- syslog-ng - lists.balabit.hu

solaris UDP loss
by Cary, Kim 14 Mar '06

14 Mar '06

Finally got around to reading the docs and applying the recommendations. FIRST - thanks much! NOW - my results: # ndd /dev/udp udp_recv_hiwat 65536 # ndd /dev/udp udp_max_buf 1073741824 # date ; netstat -s | grep udpInOverflows Tue Mar 14 10:15:16 udpInCksumErrs = 0 udpInOverflows =677996405 # date ; netstat -s | grep udpInOverflows Tue Mar 14 10:15:19 udpInCksumErrs = 0 udpInOverflows =677996571 # date ; netstat -s | grep udpInOverflows Tue Mar 14 10:15:22 udpInCksumErrs = 0 udpInOverflows =677996726 I'm pretty sure this is just the Firewall sending more than 55M lines of connection/deny logs over UDP. IF I was to switch the FW over to TCP logging from UDP, would this be a better solution? BTW, here are a few words from syslog-ng: Mar 14 09:32:32 syslog-ng[20685]: STATS: dropped 0 Mar 14 09:42:32 syslog-ng[20685]: STATS: dropped 0 Mar 14 09:52:32 syslog-ng[20685]: STATS: dropped 0 Mar 14 10:02:32 syslog-ng[20685]: STATS: dropped 0 Mar 14 10:04:53 syslog-ng[20685]: Garbage collecting while busy... Mar 14 10:04:58 syslog-ng[20685]: Objects alive: 310, garbage collected: 2999695 Mar 14 10:12:32 syslog-ng[20685]: STATS: dropped 0 Mar 14 10:16:22 syslog-ng[20685]: Garbage collecting while idle... Mar 14 10:16:24 syslog-ng[20685]: Objects alive: 318, garbage collected: 1129970 Mar 14 10:22:32 syslog-ng[20685]: STATS: dropped 0 and its config: source s_udp_inetpix { udp(ip(192.168.0.1)); }; On Mar 7, 2006, at 3:01 PM, syslog-ng-request(a)lists.balabit.hu <mailto:syslog-ng-request@lists.balabit.hu> wrote: | 1) Am I reading that loss right?? Probably, you might however want to snoop on the interface to see what kind of udp packets come on your interface. | 2) Any tips from Solaris/syslog-ng tuners would be appreciated! udp_max_buf does not set the queue length of the udp socket, which by the way can have a different value for each socket... You could have a look at: http://sunsolve.sun.com/search/document.do?assetkey=1-30-3218-1 <http://sunsolve.sun.com/search/document.do?assetkey=1-30-3218-1> basically: increasing udp_max_buf without increasing udp_recv_hiwat has no meaning. Furthermore, you can increase you socket buffer that way up to 64k (Solaris 8 & 9), if you want to increase it further up you must use the setsockopt call (up to udp_max_buf which has a maximum value of 1GB). Here is the official SUN documentation regarding this: http://docs.sun.com/app/docs/doc/817-0404/6mg74vsb5?a=view#gbtag <http://docs.sun.com/app/docs/doc/817-0404/6mg74vsb5?a=view#gbtag> Now regarding your packet loss issue. I would increase udp_recv_hiwat -> 65536 udp_max_buf -> 1073741824 (you will never get here anyway) Then I would try to play with syslog-ng config: log_fifo_size, log_iw_size and log_fetch_limit. But here I'd appreciate a syslog-ng expert to step in and tell us what to do more preceisely.

1 0

Message loss (probably) within syslog-ng
by Vincent Haverlant 14 Mar '06

14 Mar '06

Hi, I get a kind of message loss trouble like in some previous message with the subject "remote logging not reliable", but in his case, the remote logging was done other tcp and this was pointed as the probable cause of message loss. In my case only udp is involved. Description of the infra: About 2500 unix hosts sending logs via their original syslog daemon (Solaris or RedHat). They are set up that way: ===== kern.info @logserver *.error;user.none @logserver auth.info @logserver ===== The central syslog-ng (1.9.9) server is a solaris 8 host configured that way: ===== options { time_reopen (1); time_reap(600); stats_freq(60); log_fifo_size (25000000); keep_hostname (yes); long_hostnames (no); use_dns (yes); dns_cache (yes); dns_cache_size(3000); use_fqdn (no); # utilisation du nom court de la machine owner("root"); # Logs owner group("sys"); # Logs group owner perm(0755); dir_owner("sysexplo"); # Directory Owner dir_group("sys"); # Directpry Group dir_perm(0775); # Directory Perm create_dirs (yes); use_time_recvd(yes); # gc_idle_threshold(1000); # gc_busy_threshold(100000); }; # # Configuration directives for remote logs # source lan { udp (port(514)); }; destination hostfiles { file("/projets/SYS/sysexplo/syslogdata/$YEAR$MONTH$DAY.logremote/$HOST" owner("sysexplo") group("sys") perm(0755) template("$ISODATE $HOST $MSG\n") ); }; log { source(lan); destination(hostfiles); flags(final); }; # #local logs # source localmsg { sun-stream("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslog { file("/var/log/syslog"); }; destination authlog { file("/var/adm/authlog"); }; destination messages { file("/var/adm/messages"); }; # filters to mimic traditional Solaris logging filter f_mail { facility(mail); }; filter f_auth { level(info) and facility(auth, authpriv); }; filter f_not_mail { not facility(mail); }; log { source(localmsg); filter(f_auth); destination(authlog); }; log { source(localmsg); filter(f_mail); destination(syslog); }; log { source(localmsg); filter(f_not_mail); destination(messages); }; log { source(localmsg); destination(hostfiles); flags(final); }; # Also save logs from local host # ===== This generates between 3 to 8 GiB logs per day on the logserver. Everything went fine until we wanted to check a specific event on a specific host which generates something like 10 lines of auth.info logs for which only 5 lines were saved on the log server. It appeared that dome packets were randomly ignored. But not sure if it was a network issue (udp) or syslog-ng we produced the following tool to dump what arrives on the udp socket: ==== syslog-dump.c #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <sys/errno.h> #define BUFFLEN 2047 int main (int argc, char **argv) { int syslog_socket; int syslog_port=514; struct sockaddr_in syslog_addr; unsigned char syslog_buffer[BUFFLEN+1]; int len,ret; /* create socket */ syslog_socket=socket(PF_INET, SOCK_DGRAM, 0); if (syslog_socket==-1) { printf("Error creating socket"); exit(1); } bzero(&syslog_addr,sizeof(syslog_addr)); syslog_addr.sin_family = AF_INET; syslog_addr.sin_addr.s_addr = htonl(INADDR_ANY); syslog_addr.sin_port = htons(syslog_port); ret=bind(syslog_socket, (struct sockaddr *) &syslog_addr, sizeof(syslog_addr)); if (ret==-1) { perror("Error binding to socket"); exit(1); } while (len=read(syslog_socket, syslog_buffer, BUFFLEN)){ printf("%s\n",syslog_buffer); bzero(syslog_buffer, BUFFLEN+1); } } ==== We run this instead of syslog-ng for a few minutes and produces som 20000 lines of log on 2 hosts in 20 seconds using logger. During the tests I also kept receiving the normal messages from my 2500 hosts in addition to my test messages. I tested it for more than half an hour and never lost any message using my syslog-dump program (something like 20 consecutive tests). The next half hour I repeated the test with syslog-ng. Unfortunately I lost around 10% to 20% of my test messages every time. I started with syslog-ng 1.6.9 but upgraded to 1.9.9 to be sure I had all the improvements. Has anybody an idea of where my packets get lost, is there a tunning only solution, should I start looking at the code to find my lost packets ? I'd appreciate a small explanation of syslog-ng internal if that is the case :) Aside from that I would like to say that I'm quite happy with syslog-ng features. Regards, Vincent.

4 10

Syslog-ng & RedHat
by syslogyk 14 Mar '06

14 Mar '06

Hi! I tried to work with syslog-ng-1.9.9 on Redhat Linux AS 4. Sources (eventlog and syslog-ng) were taken here: http://www.balabit.com/downloads/syslog-ng/1.9/src/ I walked through configure, make and make install successfully. Simple syslog-ng.conf was placed to /usr/local/etc When I run /usr/local/sbin/syslog-ng, I get the following error: fsync() does not work yet; fsync() does not work yet; Error binding socket; error='No such file or directory (2)', addr='AF_UNIX(/var/lib/named/dev/log)' Error initializing source driver; source='src' Could you please give me a hint about what was a reason of such error? Anyway, I can't tell I'm interested in last version only. So, could you please advice me syslog-ng version that worked successfully on RedHat Linux AS 4? Thank you in advance.

3 5

Remote hosts logging as loopback, not hostname
by Rob Munsch 13 Mar '06

13 Mar '06

Hello, Knowing next t'nothing about openssl, stunnel, and syslog-ng, i've gotten a central loghost going with one remote client. Poking into MySQL is via: INSERT INTO logs (host, facility, priority ... VALUES ( '$HOST','$FACILITY','$PRIORITY'... )etc. with all the $MACROS you'd expect. However. The messages from the remote host always seem to appear as 127.0.0.1! My question is: is it because of something i am or am not doing in syslog? I am not logging remote messages to any local logs, something that only dawned on me after i had it all running. Instead, I am doing this: # Sending to the MySQL table log { source(s_all); destination(d_mysql); }; # ... as well as remote client messages log { source(stunnel); destination(d_mysql); }; which, i realize, may inspire laughing. or not. It seemed like a good idea at the time, as the idea was to have every individual hosts' logs be 'personal,' and the database be the amalgam. I am starting to suspect stunnel, however, as well: source stunnel { tcp(ip(127.0.0.1) <<=== ! port(514) max-connections(10) ); }; is THAT why remote messages are being stamped with a $HOST of the loopback address? Is it a combination of both factors, neither, something else entirely...? I'm prepared to go bug the stunnel list too, if necessary :D. Thanks! Robert -- Rob Munsch Solutions For Progress IT

3 5

Why does this not work?
by David Anderson 13 Mar '06

13 Mar '06

Hi, I am trying to lessen the amount in my messages log. I have logs coming in from my router which I can successfully put into their own log using the following filters. Unfortunately this also drops the info into messages as well: filter f_messages { not facility(news, mail) and not filter(f_iptables); }; filter f_router { host(vigor); }; If I try to prevent the additions to the message log using the following filters I get the error shown below. filter f_messages { not facility(news, mail) and not filter(f_iptables, f_router); }; filter f_router { host(vigor); }; benden:~ # /etc/init.d/syslog restart Shutting down syslog services done Starting syslog servicessyntax error at 76 Parse error reading configuration file, exiting. (line 76) startproc: exit status of parent of /sbin/syslog-ng: 1 failed Can anyone explain what I am doing wrong please? -- Best regards, David mailto:dma@pern.co.uk

3 3

remote logging not reliable
by stucky 13 Mar '06

13 Mar '06

guys I've been pulling my hair out here. I gonna go insane.... Here's the story. I first setup syslog-ng-1.6.6 for remote syslogging a year ago. I seemed to work out great - all my stuff appeared to be logged remotely and everything was dandy. Then I decided to come up with some sort of check that would tell me if a machine was not logging remotely anymore cause of network problems or whatever. I have a perl logchecker which I basically told to check for the cron.hourly log message and if it finds it to grep for the source host and add this host to a file. I was then gonna check this list against a pre-defined array of hosts that should be logging blablaba.... This is how I discovered that not everything is really logged. All my clients have this conf file: options { chain_hostnames(0); time_reopen(10); time_reap(360); log_fifo_size(2048); sync(1); stats(0); create_dirs(yes); owner(root); group(root); perm(0644); dir_perm(0755); use_dns(yes); dns_cache(yes); }; source src { internal(); unix-stream("/dev/log"); file("/proc/kmsg"); }; destination messages { file("/var/log/messages"); }; destination auth { file("/var/log/auth"); }; destination cron { file("/var/log/cron"); }; destination mail { file("/var/log/mail"); }; destination loghost { tcp("**********" port(5000)); }; filter auth { facility(auth, authpriv); }; filter cron { facility(cron); }; filter mail { facility(mail); }; filter nagios { not ( match("Accepted publickey for nagios from ********") or match("COMMAND=/usr/local/nagios/home/check_duplex") or match("session opened for user nagios") or match("session closed for user nagios")); }; log { source(src); filter(cron); destination(cron); destination(loghost); flags(final); }; log { source(src); filter(mail); destination(mail); destination(loghost); flags(final); }; log { source(src); filter(auth); filter(nagios); destination(auth); destination(loghost); flags(final); }; log { source(src); filter(nagios); destination(messages); destination(loghost); }; If I check the cronlog locally on a client I can see that all the hourly logs are there: Feb 27 12:01:01 sbeta crond[31964]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 13:01:01 sbeta crond[9232]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 14:01:01 sbeta crond[18969]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 15:01:01 sbeta crond[28630]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 16:01:01 sbeta crond[5311]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 17:01:01 sbeta crond[14977]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 18:01:01 sbeta crond[22335]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 19:01:01 sbeta crond[31995]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 20:01:01 sbeta crond[9336]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 21:01:01 sbeta crond[19002]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 22:01:01 sbeta crond[28663]: (root) CMD (run-parts /etc/cron.hourly) Feb 27 23:01:01 sbeta crond[5928]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 00:01:01 sbeta crond[15495]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 01:01:01 sbeta crond[25160]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 02:01:01 sbeta crond[2394]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 03:01:01 sbeta crond[12087]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 04:01:01 sbeta crond[21753]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 05:01:01 sbeta crond[31573]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 06:01:01 sbeta crond[8840]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 07:01:01 sbeta crond[18506]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 08:01:01 sbeta crond[28166]: (root) CMD (run-parts /etc/cron.hourly) Feb 28 09:01:01 sbeta crond[5433]: (root) CMD (run-parts /etc/cron.hourly) However, checking the remote cron logs for that machine for that whole of February shows this: Feb 21 12:01:01 sbeta crond[23754]: (root) CMD (run-parts /etc/cron.hourly) Feb 24 05:01:01 sbeta crond[5012]: (root) CMD (run-parts /etc/cron.hourly) Feb 24 17:01:01 sbeta crond[26525]: (root) CMD (run-parts /etc/cron.hourly) Feb 25 03:01:01 sbeta crond[28212]: (root) CMD (run-parts /etc/cron.hourly) Feb 25 13:01:01 sbeta crond[30890]: (root) CMD (run-parts /etc/cron.hourly) Feb 26 01:01:01 sbeta crond[20620]: (root) CMD (run-parts /etc/cron.hourly) Feb 16 19:01:01 sbeta crond[6299]: (root) CMD (run-parts /etc/cron.hourly) Feb 17 00:01:01 sbeta crond[22138]: (root) CMD (run-parts /etc/cron.hourly) Feb 17 04:01:01 sbeta crond[28292]: (root) CMD (run-parts /etc/cron.hourly) Feb 17 08:01:01 sbeta crond[1917]: (root) CMD (run-parts /etc/cron.hourly) Feb 17 12:01:01 sbeta crond[7812]: (root) CMD (run-parts /etc/cron.hourly) Feb 17 16:01:01 sbeta crond[14136]: (root) CMD (run-parts /etc/cron.hourly) Feb 17 19:01:01 sbeta crond[10669]: (root) CMD (run-parts /etc/cron.hourly) Feb 18 00:01:01 sbeta crond[26489]: (root) CMD (run-parts /etc/cron.hourly) Feb 18 04:01:01 sbeta crond[32742]: (root) CMD (run-parts /etc/cron.hourly) Feb 18 08:01:01 sbeta crond[6852]: (root) CMD (run-parts /etc/cron.hourly) Feb 18 12:01:01 sbeta crond[13106]: (root) CMD (run-parts /etc/cron.hourly) Feb 18 15:01:01 sbeta crond[9768]: (root) CMD (run-parts /etc/cron.hourly) Feb 18 20:01:01 sbeta crond[25588]: (root) CMD (run-parts /etc/cron.hourly) Feb 12 08:01:01 sbeta crond[22554]: (root) CMD (run-parts /etc/cron.hourly) Feb 12 12:01:01 sbeta crond[28808]: (root) CMD (run-parts /etc/cron.hourly) Feb 12 16:01:01 sbeta crond[2735]: (root) CMD (run-parts /etc/cron.hourly) Feb 12 20:01:01 sbeta crond[9063]: (root) CMD (run-parts /etc/cron.hourly) Feb 13 00:01:01 sbeta crond[15268]: (root) CMD (run-parts /etc/cron.hourly) Feb 14 17:01:01 sbeta crond[22845]: (root) CMD (run-parts /etc/cron.hourly) Feb 14 21:01:02 sbeta crond[29177]: (root) CMD (run-parts /etc/cron.hourly) Feb 15 22:01:01 sbeta crond[12945]: (root) CMD (run-parts /etc/cron.hourly) Feb 16 05:01:01 sbeta crond[17917]: (root) CMD (run-parts /etc/cron.hourly) Feb 16 16:01:01 sbeta crond[29758]: (root) CMD (run-parts /etc/cron.hourly) Feb 16 18:01:01 sbeta crond[16687]: (root) CMD (run-parts /etc/cron.hourly) As you can see it seemingly randomly logs this stuff now and then. So this machine hasn't been sending logs remotely since Feb 21. ? As I said all clients run the same version of syslog-ng and the exact same config - yet some of then seem to log cron stuff every hour and others don't. I get a log ot those 'Error connecting to remote host AF_INET' messages BUT i get those for EVERY host so why is there no consistency ? I know what everbody is gonna this - your network is hosed but here is the problem with that theory. I can log on to that box and I will immediately see this on the loghost in /var/log/auth Feb 28 10:43:06 sbeta sshd[21815]: Accepted publickey for stucky from ******** port 47427 ssh2 Feb 28 10:43:06 sbeta sshd(pam_unix)[21819]: session opened for user stucky by (uid=0) This will work every time for all other machines as well. I'd understand if it didn't log at all or with a slight delay like say 1 minute. Besides it appears cron stuff really gets lost but then why doesn't any of the auth/authpriv stuff get lost ? I can't help feeling it has something to do with logging cron but looking at the config I clearly told it to log to the local file first and then again to the remote host just like auth/authpriv stuff. Here is my logservers config: options { chain_hostnames(0); time_reopen(10); time_reap(360); log_fifo_size(2048); use_fqdn(no); use_dns(yes); dns_cache(yes); keep_hostname(yes); long_hostnames(off); sync(1); stats(0); create_dirs(yes); perm(0640); dir_perm(0750); }; source src { internal(); unix-stream("/dev/log"); file("/proc/kmsg"); udp (ip("*********")); tcp (ip("*********") port(5000) max-connections(1000) keep-alive(yes)); }; destination messages { file("/var/log/messages"); }; destination auth { file("/var/log/auth"); }; destination cron { file("/var/log/cron"); }; destination mail { file("/var/log/mail"); }; destination arch { file("/usr/local/var/log_archive/$HOST/$YEAR/$MONTH/$DAY/archive"); }; filter auth { facility(auth, authpriv); }; filter cron { facility(cron); }; filter mail { facility(mail); }; filter messages { not facility(auth, authpriv, cron, mail); }; filter nagios { not ( match("Accepted publickey for nagios from *******") or match("COMMAND=/usr/local/nagios/home/check_duplex") or match("session opened for user nagios") or match("session closed for user nagios")); }; filter junk { not ( match("Accepted publickey for oracle from ***********") or match("Accepted publickey for oracle from ***********") or match("Accepted publickey for stucky from ***********") or match("COMMAND=/usr/local/nagios/home/check_duplex") or match(".+reconnecting to LDAP server.+sleeping") or match("session opened for user root") or match(".+AF_INET client connected from .+") or match(".+AF_INET client dropped connection from.+") or match(".+Connection broken to AF_INET.+")); }; log { source(src); filter(cron); destination(cron); destination(arch); flags(final); }; log { source(src); filter(mail); destination(mail); destination(arch); flags(final); }; log { source(src); filter(auth); filter(nagios); destination(auth); destination(arch); flags(final); }; log { source(src); filter(junk); filter(nagios); destination(messages); destination(arch); }; And here's the really messed up thing. EVERY time I set up a tcpdump on the loghost at the full hour to see whether the box actually sends stuff to it - it does ! Yet, if I wait again for a while and check the logs I can see again that a log of hourly cronlogs are skipped. Can anybody please take a look at my configs and at least tell me that they are not completely wrong ? I'm running out of ideas. -- stucky

4 7

Static -ll Library Rq'd and Solaris 10
by Dave Knoch 13 Mar '06

13 Mar '06

I'm attempting to install syslog-ng 1.6.9 on Solaris 10 and am receiving this error: gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet -Wl,-Bstatic -ll -Wl,-Bdynamic ld: fatal: library -ll: not found ld: fatal: File processing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /tmp/syslog-ng-1.6.9+20051127/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='. tests'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /tmp/syslog-ng-1.6.9+20051127/src *** Error code 1 make: Fatal error: Command failed for target `all' Current working directory /tmp/syslog-ng-1.6.9+20051127/src *** Error code 1 The following command caused the error: set fnord $MAKEFLAGS; amf=$2; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='src doc contrib'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (cd $subdir && make $local_target) \ || case "$amf" in *=*) exit 1;; *k*) fail=yes;; *) exit 1;; esac; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' It appears to be caused by the absence of a static -ll library. Unfortunately, Sun no longer includes static Solaris libraries with Solaris 10. Has anyone discovered a workaround for this situation? Thank you. Dave Knoch

3 2

AIX 5.2, AIX 5.3 libol compile problems "
by Mike Harvey 13 Mar '06

13 Mar '06

I get this error during make on libol 0.3.17 io.c:493: `MSG_DONTWAIT' undeclared (first use in this function) I saw a related thread for HP-UX. https://lists.balabit.hu/pipermail/syslog-ng/2006-January/008352.html Details were posted to make a download of a January 2006 patch of io.c, but I can't track down where to download this new file from. Thanks <syslog-ng(a)lists.balabit.hu>

3 2

AIX: Syslog NG 1.6.9 (tcp) send logmessages to central log server
by Jochen Kirn 13 Mar '06

13 Mar '06

Hi all, logmessages are being written to the AIX default syslog daemon which forwards certain messages to syslog ng via a named pipe "/var/adm/syslog.pipe" The log messages are being written to the destination "localfile" but not to the remote syslog ng logging server. Any idea what's going wrong here ? the exact same "syslog-ng.conf" works with a HP-UX or Solaris based Syslog NG Installation without any problem. Setup: Syslog NG: 1.6.9 with libol 0.3.17 System: AIX 5.1 ML8 and AIX 5.3 ML 3 central logging server is a linux based syslog NG 1.6.9 which can successfully receive log messages from other (non aix) hosts. syslog-ng.conf: ############## # Log sources # source src { pipe ("/var/adm/syslog.pipe"); }; ############## # filters # filter f_sshd {program("sshd"); }; ############## # Log destinations destination mylogserver{ tcp("logserver" port(514)); }; destination localfile{ file("/var/tmp/messages" template("$YEAR.$MONTH.$DAY $HOUR:$MIN:$SEC $HOST $MSG\n") template-escape(yes )); }; ############## # Perform the logging log { source(src); filter(f_sshd); destination(mylogserver); }; log { source(src); filter(f_sshd); destination(localfile); }; regards Jochen

3 3

DNS hostnames vs. /etc/hosts?
by micah milano 13 Mar '06

13 Mar '06

Hi, I'm doing remote logging from one client, whose actual hostname is "ibis", however the logs are being sent through an openVPN tunnel so the receiving log server has this in /etc/hosts: 127.0.0.1 localhost emu 10.8.0.5 ibis-vpn What I cannot figure out is why a log directory is created for both "ibis" and "ibis-vpn", I want all the logs from that host to appear in one directory. On the client I have: destination server { tcp("10.8.0.1" port(514)); }; On the server I have: options { long_hostnames(off); sync(1); stats(0); log_fifo_size(2048); dns_cache(yes); keep_hostname(yes); bad_hostname("gconfd"); create_dirs(yes); }; source tcp_src { tcp(max-connections(1000) tcp-keep-alive(yes)); }; destination remote_servers { file("/whopper/logs/$HOST/$FACILITY.log" owner(root) group(adm) perm(0640) dir_perm(0755) create_dirs(yes)); }; log { source(tcp_src); destination(remote_servers); flags(final); };

1 0

syslog-ng with samba
by Dev Anand 10 Mar '06

10 Mar '06

Hi All , Well I have a good and working version of syslog-ng with phpsyslog enabled and reports properly generated. There is only one issue . I have three different samba servers which are not sending their logs but I get other logs from the same servers like cron and logins and other stuff. Please advise. Thanks in advance. Regards Deva

2 2

RE: [syslog-ng] Splitting a single source to multiple mysql tables
by Dukes Clayton 07 Mar '06

07 Mar '06

nope... ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Dukes Clayton Sent: Tuesday, March 07, 2006 5:00 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Splitting a single source to multiple mysql tables I think this fixed it, can someone confirm? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Dukes Clayton Sent: Tuesday, March 07, 2006 4:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Splitting a single source to multiple mysql tables Hiya, Here's what I have, why doesn't it work? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") template-esc destination d_host { pipe("/var/log/mysql.pipe" template("INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") template-escape(yes)); }; destination d_mysql_facility { pipe("/var/log/mysql.pipe" template("INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; # This doesn't work #log { source(net); destination(d_mysql); destination(d_host); destination(d_mysql_facility); }; # This works log { source(net); destination(d_mysql); };

1 0

RE: [syslog-ng] Splitting a single source to multiple mysql tables
by Dukes Clayton 07 Mar '06

07 Mar '06

I think this fixed it, can someone confirm? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Dukes Clayton Sent: Tuesday, March 07, 2006 4:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Splitting a single source to multiple mysql tables Hiya, Here's what I have, why doesn't it work? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") template-esc destination d_host { pipe("/var/log/mysql.pipe" template("INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") template-escape(yes)); }; destination d_mysql_facility { pipe("/var/log/mysql.pipe" template("INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; # This doesn't work #log { source(net); destination(d_mysql); destination(d_host); destination(d_mysql_facility); }; # This works log { source(net); destination(d_mysql); };

1 0

Splitting a single source to multiple mysql tables
by Dukes Clayton 07 Mar '06

07 Mar '06

Hiya, Here's what I have, why doesn't it work? destination d_mysql { pipe("/var/log/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, datetime, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC','$MSG' );\n") template-esc destination d_host { pipe("/var/log/mysql.pipe" template("INSERT INTO host (host) VALUES ( '$HOST' ) ON DUPLICATE KEY UPDATE count=count+1;\n") template-escape(yes)); }; destination d_mysql_facility { pipe("/var/log/mysql.pipe" template("INSERT IGNORE INTO facility (facility) VALUES ( '$FACILITY' );\n") template-escape(yes)); }; # This doesn't work #log { source(net); destination(d_mysql); destination(d_host); destination(d_mysql_facility); }; # This works log { source(net); destination(d_mysql); };

1 0

RE: [syslog-ng] Syslog-ng 1.6.9 just stops...
by Andreoli, Tony A. USNUNK NAVAIR B1490, R215 07 Mar '06

07 Mar '06

I had klogd off already, but this got me thinking about something else. My config file's sources are: source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); udp(); internal(); }; source t_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); tcp(); internal(); }; Could it be that both sources, attempting to read /proc/kmsg and /dev/log (and internal()?) are causing this? Thanks a lot! Tony -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Wednesday, March 01, 2006 15:25 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 1.6.9 just stops... On Wed, 2006-03-01 at 10:01 -0500, Andreoli, Tony A. USNUNK NAVAIR B1490, R215 wrote: > I'm using 1.6.9 (upgraded from 1.6.6 because I was seeing the same > problem). I have it running on 8 different servers at different > locations, some are SMP, some aren't. On these hosts, we have > anywhere from 2 to 14 devices logging to the servers, some via > 514/tcp, others via 514/udp. All of the loggers typically sit with a > load average < 1 (usually not even registering), and a cpu idle of > 99%. 7 of these remote loggers also log to our local machine, but > only 5 lines every 2 minutes (for stats). > > What I've noticed (and I've seen this on all of them at one time or > another), is that syslog-ng just stops. ps shows it running, but the > log file (/logs/messages) never changes. If I tcpdump on the > interface that it's listening on, I see traffic, and it seems that the > act of tcpdumping causes the log file to start to grow again, then a > little while later, it may stop again. It's sporadic though, on one > of my systems, it hasn't done it in over 2 months, on another, it's > done it 3 times today. > > I've pulled out my last hair and still haven't come any closer to a > solution. I've recompiled the source, loaded 3 different versions, > etc. The only thing common is that all of these systems are running > RHEL3. Don't you happen to read /proc/kmsg by both syslog-ng and klogd ? That is a known bad situation and the symptoms are exactly what you describe. (poll indicates readability but by the time syslog-ng gets to read the file the data has already been read) This is documented in the FAQ as well. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

6 8

rotating logs at 12:00 noon
by Navin Jathan 07 Mar '06

07 Mar '06

Hi, I am new to syslog-ng. I am not a programmer, but configuration of syslog-ng feels like I programming something!!! Wish I could get over this soon!! Apart from normal logging operation, I use syslog-ng to log PIX firewall logs from the network. Following is the configuration file: <..snip..> filter f_11 { facility(local0) and level(debug..emerg); }; destination d_8 { file("/var/log/pix/SyslogCatchAll-$DAY-$MONTH-$YEAR.log" create_dirs(yes)); }; log { source(local); filter(f_11); destination(d_8); }; <../snip..> This would typically rotate the logs at 12:00 at midnight daily. But I need to rotate the logs at 12:00 noon daily. Is it possible to configure syslog-ng in this manner? How do I do it? I had unsuccessfully tried to use logrotate with the native syslog utility in Linux. Do I have to use logrotate here again? Thanks in Advance, Regards, Navin Jathan. Disclaimer: Information transmitted by this e-mail is proprietary to Adventity and/ or its Customers, intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If you are not the intended recipient or it appears that this mail has been forwarded to you without proper authority, you are notified that any use or dissemination of this information in any manner is strictly prohibited. In such cases, please notify us immediately at postmaster(a)adventity.com and delete this mail from your records.

2 1

Checking for drops with netstat -s
by Cary, Kim 06 Mar '06

06 Mar '06

Syslog-ng 1.6.4 on Solaris 9: IPv4 udpInOverflows =640473547 UDP udpInDatagrams =409687632 udpInErrors = 0 udpOutDatagrams =466811 udpOutErrors = 0 Does the udpInOverflows indicate I'm losing packets?

2 1

filtering logs from a file?
by Steven Matkoski 06 Mar '06

06 Mar '06

Hi, I am using syslog-ng 1.6.5-2.2 on a Debian box in a chroot environment. I have a default configuration except for gathering log messages from a few routers, a pix, and vpn concentrator. I have the logs going into the files I want, but the logs are also going into files I don't want. I currently have all the routers logging into a routers/ directory and the pix and vpn logging into a security/ directory, but the pix and vpn are also logging into the router directory which I would like to stop. I have tried a bunch of different filters but nothing seems to work. Any help appreciated. My configuration: # router syslog source s_syslogd { udp(ip(0.0.0.0) port(514)); }; # router syslog destination d_router { file("/var/log/routers/$HOST"); }; destination d_security { file("/var/log/security/$HOST"); }; # router syslog filter f_router { not host(/<vpn ip>/) or not host(/<pix ip>/); }; filter f_security { host(<vpn ip>) or host(<pix ip>); }; # router.* #log { source(s_syslogd); filter(f_router); destination(d_router); }; log { source(s_syslogd); destination(d_router); }; # firewall, vpn concentrtor log { source(s_syslogd); filter(f_security); destination(d_security); }; thanks. -s.

1 0

how can I change the priority/facility of a log entry?
by Dave Augustus 02 Mar '06

02 Mar '06

Hello All, I have spent hours looking for this. Is there a way, using syslog-ng to re-write an incoming log entry's priority/facility. We have some windows boxen that we are logging but the log entries need a little massaging. Any ideas would be helpful. TIA -- Dave Augustus <davea(a)support.kcm.org>

2 1

Syslog-ng 1.6.9 just stops...
by Andreoli, Tony A. USNUNK NAVAIR B1490, R215 01 Mar '06

01 Mar '06

I'm using 1.6.9 (upgraded from 1.6.6 because I was seeing the same problem). I have it running on 8 different servers at different locations, some are SMP, some aren't. On these hosts, we have anywhere from 2 to 14 devices logging to the servers, some via 514/tcp, others via 514/udp. All of the loggers typically sit with a load average < 1 (usually not even registering), and a cpu idle of 99%. 7 of these remote loggers also log to our local machine, but only 5 lines every 2 minutes (for stats). What I've noticed (and I've seen this on all of them at one time or another), is that syslog-ng just stops. ps shows it running, but the log file (/logs/messages) never changes. If I tcpdump on the interface that it's listening on, I see traffic, and it seems that the act of tcpdumping causes the log file to start to grow again, then a little while later, it may stop again. It's sporadic though, on one of my systems, it hasn't done it in over 2 months, on another, it's done it 3 times today. I've pulled out my last hair and still haven't come any closer to a solution. I've recompiled the source, loaded 3 different versions, etc. The only thing common is that all of these systems are running RHEL3. Any help would be greatly appreciated. Thanks, Tony

4 3

RE: [syslog-ng] Syslog-ng 1.6.9 just stops...
by Andreoli, Tony A. USNUNK NAVAIR B1490, R215 01 Mar '06

01 Mar '06

Thanks for the reply. Yes, I do have it running, but the problem is more frequent than nightly. My logrotate script gets run every night at midnight, yet syslog-ng has stopped running 5 times today (in the last 6 hours) on one of my systems. Thanks, Tony _____ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of David Anderson Sent: Wednesday, March 01, 2006 12:19 To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng 1.6.9 just stops... R215, Wednesday, March 1, 2006, 3:01:47 PM, you wrote: > I'm using 1.6.9 (upgraded from 1.6.6 because I was seeing the same problem). I have it running on 8 different servers at different locations, some are SMP, some aren't. On these hosts, we have anywhere from 2 to 14 devices logging to the servers, some via 514/tcp, others via 514/udp. All of the loggers typically sit with a load average < 1 (usually not even registering), and a cpu idle of 99%. 7 of these remote loggers also log to our local machine, but only 5 lines every 2 minutes (for stats). What I've noticed (and I've seen this on all of them at one time or another), is that syslog-ng just stops. ps shows it running, but the log file (/logs/messages) never changes. If I tcpdump on the interface that it's listening on, I see traffic, and it seems that the act of tcpdumping causes the log file to start to grow again, then a little while later, it may stop again. It's sporadic though, on one of my systems, it hasn't done it in over 2 months, on another, it's done it 3 times today. I've pulled out my last hair and still haven't come any closer to a solution. I've recompiled the source, loaded 3 different versions, etc. The only thing common is that all of these systems are running RHEL3. Any help would be greatly appreciated. Thanks, Tony You haven't got Logrotate running, have you? I found that unless I restarted syslog-ng in the rotate scripts, then nothing further was logged. -- Best regards, David mailto:dma@pern.co.uk

1 0

Reverse DNS
by Jesper Markenstam 01 Mar '06

01 Mar '06

Hello, I am sure this topic has been beaten to death, but I cannot find answers anywhere. Apologies if I have missed something - here we go: I run syslog-ng 1.6.4 on Sol 9 Sparc (sunfreeware distribution). It works fine, except I want syslog-ng to resolve IP's to hostnames, and create directories using the resolved name rather than IP (long term, I will look at MySQL, but I would still have to get either DNS or keep_hostname to work). I installed bind 9.2.3 on the log server and setup a reverse zone authoritative for in-addr.arpa., but it still doesn't work. At this time, I prefer to use reverse DNS rather than hostname. I was not able to create_dirs based on keep_hostname(yes) either. dig works, and returns NOERROR when I run dig -x 1.2.3.4 @127.0.0.1 for example. The reverse zone is fully populated with all hosts that will be logging syslog-ng. nsswitch.conf: hosts: dns files ipnodes: dns files everything else is files only. resolv.conf: nameserver 127.0.0.1 syslog-ng.conf: # Options options { use_fqdn(no); use_dns(yes); dns_cache(yes); sync(5); keep_hostname(no); chain_hostnames(no); create_dirs(yes); # bad! perm(0644); dir_perm(0755); use_time_recvd(yes); }; # Sources source s_udp { udp(); }; # logging to console destination l_console { file ("/dev/console"); }; # logging of cisco's via udp to individual files and to one file destination r_cisco { file( "/remote/$HOST/$HOST-$YEAR$MONTH.LOG" ); file( "/r emote/all/alldevices.log" ); }; # Remote sources log { source (s_udp); destination (r_cisco); }; Kind regards Jesper Jesper Markenstam IS&T Systems Analyst REUTERS.KNOW.NOW. www.reuters.com <http://www.reuters.com/> To find out more about Reuters visit www.about.reuters.com Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Reuters Ltd.

2 1

RE: [syslog-ng] Make Error messages
by Stuart Boyle 28 Feb '06

28 Feb '06

Removed 1.9.8 and installed 1.9.9 and it went very smoothly. Many thanks for the assistance. Stuart -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, February 28, 2006 2:59 PM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Make Error messages On Tue, 2006-02-28 at 14:06 -0500, Stuart Boyle wrote: > The file cfg-lex.c is empty !! Now, that's what I suspected. This is a problem. Try removing the file or restore it from the tarball and recompile. (please note that I've release 1.9.9 which should be better than 1.9.8 wsa) -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng] Make Error messages
by Stuart Boyle 28 Feb '06

28 Feb '06

Output from ./configure :/usr/local/syslog-ng-1.9.8 # ./configure checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... gawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc option to accept ANSI C... none needed checking for bison... bison -y checking for flex... flex checking for yywrap in -lfl... yes checking lex output file root... lex.yy checking whether yytext is a pointer... yes checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking how to enable static linking for certain libraries... GNU or Solaris checking how to run the C preprocessor... gcc -E checking for egrep... grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... no checking sys/strlog.h presence... no checking for sys/strlog.h... no checking door.h usability... no checking door.h presence... no checking for door.h... no checking whether struct tm is in sys/time.h or time.h... time.h checking for struct tm.tm_gmtoff... yes checking for I_CONSLOG... no checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for strdup... yes checking for strtol... yes checking for inet_aton... yes checking for inet_ntoa... yes checking for getopt_long... yes checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB_CFLAGS... -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include checking for GLIB_LIBS... -L/usr/local/lib -lglib-2.0 checking for EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking for EVTLOG_LIBS... -L/usr/local/lib -levtlog checking for static GLib libraries... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands Output from MAKE :/usr/local/syslog-ng-1.9.8 # make make all-recursive make[1]: Entering directory `/usr/local/syslog-ng-1.9.8' Making all in src make[2]: Entering directory `/usr/local/syslog-ng-1.9.8/src' gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib -levtlog -Wl,-Bdynamic libsyslog-ng.a(cfg.o)(.text+0x5d6): In function `cfg_new': /usr/local/syslog-ng-1.9.8/src/cfg.c:247: undefined reference to `lex_init' libsyslog-ng.a(cfg-grammar.o)(.text+0x17): In function `yyerror': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:829: undefined reference to `linenum' libsyslog-ng.a(cfg-grammar.o)(.text+0x18ea): In function `yyparse': /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.c:1689: undefined reference to `yylex' collect2: ld returned 1 exit status make[2]: *** [syslog-ng] Error 1 make[2]: Leaving directory `/usr/local/syslog-ng-1.9.8/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/syslog-ng-1.9.8' make: *** [all] Error 2 The file cfg-lex.l contains the following: /usr/local/syslog-ng-1.9.8/src # more cfg-lex.l /*************************************************************************** * * Copyright (c) 1999 Balázs Scheidler * Copyright (c) 1999-2001 BalaBit IT Ltd. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. * * Inspired by nsyslog, originally written by Darren Reed. * * $Id: cfg-lex.l,v 1.8 2003/01/22 11:11:18 bazsi Exp $ * ***************************************************************************/ %{ #include "syslog-ng.h" #include "filter.h" #include "cfg-grammar.h" #include <string.h> #include <strings.h> struct keyword { char *kw_name; int kw_token; }; static struct keyword keywords[] = { /* statements */ { "source", KW_SOURCE }, { "destination", KW_DESTINATION }, { "log", KW_LOG }, { "options", KW_OPTIONS }, { "filter", KW_FILTER }, /* source or destination items */ { "file", KW_FILE }, { "fifo", KW_PIPE }, { "pipe", KW_PIPE }, { "internal", KW_INTERNAL }, { "unix_dgram", KW_UNIX_DGRAM }, { "unix_stream", KW_UNIX_STREAM }, { "udp", KW_UDP }, { "tcp", KW_TCP }, { "usertty", KW_USER }, { "door", KW_DOOR }, { "sun_stream", KW_SUN_STREAMS }, { "sun_streams", KW_SUN_STREAMS }, { "program", KW_PROGRAM }, /* option items */ { "flags", KW_FLAGS }, { "catchall", KW_CATCHALL }, { "fallback", KW_FALLBACK }, { "final", KW_FINAL }, { "flow_control", KW_FLOW_CONTROL }, { "no_parse", KW_NO_PARSE }, { "pad_size", KW_PAD_SIZE }, { "mark_freq", KW_MARK_FREQ }, { "stats_freq", KW_STATS_FREQ }, { "flush_lines", KW_FLUSH_LINES }, { "flush_timeout", KW_FLUSH_TIMEOUT }, /* obsolete */ { "sync_freq", KW_FLUSH_LINES }, { "sync", KW_FLUSH_LINES }, { "fsync", KW_FSYNC }, { "long_hostnames", KW_CHAIN_HOSTNAMES }, { "chain_hostnames", KW_CHAIN_HOSTNAMES }, { "keep_hostname", KW_KEEP_HOSTNAME }, { "keep_timestamp", KW_KEEP_TIMESTAMP }, { "ts_format", KW_TS_FORMAT }, { "time_zone", KW_TIME_ZONE }, { "recv_time_zone", KW_RECV_TIME_ZONE }, { "send_time_zone", KW_SEND_TIME_ZONE }, { "use_time_recvd", KW_USE_TIME_RECVD }, { "use_fqdn", KW_USE_FQDN }, { "use_dns", KW_USE_DNS }, { "gc_threshold", KW_GC_BUSY_THRESHOLD }, { "gc_busy_threshold", KW_GC_BUSY_THRESHOLD }, { "gc_idle_threshold", KW_GC_IDLE_THRESHOLD }, { "time_reopen", KW_TIME_REOPEN }, { "time_reap", KW_TIME_REAP }, { "follow_freq", KW_FOLLOW_FREQ }, { "file_template", KW_FILE_TEMPLATE }, { "proto_template", KW_PROTO_TEMPLATE }, { "log_fifo_size", KW_LOG_FIFO_SIZE }, { "log_fetch_limit", KW_LOG_FETCH_LIMIT }, { "log_iw_size", KW_LOG_IW_SIZE }, { "log_msg_size", KW_LOG_MSG_SIZE }, { "log_prefix", KW_LOG_PREFIX }, { "create_dirs", KW_CREATE_DIRS }, { "localip", KW_LOCALIP }, { "ip", KW_IP }, { "localport", KW_LOCALPORT }, { "port", KW_PORT }, { "destport", KW_DESTPORT }, { "owner", KW_OWNER }, { "group", KW_GROUP }, { "perm", KW_PERM }, { "dir_owner", KW_DIR_OWNER }, { "dir_group", KW_DIR_GROUP }, { "dir_perm", KW_DIR_PERM }, { "template", KW_TEMPLATE }, { "template_escape", KW_TEMPLATE_ESCAPE }, { "keep_alive", KW_KEEP_ALIVE }, { "max_connections", KW_MAX_CONNECTIONS }, { "mac", KW_MAC }, { "authentication", KW_AUTH }, { "encrypt", KW_ENCRYPT }, { "required", KW_REQUIRED }, { "allow", KW_ALLOW }, { "deny", KW_DENY }, { "compress", KW_COMPRESS }, { "dns_cache", KW_DNS_CACHE }, { "dns_cache_size", KW_DNS_CACHE_SIZE }, { "dns_cache_expire", KW_DNS_CACHE_EXPIRE }, { "dns_cache_expire_failed", KW_DNS_CACHE_EXPIRE_FAILED }, /* filter items */ { "or", KW_OR }, { "and", KW_AND }, { "not", KW_NOT }, { "level", KW_LEVEL }, { "priority", KW_LEVEL }, { "facility", KW_FACILITY }, { "program", KW_PROGRAM }, { "host", KW_HOST }, { "match", KW_MATCH }, /* on/off switches */ { "yes", KW_YES }, { "on", KW_YES }, { "no", KW_NO }, { "off", KW_NO } }; #define MAX_REGEXP_LEN 1024 int linenum = 1; int lex_filter_params = 0; char buf[MAX_REGEXP_LEN]; char *str; static int check_reserved_words(char *token); static void append_string(int length, char *str); static void append_char(char c); %} %option nounput white [ \t] digit [0-9] alpha [a-zA-Z] alphanum [a-zA-Z0-9] word [^ \#'"\{\}\\;\n\t,|\.] %x string %x qstring %% \#.*$ ; \n { linenum++; } {white}+ ; \.\. { return DOTDOT; } 0x{digit}+ { yylval.num = strtol(yytext, NULL, 16); return NUMBER; } 0{digit}+ { yylval.num = strtol(yytext, NULL, 8); return NUMBER; } {digit}+ { yylval.num = atoi(yytext); return NUMBER; } ({word}+(\.)?)*{word}+ { return check_reserved_words(yytext); } $ { return '('; } $ { return ')'; } \; { return ';'; } \{ { return '{'; } \} { return '}'; } \| { return '|'; } \, ; \" { str = buf; /* yy_push_state(string);*/ BEGIN(string); } \' { str = buf; BEGIN(qstring); } <string>\\a { append_char(7); } <string>\\n { append_char(10); } <string>\\r { append_char(13); } <string>\\t { append_char(9); } <string>\\v { append_char(11); } <string>\\[^anrtv] { append_string(1, yytext + 1); } <string>\" { BEGIN(INITIAL); /* yy_pop_state();*/ yylval.cptr = strdup(buf); return STRING; } <string>[^"\\]+ { append_string(strlen(yytext), yytext); } <qstring>[^']+ { append_string(strlen(yytext), yytext); } <qstring>\' { BEGIN(INITIAL); yylval.cptr = strdup(buf); return STRING; } %% int lex_init(FILE *file) { yyrestart(file); linenum = 1; return 0; } int check_reserved_words(char *token) { int i, j; for (i = 0; i < (sizeof(keywords) / sizeof(struct keyword)); i++) { for (j = 0; token[j] && keywords[i].kw_name[j]; j++) { if (token[j] == '-' || token[j] == '_') { if (keywords[i].kw_name[j] != '_') break; } else if (token[j] != keywords[i].kw_name[j]) break; } if (token[j] == 0 && keywords[i].kw_name[j] == 0) return keywords[i].kw_token; } yylval.cptr = strdup(token); return IDENTIFIER; } static void append_string(int length, char *s) { int to_copy = MIN(MAX_REGEXP_LEN - (str - buf) - 1, length); memcpy(str, s, to_copy); str += to_copy; *str = 0; } static void append_char(char c) { *str = c; str++; *str = 0; } The file cfg-lex.c is empty !! -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Tuesday, February 28, 2006 1:52 PM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Make Error messages On Mon, 2006-02-27 at 16:08 -0500, Stuart Boyle wrote: > Im getting the following errors when I run make, ./configure runs > fine, no errors. > > I have bison and flex installed. > > cyblops2a:/usr/local/syslog-ng-1.9.8 # make make all-recursive > make[1]: Entering directory `/usr/local/syslog-ng-1.9.8' > Making all in src > make[2]: Entering directory `/usr/local/syslog-ng-1.9.8/src' > gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl > -Wl,-Bstatic -lfl -L/usr/local/lib -lglib-2.0 -L/usr/local/lib > -levtlog -Wl,-Bdynamic > > libsyslog-ng.a(cfg.o)(.text+0x5d6): In function `cfg_new': > /usr/local/syslog-ng-1.9.8/src/cfg.c:247: undefined reference to > `lex_init' > libsyslog-ng.a(cfg-grammar.o)(.text+0x17): In function `yyerror': > /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.y:829: > undefined reference to `linenum' > libsyslog-ng.a(cfg-grammar.o)(.text+0x18ea): In function `yyparse': > /home/bazsi/zwa/work/syslog-ng-2.0/syslog-ng/src/cfg-grammar.c:1689: > undefined reference to `yylex' > collect2: ld returned 1 exit status Now as I look at it again, it is not necessarily the flex version that is not correct, syslog-ng ships a generated cfg-lex.c file, and "linenum" variable is not something that -lfl exports but it is defined by cfg-lex.l (which is used to generate cfg-lex.c), as it seems you might have regenerated cfg-lex.c for some reason but it might be empty? Please try to include the make output that generated cfg-lex.c and the contents of your cfg-lex.c is also interesting. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Segfault under RHEL4U2
by Paul Krizak 28 Feb '06

28 Feb '06

I just downloaded 1.9.9 and I'm getting a segfault for the following syslog-ng.conf: source s_external_syslog { udp(port(514)); }; destination d_re_mce_aggregator { program( "/bin/true" ); }; log { source(s_external_syslog); destination(d_re_mce_aggregator); }; I think that the problem is when programs exit unexpectedly and/or don't wait for input. I haven't run many more test cases to see exactly what's going on. The segfault drops two cores, 1MB and 256KB. If they would be helpful, please let me know and I can send them somewhere. -- Paul Krizak 5900 E. Ben White Blvd. MS 625 Advanced Micro Devices Austin, TX 78741 Linux/Unix Systems Engineering Phone: (512) 602-8775 Microprocessor Solutions Sector Cell: (512) 791-0686

3 3