- syslog-ng - lists.balabit.hu

help- Problem with TCP Based Centralized Log Server using Syslog-ng
by Padmanabhan, Rajeesh (GE Healthcare) 31 Oct '06

31 Oct '06

Hi Im trying to setup a centralized, TCP Based Log Server using Syslog-ng. Syslog-ng server stops accepting logs from clients intermediatley. It works again, once i restart the syslog-ng server. Im getting following error messages from clients. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Oct 18 10:29:28 System1 syslog-ng[11745]: Connection broken; time_reopen='60' Oct 18 15:06:26 RADIUM syslog-ng[4999]: io.c: do_write: write() failed (errno 32), Broken pipe Oct 18 15:06:26 RADIUM syslog-ng[4999]: pkt_buffer::do_flush(): Error flushing data Oct 18 15:06:26 RADIUM syslog-ng[4999]: Connection broken to AF_INET(10.70.201.233:514), reopening in 10 seconds syslog-ng[13843]: Connection failed; error='Connection refused (111)', time_reopen='60 syslog-ng[302]: Error connecting to remote host AF_INET(10.70.201.233:514), reattempting in 10 seconds ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Please help me... Thanks in advance. Rajeesh

2 1

which syslog-ng version support default filter rule to uncaught messages?
by Csuti Istvan 31 Oct '06

31 Oct '06

I use syslog-ng 1.6.5-2.2 on debian sarge, and I try DEFAULT filter to manage uncaught messages. log { source(s_sys); filter(DEFAULT); destination(df_facility_other); }; When I restart syslog-ng daemon, I get a following error message: Starting system logging: syslog-ngunresolved reference: DEFAULT Error initializing configuration, exiting. start failed. The Question: Which syslog-ng version support the DEFAULT filter rule? Or, I must compile the pached source version? Istvan Csuti

2 1

Idea for streaming logs to my workstation as well as logserver
by Hari Sekhon 31 Oct '06

31 Oct '06

I have a cunning idea. When I first set up a logserver, I also had it log to tty12, and a monitor next to my desk of the server with the network logs streaming down the screen. This was very interesting and I managed to pick up quite a lot about my network by noticing when a sudden screen full of information would whizz by instead of the usual incremental logs coming in. I would like to implement something similar by having the logserver also send on it's logs to my linux workstation by way of udp. I could then have my local syslog-ng listen for this udp and write it to a pipe (similar to the way you integrate mysql with syslog-ng). I would then like to have root-tail read from this pipe and output to my X background so that I have a continuous stream of network logs in the background. Are there any pitfalls that you can think of when doing this? I don't think this will risk filling up the bit bucket on the logserver since the logs are immediately sent on via udp, "spray and pray". If they don't get to my workstation for any reason, no harm done, it won't clog up the logserver. I guess the root-tail will take a bit out of my workstation having to draw on the X background all the time but it's a fast machine. I believe that it would block my local syslog-ng on my workstation if the root-tail were to stop reading from it. Which brings me to my next question: Is it better to do root-tail /var/log/logstream.pipe or root-tail - < /var/log/logstream.pipe Since I'm not sure that the first will take the actual throughput away from the pipe to stop the logger from blocking on the sending side. Also, this would require that the my X session not be closed otherwise the root-tail wouldn't be able to run to take away the logs from the other side of the pipe and the local logger would block again. All feedback welcome. Thanks. -h -- Hari Sekhon

2 3

Re: [syslog-ng] runaway programs started by syslog-ng
by Dev Man 30 Oct '06

30 Oct '06

A followup... On a test server, I have noticed that when the system reboots there is one instance of syslog-ng but two instances of the program being executed. There should only be one. If I do a /etc/init.d/syslog-ng restart, then I end up with just one instance of the program as expected, and the system appears to be fine. Any ideas?

3 2

2.0RC4 make warning on OS X 10.4.8 PPC G4
by Mr. Brian Opitz 30 Oct '06

30 Oct '06

System is OS X 10.4.8, Xcode 2.4, PPC G4(2.7), configure --enable-debug --enable-dynamic-linking I am seeing the following warnings during compiling 2.0RC4: logmsg.c: In function 'log_msg_parse': logmsg.c:149: warning: pointer targets in assignment differ in signedness logmsg.c:212: warning: pointer targets in passing argument 2 of 'g_string_assign_len' differ in signedness logmsg.c:214: warning: pointer targets in assignment differ in signedness logmsg.c:232: warning: pointer targets in passing argument 1 of 'strlen' differ in signedness logmsg.c:271: warning: pointer targets in passing argument 2 of 'g_string_assign_len' differ in signedness logmsg.c:309: warning: pointer targets in assignment differ in signedness logmsg.c:313: warning: pointer targets in assignment differ in signedness logmsg.c:344: warning: pointer targets in assignment differ in signedness logmsg.c:378: warning: pointer targets in assignment differ in signedness logmsg.c:389: warning: pointer targets in assignment differ in signedness logmsg.c:401: warning: pointer targets in assignment differ in signedness logmsg.c:413: warning: pointer targets in assignment differ in signedness logmsg.c:435: warning: pointer targets in assignment differ in signedness logmsg.c:440: warning: pointer targets in assignment differ in signedness logmsg.c:445: warning: pointer targets in passing argument 2 of 'g_string_assign_len' differ in signedness and: affile.c: In function 'affile_dd_init': affile.c:456: warning: comparison is always false due to limited range of data type affile.c:462: warning: comparison is always false due to limited range of data type and: afuser.c: In function 'afuser_dd_queue': afuser.c:57: warning: implicit declaration of function 'getutent' afuser.c:57: warning: assignment makes pointer from integer without a cast and finally: gsockaddr.c: In function 'g_accept': gsockaddr.c:116: warning: pointer targets in passing argument 3 of 'accept' differ in signedness Can these safely be ignored or is there something that needs to be changed to make them go away? --

5 5

Re: [syslog-ng] runaway programs started by syslog-ng
by Dev Man 27 Oct '06

27 Oct '06

No, the program does not fork or execute any other programs. It just processes input from syslog and does some inserts into a database. Due to the out of control restarts, they end up hogging up database connections, too. :( --===============0443184984== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6FA0C.AE82AFEE" This is a multi-part message in MIME format. Simple question which may help: does your program fork() or daemon() into a "background" process? This would explain the behavior you're seeing, and should be relatively easy to work around. Hope that helps. Good luck, Peter Nahas MRV Communications - Boston Division ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Dev Man Sent: Friday, October 27, 2006 3:38 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] runaway programs started by syslog-ng Hi Bazsi, How would having that switch help? The problem is we do want it to automatically restart. It just appears that there are some scenarios which we haven't figure out.. in which the program gets restarted repeatedly leaving apparently multiple instances running. How do you determine when to restart? Thanks! On Fri, 2006-10-27 at 10:59 -0700, Dev Man wrote: > > Hi, > > We have experienced cases of syslog-ng apparently launching multiple > instances of the same program unexpectedly, causing the machine to > become unusable. Some of the launched processes can end up defunct, > but not all appeared to be when we checked the running processes. > > Isn't syslog-ng only supposed to start a program if it was terminated? > > In one case, we were seeing a constant stream of "duplicate stats > counter" messages like: > syslog.1:Oct 26 06:27:10 in-mta syslog-ng[29833]: Duplicate stats > counter; counter='program(/home/readlog/readlog.php)' > > One machine was using syslog-ng version 1.9.11 and another version > 2.0rc1. 2.0.x (and 1.9.x which was development versions for 2.0) restart program() destinations by default. I'll add a switch to disable that behaviour as it is hardwired at the moment. -- Bazsi [Attachment #3 (text/html)] <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=Content-Type content="text/html; charset=us-ascii"> <META content="MSHTML 6.00.2900.2963" name=GENERATOR></HEAD> <BODY> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2>Simple question which may help: does your program fork() or daemon() into a "background" process?  This would explain the behavior you're seeing, and should be relatively easy to work around.</FONT></SPAN></DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2></FONT></SPAN> </DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2>Hope that helps.</FONT></SPAN></DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2></FONT></SPAN> </DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2></FONT></SPAN> </DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2>Good luck,</FONT></SPAN></DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2></FONT></SPAN> </DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2>Peter Nahas</FONT></SPAN></DIV> <DIV dir=ltr align=left><SPAN class=510391021-27102006><FONT face=Arial color=#0000ff size=2>MRV Communications - Boston Division</FONT></SPAN><BR></DIV> <DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left> <HR tabIndex=-1> <FONT face=Tahoma size=2><B>From:</B> syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] <B>On Behalf Of </B>Dev Man<BR><B>Sent:</B> Friday, October 27, 2006 3:38 PM<BR><B>To:</B> syslog-ng(a)lists.balabit.hu<BR><B>Subject:</B> Re: [syslog-ng] runaway programs started by syslog-ng<BR></FONT><BR></DIV> <DIV></DIV> <DIV> </DIV> <DIV>Hi Bazsi,</DIV> <DIV> </DIV> <DIV>How would having that switch help?</DIV> <DIV>The problem is we do want it to automatically restart.  It just appears that there are some scenarios which we haven't figure out.. in which the program gets restarted repeatedly leaving apparently multiple instances running. </DIV> <DIV> </DIV> <DIV>How do you determine when to restart?</DIV> <DIV> </DIV> <DIV>Thanks!</DIV> <DIV><PRE>On Fri, 2006-10-27 at 10:59 -0700, Dev Man wrote: > > Hi, > > We have experienced cases of syslog-ng apparently launching multiple > instances of the same program unexpectedly, causing the machine to > become unusable. Some of the launched processes can end up defunct, > but not all appeared to be when we checked the running processes. > > Isn't syslog-ng only supposed to start a program if it was terminated? > > In one case, we were seeing a constant stream of "duplicate stats > counter" messages like: > syslog.1:Oct 26 06:27:10 in-mta syslog-ng[29833]: Duplicate stats > counter; counter='program(/home/readlog/readlog.php)' > > One machine was using syslog-ng version 1.9.11 and another version > 2.0rc1. 2.0.x (and 1.9.x which was development versions for 2.0) restart program() destinations by default. I'll add a switch to disable that behaviour as it is hardwired at the moment. -- Bazsi</PRE></DIV></BODY></HTML> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] runaway programs started by syslog-ng
by Peter Nahas 27 Oct '06

27 Oct '06

Simple question which may help: does your program fork() or daemon() into a "background" process? This would explain the behavior you're seeing, and should be relatively easy to work around. Hope that helps. Good luck, Peter Nahas MRV Communications - Boston Division ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Dev Man Sent: Friday, October 27, 2006 3:38 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] runaway programs started by syslog-ng Hi Bazsi, How would having that switch help? The problem is we do want it to automatically restart. It just appears that there are some scenarios which we haven't figure out.. in which the program gets restarted repeatedly leaving apparently multiple instances running. How do you determine when to restart? Thanks! On Fri, 2006-10-27 at 10:59 -0700, Dev Man wrote: > > Hi, > > We have experienced cases of syslog-ng apparently launching multiple > instances of the same program unexpectedly, causing the machine to > become unusable. Some of the launched processes can end up defunct, > but not all appeared to be when we checked the running processes. > > Isn't syslog-ng only supposed to start a program if it was terminated? > > In one case, we were seeing a constant stream of "duplicate stats > counter" messages like: > syslog.1:Oct 26 06:27:10 in-mta syslog-ng[29833]: Duplicate stats > counter; counter='program(/home/readlog/readlog.php)' > > One machine was using syslog-ng version 1.9.11 and another version > 2.0rc1. 2.0.x (and 1.9.x which was development versions for 2.0) restart program() destinations by default. I'll add a switch to disable that behaviour as it is hardwired at the moment. -- Bazsi

1 0

Re: [syslog-ng] runaway programs started by syslog-ng
by Dev Man 27 Oct '06

27 Oct '06

Hi Bazsi, How would having that switch help? The problem is we do want it to automatically restart. It just appears that there are some scenarios which we haven't figure out.. in which the program gets restarted repeatedly leaving apparently multiple instances running. How do you determine when to restart? Thanks! On Fri, 2006-10-27 at 10:59 -0700, Dev Man wrote: > > Hi, > > We have experienced cases of syslog-ng apparently launching multiple > instances of the same program unexpectedly, causing the machine to > become unusable. Some of the launched processes can end up defunct, > but not all appeared to be when we checked the running processes. > > Isn't syslog-ng only supposed to start a program if it was terminated? > > In one case, we were seeing a constant stream of "duplicate stats > counter" messages like: > syslog.1:Oct 26 06:27:10 in-mta syslog-ng[29833]: Duplicate stats > counter; counter='program(/home/readlog/readlog.php)' > > One machine was using syslog-ng version 1.9.11 and another version > 2.0rc1. 2.0.x (and 1.9.x which was development versions for 2.0) restart program() destinations by default. I'll add a switch to disable that behaviour as it is hardwired at the moment. -- Bazsi

1 0

runaway programs started by syslog-ng
by Dev Man 27 Oct '06

27 Oct '06

Hi, We have experienced cases of syslog-ng apparently launching multiple instances of the same program unexpectedly, causing the machine to become unusable. Some of the launched processes can end up defunct, but not all appeared to be when we checked the running processes. Isn't syslog-ng only supposed to start a program if it was terminated? In one case, we were seeing a constant stream of "duplicate stats counter" messages like: syslog.1:Oct 26 06:27:10 in-mta syslog-ng[29833]: Duplicate stats counter; counter='program(/home/readlog/readlog.php)' One machine was using syslog-ng version 1.9.11 and another version 2.0rc1. Any suggestions? Thanks. D

2 1

Re: [syslog-ng] use syslog-ng to monitor just couple of processes
by Hari Sekhon 27 Oct '06

27 Oct '06

I've not used rsyslog myself, but it seems a lot closer to the old syslog than syslog-ng which is quite different and very flexible. Rsyslog seems to do most of the things that syslog-ng does so I guess it might be down to which you personally prefer. Syslog-ng seems more prevalent, and although rsyslog seems to have built in mysql support, whereas syslog-ng uses a tiny glue shell script, the syslog-ng way works well enough too. I run my central logserver this way and it is reliable. Neither of these things really support web interfaces to my knowledge. My web interface is an interface to mysql, nothing to do with syslog-ng.... -h Hari Sekhon Tiger Peng wrote: > Hi, Hari: > Thanks a lot, since I also consider to dump the > syslog-ng log to database (MySQL or Oracle), do you > think it is better to choose the syslog-ng, or > rsyslog, it looks like the syslog-ng has better web > interface supporting, but rsyslog has the better built > in MySQL database support. > Definitely, I will take your advice to read through > all the syslog-ng documents and FAQ. Thanks again. > > > > David > > = = = Original message = = = > > ? > > You don't use syslog-ng in this way. For what you want > to do you should make your application output the > information you want to the standard syslog and use > syslog-ng as your logger. Then use filters to extract > the messages you want the launch an external program > to email them off to you or something. That is what I > did. A few lines of code, some regex filtering with > syslog-ng definitions is all it takes. > > Now you have all the pointers, you can read the docs > on filtering, program(), etc. > Although it sounds like you don't have a good grasp of > the whole logging thing yet so my advice is to read > all the syslog-ng docs and faq. They are worth the > read. > > -h > > > > Hari Sekhon > > Tiger Peng wrote: > > I have two questions about how to use the > syslog-ng to monitor just couple of processes. > In my case, I try to use some kind of utility to > just monitor 4 to 8 different processes, some of them > are system resource, but some of them are new > developed processes. Here are my questions. > > 1. can I start a seperate syslog-ng, I mean if I can > keep syslogd running, but start another syslog-ng > process to dedicate the service for my special > purpose. > > 2. I guess syslog-ng has some kind of filter which can > filter the information, but how can I expand it > ability to receive some specific information or more > field, such as message ID. Is this configurable, or I > must modify the source to support it. > > Thanks. > > > > David > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > ___________________________________________________________ > Sent by ePrompter, the premier email notification > software. > Free download at http://www.ePrompter.com. > >

1 0

use syslog-ng to monitor just couple of processes
by Tiger Peng 27 Oct '06

27 Oct '06

I have two questions about how to use the syslog-ng to monitor just couple of processes. In my case, I try to use some kind of utility to just monitor 4 to 8 different processes, some of them are system resource, but some of them are new developed processes. Here are my questions. 1. can I start a seperate syslog-ng, I mean if I can keep syslogd running, but start another syslog-ng process to dedicate the service for my special purpose. 2. I guess syslog-ng has some kind of filter which can filter the information, but how can I expand it ability to receive some specific information or more field, such as message ID. Is this configurable, or I must modify the source to support it. Thanks. David

2 1

beginner's question about how to use Java to write log to syslog-ng
by Tiger Peng 26 Oct '06

26 Oct '06

I am the beginner of the syslog-ng, and have a very basic question. How to use Java to write the system log to syslog-ng? Is the same syslogger wrapper can be used here? Another suggestion is that the list didn't have the search ability, it should be very helpful to have it, I believe a lot of people do like to see it. Thanks. David

2 1

building 2.0 on freebsd
by Vivek Khera 25 Oct '06

25 Oct '06

I'm attempting to install 2.0 daily snapshot from 12 october onto a freebsd 6.1 system. From the FAQ I see that it needs to have glib installed, which was easy. However, the configure is not able to find the eventlib library. I cannot find what provides this library. My searches all keep pointing to something which is part of bind, which seems not right to me. What do I need to install to get eventlib on this system?

2 4

A database connection problem was encountered.
by tagarsi, arun 25 Oct '06

25 Oct '06

Hi, I have installed syslog-ng on a server running RHEL4 without much problems but so far I have not been able to on a RHEL3.8 system. from what I can tell the mysql server is running ok , I can do all the command line queries to the databases but for some reason I cannot get the web access up and running . On this server I have loaded phpMyAdmin-2.8.2 and this is ok and I am able to use this to look and manage the databases . Can someone point out why or where I can look for any log information regarding the error reported. I know the config file is ok as it is . I tried to load up the latest version 2.9.2 using the installer, and this does complain there is something not quite right as on the pre check it says - Pre-installation check for: Php-Syslog-NG 2.9.2a (r13) Stable [ cdukes ] 23-Sep-2006 15:10 EST If any of these items are highlighted in red then please take actions to correct them. Failure to do so could lead to your PHP-Syslog-NG installation not functioning correctly. PHP version >= 4.1.0 Yes - zlib compression support Available - XML support Available - GD support Available - MySQL support Unavailable ************************************** config.php Writeable Session save path /tmp, Writeable So it is complaining about not having MySQl support . Unfortunately I cannot see what it is that it needs and what is missing from my mysql install. The weird thing is that mysql seems to be ok on this server as I can access all my databases using other means. Does anyone know what could be missing. Here is a list of the RPMS loaded for mysql and php. mysql-bench-3.23.58-16.RHEL3.1 php-mysql-4.3.2-36.ent libdbi-dbd-mysql-0.6.5-5 mysql-server-3.23.58-16.RHEL3.1 mysql-3.23.58-16.RHEL3.1 mysql-devel-3.23.58-16.RHEL3.1 mod_auth_mysql-20030510-2.ent php-imap-4.3.2-36.ent php-mysql-4.3.2-36.ent php-ldap-4.3.2-36.ent php-odbc-4.3.2-36.ent php-4.3.2-36.ent php-devel-4.3.2-36.ent Thanks Arun Tagarsi

1 0

Re: [syslog-ng] AIX startup
by Nathan Campi 25 Oct '06

25 Oct '06

Is that a question for me? Easy answer, I don't run AIX. :) I probably should have mentioned that. Back a couple years ago when installing openssh on AIX I found it easy to set it up under the SRC, syslog-ng should be easy. On Wed, Oct 25, 2006 at 12:09:14PM -0400, Schernau, Ed wrote: > On AIX, why not just use the system resource controller (SRC) ? > > Ed > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu > [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Nathan Campi > Sent: Wednesday, October 25, 2006 11:50 AM > To: Syslog-ng users' and developers' mailing list > Subject: Re: [syslog-ng] AIX startup > > I run syslog-ng under daemontools on a couple loghosts where I don't > want it down for more than a second. > > I already have cfengine install daemontools on all my systems anyways, > so it is trivial for me to automate that part as well. The only problem > is that daemontools comes up after all the rc scripts, which leaves you > without logging during all of startup. > > Workable solution is to still have an rc script that starts syslog and > have the daemontools run script kill off any already running syslog-ng > daemons when it comes up later. Might be overkill to supervise it in the > > first place - judgement call I suppose. > > -- > Nate Campi > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > ----------------------------------------- > Use of email is inherently insecure. Confidential information, > including account information, and personally identifiable > information, should not be transmitted via email, or email > attachment. In no event shall Citizens or any of its affiliates > accept any responsibility for the loss, use or misuse of any > information including confidential information, which is sent to > Citizens or its affiliates via email, or email attachment. Citizens > does not guarantee the accuracy of any email or email attachment, > that an email will be received by Citizens or that Citizens will > respond to any email. > > This email message is confidential and/or privileged. It is to be > used by the intended recipient only. Use of the information > contained in this email by anyone other than the intended recipient > is strictly prohibited. If you have received this message in error, > please notify the sender immediately and promptly destroy any > record of this email. > > -- Nate "If a trainstation is where the train stops, what's a workstation...?" -Anon.

1 0

If a destination{} fails ...
by Brian A. Seklecki 25 Oct '06

25 Oct '06

If a message is qualified for many destinations{} before finally hitting a cath-all fallback destination{} at the bottom of the config, will processing of that message stop at the failed facility {} ? ~BAS

2 2

flags(fallback)
by Brian A. Seklecki 25 Oct '06

25 Oct '06

"This flag makes a log statement 'fallback'. Being a fallback statement means that only messages not matching any 'non-fallback' log statements will be dispatched." Presumably this means "...messages not matching any 'non-fallback' log statements flagged as 'final' ...." Could it be possible to change the behavior, or have an alternate mode, that catches all message that haven't reached a "final" yet? ~BAS l8* -lava (Brian A. Seklecki - Pittsburgh, PA, USA) http://www.spiritual-machines.org/ "...from back in the heady days when "helpdesk" meant nothing, "diskquota" meant everything, and lives could be bought and sold for a couple of pages of laser printout - and frequently were."

2 2

Problem compiling syslog-ng 1.6.8 on HP-UX
by olivier "madmax"rolland 25 Oct '06

25 Oct '06

I Tried to compile syslog-ng 1.6.8 on HP-UX 11.11 and 11.23 but a lot of warning appeared: ./configure --enable-full-dynamic make gcc -g -O -Wall -I/usr/local/include/libol -D_GNU_SOURCE -fPIC -ldl - o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile. o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afus er.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o mac ros.o getopt.o getopt1.o -lnsl -ll /usr/local/lib/hpux32/libol.a -lnsl -lxnet ld: (Warning) Unsatisfied symbol "yylenguc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyinput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyunput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyolsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyoutput" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextuc" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyextra" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyfnd" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyprevious" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylsp" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yylstate" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yytextarr" in file /usr/lib/hpux32/libl.so ld: (Warning) Unsatisfied symbol "yyback" in file /usr/lib/hpux32/libl.so 13 warnings. What can I do in order to resolve those warnings? ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Demandez à ceux qui savent sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

3 2

ignore src{}; contents at startup?
by Brian A. Seklecki 25 Oct '06

25 Oct '06

All: On FreeBSD, /dev/klog provides for output from the kernel (normally redirected to /dev/console before syslog starts). At startup, /etc/rc.d/dmesg copies the kernel boot hardware paramters to /var/run/dmesg.boot. If I have my src(); set to: source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; ...at starup, syslog-ng drains the contents of /dev/klog. By default it tsends to them to user.notice. I like to log{} these to an SMS pager (so I know if a RAID is failing or other hardware problem). However, I'd like to avoid duplication of the efforts of /etc/rc.d/dmesg on behalf of syslog-ng(8) ...especially since I route user.notice to my pager, and kernel boot dmesg(8) can grow over 50 lines. /dev/klog really isn't a socket. It's a special char device. Is there anyway to tell syslog-ng(8) to ignore it's contents at startup? If it was tail(1), i'd say "tail -0 -f /file". Perhaps clear out the contents of /dev/klog somehow? TIA, ~BAS

2 2

proper procedure for filing bug reports (fwd)
by Brian A. Seklecki 25 Oct '06

25 Oct '06

On Fri, 6 Oct 2006, Balazs Scheidler wrote: > On Tue, 2006-09-19 at 11:37 -0500, Matt Zagrabelny wrote: >> just curious what people do for bug reports with syslog-ng... > > send it to this mailing list. That's quite an interesting approach. Most projects, regardless of size, tending to maintain some sort of sf.net or collab.net project page where they can manage bug reports, patches, mailing lists, auto builds, docs, statistics, CVS/SVN, forums, mailing list archives, etc. If if the problem report load is low, it would be nice if dev/users had the full suite of F/OSS development tools available somewhere. ~BAS > > -- > Bazsi l8*

1 0

syslog-ng 2.0rc4 released
by Balazs Scheidler 24 Oct '06

24 Oct '06

Hi, I have released 2.0rc4 with the latest bugfixes. The NEWS entry is below. I'd appreciate feedback on the stability of this version, so that I can finally prepare a 2.0.0 final. 2.0rc4 Tue, 24 Oct 2006 13:33:55 +0200 Bugfixes: * Another leak fix in 2.0rc2 caused syslog-ng to crash when a destination TCP/unix-stream connection was broken. * Fixed EOF detection for destination connections. -- Bazsi

1 0

Segmantation fault
by Sergey N. Romanov 22 Oct '06

22 Oct '06

Hi there, I have syslog-ng 2.0rc3 on FreeBSD 5.4. >From time to time I have problems. Syslog-ng dies with core dump. This is output from gdb NU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"... Core was generated by `syslog-ng'. Program terminated with signal 11, Segmentation fault. #0 log_writer_broken (self=0x820e080, notify_code=3) at logpipe.h:77 77 logpipe.h: No such file or directory. in logpipe.h (gdb) where #0 log_writer_broken (self=0x820e080, notify_code=3) at logpipe.h:77 #1 0x08051199 in log_writer_fd_dispatch (source=0x81f0540, callback=0, user_data=0x0) at logwriter.c:361 #2 0x0805b7b1 in g_main_context_dispatch () #3 0x0805cb76 in g_main_context_iterate () #4 0x0805cf5b in g_main_context_iteration () #5 0x080483ac in main_loop_run (cfg=0x81f1300) at main.c:162 #6 0x08048a8c in main (argc=0, argv=0x0) at main.c:420 (gdb) In syslog-ng config I have some pipe sources. I have this problem after upgrade from 1.6 to 2.0rc3. Any ideas why I have this problem and how to fix this? -- Best regards, Sergey N. Romanov

3 4

lazy logger++
by Alexander Clouter 22 Oct '06

22 Oct '06

Hi, This is probably the last thing you care about during the release candidate phase but a single bit of extra functionality would be greatly useful for those using the multicast logging feature. What I am planning on doing is having something like the following in my syslog-ng.conf file which is fantastic as to add logging groups I just add extra udp() lines to s_multicastGeneric and nothing else is needed. At the moment I would need separate source/destination/log entries per multicast group address, which is upsetting and results in a hideous configuration file. ==================== source s_multicastGeneric { ## squid # access udp(ip(239.194.251.0) port(514)); # cache udp(ip(239.194.251.32) port(514)); }; destination df_multicastGeneric { file("/var/log/syslog-ng/mulitcastGeneric/$DESTIP/$R_YEAR$R_MONTH$R_DAY.log"); }; log { source(s_multicastGeneric); destination(df_multicastGeneric); flags(final); }; ==================== I have actually had a go at patching syslog-ng to do this, however my patching effort is getting out of control. My method is to add the IP_PKTINFO (or IP_RECVDSTADDR) socket option to the multicast receive section in afinet_setup_socket() but thats about as far as I have gotten. I'm still working on trying to produce a patch myself but I am hoping someone on this list might have a better idea on how to cleanly get the information needed for $DESTIP to function from macros.c without doing anything major to the sourcecode. Whilst I am in my 'moon-on-a-stick' request list, a $HOST_TO in addition to $DESTIP would be handy too. :) As I said, I'm working on a patch at my end and will post it here once done, but its unlikely to be pretty... :) Cheers Alex

2 3

Destination regex question
by James Whitt 18 Oct '06

18 Oct '06

My question is about using regex and breaking up the parts of a string to use in the destination. Here's the situation. We have all of our firewalls logging into one box that is running syslog-ng. We want to break them up into a directory structures such as: /logs/location1/firewall/host1/ /logs/location2/firewall/host1/ /logs/location2/firewall/host2/ Now the hostname contains all the information needed to do this. For example, a host name might be: firewallname.firewall.location1 anothername.firewall.location2 Up to this point, for each location I've had to do the following in syslog to map to the correct directory: destination location1_firewall { file("/logs/location1/firewall/$HOST/$R_YEAR-$R_MONTH-$R_DAY.log"); }; filter location1_firewall { host(.firewall.location1$); }; log { source(external); filter(location1_firewall); destination(location1_firewall); }; This works completely fine. The only issue is that we have over 80 different locations, so this would need to have these three lines modified and added for each location. We're also adding more over time, so each time another location is set up, we need to go through the configuration and update. I was hoping there woud be a way to just combine them all together. Something like: destination firewall { host(.firewall.(.+)$); file("/logs/$1/firewall/$HOST/$R_YEAR-$R_MONTH-$R_DAY.log"); }; filter firewall { host(.firewall.); }; log { source(external); filter(firewall); destination(firewall); }; I know the regex syntax might be different, but was curious if this kind of situation is possible.

2 1

Error accepting AF_UNIX connection, opened connections: 100, max: 100
by Hari Sekhon 18 Oct '06

18 Oct '06

I'm getting the following on a host that is sending logs to a remote central logserver: syslog-ng[2390]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 Why is this happening? It isn't accepting logs, it's only sending them. And I also increased the remote logserver's max to 100 with the following line source s_tcp { tcp( port(<someport>) max-connections(1000)); }; For a start, I don't have 100 hosts logging to the remote logserver. Second, this host isn't the logserver so it shouldn't have this in it's /var/log/messages!!!! Can anyone explain this strange behavior? Thanks -h -- Hari Sekhon

2 3