- syslog-ng - lists.balabit.hu

syslog-ng make errors on RHEL4 x86_64
by James Young 12 Dec '06

12 Dec '06

When attempting to perform make on RHEL4 x86_64 for syslog-ng 2.0.0 I recieve the following errors. I have managed to find a previous post in July which mentions patching the source, however the attachment has been 'scrubbed' from the message. Anyone able to point me toward what I need to be doing to resolve these errors below? libsyslog-ng.a(misc.o)(.text+0x3d1): In function `resolve_hostname': /var/tmp/syslog-ng-2.0.0/src/misc.c:178: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x97): In function `log_stamp_format': /var/tmp/syslog-ng-2.0.0/src/logmsg.c:111: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x37e): In function `log_msg_ref': /var/tmp/syslog-ng-2.0.0/src/logmsg.c:489: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0x41f): In function `log_msg_unref': /var/tmp/syslog-ng-2.0.0/src/logmsg.c:503: undefined reference to `g_assert_warning' libsyslog-ng.a(logmsg.o)(.text+0xd8b): In function `log_msg_ack_block_end': /var/tmp/syslog-ng-2.0.0/src/logmsg.c:623: undefined reference to `g_return_if_fail_warning' libsyslog-ng.a(logpipe.o)(.text+0x58): In function `log_pipe_ref': /var/tmp/syslog-ng-2.0.0/src/logpipe.c:38: undefined reference to `g_assert_warning' libsyslog-ng.a(logpipe.o)(.text+0xa9): In function `log_pipe_unref': /var/tmp/syslog-ng-2.0.0/src/logpipe.c:47: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x9f): In function `log_endpoint_free': /var/tmp/syslog-ng-2.0.0/src/center.c:90: undefined reference to `g_assert_warning' libsyslog-ng.a(center.o)(.text+0x18d): In function `log_connection_new': /var/tmp/syslog-ng-2.0.0/src/center.c:132: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x358): In function `log_template_ref': /var/tmp/syslog-ng-2.0.0/src/templates.c:169: undefined reference to `g_assert_warning' libsyslog-ng.a(templates.o)(.text+0x3bd):/var/tmp/syslog-ng-2.0.0/src/templates.c:180: more undefined references to `g_assert_warning' follow collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/var/tmp/syslog-ng-2.0.0/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/var/tmp/syslog-ng-2.0.0' make: *** [all] Error 2

3 4

Trouble with timezone()
by anthony lineham 11 Dec '06

11 Dec '06

Hi, I'm trying to convert the time information in messages so they match the timezone offset of a remote device. Initially I was using time_zone(). This seemed to work ok until I tried and offset of greater than 12hours, which failed. It occurred to me that this utility is intended convert messages initially with GMT time to a GMT +/- offset time hence only +/-12 is required. What I want to be able to do is make a coversion relative to local time, so I need to be able to handle an offset of up 23 hours. I'm trying to use timezone(), which is supposed to take an offset value in seconds. However I can't work out the syntax. For a 2 hour offset I've tried: timezone(7200) timezone("7200") timezone("+7200") timezone(+7200) For each of these I get config parsing errors. Can anyone help me out please? Anthony

2 5

Advice on keeping hostnames/using dns
by Hari Sekhon 07 Dec '06

07 Dec '06

Hi, I'd like some advice on what I should do on my logserver regarding hostnames. I've currently got keep_hostnames(no) use_dns(yes) in order to get accurate and consistent hostnames but I'd like to consider just skipping the whole dns check rewriting thing and use keep_hostnames(yes) use_dns(no) The only issue I can see from this is that the hostname gets logged according to the packet. I'm reasonably confident that most machines will report the right name in their logs to the logserver but I also think that it makes it all too possible to screw up the logserver maliciously since any old junk that is sent to the port is put into the logs so you could hammer the integrity of the logs just by sending loads of bogus logs from a machine with the name set to that of any other machine on the network. Got any views on this? All opinions welcome. Thanks Hari -- Hari Sekhon

8 13

RE: [syslog-ng] logrotate again...
by Justin Randall 06 Dec '06

06 Dec '06

Hello, If the sed script was copied without first reviewing the actual format of Syslog messages, then yes this would happen. The sed scripts were examples of how to write the sed script, the actual regex for the date "November 15th" are completely different in the actual log file. Syslog messages use the time format "Dec 3 04:29:20" at the beginning of each line. This means that you would use a date format like the above. Likely the regex you would want to use is something more like "15 +Nov". This implies "15", then 1 or more white spaces, and then "Nov". In the future it is always good practice to test any procedure you get from a mailing list. In this case, looking at the Syslog message format should have obviously shown that the example originally submitted would not work. Basically what happened was that the sed script started at "." (match any character) and until "15 Nov" and deleted everything in between. Since "15 Nov" never appeared in the log file, everything was deleted. Since this is not a discussion for the Syslog-NG mailing list and more of a regular System Administration problem, if you'd like to discuss this further let's take this off this mailing list. Feel free to email me at djsykz(a)hotmail.com. Regards, Justin. -----Original Message----- From: Vadim Pushkin [mailto:wiskbroom@hotmail.com] Sent: Wednesday, December 06, 2006 1:42 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng] logrotate again... Well, this did not work, but it was sucessful at wiping out the entire contents of the file altogether :-( Regards, .vp >From: "Justin Randall" <jrandall(a)comwave.net> >Slight correction on the command syntax: > > > find /var/log -type f -exec sed -if <sed script filename> {} \; > >Should be > >find /var/log -type f -exec sed -f <sed script filename> --in-place {} >\; > >Cheers. > >-----Original Message----- >From: Justin Randall >Sent: Wednesday, December 06, 2006 11:21 AM >To: 'Syslog-ng users' and developers' mailing list' >Subject: RE: [syslog-ng] logrotate again... > > >find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is >untested, though :) > >If I'm not mistaken this will only remove lines containing '15 Nov'. If >you want something that will eliminate all logs prior to that date you >could write a sed script like the following: > >= begin sed script = >/./,/15 Nov/{ >d >} >= end sed script = > >If you had another date range in mind you could also do the following: > >= begin sed script = >/13 Nov/,/15 Nov/{ >d >} >= end sed script = > >Once you have your sed script simply invoke it similar to the above >method: > >find /var/log -type f -exec sed -if <sed script filename> {} \; > >Hope this helps, > >Justin. > >-----Original Message----- >From: Andrej Ricnik-Bay [mailto:andrej.groups@gmail.com] >Sent: Tuesday, December 05, 2006 3:44 PM >To: Syslog-ng users' and developers' mailing list >Subject: Re: [syslog-ng] logrotate again... > >On 12/6/06, Vadim Pushkin <wiskbroom(a)hotmail.com> wrote: > > > 2. The other issue that I am having is that I wish to rotate now, my > > filesystem is fill, but since I did not rotate, all of my logfiles are >one. > > How can I prune them of any data prior to say 15 Nov for *each* >logfile? >find /var/log -type f -exec sed -i '/15 Nov/d' {} \; >should work - is untested, though :) > > > > Thank you again, > > > > .vp >Cheers _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] logrotate again...
by Justin Randall 06 Dec '06

06 Dec '06

Slight correction on the command syntax: > find /var/log -type f -exec sed -if <sed script filename> {} \; Should be find /var/log -type f -exec sed -f <sed script filename> --in-place {} \; Cheers. -----Original Message----- From: Justin Randall Sent: Wednesday, December 06, 2006 11:21 AM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] logrotate again... >find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is untested, though :) If I'm not mistaken this will only remove lines containing '15 Nov'. If you want something that will eliminate all logs prior to that date you could write a sed script like the following: = begin sed script = /./,/15 Nov/{ d } = end sed script = If you had another date range in mind you could also do the following: = begin sed script = /13 Nov/,/15 Nov/{ d } = end sed script = Once you have your sed script simply invoke it similar to the above method: find /var/log -type f -exec sed -if <sed script filename> {} \; Hope this helps, Justin. -----Original Message----- From: Andrej Ricnik-Bay [mailto:andrej.groups@gmail.com] Sent: Tuesday, December 05, 2006 3:44 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] logrotate again... On 12/6/06, Vadim Pushkin <wiskbroom(a)hotmail.com> wrote: > 2. The other issue that I am having is that I wish to rotate now, my > filesystem is fill, but since I did not rotate, all of my logfiles are one. > How can I prune them of any data prior to say 15 Nov for *each* logfile? find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is untested, though :) > Thank you again, > > .vp Cheers _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syntax error 47
by Brian Long 06 Dec '06

06 Dec '06

Hello, I just upgraded my syslog-ng installation on debian and when it restarts I get this error: root@lancelot:/etc/init.d# /etc/init.d/syslog-ng restart Stopping system logging: syslog-ng not running. Starting system logging: syslog-ngsyntax error at 47 start failed. Syslog-ng works swimmingly on an identical debian system. Anyone know how I can get past this syntax error? Many thanks, Brian Long

3 2

RE: [syslog-ng] logrotate again...
by Justin Randall 06 Dec '06

06 Dec '06

>find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is untested, though :) If I'm not mistaken this will only remove lines containing '15 Nov'. If you want something that will eliminate all logs prior to that date you could write a sed script like the following: = begin sed script = /./,/15 Nov/{ d } = end sed script = If you had another date range in mind you could also do the following: = begin sed script = /13 Nov/,/15 Nov/{ d } = end sed script = Once you have your sed script simply invoke it similar to the above method: find /var/log -type f -exec sed -if <sed script filename> {} \; Hope this helps, Justin. -----Original Message----- From: Andrej Ricnik-Bay [mailto:andrej.groups@gmail.com] Sent: Tuesday, December 05, 2006 3:44 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] logrotate again... On 12/6/06, Vadim Pushkin <wiskbroom(a)hotmail.com> wrote: > 2. The other issue that I am having is that I wish to rotate now, my > filesystem is fill, but since I did not rotate, all of my logfiles are one. > How can I prune them of any data prior to say 15 Nov for *each* logfile? find /var/log -type f -exec sed -i '/15 Nov/d' {} \; should work - is untested, though :) > Thank you again, > > .vp Cheers _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Re: Tool to determine facility and severity from syslog packets
by G.W. Haywood 06 Dec '06

06 Dec '06

Hi there, On Wed, 6 Dec 2006 Paul Krizak wrote: > # The big monolithic syslog file > destination d_big_messages { > file ( > "/var/log/logs/messages.log" How about # The several separate syslog files destination d_separated_messages { file ( "/var/log/logs/$FACILITY.log" etc.? -- 73, Ged.

2 1

Rewriting log messages
by John Morrissey 05 Dec '06

05 Dec '06

We've been using the syslog-ng-anon patch[1] to rewrite log traffic (mainly to remove the redundant integer timestamp logged by qmail-pop3d via splogger(8)). We're looking at the upcoming syslog-ng 2.0 upgrade that's coming with the next Debian release (etch) and haven't been able to find an equivalent. I saw a request or two[2] for a feature like this, but don't see it in the latest syslog-ng source or docs. Is a feature like this planned, or is there another way I can go about rewriting log traffic? thanks, john [1] http://dev.riseup.net/privacy/syslog-ng-anon/ [2] https://lists.balabit.hu/pipermail/syslog-ng/2006-August/009129.html -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

4 3

Re: [syslog-ng] Tool to determine facility and severity from syslog packets
by G.W. Haywood 05 Dec '06

05 Dec '06

Hi there, On Tue, 5 Dec 2006, "Justin Shore" wrote: > Does anyone know of a tool to read the facility and severity info from > inbound syslog packets? I have a number of devices that are sending me > syslog info and I can't determine what facility they're using. >From your description I'm not sure exactly what your problems are, but _if_ you're using syslog-ng (if not, why not?!:) and _if_ I understand what you need then I think I would simply create two sets of temporary logfiles: one set would log everything at every severity and the other would log everything at every facility. Then I'd look in the logs to see if I recognized any of the output. A lot simpler and, er, more deterministic than hacking C and/or Perl. -- 73, Ged.

2 1

Tool to determine facility and severity from syslog packets
by Justin Shore 05 Dec '06

05 Dec '06

Does anyone know of a tool to read the facility and severity info from inbound syslog packets? I have a number of devices that are sending me syslog info and I can't determine what facility they're using. These devices can't be set to use specific facilities unfortunately. It would be ideal if I could read the data out of a raw dump from tcpdump or at least be able to bind it to 514/udp and prepend facility/severity info on each log line. Along the same lines it would be sweet if there was a way to rewrite the facility information in inbound syslog packets (based on source IP) before passing them to your favorite syslog server. This would be ideal for occasions such as this. Any info would be greatly appreciated. Thanks Justin

4 3

RE: [syslog-ng] Tool to determine facility and severity from
by Justin Shore 05 Dec '06

05 Dec '06

That's an interesting idea. I mess around with Perl when the need arrises but only on a very small scale; I'm not a programmer. I may try this some time. The whole proxy idea is a bit of an offshoot of my original problem (and the ultimate cause of the problem being a vendor that won't let you define the facility). I can see the problems of placing a proxy in between the loghost and sender. I figured syslog-ng could probably be bound to an oddball port so that the proxy could then listn on 514 and forward the rewritten messages to the oddball. This is terribly crucial though. I would be handy to mess with until I can convince these vendors to join the rest of the technological world and add this basic feature. I do need to be able to recognize the incoming messages somehow though so that I can stick them appropriate log file, store info level data in one log that is rotated weekly and kept for a year, and then store debug info in another log file that is rotated weekly and kept for only a single week. Otherwise drive space will become a major issue. For example, I have 1 firewall that is sending me 4.5GB of data each day. Without this basic log sorting and rotation setup I'd run out of drive space within a few days. I'll probably looking into matching each host by the source IP. That might be easiest in the long-term for these oddball hosts. I haven't set up syslog-ng so this could be an interesting experience. Thanks for the info Justin -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Alexander Clouter Sent: Tuesday, December 05, 2006 3:48 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Tool to determine facility and severity from Hi, Heiko Blume <Heiko(a)Blume.AG> [20061205 10:32:19 +0100]: > > probably with the sniffer from ethereal.com > I would be more inclinded to use a Perl module: http://search.cpan.org/~sparsons/Net-Dev-Syslog-0.8.0/Syslog.pm It will create a mini-syslog server, decode the packets for you and then it would be trivial, if you know perl, to re-inject them with the same module or a different one: http://search.cpan.org/~saper/Sys-Syslog-0.18/Syslog.pm If you do not know perl you probably will find this is a nice mini-project to introduce you to the language. Its damn handy to be able to throw together a quick hack script to do jobs like this; means you no longer have to rely on the hope that someone else has done this already otherwise you would be out of options. The problem you are going to run into is that you have to have effectively a syslog proxy on another machine, or a second IP bound to your syslog core server. You cannot have this 'rewriter' and syslog-ng on the same box as both will be trying to listen on the same port; well you could pick different IP's for them to bind to though. By the sounds of it you really want to create a syslog-ng filter that has a list of IP's and hardcode in the facility and extract the severity there. To be honest if the facility is fixed then really there is no information you can extract that you could not determine "well it came from this IP therefore it has the *fixed* facility xyz". As for severity, its probably worth just grepping for keywords in the message for what you are looking for anyway. Thats where programs like swatch can help. Of course I might have missed completely what you are trying to accomplish, if so give a few more details and I'll try to help. Cheers Alex > regards, hb > > > Does anyone know of a tool to read the facility and severity info > > from inbound syslog packets? I have a number of devices that are > > sending me syslog info and I can't determine what facility they're > > using. These devices can't be set to use specific facilities > > unfortunately. It would be ideal if I could read the data out of a > > raw dump from tcpdump or at least be able to bind it to 514/udp and > > prepend facility/severity info on each log line. > > > > Along the same lines it would be sweet if there was a way to rewrite > > the facility information in inbound syslog packets (based on source > > IP) before passing them to your favorite syslog server. This would > > be ideal for occasions such as this. > > > > Any info would be greatly appreciated. Thanks > > > > Justin > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > > http://www.campin.net/syslog-ng/faq.html > > > > > > > -- > Heiko(a)Blume.AG > > Cisco Certified Network Professional > Cisco Certified Design Professional > Juniper Certified Internet Specialist > SUN Certified System Administrator > > > Office: +49.30/4426309 > FAX: +49.30/48494354 > Mobile: +49.178/6662342 > www: http://www.blume.ag/IT/ > PHY: Knaackstrasse 6, 10405 Berlin, DE > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] Tool to determine facility and severity from syslogpackets
by Justin Shore 05 Dec '06

05 Dec '06

Thanks for the reply. I was hoping to avoid doing it the hard way if at all possible. Setting up 24 separate facilities, one at a time, and checking my logs for recognizable output doesn't sound like a fun Friday night. I figured someone out there had a trick to do this. All the syslog message generation tools have the ability to set facility and severity. Somewhere along the way I figured someone would have created a tool to help test those tools. I may do this if I absolutely have to but I'm still going to hold out for a while on a script or tool that can do this for me. Thanks for the info Justin -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of G.W. Haywood Sent: Tuesday, December 05, 2006 6:07 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] Tool to determine facility and severity from syslogpackets Hi there, On Tue, 5 Dec 2006, "Justin Shore" wrote: > Does anyone know of a tool to read the facility and severity info from > inbound syslog packets? I have a number of devices that are sending > me syslog info and I can't determine what facility they're using. >From your description I'm not sure exactly what your problems are, but _if_ you're using syslog-ng (if not, why not?!:) and _if_ I understand what you need then I think I would simply create two sets of temporary logfiles: one set would log everything at every severity and the other would log everything at every facility. Then I'd look in the logs to see if I recognized any of the output. A lot simpler and, er, more deterministic than hacking C and/or Perl. -- 73, Ged. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Managing hostnames
by Olivier DUCROT 05 Dec '06

05 Dec '06

Hello list I¹m trying to configure syslog-ng with multiple mail server sources. It works fine, but I want a little more : The two line below shows what¹s happening : Dec 5 12:30:37 auxey postfix/smtpd[16360]: <- original log on the mail server Dec 5 12:30:37 auxey/auxey postfix/smtpd[16360]: <- log stored localy by syslog-ng shortname appeared twice separated by ³/² Here¹s my configuration : On auxey : /etc/syslog.conf mail.* @syslogserver.mydomain.com:514 On syslogserver.mydomain.com : /usr/local/etc/syslog-ng.conf options { create_dirs(yes); keep_hostname(no); }; source net { udp(); }; destination d_auxey { file("/var/log/tracemail/auxey.log"); }; destination d_hermes { file("/var/log/tracemail/hermes.log"); }; filter f_auxey { host("auxey"); }; filter f_hermes { host("hermes"); }; log { source(net); filter(f_auxey); destination(d_auxey); }; log { source(net); filter(f_hermes); destination(d_hermes); }; I tried with keep_hostname(no); and keep_hostname(yes);and without the option with the same result Any idea ?

1 1

syslog-ng 2.0.0 successful on Mac OS X Tiger
by Usman Wahid 04 Dec '06

04 Dec '06

Hi, I am getting the following error message, while compiling syslog-ng-2.0 on Mac OS X server 10.4.6, dnscache.c: In function 'dns_cache_key_hash': dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' dnscache.c:80: error: 'struct in6_addr' has no member named 's6_addr32' make[2]: *** [dnscache.o] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 I am using eventlog-0.2.6, glib-2.12.4 and pkg-config-0.21. Any ideas to solve the problem? Regards. _________________________________________________________________ Get MSN Messenger emoticons and display pictures here! http://ilovemessenger.msn.com/?mkt=en-sg

2 1

syslog-ng 2.0.0 compile problem
by Buozis, Martynas 02 Dec '06

02 Dec '06

Hello I tried to compile syslog-ng on Solaris 10 with Sun Studio 11 using following configure line : PKG_CONFIG_PATH=/opt/eventlog/lib/pkgconfig/ GLIB_LIBS=/opt/glib/lib/ CC=cc CXX=CC ./configure --prefix=/opt/syslog-ng --sysconfdir=/opt/syslog-ng/ I have compiled Eventlog and GLIB (statistically) with same compiler. Alas configure returns error: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or insta ll a static Glib What I found in config.log is a syntax problem in test code? Can this be fixed somehow by some patch or workaround? I also think, that compile line is also not correct : configure:5687: cc -o conftest -g conftest.c -Wl,-Bstatic /opt/glib/lib/ -Wl,-Bdynamic >&5 "conftest.c", line 52: syntax error before or at: { "conftest.c", line 55: undefined symbol: fn "conftest.c", line 59: warning: syntax error: empty declaration "conftest.c", line 60: syntax error before or at: return "conftest.c", line 60: warning: syntax error: empty declaration cc: acomp failed for conftest.c configure:5693: $? = 2 configure: failed program was: | /* confdefs.h. */ | | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define PACKAGE "syslog-ng" | #define VERSION "2.0.0" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 | #define HAVE_STRING_H 1 | #define HAVE_MEMORY_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_INTTYPES_H 1 | #define HAVE_STDINT_H 1 | #define HAVE_UNISTD_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_GETOPT_H 1 | #define HAVE_STROPTS_H 1 | #define HAVE_SYS_STRLOG_H 1 | #define HAVE_DOOR_H 1 | #define HAVE_O_LARGEFILE 1 | #define HAVE_LIBDOOR 1 | #define HAVE_LIBSOCKET 1 | #define HAVE_LIBRT 1 | #define HAVE_LIBNSL 1 | #define HAVE_STRDUP 1 | #define HAVE_STRTOL 1 | #define HAVE_INET_NTOA 1 | #define HAVE_GETOPT_LONG 1 | #define HAVE_GETADDRINFO 1 | #define HAVE_PTHREAD_H 1 | #define HAVE_LIBPTHREAD 1 | #define ENABLE_SUN_STREAMS 1 | #define ENABLE_SUN_DOOR 1 | #define ENABLE_DEBUG 0 | #define ENABLE_MEM_TRACE 0 | #define ENABLE_SSL 0 | #define ENABLE_IPV6 1 | /* end confdefs.h. */ | | int | main () | { | | extern void g_hash_table_new(void); | | int main() | { | void (*fn)(void) = g_hash_table_new; | | return (int) fn; | } | | | ; | return 0; | } configure:5717: result: no configure:5728: error: static GLib libraries not found (a file named libglib-2.0.a), either link GLib dynamically using the --enable-dynamic-linking or insta ll a static Glib I can fix above code with look like : /* end confdefs.h. */ extern void g_hash_table_new(void); int main () { void (*fn)(void) = g_hash_table_new; return (int) fn; } And compile it with command : cc -o test -g test.c -Wl,-Bstatic /opt/glib/lib/libglib-2.0.a -Wl,-Bdynamic With best regards Martynas

4 3

FW: Make file on RHEL3
by Quinn, Martin 01 Dec '06

01 Dec '06

> I have a problem with compiling syslog-ng on RHEL3, have been able to > run configure,etc, but when I issue make command the following error > occurs. Any help would be much appreciated. > Thanks > > make > make all-recursive > make[1]: Entering directory `/etc/syslog-ng' > Making all in src > make[2]: Entering directory `/etc/syslog-ng/src' > if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/include/glib-1.2 > -I/usr/lib/glib/include -I/usr/local/include/eventlog > -D_GNU_SOURCE -g -O2 -Wall -g -MT misc.o -MD -MP -MF ".deps/misc.Tpo" > \ > -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ > then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ > else rm -f ".deps/misc.Tpo"; exit 1; \ > fi > In file included from misc.h:27, > from misc.c:24: > syslog-ng.h:37:18: glib.h: No such file or directory > In file included from misc.h:28, > from misc.c:24: > gsockaddr.h:42: syntax error before "gint" > gsockaddr.h:42: warning: no semicolon at end of struct or union > gsockaddr.h:43: warning: type defaults to `int' in declaration of > `flags' > gsockaddr.h:43: warning: data definition has no type or storage class > gsockaddr.h:47: syntax error before '}' token > gsockaddr.h:47: warning: type defaults to `int' in declaration of > `GSockAddr' > gsockaddr.h:47: warning: data definition has no type or storage class > gsockaddr.h:51: syntax error before "GIOStatus" > gsockaddr.h:51: warning: no semicolon at end of struct or union > gsockaddr.h:52: syntax error before '*' token > gsockaddr.h:52: syntax error before "GSockAddr" > gsockaddr.h:52: warning: type defaults to `int' in declaration of > `GIOStatus' > gsockaddr.h:52: `GIOStatus' declared as function returning a function > gsockaddr.h:52: warning: data definition has no type or storage class > gsockaddr.h:53: syntax error before '*' token > gsockaddr.h:53: syntax error before '*' token > gsockaddr.h:55: warning: type defaults to `int' in declaration of > `sa_format' > gsockaddr.h:55: warning: data definition has no type or storage class > gsockaddr.h:56: syntax error before '*' token > gsockaddr.h:59: syntax error before '*' token > gsockaddr.h:59: warning: type defaults to `int' in declaration of > `g_sockaddr_new' > gsockaddr.h:59: warning: data definition has no type or storage class > gsockaddr.h:60: syntax error before '*' token > gsockaddr.h:60: syntax error before '*' token > gsockaddr.h:60: warning: type defaults to `int' in declaration of > `g_sockaddr_format' > gsockaddr.h:60: warning: data definition has no type or storage class > gsockaddr.h:61: syntax error before '*' token > gsockaddr.h:61: syntax error before '*' token > gsockaddr.h:61: warning: type defaults to `int' in declaration of > `g_sockaddr_ref' > gsockaddr.h:61: warning: data definition has no type or storage class > gsockaddr.h:62: syntax error before '*' token > gsockaddr.h:64: syntax error before "g_sockaddr_inet_check" > gsockaddr.h:64: syntax error before '*' token > gsockaddr.h:64: warning: type defaults to `int' in declaration of > `g_sockaddr_inet_check' > gsockaddr.h:64: warning: data definition has no type or storage class > gsockaddr.h:65: syntax error before '*' token > gsockaddr.h:65: syntax error before '*' token > gsockaddr.h:65: warning: type defaults to `int' in declaration of > `g_sockaddr_inet_new' > gsockaddr.h:65: warning: data definition has no type or storage class > gsockaddr.h:66: syntax error before '*' token > gsockaddr.h:66: warning: type defaults to `int' in declaration of > `g_sockaddr_inet_new2' > gsockaddr.h:66: warning: data definition has no type or storage class > gsockaddr.h:67: syntax error before '*' token > gsockaddr.h:67: syntax error before '*' token > gsockaddr.h:67: warning: type defaults to `int' in declaration of > `g_sockaddr_inet_range_new' > gsockaddr.h:67: warning: data definition has no type or storage class > gsockaddr.h:70: syntax error before '*' token > gsockaddr.h: In function `g_sockaddr_get_sa': > gsockaddr.h:72: `self' undeclared (first use in this function) > gsockaddr.h:72: (Each undeclared identifier is reported only once > gsockaddr.h:72: for each function it appears in.) > gsockaddr.h: At top level: > gsockaddr.h:76: syntax error before '*' token > gsockaddr.h: In function `g_sockaddr_inet_get_sa': > gsockaddr.h:78: warning: implicit declaration of function `g_assert' > gsockaddr.h:78: `s' undeclared (first use in this function) > gsockaddr.h: At top level: > gsockaddr.h:92: syntax error before '*' token > gsockaddr.h: In function `g_sockaddr_inet_get_address': > gsockaddr.h:94: `s' undeclared (first use in this function) > gsockaddr.h: At top level: > gsockaddr.h:106: syntax error before '*' token > gsockaddr.h: In function `g_sockaddr_inet_set_address': > gsockaddr.h:108: `s' undeclared (first use in this function) > gsockaddr.h:108: `addr' undeclared (first use in this function) > gsockaddr.h: At top level: > gsockaddr.h:122: syntax error before "g_sockaddr_inet_get_port" > gsockaddr.h:122: syntax error before '*' token > gsockaddr.h:123: warning: return type defaults to `int' > gsockaddr.h: In function `g_sockaddr_inet_get_port': > gsockaddr.h:124: `s' undeclared (first use in this function) > In file included from misc.h:28, > from misc.c:24: > gsockaddr.h: At top level: > gsockaddr.h:135: syntax error before '*' token > gsockaddr.h: In function `g_sockaddr_inet_set_port': > gsockaddr.h:137: `s' undeclared (first use in this function) > gsockaddr.h:137: `port' undeclared (first use in this function) > gsockaddr.h: At top level: > gsockaddr.h:143: syntax error before "g_sockaddr_inet6_check" > gsockaddr.h:143: syntax error before '*' token > gsockaddr.h:143: warning: type defaults to `int' in declaration of > `g_sockaddr_inet6_check' > gsockaddr.h:143: warning: data definition has no type or storage class > gsockaddr.h:144: syntax error before '*' token > gsockaddr.h:144: syntax error before '*' token > gsockaddr.h:144: warning: type defaults to `int' in declaration of > `g_sockaddr_inet6_new' > gsockaddr.h:144: warning: data definition has no type or storage class > gsockaddr.h:145: syntax error before '*' token > gsockaddr.h:145: warning: type defaults to `int' in declaration of > `g_sockaddr_inet6_new2' > gsockaddr.h:145: warning: data definition has no type or storage class > gsockaddr.h:148: syntax error before '*' token > gsockaddr.h: In function `g_sockaddr_inet6_get_sa': > gsockaddr.h:150: `s' undeclared (first use in this function) > gsockaddr.h: At top level: > gsockaddr.h:163: syntax error before '*' token > gsockaddr.h: In function `g_sockaddr_inet6_get_address': > gsockaddr.h:165: `s' undeclared (first use in this function) > gsockaddr.h: At top level: > gsockaddr.h:177: syntax error before '*' token > gsockaddr.h: In function `g_sockaddr_inet6_set_address': > gsockaddr.h:179: `s' undeclared (first use in this function) > gsockaddr.h:179: `addr' undeclared (first use in this function) > gsockaddr.h: At top level: > gsockaddr.h:193: syntax error before "g_sockaddr_inet6_get_port" > gsockaddr.h:193: syntax error before '*' token > gsockaddr.h:194: warning: return type defaults to `int' > gsockaddr.h: In function `g_sockaddr_inet6_get_port': > gsockaddr.h:195: `s' undeclared (first use in this function) > In file included from misc.h:28, > from misc.c:24: > gsockaddr.h: At top level: > gsockaddr.h:206: syntax error before '*' token > gsockaddr.h: In function `g_sockaddr_inet6_set_port': > gsockaddr.h:208: `s' undeclared (first use in this function) > gsockaddr.h:208: `port' undeclared (first use in this function) > gsockaddr.h: At top level: > gsockaddr.h:212: syntax error before '*' token > gsockaddr.h:212: syntax error before '*' token > gsockaddr.h:212: warning: type defaults to `int' in declaration of > `g_sockaddr_unix_new' > gsockaddr.h:212: warning: data definition has no type or storage class > gsockaddr.h:213: syntax error before '*' token > gsockaddr.h:213: warning: type defaults to `int' in declaration of > `g_sockaddr_unix_new2' > gsockaddr.h:213: warning: data definition has no type or storage class > gsockaddr.h:215: syntax error before "g_bind" > gsockaddr.h:215: syntax error before "GSockAddr" > gsockaddr.h:215: warning: type defaults to `int' in declaration of > `g_bind' > gsockaddr.h:215: warning: data definition has no type or storage class > gsockaddr.h:216: syntax error before "g_accept" > gsockaddr.h:216: syntax error before "GSockAddr" > gsockaddr.h:216: warning: type defaults to `int' in declaration of > `g_accept' > gsockaddr.h:216: warning: data definition has no type or storage class > gsockaddr.h:217: syntax error before "g_connect" > gsockaddr.h:217: syntax error before "GSockAddr" > gsockaddr.h:217: warning: type defaults to `int' in declaration of > `g_connect' > gsockaddr.h:217: warning: data definition has no type or storage class > gsockaddr.h:218: syntax error before '*' token > gsockaddr.h:218: warning: type defaults to `int' in declaration of > `g_inet_ntoa' > gsockaddr.h:218: warning: data definition has no type or storage class > gsockaddr.h:219: syntax error before "g_inet_aton" > gsockaddr.h:219: warning: type defaults to `int' in declaration of > `g_inet_aton' > gsockaddr.h:219: warning: data definition has no type or storage class > In file included from misc.c:24: > misc.h:33: syntax error before '*' token > misc.h:33: syntax error before '*' token > misc.h:33: warning: type defaults to `int' in declaration of > `g_string_assign_len' > misc.h:33: warning: data definition has no type or storage class > misc.h:37: syntax error before '*' token > misc.h:39: syntax error before "g_fd_set_nonblock" > misc.h:39: syntax error before "gboolean" > misc.h:39: warning: type defaults to `int' in declaration of > `g_fd_set_nonblock' > misc.h:39: warning: data definition has no type or storage class > misc.h:40: syntax error before "g_fd_set_cloexec" > misc.h:40: syntax error before "gboolean" > misc.h:40: warning: type defaults to `int' in declaration of > `g_fd_set_cloexec' > misc.h:40: warning: data definition has no type or storage class > misc.h:42: syntax error before "resolve_user" > misc.h:42: warning: type defaults to `int' in declaration of > `resolve_user' > misc.h:42: warning: data definition has no type or storage class > misc.h:43: syntax error before "resolve_group" > misc.h:43: warning: type defaults to `int' in declaration of > `resolve_group' > misc.h:43: warning: data definition has no type or storage class > misc.h:44: syntax error before "resolve_user_group" > misc.h:44: warning: type defaults to `int' in declaration of > `resolve_user_group' > misc.h:44: warning: data definition has no type or storage class > misc.h:45: syntax error before "resolve_hostname" > misc.h:45: syntax error before '*' token > misc.h:45: warning: type defaults to `int' in declaration of > `resolve_hostname' > misc.h:45: warning: data definition has no type or storage class > misc.c:40: syntax error before '*' token > misc.c:41: syntax error before '*' token > misc.c:42: warning: return type defaults to `int' > misc.c: In function `g_string_assign_len': > misc.c:43: warning: implicit declaration of function > `g_string_truncate' > misc.c:43: `s' undeclared (first use in this function) > misc.c:44: `val' undeclared (first use in this function) > misc.c:44: `len' undeclared (first use in this function) > misc.c:45: warning: implicit declaration of function > `g_string_append_len' > misc.c: At top level: > misc.c:80: syntax error before '*' token > misc.c: In function `format_zone_info': > misc.c:82: `buf' undeclared (first use in this function) > misc.c:82: `buflen' undeclared (first use in this function) > misc.c:83: `gmtoff' undeclared (first use in this function) > misc.c: At top level: > misc.c:127: syntax error before "resolve_hostname" > misc.c:127: syntax error before '*' token > misc.c:128: warning: return type defaults to `int' > misc.c: In function `resolve_hostname': > misc.c:129: syntax error before "local_hostname" > misc.c:132: `saddr' undeclared (first use in this function) > misc.c:152: `usedns' undeclared (first use in this function) > misc.c:169: `usefqdn' undeclared (first use in this function) > misc.c:178: warning: implicit declaration of function > `g_assert_not_reached' > misc.c:183: `local_hostname' undeclared (first use in this function) > misc.c:193: warning: implicit declaration of function > `g_string_assign' > misc.c:193: `result' undeclared (first use in this function) > misc.c:194: `TRUE' undeclared (first use in this function) > misc.c: At top level: > misc.c:198: syntax error before "g_fd_set_nonblock" > misc.c:198: syntax error before "gboolean" > misc.c:199: warning: return type defaults to `int' > misc.c: In function `g_fd_set_nonblock': > misc.c:202: `fd' undeclared (first use in this function) > misc.c:203: `FALSE' undeclared (first use in this function) > misc.c:204: `enable' undeclared (first use in this function) > misc.c:213: `TRUE' undeclared (first use in this function) > misc.c: At top level: > misc.c:217: syntax error before "g_fd_set_cloexec" > misc.c:217: syntax error before "gboolean" > misc.c:218: warning: return type defaults to `int' > misc.c: In function `g_fd_set_cloexec': > misc.c:221: `fd' undeclared (first use in this function) > misc.c:222: `FALSE' undeclared (first use in this function) > misc.c:223: `enable' undeclared (first use in this function) > misc.c:232: `TRUE' undeclared (first use in this function) > misc.c: At top level: > misc.c:236: syntax error before "resolve_user" > misc.c:237: warning: return type defaults to `int' > misc.c: In function `resolve_user': > misc.c:250: `FALSE' undeclared (first use in this function) > misc.c:252: `TRUE' undeclared (first use in this function) > misc.c: At top level: > misc.c:256: syntax error before "resolve_group" > misc.c:257: warning: return type defaults to `int' > misc.c: In function `resolve_group': > misc.c:270: `FALSE' undeclared (first use in this function) > misc.c:272: `TRUE' undeclared (first use in this function) > misc.c: At top level: > misc.c:276: syntax error before "resolve_user_group" > misc.c:277: warning: return type defaults to `int' > misc.c: In function `resolve_user_group': > misc.c:285: `FALSE' undeclared (first use in this function) > misc.c:288: `TRUE' undeclared (first use in this function) > make[2]: *** [misc.o] Error 1 > make[2]: Leaving directory `/etc/syslog-ng/src' > make[1]: *** [all-recursive] Error 1 > make[1]: Leaving directory `/etc/syslog-ng' > make: *** [all] Error 2 > > > M Quinn > > This is an email from Fujitsu Australia Limited, ABN 19 001 011 427. It is confidential to the ordinary user of the email address to which it was addressed and may contain copyright and/or legally privileged information. No one else may read, print, store, copy or forward all or any of it or its attachments. If you receive this email in error, please return to sender. Thank you. If you do not wish to receive commercial email messages from Fujitsu Australia Limited, please email unsubscribe(a)au.fujitsu.com

1 0

unix_stream socket
by pat.hartemann＠bluewin.ch 30 Nov '06

30 Nov '06

Hello all, I'm configuring syslog-ng 2.0 on a RHEL ES 4 U4 system. One of the destination is an unix stream socket. After the first log writen on this socket, I get the error message : ------------------------------------------------------------------------------------------------------- Nov 27 11:32:30 ch-syslog-1 syslog-ng[10153]: I/O error occurred while writing; fd='8', error='Connection refused (111)' Nov 27 11:32:30 ch-syslog-1 syslog-ng[10153]: Connection broken; time_reopen='10' ------------------------------------------------------------------------------------------------------- I checked the socket with a thin client (perl script) and that's working (whitout restart socket server of course), so I assume this issue comes from syslog-ng, but syslog-ng works as root ... I'm little bit confusing ... Hereby the the dest, template and options configurations. -------------------------------------------------------------------------------------------------------- options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); flush_lines(1); flush_timeout(5000); }; template t_test { template ("$R_STAMP;$S_STAMP;$HOST;$FACILITY;$LEVEL;$PROGRAM;$MSGONLY\n"); }; destination d_test { file("/var/log/test.log" template(t_test)); unix-stream('/var/tmp/syslog_generic.soc' template(t_test));}; --------------------------------------------------------------------------------------------------------- Many thx for your help Ciao patrick

3 3

UI for editing syslog-ng configuration files
by John Svazic 29 Nov '06

29 Nov '06

Hi, Not sure if this is the best forum to ask this question, but I'm not having any luck trolling through Google, Sourceforge and Freshmeat. Does anyone know of any front-end UI (web or GUI) for editing a syslog-ng configuration file? I'm looking for something simple for users who are not familiar with the config file format to take on. Thanks!

5 5

Config parse error in syslog-ng 2.0.0
by Jacek Kalinski 28 Nov '06

28 Nov '06

Hi, I have a config file working fine with syslog-ng-1.6.11. But the same config won't work with 2.0.0. Problem (as I've checked, compiling syslog-ng with YYDEBUG) is in: dir_owner(0); dir_group(0); owner(0); group(0); 2 first lines of config: options { dir_perm(0700); perm(0600); chain_hostnames(no); stats(1200); keep_hostname(yes); dir_owner(0); dir_group(0); owner(0); group(0); }; Debug from checking syntax: ... Reducing stack by rule 212 (line 731), KW_STATS_FREQ '(' NUMBER ')' -> options_item Stack now 0 4 18 73 156 73 156 73 156 Entering state 73 Reading a token: Next token is token ';' () Shifting token ';' () Entering state 156 Reading a token: Next token is token KW_KEEP_HOSTNAME () Shifting token KW_KEEP_HOSTNAME () Entering state 42 Reading a token: Next token is token '(' () Shifting token '(' () Entering state 125 Reading a token: Next token is token KW_YES () Shifting token KW_YES () Entering state 206 Reducing stack by rule 271 (line 868), KW_YES -> yesno Stack now 0 4 18 73 156 73 156 73 156 73 156 42 125 Entering state 211 Reading a token: Next token is token ')' () Shifting token ')' () Entering state 308 Reducing stack by rule 217 (line 736), KW_KEEP_HOSTNAME '(' yesno ')' -> options_item Stack now 0 4 18 73 156 73 156 73 156 73 156 Entering state 73 Reading a token: Next token is token ';' () Shifting token ';' () Entering state 156 Reading a token: Next token is token KW_DIR_OWNER () Shifting token KW_DIR_OWNER () Entering state 66 Reading a token: Next token is token '(' () Shifting token '(' () Entering state 149 Reading a token: Next token is token NUMBER () syntax error at 2 Error: popping token '(' () Stack now 0 4 18 73 156 73 156 73 156 73 156 73 156 66 Error: popping token KW_DIR_OWNER () Stack now 0 4 18 73 156 73 156 73 156 73 156 73 156 Error: popping token ';' () Stack now 0 4 18 73 156 73 156 73 156 73 156 73 Error: popping nterm options_item () Stack now 0 4 18 73 156 73 156 73 156 73 156 Error: popping token ';' () Stack now 0 4 18 73 156 73 156 73 156 73 Error: popping nterm options_item () Stack now 0 4 18 73 156 73 156 73 156 Error: popping token ';' () Stack now 0 4 18 73 156 73 156 73 Error: popping nterm options_item () Stack now 0 4 18 73 156 73 156 Error: popping token ';' () Stack now 0 4 18 73 156 73 Error: popping nterm options_item () Stack now 0 4 18 73 156 Error: popping token ';' () Stack now 0 4 18 73 Error: popping nterm options_item () Stack now 0 4 18 Error: popping token '{' () Stack now 0 4 Error: popping token KW_OPTIONS () Stack now 0 Cleanup: discarding lookahead token NUMBER () When I change 'dir_owner' to: dir_owner(root) next error found is on 'dir_group': Reading a token: Next token is token KW_DIR_GROUP () Shifting token KW_DIR_GROUP () Entering state 67 Reading a token: Next token is token '(' () Shifting token '(' () Entering state 150 Reading a token: Next token is token NUMBER () syntax error at 2 BUT manual, says: dir_owner(uid) User id. documantecion says: â â â âThe default owner of â âdir_owner() âuserid âroot ânewly created â â â â âdirectories. â The same problem with: owner and group options (so all options working with UID/GID). Is it an error in my configuration, or in docs? :) Is it possible to keep compatibility with syslog-1.6 (so use UID/GID instead of username)? Jacek -- Wortal chelloPL: http://chellopl.one.pl Forum dyskusyjne: http://chellopl.one.pl/forum/ Bramka news: http://chellopl.one.pl/bramka/ i inne - sprawdź sam!

2 2

Re: syslog-ng Digest, Vol 15, Issue 12
by dwarnock＠harbrook.net 28 Nov '06

28 Nov '06

I am on holiday from the 17th August returning on Monday the 31st August. If your query is urgent please contact the office on +44 (0)1423 508060 or Neil Harvey on +44 (0)15395 64734 (nharvey(a)harbrook.net) Regards David Warnock

5 9

Weird ${HOST} values
by Wolfram Schlich 27 Nov '06

27 Nov '06

Hi, I just experienced some weird behaviour regarding the resolution of the ${HOST} variable/macro. There seems to be a difference whether the remote log client runs sysklogd or syslog-ng. Basic setup =========== syslog-ng 2.0 log server ------------------------ /etc/hosts: host1.syslog-ng.local 192.168.10.1 host1.sysklogd.local 192.168.20.1 /etc/syslog-ng/syslog-ng.conf: normalize_hostnames(yes); keep_hostname(no); use_dns(yes); use_fqdn(yes); No address or hostname/fqdn is served by a real DNS server, everything is contained in /etc/hosts. Case #1 ======= syslog-ng 2.0 log server ------------------------ /etc/syslog-ng/syslog-ng.conf: chain_hostnames(yes); messages received from sysklogd log clients ------------------------------------------- ${HOST} resolves to host1.sysklogd.local ${FULLHOST} resolves to host1.sysklogd.local/host1.sysklogd.local messages received from syslog-ng 1.6 log clients ------------------------------------------------ ${HOST} resolves to host1 ${FULLHOST} resolves to host1/host1.syslog-ng.local Case #2 ======= syslog-ng 2.0 log server ------------------------ /etc/syslog-ng/syslog-ng.conf: chain_hostnames(no); messages received from sysklogd log clients ------------------------------------------- ${HOST} resolves to host1.sysklogd.local messages received from syslog-ng 1.6 log clients ------------------------------------------------ ${HOST} resolves to host1.syslog-ng.local Where does that difference come from?! Shouldn't syslog-ng on the log server just not care about whatever hostname the log client sent due to keep_hostname(no) and use the data from /etc/hosts? How come that messages directly being sent to the syslog-ng log server are affected by chain_hostnames() *at all*?! Puzzled, Wolfram :)

2 1

Re: Reloading configuration
by G.W. Haywood 27 Nov '06

27 Nov '06

Hi there, On Sat, 25 Nov 2006 syslog-ng-request(a)lists.balabit.hu wrote: > Just a question: We figured that out for ourselves... :) > Can syslog-ng reload its configuration file (changed) without being > restarted? I couldn't find anything related in the documentation. You didn't see the man page? Admittedly it says it isn't up to date, but it does answer the question in the second paragraph of DESCRIPTION. Sending syslog-ng the HUP signal does not restart it (so it will have the same PID as it did before the HUP sinal was received) but it does cause it to re-read its configuration file, and also to close and then reopen any log files. If the new configuration is OK, it will use it. If it isn't, it will carry on using the old one. -- 73, Ged.

2 1

RE: [syslog-ng] Reloading configuration
by Anselmo Lacerda S. de Melo 24 Nov '06

24 Nov '06

4 3

Reloading configuration
by Anselmo Lacerda Silveira de Melo 24 Nov '06

24 Nov '06

Hi Just a question: Can syslog-ng reload its configuration file (changed) without being restarted? I couldn't find anything related in the documentation. Thanks in advance Anselmo -- ------------------------------------- Anselmo Lacerda Silveira de Melo Estagiário de P&D AsGa | *Acesso* | Sistemas | Wireless E-mail: anselmo.melo(a)asga.com.br Skype: anselmo.asga http://www.asga.com.br -------------------------------------

2 1