- syslog-ng - lists.balabit.hu

RE: [syslog-ng] why /var/log/syslog, /var/log/messages etc
by Justin Randall 05 Jan '07

05 Jan '07

The basic idea behind this is quite simple. It simple simply a preference shared amongst the developers of the distribution and its software packages. I don't think you'll find a document providing you with reason for the differences, as they are purely cosmetic, however if you read up on the logging mechanisms for a specific distribution you should be able to find or deduce information regarding that specific distro's logic in choosing its log file naming scheme. In the end as you mentioned, it is up to you how you choose you log file naming scheme. Common sense is usually a good place to start, such as avoiding logging kernel logs to a file called 'maillog.log' or 'access.log'. Hope this helps, Justin. -----Original Message----- From: Zoilo Gomez [mailto:zoilo@xs4all.nl] Sent: Friday, January 05, 2007 9:31 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] why /var/log/syslog, /var/log/messages etc I would be interested in a link to a document, explaining what is the idea behind log-files like /var/log/syslog and /var/log/messages etc, and why some information is often being written to 2 or more files instead of 1. And why some distros will log DHCP-messages to /var/log/daemon.log, while others will use a different log file. Of course I know that this is all up to myself to decide, but I would like to understand better what is the reasoning behind the various options. Z. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

error in logrotate.php
by max makli 05 Jan '07

05 Jan '07

Hi I'm new in php, so my problem when i excute logrotate.php & i have this message : Starting logrotate 2007-01-04 10:38:22PHP Warning: include_once(/var/www/phpsyslogng/includes/common_funcs.php): failed to open stream: No such file or directory in /var/www/html/phpsyslogng/scripts/logrotate.php on line 8 PHP Warning: include_once(): Failed opening '/var/www/phpsyslogng/includes/common_funcs.php' for inclusion (include_path='.:/usr/share/pear') in /var/www/html/phpsyslogng/scripts/logrotate.php on line 8 PHP Warning: include_once(/var/www/phpsyslogng/config/config.php): failed to open stream: No such file or directory in /var/www/html/phpsyslogng/scripts/logrotate.php on line 9 PHP Warning: include_once(): Failed opening '/var/www/phpsyslogng/config/config.php' for inclusion (include_path='.:/usr/share/pear') in /var/www/html/phpsyslogng/scripts/logrotate.php on line 9 PHP Fatal error: Call to undefined function db_connect_syslog() in /var/www/html/phpsyslogng/scripts/logrotate.php on line 11 I didn't what i do, my second problem i have a log in localhost but how i transfer this in my base mysql + phpsyslogng THANKS _________________________________________________________________ Découvrez le Blog heroic Fantaisy d'Eragon! http://eragon-heroic-fantasy.spaces.live.com/

2 1

Feeding data into MYSQL
by Chris Killian 04 Jan '07

04 Jan '07

All I have a script that takes the data collected by syslog-ng and inputs into mysql database, which is then viewable using something like phpsyslog. However although this works for all hosts there is one that it wont do. I can see the data coming in if and get added to the syslog log file, however will not go into the data. COuld this be down to the format that the data is received in. Anyone got any ideas? Regards CK

2 1

RE: [syslog-ng] I/O error occurred while reading; fd='4',error='Operation not permitted (1)'
by Justin Randall 04 Jan '07

04 Jan '07

This cleared a few things up. Should have noticed this earlier when looking at the return code for the "read" system call: "read(4, 0x55ad20, 8192) = -1 EPERM (Operation not permitted)" This is indicative of access control restrictions. If you consider the file trying to be read ("/proc/kmsg") and it's permissions (only readable as root) it makes sense why you are getting permission errors when trying to as user "syslogng". You are also experiencing other permission related errors on certain files: /var/log/syslog /var/log/messages /dev/xconsole File attribute changes are failing due to only being modifiable as root, but being modified as user "syslogng". If you want to verify this claim, try running the daemon as root, and you should no longer see this problem. You will likely have to tune file access/location suitable to your secutiry and/or logging requirements. Regards, Justin. -----Original Message----- From: Matt Miller [mailto:syslog-ng@mattmillersf.fastmail.fm] Sent: Wed 1/3/2007 12:16 AM To: Syslog-ng users' and developers' mailing list Cc: Justin Randall Subject: RE: [syslog-ng] I/O error occurred while reading; fd='4',error='Operation not permitted (1)' > send the full output from strace without filtering specific system calls? Attached. Thanks for your help.

3 3

Re: Request for help with a filter
by G.W. Haywood 03 Jan '07

03 Jan '07

Hi there, On Wed, 3 Jan 2007 Marlier, Ian wrote: > ... need to get rid of a couple of error messages that appear on > a single host [snip] [and only those messages, defined as] > host("hostX") AND (match("ERROR 1: error 1 text") or match("ERROR 2: error 2 text")) > [snip] > > filter f_errors1 { not host("hostX") and not (match("ERROR 1:") or match("ERROR 2")); }; I think you need: not ( host("hostX") and ( match("ERROR 1:") or match("ERROR 2:") ) ) > filter f_errors2 { host("hostX") and match("ERROR 1:") or match("ERROR 2"); }; > ... not filter(f_errors1) ... This is also incorrect. You need f_errors2 { host("hostX") and (match("ERROR 1:") or match("ERROR 2")); }; and ... not filter(f_errors2) ... which I assume was just a typo. You really have to be careful with this stuff, it can bring your server down if you get it wrong. > (Perhaps more to the point, what am I totally messing up? :-)) Your logic. You need to read about the precedence of operators. Have a look at deMorgan's theorem too. But your ideas are sound. :) -- 73, Ged.

1 0

RE: [syslog-ng] I/O error occurred while reading; fd='4',error='Operation not permitted (1)'
by Justin Randall 03 Jan '07

03 Jan '07

You are correct in that fd 4 is /proc/kmsg as this can be verified in the line: open("/proc/kmsg", O_RDONLY|O_NONBLOCK|O_NOCTTY) = 4 The returned value for the call to "open" is the file descriptor. Calling "chroot" in between calls to "open" and "read" is not a problem. I've written another application which does without problems. I think however, that the path used when opening the file should be changed to the full path rather than the chroot'd absolute path. Since the call to "open" is done to "/proc/kmsg" before the chroot, this falls outside of the jail's access. Try changing the path to "/var/local/chroot/syslogng/proc/kmsg" and see if this resolves the issue. I hope this helps, Justin. -----Original Message----- From: Matt Miller [mailto:syslog-ng@mattmillersf.fastmail.fm] Sent: Tuesday, January 02, 2007 5:18 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] I/O error occurred while reading; fd='4',error='Operation not permitted (1)' > > running in a jail via the "-C" option, but ... syslog-ng[19522]: > > I/O error occurred while reading; fd='4', error='Operation not > > permitted (1)' > > Looking at that attached output, my best guess at what's opened on > descriptor 4 is /proc/kmsg. Could the problem be that /proc/kmsg is opened before the chroot, but then read after the chroot? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 2

RE: [syslog-ng] I/O error occurred while reading; fd='4',error='Operation not permitted (1)'
by Justin Randall 03 Jan '07

03 Jan '07

Hey again, Could you actually send the full output from strace without filtering specific system calls? It would be helpful to see the full deal as to what's going on with the thread creation, and the calls to "close" on certain file descriptors. Thanks, Justin. -----Original Message----- From: Justin Randall Sent: Tuesday, January 02, 2007 6:32 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] I/O error occurred while reading;fd='4',error='Operation not permitted (1)' You are correct in that fd 4 is /proc/kmsg as this can be verified in the line: open("/proc/kmsg", O_RDONLY|O_NONBLOCK|O_NOCTTY) = 4 The returned value for the call to "open" is the file descriptor. Calling "chroot" in between calls to "open" and "read" is not a problem. I've written another application which does without problems. I think however, that the path used when opening the file should be changed to the full path rather than the chroot'd absolute path. Since the call to "open" is done to "/proc/kmsg" before the chroot, this falls outside of the jail's access. Try changing the path to "/var/local/chroot/syslogng/proc/kmsg" and see if this resolves the issue. I hope this helps, Justin. -----Original Message----- From: Matt Miller [mailto:syslog-ng@mattmillersf.fastmail.fm] Sent: Tuesday, January 02, 2007 5:18 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] I/O error occurred while reading; fd='4',error='Operation not permitted (1)' > > running in a jail via the "-C" option, but ... syslog-ng[19522]: > > I/O error occurred while reading; fd='4', error='Operation not > > permitted (1)' > > Looking at that attached output, my best guess at what's opened on > descriptor 4 is /proc/kmsg. Could the problem be that /proc/kmsg is opened before the chroot, but then read after the chroot? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Request for help with a filter
by Marlier, Ian 02 Jan '07

02 Jan '07

Hi, all -- I'm trying to get a little bit of help getting a filter to work. I've looked around a little bit, but haven't found a clear indication as to priority order and the like. I've got a network source set up for syslog-ng, that accepts messages from a whole bunch of different machines: source netsrc { udp(ip("0.0.0.0") port(514)); }; All of the messages that I'm interested in come from a specific application, which is configured to log everything on local5: filter f_myapp { facility(local5); }; I've got a general filter set up that sends these messages to a single log file: destination central { file("/opt/central/central"); }; log { source(netsrc); filter(f_myapp); destination(central); }; All of the above is working fine. Now, I have need to get rid of a couple of error messages that appear on a single host. BUT, I need to do this in such a way as to avoid masking those errors if they should appear somewhere else. So, basically, I need to add a second filter that eliminates from consideration anything where: host("hostX") AND (match("ERROR 1: error 1 text") or match("ERROR 2: error 2 text")) I can think of a couple of different ways to do this, but I'm not positive if either syntax will work, or if there's another that'll work better, or what...: First attempt: source netsrc { udp(ip("0.0.0.0") port(514)); }; destination central { file("/opt/central/central"); }; filter f_myapp { facility(local5); }; filter f_errors1 { not host("hostX") and not (match("ERROR 1:") or match("ERROR 2")); }; log { source(netsrc); filter(f_myapp); filter(f_errors1); destination(central); }; Second attempt: source netsrc { udp(ip("0.0.0.0") port(514)); }; destination central { file("/opt/central/central"); }; filter f_myapp { facility(local5); }; filter f_errors2 { host("hostX") and match("ERROR 1:") or match("ERROR 2"); }; log { source(netsrc); filter(f_myapp); not filter(f_errors1); destination(central); }; Will either of these work as written? What are the alternate methods that might work better? (Perhaps more to the point, what am I totally messing up? :-)) Thanks! - Ian

1 0

RE: [syslog-ng] I/O error occurred while reading; fd='4', error='Operation not permitted (1)'
by Justin Randall 02 Jan '07

02 Jan '07

With the lack of the "-C" allowing the 4th file descriptor to be read indicates that the path to this file (or link) is not accessible from the jail. There are a few tools you could use to figure out which file is generating this log message. A good approach could involve starting the daemon through strace, and looking for the system "read" which results in a return of EACCESS. The first argument should be "4" representing the process' 4th file descriptor. A typical invocation would look like "strace -f -e trace=open,read <Syslog-NG CMD>", replacing <Syslog-NG CMD> with the appropriate command + arguments. If you are using Solaris you would use the truss utility. It's invocation would be similar: "truss -f -t open,read <Syslog-NG CMD>". You may also be able to find the problem simply verifying all the files in your "source" directives in your Syslog-NG configuration file. I hope this helps, Justin. -----Original Message----- From: Matt Miller [mailto:syslog-ng@mattmillersf.fastmail.fm] Sent: Tuesday, January 02, 2007 1:02 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] I/O error occurred while reading; fd='4', error='Operation not permitted (1)' I seem to have 2.0.0 running in a jail via the "-C" option, but when I start the service I see the following in /var/local/chroot/syslogng/var/log/syslog: Jan 2 16:48:19 xpc1 syslog-ng[19522]: syslog-ng starting up; version='2.0.0' Jan 2 16:48:19 xpc1 syslog-ng[19522]: I/O error occurred while reading; fd='4', error='Operation not permitted (1)' The daemon does seem to continue to run fine, since I am seeing facilities logging their activity to /var/local/chroot/syslogng/var/log/syslog. However, that second line above seems to indicate a problem. When I run syslog-ng without the "-C" option I don't get this second line. Am I missing something in my jail? Is the jailing process documented? _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 2

I/O error occurred while reading; fd='4', error='Operation not permitted (1)'
by Matt Miller 02 Jan '07

02 Jan '07

I seem to have 2.0.0 running in a jail via the "-C" option, but when I start the service I see the following in /var/local/chroot/syslogng/var/log/syslog: Jan 2 16:48:19 xpc1 syslog-ng[19522]: syslog-ng starting up; version='2.0.0' Jan 2 16:48:19 xpc1 syslog-ng[19522]: I/O error occurred while reading; fd='4', error='Operation not permitted (1)' The daemon does seem to continue to run fine, since I am seeing facilities logging their activity to /var/local/chroot/syslogng/var/log/syslog. However, that second line above seems to indicate a problem. When I run syslog-ng without the "-C" option I don't get this second line. Am I missing something in my jail? Is the jailing process documented?

1 0

Can't install syslog-ng 2 on fedora 6
by Martin H 29 Dec '06

29 Dec '06

Hi, I am trying to install syslog-ng 2 on a Fedora Core 6 computer. I have the glib2-2.12.3-2.fc6 rpm package installed, but when I do a ./configure of syslog-ng, I get the following: checking pkg-config is at least version 0.9.0... yes checking for GLIB... configure: error: Package requirements (glib-2.0) were not met: No package 'glib-2.0' found I even tried installing glib2 from source, but I get the same thing. Specifically, I installed glib-2.12.0.tar.bz2 from source with default path (did not change prefix or any other install dir). I tried pointing the GLIB_LIBS variable to /usr/local/lib/ but I still get the same problem. Does anyone have any ideas why this is? Am I using the wrong path? Or did I install the wrong package? If I choose to do a ./configure --enable-dynamic-linking will syslog-ng start properly, or will I simply get a glib2 error when I try to start syslog-ng? Thanks for your help. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 3

Issues getting data into a MYSQL Database
by Chris Killian 27 Dec '06

27 Dec '06

All, I have without any issues setup syslog-ng with Mysql using the script that I found called syslog2mysql.sh which is shown below. #!/bin/bash if [ ! -e /var/log/mysql.pipe ] then mkfifo /var/log/mysql.pipe fi while [ -e /var/log/mysql.pipe ] do mysql -u syslogfeeder --password=ergosum syslog < /var/log/mysql.pipe >/dev/null done This works fine with most devices however I have added a new one and no messages are being recieved, this is what happens when I strace the process. viper:/home/chrisk# strace -p 13232 Process 13232 attached - interrupt to quit read(0, "INSERT INTO logs\n(host, facility"..., 4096) = 275 read(0, "INSERT INTO logs\n(host, facility"..., 4096) = 275 read(0, "INSERT INTO logs\n(host, facility"..., 4096) = 275 write(2, "ERROR", 5) = 5 write(2, " at line 13", 11) = 11 write(2, ": Unknown command \'\\\'\'.\n", 24) = 24 fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 read(3, 0x8060318, 16384) = -1 EAGAIN (Resource temporarily unavailable) fcntl64(3, F_SETFL, O_RDWR) = 0 write(3, "\1\0\0\0\1", 5) = 5 shutdown(3, 2 /* send and receive */) = 0 close(3) = 0 exit_group(1) = ? Process 13232 detached viper:/home/chrisk# The process dies and it restarted with nothing being put into the database. Anyone got any ideas at all?? Regards Chris K

1 0

Double hostname in log excerpt
by Steve Finkelstein 23 Dec '06

23 Dec '06

Hi all, I'm sending messages over a udp() stream to a centralized logging host using syslog-ng. The centralized server is displaying output like this: Dec 22 11:36:31 cc15-5 cc15-5 syslog-ng[4748]: syslog-ng version 1.6.8 starting Is there a global option to disable that second c15-5? I'm not sure why it's being displayed twice. Generally syslogd would only incorporate this once. I have the following global options set: options { stats(43200); chain_hostnames(off); sync(0); }; Thanks, Steve !DSPAM:3343,458c14af306121939910367!

2 1

Syntax error when using the tcp-keep-alive() option
by Jonathan Turner 22 Dec '06

22 Dec '06

Hi there, I'm working on using syslog-ng within our environment mainly due to the ability to use syslog with tcp. I will be traversing firewalls and therefore the tcp-keep-alive() option is vital for me. However when I try to turn this on in my tcp source it gives me a syntax error. I have pasted in the relevant part of the config below. I'm pretty sure I have it right. The strange thing is that when I search the source code for the option I can't find anything as if it has been removed from version 2.0 (the version I'm using). Does anyone know what may have happened to the tcp-keep-alive option in version 2.0 and, if I'm right and it isn't there, what are the options in syslog-ng that I could use to prevent the sessions timing out on firewalls? source testsrc { tcp( ip(0.0.0.0) port(5514) max-connections(300) keep-alive(yes) tcp-keep-alive(yes) ); }; Thanks.

2 2

UDP Socket Dying
by William Bell 22 Dec '06

22 Dec '06

We have recently switched to the latest version of syslog-ng/ eventlog and we are experiencing a problem where syslog-ng is losing its udp listener after about 20 minutes. We are receiving about 400 msgs/s to this port which can easily be handled by syslog-ng. Does anyone have any ideas as to the cause of this? We are experiencing it on multiple builds of linux.( 2 LFS Builds, 1 CentOS build). Load on the box never budges during this time period. I have not attached any debugging as of yet. Version: Snapshot 122106 of both eventlog and syslog-ng. William L. Bell II, CISSP, SSCP

2 1

remove_if_older()
by anthony lineham 21 Dec '06

21 Dec '06

>From the description in the reference manual I was expecting remove_if_older() to cause a destination file to be deleted once the file becomes older than the specified age, in seconds. However, this is not the behaviour I have observed. It seems that the age check is only made the first time the file is written too. I've had a quick look through the code and it looks like the age check is only made in affile_dw_init, which I assume is called when the file is first opened. This would be consistent with my observations. Is this the intended behaviour? Thanks Anthony

4 8

max-connections
by Hari Sekhon 20 Dec '06

20 Dec '06

I've got a central logserver on syslog-ng and am getting the following in my logs: syslog-ng[26180]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 but I clearly have source s_tcp { tcp( port(50514) max-connections(1000)); }; source s_udp { udp(); }; in my syslog-ng.conf and the server was restarted since this change (it was made a while ago). Can anybody tell me why this is? Is it possible that it's the udp which is hitting the 100 limit (I thought since udp was connectionless this would unlikely)? -- Hari Sekhon

3 4

newbie question on dns_cache in syslog2.x
by jrhendri＠maine.rr.com 20 Dec '06

20 Dec '06

Apologies in advance for the the newbie question. I did search the archives, the FAQ and look at the source before posting. I am configuring a fedora core 5 system with syslog-ng-2.0rc4 and have not had any success with dns_cache(yes) actually doing anything. I setup tcpdump to watch the DNS traffic and am generating logs toward the box. No matter whether I have dns_cache enabled or not I see dns lookups for each inbound message. When I look at the source code, I find the resolve_hostname() function in misc.c and I don't see any caching code. What I do see is: /* FIXME: add nscache support here */ Am I missing something? How does dns_cache(yes) actually work? I do want to use hostnames in the logging directories, but I do not want each syslog message to trigger a DNS query. Should I just use nscd on the server and not worry about it :-) Thanks again! Jim

3 3

Use of sockaddr_storage in src/fdread.c
by Albert Chin 19 Dec '06

19 Dec '06

While building syslog-ng-2.0.0 on Solaris 7/SPARC: cc -DHAVE_CONFIG_H -I. -I. -I.. -DPATH_SYSCONFDIR=\"/etc/opt/TWWfsw/syslogng20\" -DPATH_LOCALSTATEDIR=\"/var/opt/TWWfsw/syslogng20\" -I/opt/TWWfsw/libglib26/include -I/opt/TWWfsw/libglib26/lib/include -I/opt/TWWfsw/gettext014/include -I/opt/TWWfsw/syslogng20/include/eventlog -D_GNU_SOURCE -mr -Qn -xstrconst -xO2 -xtarget=ultra2 -xarch=v8plusa -c fdread.c "fdread.c", line 45: incomplete struct/union/enum sockaddr_storage: sas This platform does not have struct sockaddr_storage, as used in src/fdread.c. Is syslog-ng _only_ for IPV6 systems? -- albert chin (china(a)thewrittenword.com)

2 1

src/afstreams.c needs prototype for g_fd_set_cloexec()
by Albert Chin 18 Dec '06

18 Dec '06

src/afstreams.c should #include misc.h for the prototype of g_fd_set_cloexec(). Patch attached. -- albert chin (china(a)thewrittenword.com)

2 1

$MSG value
by news gonzo news gonzo 18 Dec '06

18 Dec '06

Hello, Should it be possible to modify the value of $MSG or $MSGONLY (with a tool like sed for example) ? Thx in advance. ___________________________________________________________________________ Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire. http://fr.mail.yahoo.com

3 2

syslog-ng 2.0.0 successful on Mac OS X Tiger
by Orth, Alan 14 Dec '06

14 Dec '06

Good morning, For some time now I've have syslog-ng 1.6 working on Mac OS X Panther servers, but I could never get 1.6 or 1.9 (and probably some early 2.0 betas) to work. I just completed an install of 2.0.0 on a clean installed Tiger server. I don't have a complicated logging setup (4 filters, 4 logging destinations), but I do like syslog-ng's ability to eliminate the need for log rotation by logging filters and directory structures... I know I had been trying every few months over the last year or so to get this installed, and a few other people posted with trouble getting it to run, so I'll post some stats about my setup: Machine is a 2 GHz G5 Xserve running Mac OS X Server 10.4.8 (8L127). $ uname -a Darwin hostname.school.edu 8.8.0 Darwin Kernel Version 8.8.0: Fri Sep 8 17:18:57 PDT 2006; root:xnu-792.12.6.obj~1/RELEASE_PPC Power Macintosh powerpc RackMac3,1 Darwin Good work, whoever fixed it! -- Alan Orth Upward Bound - Systems Administrator User Services - Field Technician California State University, Chico x6000

3 9

syslog-ng 2.0.0 successful on Mac OS X Tiger
by Usman Wahid 14 Dec '06

14 Dec '06

Listed below: struct in6_addr { union { __uint8_t __u6_addr8[16]; __uint16_t __u6_addr16[8]; __uint32_t __u6_addr32[4]; } __u6_addr; /* 128-bit IP6 address */ }; On Mon, 2006-12-04 at 14:00 +0800, Usman Wahid wrote: >Hi, > >I am getting the following error message, while compiling syslog-ng-2.0 on >Mac OS X server 10.4.6, > >dnscache.c: In function 'dns_cache_key_hash': >dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' >dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' >dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' >dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' >make[2]: *** [dnscache.o] Error 1 >make[1]: *** [all-recursive] Error 1 >make: *** [all] Error 2 > >I am using eventlog-0.2.6, glib-2.12.4 and pkg-config-0.21. Any ideas to >solve the problem? Can you show me the definition of struct in6_addr in your system header files? -- Bazsi _________________________________________________________________ Find singles online in your area with MSN Dating and Match.com! http://cp.intl.match.com/eng/msn/msnsg/wbc/wbc.html

2 1

syslog-ng overload
by Serge Torop 13 Dec '06

13 Dec '06

Hello, all. On my system Linux RedHat EL AS3 kernel: Linux 2.4.21-20.EL #1 Wed Aug 18 20:58:25 EDT 2004 i686 i686 i386 GNU/Linux I note high loading CPU 99% by syslog-ng. Syslog-ng version 1.6.11 (1.6.8 too), libol 0.3.18 (0.3.16 too). Is this possible to resolve high loading CPU problem? Thanks to advance. Top cmd output: 21:33:07 up 20 days, 10:13, 3 users, load average: 1,09, 1,71, 1,93 112 processes: 109 sleeping, 3 running, 0 zombie, 0 stopped CPU states: cpu user nice system irq softirq iowait idle total 21,6% 0,0% 78,4% 0,0% 0,0% 0,0% 0,0% Mem: 510932k av, 351192k used, 159740k free, 0k shrd, 80412k buff 201384k actv, 82448k in_d, 2608k in_c Swap: 1975912k av, 13060k used, 1962852k free 181536k cached PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND 23460 root 25 0 852 852 664 R 99,8 0,1 3:36 0 syslog-ng 23518 root 15 0 1188 1188 848 R 0,1 0,2 0:00 0 top 1 root 15 0 496 460 436 S 0,0 0,0 0:04 0 init 2 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 keventd 3 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 kapmd 4 root 34 19 0 0 0 SWN 0,0 0,0 0:00 0 ksoftirqd/0 7 root 25 0 0 0 0 SW 0,0 0,0 0:00 0 bdflush 5 root 15 0 0 0 0 SW 0,0 0,0 0:21 0 kswapd 6 root 15 0 0 0 0 SW 0,0 0,0 0:14 0 kscand 8 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 kupdated 9 root 15 0 0 0 0 SW 0,0 0,0 0:18 0 mdrecoveryd 18 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 raid1d 19 root 15 0 0 0 0 SW 0,0 0,0 0:05 0 raid1d 20 root 15 0 0 0 0 SW 0,0 0,0 0:14 0 raid1d 21 root 15 0 0 0 0 SW 0,0 0,0 0:03 0 raid1d 22 root 15 0 0 0 0 SW 0,0 0,0 0:03 0 kjournald 79 root 23 0 0 0 0 SW 0,0 0,0 0:00 0 khubd 1648 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 kjournald 1649 root 15 0 0 0 0 SW 0,0 0,0 0:00 0 kjournald 1650 root 15 0 0 0 0 SW 0,0 0,0 20:21 0 kjournald # ldd /sbin/syslog-ng librt.so.1 => /lib/tls/librt.so.1 (0x00d02000) libnsl.so.1 => /lib/libnsl.so.1 (0x007b5000) libresolv.so.2 => /lib/libresolv.so.2 (0x00ef5000) libc.so.6 => /lib/tls/libc.so.6 (0x00111000) libpthread.so.0 => /lib/tls/libpthread.so.0 (0x00df5000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x00691000) # syslog-ng configuration file. # Main configuration # -------------------------------------------------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); use_time_recvd(yes); stats(3600); }; source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log" max_connections(2000)); internal(); }; # Filters section # --------------------------------------------------------------- destination d_kern { file("/var/log/kernel/kernel.$MONTH.$YEAR"); file("/dev/tty12"); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages.$FACILITY.$LEVEL"); }; destination d_auth { file("/var/log/secure/secure.$MONTH.$YEAR"); }; destination d_authinfo { file("/var/log/secure/auth-info.$MONTH.$YEAR"); }; destination d_mail { file("/var/log/mail/maillog.$DAY.$MONTH.$YEAR"); }; destination d_mailacct { file("/var/log/mail/act/mailacct.$DAY.$MONTH.$YEAR"); }; destination d_fetchm {file("/var/log/fetchmail/fetchmaillog.$DAY.$MONTH.$YEAR"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot/boot.$MONTH.$YEAR"); }; destination d_cron { file("/var/log/cron/cron.$MONTH.$YEAR"); }; destination d_mlal { usertty("*"); file("/var/log/console/console.$MONTH.$YEAR"); file("/dev/tty10"); }; destination d_named { file("/var/log/named/named.$MONTH.$YEAR"); }; destination d_iptbl { file("/var/log/iptables/iptables.$MONTH.$YEAR"); file("/dev/tty11"); }; destination d_daemons { file("/var/log/daemons/daemons-info.$MONTH.$YEAR"); }; destination d_pop { file("/var/log/pop/poplog.$DAY.$MONTH.$YEAR"); }; destination d_useradd { file("/var/log/secure/useradd.log"); }; destination d_apcupsd { file("/var/log/apc/apcupsd.log"); }; destination d_syslogngd { file("/var/log/syslog-ng/syslog-ng.$MONTH.$YEAR"); }; destination d_smartd { file("/var/log/smartd/smartd.$MONTH.$YEAR"); }; destination d_drwebp { file("/var/log/drweb/mail/drweb-postfix-$DAY.$MONTH.$YEAR"); }; # Filters sections # ----------------------------------------------------------------- filter f_filter1 { facility(kern) and not match("IPFILTER"); }; filter f_filter2 { level(info) and not (facility(mail) or facility(authpriv) or facility(cron) or facility(local1) or facility(local2) or facility(local3) or facility(local4) or facility(local5) or (facility(daemon) and level(info)) or (facility(kern) and level(info)) or (facility(auth) and level(info)) ); }; filter f_filter3 { facility(authpriv) and not match("useradd"); }; filter f_filter4 { facility(mail) and not (match("mailacct") or match("fetchmail")); } ; filter f_filter5 { level(err..emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; filter f_filter9 { facility(mail) and match("mailacct"); }; filter f_filter10 { match("named"); }; filter f_filter11 { facility(kern) and match("IPFILTER"); }; filter f_filter12 { facility(daemon) and not match("dhcpd") and not match("apcupsd"); }; filter f_filter13 { facility(auth) and level(info); }; filter f_filter14 { facility(local2) and not match("pppd"); }; filter f_filter15 { facility(mail) and match("fetchmail"); }; filter f_filter18 { facility(authpriv) and match("useradd"); }; filter f_filter20 { match("apcupsd"); }; filter f_filter21 { match("syslog-ng"); }; filter f_filter22 { match("sshd"); }; filter f_filter23 { facility(local5); }; filter f_filter24 { facility(local4); }; # Bodybuilding # ------------------------------------------------------------- #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter1); destination(d_kern); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_sys); filter(f_filter9); destination(d_mailacct); }; log { source(s_sys); filter(f_filter10); destination(d_named); }; log { source(s_sys); filter(f_filter11); destination(d_iptbl); }; log { source(s_sys); filter(f_filter12); destination(d_daemons); }; log { source(s_sys); filter(f_filter13); destination(d_authinfo); destination(d_mlal); }; log { source(s_sys); filter(f_filter14); destination(d_pop); }; log { source(s_sys); filter(f_filter15); destination(d_fetchm); }; log { source(s_sys); filter(f_filter18); destination(d_useradd); }; log { source(s_sys); filter(f_filter20); destination(d_apcupsd); }; log { source(s_sys); filter(f_filter21); destination(d_syslogngd); }; log { source(s_sys); filter(f_filter22); destination(d_mlal); }; log { source(s_sys); filter(f_filter23); destination(d_smartd); }; log { source(s_sys); filter(f_filter24); destination(d_drwebp); }; -- Serge P. Torop St.Petersburg, Russia

3 3

Does -d imply -F
by Albert Chin 12 Dec '06

12 Dec '06

According to the admittedly out-of-date man page: -d, --debug Set "debug mode". Prints out various messages to aid in debugging and stops it from becoming a daemon. To activate debugging in the yacc parser, either use this option twice or combine with -v. -F, --foreground Don't fork into background. Do, does -d imply -F as -d "stops it from becoming a daemon."? Looking at src/main.c, this does not seem to be the case. do_fork=0 only when -F is specified. -- albert chin (china(a)thewrittenword.com)

2 1