlog libraries to Syslog-ng manually? what do you mean exactly? eventlog is a static library and syslog-ng links to the .a file, to avoid runtime dependency on a possibly NFS mounted library. What is your problem you'd like to solve? -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog configuration
by Padmanabhan, Rajeesh (GE Healthcare) 16 Jan '07

16 Jan '07

Hi All, How do I link eventlog libraries to Syslog-ng manually? Thanks, Rajeesh

3 2

RE: [syslog-ng] syslog configuration
by Padmanabhan, Rajeesh (GE Healthcare) 16 Jan '07

16 Jan '07

I am talking about the evenlog libraries, which is the support libraries for Syslog-ng. Thanks for responding. -Rajeesh _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Hari Sekhon Sent: Tuesday, January 16, 2007 5:16 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] syslog configuration please specify, are you talking about manually importing event logs from windows to syslog-ng or making windows log to your central logserver or something else, programmatic or what? -h Hari Sekhon Padmanabhan, Rajeesh (GE Healthcare) wrote: Hi All, How do I link eventlog libraries to Syslog-ng manually? Thanks, Rajeesh _____ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng looping problem
by Jeff Gates 15 Jan '07

15 Jan '07

Hello, I'm currently running Fedora 6. I installed eventlog-0.2.6+20070115 and syslog-ng-2.0.1+20070115 and started syslog-ng and all goes well. Then if I do a logger command: logger [test:test123] this works but if I run logger [status:test123] syslog-ng goes onto a loop and fills up my disk. This only happens when resolv.conf is configured but the DNS server not up. I can reproduce it by setting the resolv.conf to: domain maxsp.com #nameserver 192.168.1.53 #nameserver 63.198.110.86 And you can see in the syslog-ng.conf where I'm using the Status in the filter. ]# cat syslog-ng.conf options { sync (0); time_reopen (10); log_fifo_size (10000); long_hostnames (on); use_dns (no); use_fqdn (yes); create_dirs (no); keep_hostname (yes); }; # Input source for syslog source src { internal(); udp(); tcp(); unix-stream("/dev/log"); # file("/proc/kmsg" log_prefix("kernel: ")); }; # Standard Unix syslog bucketes destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; #log { source(src); filter(f_filter1); destination(d_cons); }; #log { source(src); filter(f_filter2); destination(d_mesg); }; log { source(src); filter(f_filter3); destination(d_auth); }; log { source(src); filter(f_filter4); destination(d_mail); }; log { source(src); filter(f_filter5); destination(d_mlal); }; log { source(src); filter(f_filter6); destination(d_spol); }; log { source(src); filter(f_filter7); destination(d_boot); }; log { source(src); filter(f_filter8); destination(d_cron); }; # Filter for useful log data before sending upstream filter f_apps { match("[Application:Activescan]") or match("[Application:Expert]") or match("[Application:BCAmonitor]") ; }; filter f_alert_message { match("Type:High") or match("Type:Medium") or match("\\[Status:") or match("\\[status:") or match("\\[zippy:") ; }; # Full log messages file destination std { file("/var/log/messages" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; log { source(src); destination(std); }; ## set up logging to loghost destination loghost { tcp("logsink.maxsp.com" port(514)); }; # send to loghost log { source(src); filter(f_apps); filter(f_alert_message); destination(loghost); }; Thanks, Jeff

1 0

RE: [syslog-ng] Forwarding + Spoofing = Errors & Dropped Packets?
by Ivey, Chris 15 Jan '07

15 Jan '07

Thanks Bazsi. I finally got to the bottom of this, quite on accident. On a whim (since nothing else was working), I changed the destination for forwarding from hostnames to IP addresses. After I stopped and restarted the syslog-ng service, all worked well. I noticed in all my ltrace outputs that syslog-ng was performing a LOT of DNS queries when spoofing was on and we were using hostnames as the targets. There is not a local DNS server with this syslog-ng server, so the queries were taking quite a bit of time to come back (50-60 ms). Once I made the change to IP addresses, everything worked much better. I have now set my other syslog-ng server to use IP addresses instead of hostnames for forwarding as well. Whoever runs the syslog-ng FAQ on campin.net may need to know that if you have performance issues, switching your targets to IP addresses instead of hostnames may clear up some issues. Can you explain to me, though, why the spoofing needs to do so many nslookups? Why can it not cache the results of the first query? Does the application block waiting for DNS queries to come back? That may need to be addressed.... Thanks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst 1120 Celebration Blvd. Celebration, FL 34747 (321) 939-6540 Office 8296-6540 Disney Tie-Line (407) 557-1072 Cell 162*326905*19 Nextel Direct Connect chris.ivey(a)acs-inc.com "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Sunday, January 14, 2007 9:47 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Forwarding + Spoofing = Errors & Dropped Packets? On Thu, 2007-01-11 at 10:24 -0600, Ivey, Chris wrote: > Bazsi, > Thanks for your help thus far. After MUCH trial and error > with enabling and disabling things in syslog-ng.conf, and watching > "netstat -an" output after each attempt, I have narrowed this issue > down to something to do with spoofing. From my starting > syslog-ng.conf file, if I do NOTHING but turn off spoofing, the Recv-Q > buffer stops filling and all is happy. If I turn on spoofing, those > buffers start filling again. I used tkdiff to compare my 2 > syslog-ng.conf files side-by-side, and the only differences between > the 2 are the lines where the forward-to hosts are defined and where > the destinations are defined (the bad server has lines commented, the > good one does not). Lsof on both machines for syslog-ng shows the > same libraries opened and such. So, the question now is what happens > with spoofing that would cause all these issues? What does spoofing > do in the background that my server is unhappy about? Any insight > would be greatly appreciated! As the server is "unhappy", it is probably some kind of spoof filtering, e.g. the default route of the server points to a different interface, and the server drops the packets because of this. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Migration
by max makli 15 Jan '07

15 Jan '07

Hi My php-syslog-ng 2.8 is stable, it's possible to migrate to the new version 2.9?? THNAKS _________________________________________________________________ Windows Live Spaces : créez votre blog à votre image ! http://www.windowslive.fr/spaces

1 0

RE: [syslog-ng] Forwarding + Spoofing = Errors & Dropped Packets?
by Ivey, Chris 14 Jan '07

14 Jan '07

Bazsi, Thanks for your help thus far. After MUCH trial and error with enabling and disabling things in syslog-ng.conf, and watching "netstat -an" output after each attempt, I have narrowed this issue down to something to do with spoofing. From my starting syslog-ng.conf file, if I do NOTHING but turn off spoofing, the Recv-Q buffer stops filling and all is happy. If I turn on spoofing, those buffers start filling again. I used tkdiff to compare my 2 syslog-ng.conf files side-by-side, and the only differences between the 2 are the lines where the forward-to hosts are defined and where the destinations are defined (the bad server has lines commented, the good one does not). Lsof on both machines for syslog-ng shows the same libraries opened and such. So, the question now is what happens with spoofing that would cause all these issues? What does spoofing do in the background that my server is unhappy about? Any insight would be greatly appreciated! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst 1120 Celebration Blvd. Celebration, FL 34747 chris.ivey(a)acs-inc.com "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, January 11, 2007 8:06 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Forwarding + Spoofing = Errors & Dropped Packets? On Wed, 2007-01-10 at 13:31 -0600, Ivey, Chris wrote: > We took DNS out of the config, and had no change. How do we go about > seeing if we are blocking on /proc/kmsg? You need to identify the bottleneck, there are various tools for this. Check CPU/disk usage, vmstat, maybe even strace syslog-ng and check where it is spending its time. If everything looks normal, you might need to increase the UDP receive buffer size. What is your message rate? -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Logging HTTP and HTTPS requests in one file
by Phusion 12 Jan '07

12 Jan '07

I am trying to log HTTP and HTTPS requests in one file per virtual host on a server and need some help. Currently, it only logs HTTP access requests and HTTP error requests. It doesn't pick up the SSL access requests or the SSL error requests. I will include some parts of the config files. syslog-ng.conf --------------------- filter fd_httpd_test.abc.com { (match("logger:") and match("test.abc.com")) or (match("httpd[\[0-9]+\]") and match("/websites/abc/test")); }; filter f_terms { not match("httpd[\[0-9]+\]") and not match("logger:"); }; The f_terms filter is for a catchall filter that catches things not specified to go to a certain file. httpd.conf -------------- ErrorLog syslog LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" commonvhost CustomLog "|/usr/bin/logger" commonvhost <VirtualHost *:80> ServerName test.abc.com ServerAdmin root@localhost DocumentRoot /websites/abc/test Redirect / https://test.abc.com/ </VirtualHost> <VirtualHost *:443> ServerName test.abc.com ServerAdmin root@localhost DocumentRoot /websites/abc/test </VirtualHost> ssl.conf ------------ ErrorLog syslog LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" commonvhost CustomLog "|/usr/bin/logger" commonvhost Let me know when the problem lies. Phusion

1 0

Re: Question about regular expressions
by G.W. Haywood 12 Jan '07

12 Jan '07

Hi there, On Fri, 12 Jan 2007 Phusion wrote: > httpd[....] and /websites/abc/test > ... > > I have tried the following. > > filter fd_httpd_test.abc.com { match("httpd[\[0-9]+\]") and ... Isn't filter fd_httpd_test.abc.com { program("httpd") and ... }; what you're looking for there? -- 73, Ged.

2 1

Help with startup of syslog-ng
by PATEL, Leena, GBM 12 Jan '07

12 Jan '07

Hi I'm trying to start syslog-ng for use with splunk but get the following error and am not sure how the address is already in use. I want to configure syslog-ng so that it receives files remotely via udp. [root@lonrs00253 init.d]# service syslog-ng stop Stopping Kernel Logger: [ OK ] [root@lonrs00253 init.d]# service syslog-ng start Starting syslog-ng: Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (98)' Error initializing source driver; source='remote' Starting Kernel Logger: [ OK ] My syslog-ng config file is below which i've configured for splunk using the splunk forums. Cheers leena ---------------------------------------------------------------------------- ---------------------------------------------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (yes); create_dirs (yes); group (logs); dir_group (logs); perm (0640); dir_perm (0750); keep_hostname (yes); }; source s_sys { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); }; source remote { udp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; destination splunk { pipe("/var/log/syslog-ng/syslog_fifo"); }; destination hosts { file("/var/log/syslog-ng/hosts/$HOST/messages"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(remote); destination(splunk); }; log { source(remote); destination(hosts); }; Regards Leena Patel | Royal Bank of Scotland Global Banking & Markets | E-Commerce | Desk: +44 (0) 207 085 0692 *********************************************************************************** The Royal Bank of Scotland plc. Registered in Scotland No 90312. Registered Office: 36 St Andrew Square, Edinburgh EH2 2YB. Authorised and regulated by the Financial Services Authority This e-mail message is confidential and for use by the addressee only. If the message is received by anyone other than the addressee, please return the message to the sender by replying to it and then delete the message from your computer. Internet e-mails are not necessarily secure. The Royal Bank of Scotland plc does not accept responsibility for changes made to this message after it was sent. Whilst all reasonable care has been taken to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that the onward transmission, opening or use of this message and any attachments will not adversely affect its systems or data. No responsibility is accepted by The Royal Bank of Scotland plc in this regard and the recipient should carry out such virus and other checks as it considers appropriate. Visit our websites at: www.rbs.com www.rbsgc.com www.rbsmarkets.com ***********************************************************************************

1 0

Question about regular expressions
by Phusion 12 Jan '07

12 Jan '07

I need some help in my config file using regular expressions. This filter is for http requests from Apache. I am trying to get this filter to catch the following two types of messages. httpd[....] and /websites/abc/test logger: and test.abc.com I have tried the following. filter fd_httpd_test.abc.com { match("httpd[\[0-9]+\]") and match("/websites/abc/test") or match("logger:") and match("test.abc.com"); }; I also tried this. filter fd_httpd_test.abc.com { match("httpd[\[0-9]+\]*/websites/abc/test") or match("logger:*test.abc.com"); }; Let me know. Thanks. Phusion

2 1

RE: [syslog-ng] Forwarding + Spoofing = Errors & Dropped Packets?
by Ivey, Chris 11 Jan '07

11 Jan '07

We took DNS out of the config, and had no change. How do we go about seeing if we are blocking on /proc/kmsg? Thanks! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst 1120 Celebration Blvd. Celebration, FL 34747 chris.ivey(a)acs-inc.com "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Wednesday, January 10, 2007 1:10 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Forwarding + Spoofing = Errors & Dropped Packets? On Wed, 2007-01-10 at 07:30 -0600, Ivey, Chris wrote: > We are having a REALLY weird issue with syslog-ng that I need to > request some assistance with resolving. It has to do with forwarding > and spoofing. If I go into syslog-ng.conf and enable forwarding to my > 3 remote servers along with spoofing, it causes issues on the server. > First, the Recv-Q fills to capacity (as seen in "netstat -a | grep > syslog"). Once that buffer fills, we start seeing "packet receive > errors" (as seen in "netstat -su"). We have an INORDINATE amount of > these errors (about 45%). Observe: syslog-ng is busy doing something and it causes not to read the UDP receive buffers in a timely manner. Can you check: * syslog-ng is not blocking on DNS * syslog-ng is not blocking on /proc/kmsg or something else. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Forwarding + Spoofing = Errors & Dropped Packets?
by Ivey, Chris 10 Jan '07

10 Jan '07

We are having a REALLY weird issue with syslog-ng that I need to request some assistance with resolving. It has to do with forwarding and spoofing. If I go into syslog-ng.conf and enable forwarding to my 3 remote servers along with spoofing, it causes issues on the server. First, the Recv-Q fills to capacity (as seen in "netstat -a | grep syslog"). Once that buffer fills, we start seeing "packet receive errors" (as seen in "netstat -su"). We have an INORDINATE amount of these errors (about 45%). Observe: [civey@logsvr2 syslog-ng]$ netstat -su Udp: 112958828 packets received 4084 packets to unknown port received. 50596174 packet receive errors 95393123 packets sent Here is kind of a tabular representation of what I have done so far, and the results: Action Results No forwarding, no spoofing Buffers stay at 0 about 99% of the time, no problems Forwarding to 1 server w/spoofing Buffers increase and stay high for a while, but do eventually get back to 0 Forwarding to 2 servers w/spoofing Buffers increase and stay high, eventually filling and causing "packet receive errors" Forwarding to 1 server, no spoofing Same as no forwarding enabled at all So far we have re-downloaded the syslog-ng source and recompiled on the server, we have re-downloaded and recompiled all the prerequisites for syslog-ng, and we have backed up all the libraries and executables on the bad server and replaced them with the libraries and executables from the good server. None of this has done any good, as we keep seeing the same issues. I am about at my wit's end here. Can someone please provide some direction on where to go from here? O/S: Fedora Core 4 RAM: 2 GB Syslog-ng: 1.6.11 Thanks in advance! Chris Ivey Affiliated Computer Services Enterprise Management Integration Services Infrastructure Management Senior Analyst 1120 Celebration Blvd. Celebration, FL 34747 chris.ivey(a)acs-inc.com "When you find yourself in a hole, the best thing to do is stop digging!" -- Nick Stokes

2 1

syslog-ng-1.6.8 seg fault
by Ralf Ebeling 08 Jan '07

08 Jan '07

Hi, I've just started with syslog-ng on a box running SLES10 x64 and run into problems after modifying the configuration. With the default configuration everything runs fine, but when using the attached configuration syslog-ng stalls writing to the log files after some undefined time (syslog-ng doesn't die when running as daemon). Running 'strace syslog-ng -F' exits with a seg fault after some time. Any hints what I've done wrong? 'syslog-ng -s' doesn't complain... Ralf --- syslog-ng.conf --- options {sync(0); perm(0640); stats(3600); long_hostnames(off); use_dns(yes); dns_cache(yes); log_fifo_size(8192); log_msg_size(4096); }; source src { internal(); unix-dgram("/dev/log"); # bind runs chroot'ed unix-dgram("/var/lib/named/dev/log"); udp(ip("0.0.0.0") port(514)); }; filter f_auth { facility(auth); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_localx { facility(local0, local1, local2, local3, local4, local5, local6, local7); }; filter f_courier { facility(local3); }; filter f_nmsg { filter(f_courier) or filter(f_auth) or filter(f_localx); }; filter f_nlocal { filter(f_courier) or filter(f_auth) or filter(f_fg100); }; filter f_nwarn { filter(f_courier) or filter(f_auth) or filter(f_localx); }; filter f_iptables { facility(kern) and match("IN=") and match("OUT="); }; filter f_console { level(warn) and facility(kern) and not filter(f_iptables) or level(err) and not facility(authpriv); }; filter f_newsnotice { level(notice) and facility(news); }; filter f_newscrit { level(crit) and facility(news); }; filter f_newserr { level(err) and facility(news); }; filter f_news { facility(news); }; filter f_mailinfo { level(info) and facility(mail) and not filter(f_courier); }; filter f_mailwarn { level(warn) and facility(mail) and not filter(f_courier); }; filter f_mailerr { level(err, crit) and facility(mail) and not filter(f_courier); }; filter f_mail { facility(mail) and not filter(f_courier); }; filter f_cron { facility(cron); }; filter f_local { filter(f_localx) and not filter(f_nlocal); }; filter f_acpid { match('^\[acpid\]:'); }; filter f_netmgm { match('^NetworkManager:'); }; filter f_messages { not facility(news, mail) and not filter(f_iptables) and not filter(f_nmsg); }; filter f_warn { level(warn, err, crit) and not filter(f_iptables) and not filter(f_warn); }; filter f_alert { level(alert); }; destination console { file("/dev/tty10" group(tty) perm(0620)); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole" group(tty) perm(0400)); }; log { source(src); filter(f_console); destination(xconsole); }; destination newscrit { file("/var/log/news/news.crit" owner(news) group(news)); }; log { source(src); filter(f_newscrit); destination(newscrit); }; destination newserr { file("/var/log/news/news.err" owner(news) group(news)); }; log { source(src); filter(f_newserr); destination(newserr); }; destination newsnotice { file("/var/log/news/news.notice" owner(news) group(news)); }; log { source(src); filter(f_newsnotice); destination(newsnotice); }; destination mail { file("/var/log/mail.log" ); }; log { source(src); filter(f_mail); destination(mail); }; destination acpid { file("/var/log/acpid"); }; log { source(src); filter(f_acpid); destination(acpid); flags(final); }; destination netmgm { file("/var/log/NetworkManager"); }; log { source(src); filter(f_netmgm); destination(netmgm); flags(final); }; destination messages { file("/var/log/messages.log"); }; log { source(src); filter(f_messages); destination(messages); }; destination firewall { file("/var/log/firewall"); }; log { source(src); filter(f_iptables); destination(firewall); }; destination warn { file("/var/log/warn" fsync(yes)); }; log { source(src); filter(f_warn); destination(warn); }; destination d_courier { file("/var/log/courier.log"); }; log { source(src); filter(f_courier); destination(d_courier); }; destination d_authlog { file("/var/log/auth.log"); }; log { source(src); filter(f_auth); destination(d_authlog); }; destination d_local0 { file("/var/log/local0.log"); }; destination d_local1 { file("/var/log/local1.log"); }; destination d_local2 { file("/var/log/local2.log"); }; destination d_local3 { file("/var/log/local3.log"); }; destination d_local4 { file("/var/log/local4.log"); }; destination d_local5 { file("/var/log/local5.log"); }; destination d_local6 { file("/var/log/local6.log"); }; destination d_local7 { file("/var/log/local7.log"); }; log { source(src); filter(f_local0); destination(d_local0); }; log { source(src); filter(f_local1); destination(d_local1); }; log { source(src); filter(f_local2); destination(d_local2); }; log { source(src); filter(f_local3); destination(d_local3); }; log { source(src); filter(f_local4); destination(d_local4); }; log { source(src); filter(f_local5); destination(d_local5); }; log { source(src); filter(f_local6); destination(d_local6); }; log { source(src); filter(f_local7); destination(d_local7); }; --- syslog-ng.conf ---

1 0

syntax error
by Matthias Kerk 08 Jan '07

08 Jan '07

Hello, I try the version 2.0.1. So far I used the version 2.0.0rc3 with following config example: --------- destination console { file("/dev/tty10" group(tty) perm(0620)); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole" group(tty) perm(0400)); }; log { source(src); filter(f_console); destination(xconsole); }; --------- The version 2.0.1 (and 2.0.0) says 'syntax error at ...' If I delete the options from file and pipe, then work syslog ng. see here: --------- destination console { file("/dev/tty10"); }; log { source(src); filter(f_console); destination(console); }; destination xconsole { pipe("/dev/xconsole"); }; log { source(src); filter(f_console); destination(xconsole); }; --------- In the reference manual are however permitted the option. Thanks for your help, Matthias

3 3

Error compiling syslog-ng 2.0.1 on Solaris, Bug in dnscache.c
by Thomas Blank 08 Jan '07

08 Jan '07

I tried to compile syslog-ng 2.0.1 on a Solaris 10-machine, but gcc exits with an error: [...] dnscache.c: In function `dns_cache_key_hash': dnscache.c:82: error: structure has no member named `s6_addr32' dnscache.c:82: error: structure has no member named `s6_addr32' dnscache.c:82: error: structure has no member named `s6_addr32' dnscache.c:82: error: structure has no member named `s6_addr32' make[2]: *** [dnscache.o] Error 1 [...] So I took a look at line 80 in dnsache.c: return (0x80000000 | (e->addr.ip6.s6_addr32[0] ^ e->addr.ip6.s6_addr32[2] ^ e->addr.ip6.s6_addr32[3] ^ e->addr.ip6.s6_addr32[4])); e is a _DNSCacheKey: struct _DNSCacheKey { gint family; union { struct in_addr ip; struct in6_addr ip6; } addr; }; in6_addr comes from /usr/include/netinet/in.h: struct in6_addr { union { #ifdef _KERNEL uint32_t _S6_u32[4]; /* IPv6 address */ uint8_t _S6_u8[16]; /* IPv6 address */ #else uint8_t _S6_u8[16]; /* IPv6 address */ uint32_t _S6_u32[4]; /* IPv6 address */ #endif uint32_t __S6_align; /* Align on 32 bit boundary */ } _S6_un; }; #define s6_addr _S6_un._S6_u8 #ifdef _KERNEL #define s6_addr8 _S6_un._S6_u8 #define s6_addr32 _S6_un._S6_u32 #endif As we are not compiling Kernel-Modules, macro _KERNEL is not defined, so gcc cannot find the member s6_addr32. So I had to modify dnscache.c: tb@host:~/src/syslog-ng-2.0.1 $ vi +80 src/dnscache.c #define s6_addr32 _S6_un._S6_u32 static guint dns_cache_key_hash(DNSCacheKey *e) { if (e->family == AF_INET) return ntohl(e->addr.ip.s_addr); else return (0x80000000 | (e->addr.ip6.s6_addr32[0] ^ e->addr.ip6.s6_addr32[1] ^ e->addr.ip6.s6_addr32[2] ^ e->addr.ip6.s6_addr32[3])); } Among this, s6_addr32 is defined as an array with 4 elements, but you are requesting elements 0, 2, 3 and 4 - this will produce a core dump! I corrected this. The problem with the missing macro exists on Solaris 8 and 9 also, this is fine on Linux. A patch would be fine!

2 3

Migration 1.6.x -> 2.0.x (missing bits)
by Jose Pedro Oliveira 07 Jan '07

07 Jan '07

Hi, I would like to know if there are plans to add support in syslog-ng 2.0 for the tcp_wrappers and the address spoofing features that were available in the syslog-ng 1.6.? The above features could be enabled in syslog-ng 1.6 by the following two configure options: --enable-tcp-wrapper --enable-spoof-source Thanks in advance, jpo -- José Pedro Oliveira * mailto: jpo(a)di.uminho.pt * http://gsd.di.uminho.pt/jpo * * gpg fingerprint = F9B6 8D87 859D 1C94 48F0 84C0 9749 9EB5 91BD 851B *

2 1

More Glib static library problems
by Thomas Upton 07 Jan '07

07 Jan '07

I just downloaded the lastest snapshot (1/5/2007) and I am getting the following error when I run configure. This is on a Solaris 9 server. checking pkg-config is at least version 0.9.0... yes checking for GLIB_CFLAGS... -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include checking for GLIB_LIBS... /usr/local/lib checking for EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking for EVTLOG_LIBS... -L/usr/local/lib -levtlog checking for static GLib libraries... no configure: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or install a static GLib # find /usr -name libglib-2.0.a -ls 76667 1176 -rw-r--r-- 1 root root 1192836 Jan 5 12:33 /usr/local/lib/libglib-2.0.a As you can see, the static library exists but the configure script can't see it for some reason. Any Ideas? __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Re: why /var/log/syslog, /var/log/messages etc
by G.W. Haywood 06 Jan '07

06 Jan '07

Hi there, On Sat, 6 Jan 2007 Zoilo Gomez wrote: > I would be interested in a link to a document, explaining what is the > idea behind log-files like /var/log/syslog and /var/log/messages etc, http://www.pathname.com/fhs/ -- 73, Ged.

1 0

why /var/log/syslog, /var/log/messages etc
by Zoilo Gomez 06 Jan '07

06 Jan '07

I would be interested in a link to a document, explaining what is the idea behind log-files like /var/log/syslog and /var/log/messages etc, and why some information is often being written to 2 or more files instead of 1. And why some distros will log DHCP-messages to /var/log/daemon.log, while others will use a different log file. Of course I know that this is all up to myself to decide, but I would like to understand better what is the reasoning behind the various options. Z.

2 1