- syslog-ng - lists.balabit.hu

Fwd: [syslog-ng] spoof_source not working
by Chance Ellis 22 Oct '05

22 Oct '05

Ok, I have tried everything you have given men and I am still coming up with nothing... Here is the output of my ldd: ldd /usr/local/sbin/syslog-ng libpthread.so.1 => /usr/lib/libpthread.so.1 libnsl.so.1 => /usr/lib/libnsl.so.1 libsocket.so.1 => /usr/lib/libsocket.so.1 libdoor.so.1 => /usr/lib/libdoor.so.1 libresolv.so.2 => /usr/lib/libresolv.so.2 libxnet.so.1 => /usr/lib/libxnet.so.1 libc.so.1 => /usr/lib/libc.so.1 libdl.so.1 => /usr/lib/libdl.so.1 libmp.so.2 => /usr/lib/libmp.so.2 libthread.so.1 => /usr/lib/libthread.so.1 /usr/platform/SUNW,Sun-Fire-V210/lib/libc_psr.so.1 Notice libxnet. Should I be using it? Can it be causing the problem? How do I tell syslog-ng at compile time to use libnet.a or libnet.so? On 10/14/05, Nate Campi <nate(a)campin.net> wrote: > > Ellis, > > I didn't mention in my email to you that you'll want the libnet.so file > in /tmp/foo - but first make sure you're dynamically liked using the ldd > command: > > -0-[root@duo:masterfiles]# ldd /sbin/syslog-ng > libnsl.so.1 => /lib/libnsl.so.1 (0x40028000) > libresolv.so.2 => /lib/libresolv.so.2 (0x4003c000) > libc.so.6 => /lib/libc.so.6 (0x4004e000) > /lib/ld-linux.so.2 (0x40000000) > > You should see libnet.so in there somewhere if you're dynamically > linked. If you're statically linked then you have to narrow it down with > truss as Bazsi has said. > > Good luck, > Nate > > On Fri, Oct 14, 2005 at 05:35:13PM +0200, Balazs Scheidler wrote: > > On Thu, 2005-10-13 at 15:57 -0400, Chance Ellis wrote: > > > Ok, > > > > > > I copied the the Solaris 8 libnet-config file to the /tmp/foo folder > > > on Solaris 9. I then ran: > > > > > > LD_LIBRARY_PATH=/tmp/foo:$LD_LIBRARY_PATH > > > truss /usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf -F & > > > > > > > > > I get the same result... Whenever I apply the spoof_source(yes) to the > > > config I do not get any messages forwarded to the destination. If I > > > remove the spoof_source(yes) messages flow but with the source IP > > > address from the syslog-ng server... > > > > > > The truss output is quite huge! Is there any piece of the truss output > > > that would help me to troubleshoot this? Is libnet-config the only > > > thing I need or do I need something in addition to libnet-config? > > > > libnet-config is not used at all while running syslog-ng, it is a > > build-time script that is invoked to query header location and linking > > information about the libnet library. > > > > libnet is usually linked statically, so there's no point in setting > > LD_LIBRARY_PATH either, you can check which one syslog-ng is using by > > using "ldd" and/or checking if you have a libnet.a file (static), or > > libnet.so file (dynamic), or both. If you have both, the linking > > parameters determine which one is used by syslog-ng, in this case ldd > > should tell you the truth. > > > > To analyze the truss path, you should look for the pattern of the > > message that should be sent out with a spoofed source address, and then > > you should see system calls like recvmsg() when the message is received > > and either send() or write() when it is sent. libnet uses raw sockets to > > send messages, syslog-ng is probably opening AF_INET, SOCK_RAW sockets > > in that case. > > > > Although Solaris uses socket emulation and thus the actual system calls > > you see in the truss output might not be the same as in Linux, this is > > pretty straightforward. By the way, it might be easier to analyze the > > truss output if you are running a syslog-ng instance which does not > > actually deliver a lot of messages, but only a single one, this way the > > truss output will not be so large. > > -- > Nate > > "Often, when I am reading a good book, I stop and thank my teacher. That > is, I used to, until she got an unlisted number." - Unknown 15-year-old > > >

3 4

Queueing of messages if remote loghost is down
by Eric Brown 22 Oct '05

22 Oct '05

I'd like to centralize logs from 2-data centers to my corporate offices via tcp destinations at my data centers and a tcp source at my corporate office. What if my data centers suffer network connectivity problems or I loose power at my corporate office? How long will syslog-ng keep queueing messages before I start loosing data? Will its attempts to retry connecting to my corporate office adversely affect overall system performance of the machine it is running on? Will it recover on its own after a few hours of lost connectivity? Thanks, Eric

1 0

Fwd: Re: [syslog-ng] I need to add more facilities
by Yan M. 22 Oct '05

22 Oct '05

On Fri, 2005-10-21 at 01:03 -0500, Kevin wrote:> On 10/20/05, Yan M. <yannnick_m(a)yahoo.com> wrote:> > searching through the documentation, FAQ, README> > and INSTALL I didnt find anywhere mentionned that I can> > create new facilities.> >> > I read that syslog-ng has the same facilities than syslog in Solaris.> > Technically, syslog-ng has the same facilities as all> standards-compliant syslog daemons, because the facility range is> defined in RFC 3164> > There are only 24 legal values for the facility, and eight legal> values for severity.> > > What I want to do is to have more facilities, with significative names> > like httpd0, httpd1, httpd2, httpd3.....and so on to httpd50.> >> > This is to split message received from my apache VirtualHosts AccessLog and> > ErrorLog> > How would you cause Apache to generate "syslog" messages with> non-standards-conformant facility values, corresponding to your> virtual hosts?> > > > I dont want to filter using regexp, only with facility> > One ugly hack to accomplish what you ask would be to use the standard> facilities and severities to indicate which virtual host sourced the> traffic. So "kern.debug" would be httpd0, kern.info would be httpd1,> and local7.emergency would be httpd191> > It might be easier to just use regex.syslog-ng 2.x allows specifying facility values by number, even stilldifficult to generate non-compliant facility messages in the firstplace.The reason why the facility based filtering failed in the first placewas that no appropriate processes were created to allocate new numbers.-- Bazsi_______________________________________________syslog-ng maillist - syslog-ng@lists.balabit.huhttps://lists.balabit.hu/mailman/listinfo/syslog-ngFrequently asked questions at http://www.campin.net/syslog-ng/faq.html Rethinking about it, I found another way to do it. It is under Solaris8 so I can use pipes, apache ErrorLog and AccessLog can write to pipes. Apache runs in a chroot jail, and ErrorLog's/AccessLog's of all VirtualHosts write to their own unique pipe in the jail. Syslog-ng runs not chrooted and can read the pipes so I defines a source for each pipes in the config I can split logs from apache that way. Thanks for your replies Yan --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

1 0

new list: syslog-ng-commit
by Balazs Scheidler 21 Oct '05

21 Oct '05

Hi, For those interested I've created a new list named syslog-ng-commit where information about the commits to my internal syslog-ng 2.0 tree will be published. To subcribe go to https://lists.balabit.hu/mailman/listinfo/syslog-ng-commit/ The number of commits is usually low, you don't need to expect more than 1-5 commits weekly. I hope this list can help you to track the progress towards syslog-ng 2.x. Each message lists commit meta information, changelog entry and a diffstat on the commit. For now the patch will not be available, I'm going to publish my internal GNU arch tree if requested. -- Bazsi

1 0

I need to add more facilities
by Yan M. 21 Oct '05

21 Oct '05

Hi list, searching through the documentation, FAQ, README and INSTALL I didnt find anywhere mentionned that I can create new facilities. I read that syslog-ng has the same facilities than syslog in Solaris. What I want to do is to have more facilities, with significative names like httpd0, httpd1, httpd2, httpd3.....and so on to httpd50. This is to split message received from my apache VirtualHosts AccessLog and ErrorLog I dont want to filter using regexp, only with facility Thank you Yan --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

3 2

Unix-stream destination as listen socket
by Peter Nahas 20 Oct '05

20 Oct '05

Hello everyone, I am currently working on a project using syslog-ng-1.9.5 (soon to upgrade to 1.9.6) which requires a syslog-ng destination to be a Unix socket. The problem is that the syslog-ng daemon will always be started before the destination application. So to prevent the loss of messages due to the reconnect timer, the syslog-ng destination Unix socket will have to listen()/accept() for a connection rather than connect() to an external socket. If this enhancement would be used by others, I would like to write this properly. Therefore I have the following questions: A) If this enhancement were written, would it be accepted into the repository? If not, I will simply hack up the current AFUnixDestinationDriver to do what I want. B) Is there any specification document which would assist me in making this enhancement? C) Would this best be done by adding an additional option to unix-stream for destinations or by creating a separate destination driver? D) It appears as if the AFSocketDestinationDriver is not designed to perform listen()/accept(), but the AFSocketSourceDriver is. Would it be possible to set up the AFUnixDestinationDriver to use the AFSocketSourceDriver as a parent, but attach it to a log writer? Thanks in advance, Peter Nahas Software Engineer MRV Communications - InReach division

3 4

Filter based on source?
by Robert.Becker＠motoristsgroup.com 20 Oct '05

20 Oct '05

As with many people I am using syslog-ng to send all my logs to a central source. A bunch of the logs I am sending are from growing log files. I have everything working and quite well, but I have one problem. When syslog-ng builts the log statement it goes in the following format: Oct 20 09:59:24 server_pipe@linuxp17 [org.jboss.resource.connectionmanager.IdleRemover] run: IdleRemover notifying pools, interval: 450000 server_pipe is the name of the source, defined on the client syslog server, this log is coming from. When this log is piped via tcp to the central server I want to be able to filter the server_pipe part and send it to a specific destination. Can this be done? From what I've read the match only works on the message section. I need to filter based the source. Any ideas? Thanks a bunch. -Rob Becker ********************************************************************** The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error or there are any problems please notify the originator immediately. The unauthorized use, disclosure, copying or alteration of this message is strictly forbidden. Motorists Insurance Group will not be liable for direct, special, indirect or consequential damages arising from the alteration of the contents of this message by a third party or as a result of any virus being passed on. **********************************************************************

2 1

Problem with setup of syslog-ng loghost in HA environment
by Berthold Cogel 19 Oct '05

19 Oct '05

Hello! We want to set up a syslog-ng in a HA Cluster (Red Hat Clumanager). The Cluster has two nodes for failover of services with attached shared storage from our SAN. The idea was to use syslog-ng only for the loghost. Local logging on all machines is done by standard syslog and forwarded to the loghost. The loghost uses his own IP which is handed over from one node to the other in case of a failover situation. It is not a problem to get the loghost running. The problem is the logging on the cluster node that is the current loghost. Although syslog doesn't log remote messages and syslog-ng binds to another (virtual) interface. We have an old loghost with syslog, where our systems send parts of their messages. This works, even for the system, syslog-ng is running on. I can see the udp packets with ethereal. But there is no syslog traffic to the second IP or localhost. Only 'external' messages get logged with syslog-ng The system is Red Hat Enterprise Linux 3. syslog-ng is 1.6.8. Thanks in advance Berthold Cogel

2 1

syslog server
by John.Dickinson＠nominet.org.uk 19 Oct '05

19 Oct '05

I have a central syslog server receiving log messages from clients. I want to store the messages on the clients and the server (with different rotation/archiving setting). From what I have seen I will need to have all the syslog configuration on both the client and the server. Is there anyway to simplify this? As an example: I have something like this on the client (along with other filters and destinations) filter f_emerg { level (emerg); }; filter f_alert { level (alert .. emerg); }; filter f_crit { level (crit .. emerg); }; filter f_err { level (err .. emerg); }; filter f_warning { level (warning .. emerg); }; filter f_notice { level (notice .. emerg); }; filter f_info { level (info .. emerg); }; filter f_debug { level (debug .. emerg); }; filter f_kern { facility (kern); }; filter f_user { facility (user); }; filter f_mail { facility (mail); }; filter f_daemon { facility (daemon); }; filter f_auth { facility (auth); }; filter f_syslog { facility (syslog); }; filter f_lpr { facility (lpr); }; filter f_news { facility (news); }; filter f_uucp { facility (uucp); }; filter f_cron { facility (cron); }; filter f_local0 { facility (local0); }; filter f_local1 { facility (local1); }; filter f_local2 { facility (local2); }; filter f_local3 { facility (local3); }; filter f_local4 { facility (local4); }; filter f_local5 { facility (local5); }; filter f_local6 { facility (local6); }; filter f_local7 { facility (local7); }; filter f_kern_debug { filter (f_kern) and filter (f_debug); }; filter f_daemon_notice { filter (f_daemon) and filter (f_notice); }; filter f_mail_crit { filter (f_mail) and filter (f_crit); }; filter f_syslog { filter (f_err) or filter (f_kern_debug) or filter (f_daemon_notice) or filter (f_mail_crit); }; destination d_syslog { file ("/var/log/syslog"); }; destination d_log_server { tcp ("127.0.0.1" port (514) tcp-keep-alive(yes) log_fifo_size(10000)); }; log { source (s_local); filter (f_syslog); destination (d_syslog); }; log { source (s_local); filter (f_syslog); destination (d_log_server); }; On the server I want to get all the messages in a file with the same name as they are in on the client. Do I have to repeat all these filters again on the server or is there a way to find what log statement they matched on the client? Basically, I dont want to be repeating the config everywhere because it will become a maintenance nightmare. John

1 0

clustering syslog-ng
by John.Dickinson＠nominet.org.uk 19 Oct '05

19 Oct '05

Hi, I am trying to setup a clustered syslog server using polyserve, syslog-ng (1.6.8) and stunnel. Log messages are sent using TCP for reliability. I am testing the setup by generating 10 messages per second on a client. The messages are numbered so that I can see if any are missing. Logging is working but when I force the syslog service to fail over to a different node in the cluster I lose messages. From what I have read on these lists I would expect syslog-ng 1.6.8 to lose one message when it finds that the first server has failed but should queue the rest until the service returns on the other node. However I am losing around 200 messages. This part of the client config destination d_log_server { tcp ("127.0.0.1" port (514) tcp-keep-alive(yes) log_fifo_size(10000)); }; log { source (s_local); filter (f_local7_info); destination (d_log_server); }; and the server options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_ext { tcp(ip(127.0.0.1) port(514) tcp-keep-alive(yes)); }; destination d_dev1 { file("/logs/dev1.log"); }; log { source(s_ext); destination(d_dev1); }; This stunnel config is the same as the example on the stunnel web site. Any ideas? I know it is only beta but would I be better off using syslog-ng 1.9? I realise that I could do this without the clustering and just send all the messages to both servers but this way I have no duplication of logs. Thanks John

1 0

Syslog-ng.conf syntax
by SOLIS, ALEX 19 Oct '05

19 Oct '05

Does a log statement need to all be on one line? I have a log statement with two sources, 4 filters and 2 destinations. It all wont fit on one line. When I try to break it up into a block format logging stops for those destiniations. I am sure I am missing something. Here is the log statement: log { source(net); source(net_tcp); filter (f_not_nmrouter); filter (f_not_non_critical_windows); filter (f_not_non_crit_unix); filter (f_not_uiz_servers); destination(x); destination(y); }; Is this broken up correctly? <p class=MsoNormal><span style='font-size:8.5pt'>This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.</p>

3 2

messed up permissions on /dev/null destination on solaris
by Nate Campi 18 Oct '05

18 Oct '05

When using /dev/null as a destination on Solaris 8 (sparc) with syslog-ng 1.6.7 the perms of /dev/null get messed up: $ ls -l /dev/null lrwxrwxrwx 1 root other 27 Apr 19 2003 /dev/null -> ../devices/pseudo/mm@0:null $ ls -l /devices/pseudo/mm@0:null crw-r--r-- 1 root root 13, 2 Oct 16 18:27 /devices/pseudo/mm@0:null I thought this was addressed at some point, was that only on Linux perhaps? Thanks, -- Nate "Hardware : The parts of a computer system that can be kicked." - Pesis, Jeff

5 10

program dies
by Jeff DiNisco 17 Oct '05

17 Oct '05

I'm running syslog-ng on solaris 10. I have a destination defined as - destination d_alert { program("/usr/local/admin/syslog-ng/alert.bash"); }; when syslog-ng is started, these processes also start... /bin/bash /usr/local/admin/syslog-ng/alert.bash /bin/sh -c /usr/local/admin/syslog-ng/alert.bash About an hour later, for no apparent reason, the 2 alert.bash processes die but the syslog-ng process continues to run. I've implemented a watchdog script to alert and restart syslog-ng when they die. It's interesting to note that they seem to die exactly 1 hour after being restarted. command used to start syslog-ng - /usr/local/sbin/syslog-ng -f /usr/local/etc/syslog-ng.conf >> ${logfile} 2>&1 alert.bash script... #!/bin/bash export mailaddr=jeff(a)xxxxxx.com while read input do hostname=`echo ${input} |awk '{print $4}' |sed 's|/.*||'` program=`echo ${input} |awk '{print $5}' |sed 's|[[(].*||'` echo ${input} | mailx -s "${program} alert on ${hostname}" ${mailaddr} done Any help would be greatly appreciated. - Jeff __________________________________ Yahoo! Music Unlimited Access over 1 million songs. Try it free. http://music.yahoo.com/unlimited/

3 3

How does regex work with HOST definitions?
by Jason Haar 17 Oct '05

17 Oct '05

Hi there I have a subset of syslog-ng hosts that use a specific DNS formatted naming convention that I wish to ensure all their data is caught by a particular syslog-ng filter. I have filter f_process_Test { host("^...\-..\-ids\-[0-9]+\...\.our\.net$") and not host("abc-xy-ids-02\.our\.net"); }; i.e. I want abc-12-ids-01.aa.our.net and xyz-12-ids-01.aa.our.net to be caught by this filter, but abc-xy-ids-02\.our\.net not to be. I could explicitly name them all I suppose - but there are 12+ of them and they are growing in number. A regex would be much more efficient. Anyway, it doesn't work. That filter never triggers. I know the hostnames are correct as I have a general catch-all rule that logs to filenames containing the hostname - and those hostnames show up in there. Can anyone explain what I've got wrong? REGEX works fine in my "match" calls... This is syslog-ng-1.6.7-2 under CentOS4.1 Thanks! -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

6 9

messages on syslog-ng server and locals files
by Atif Munir 17 Oct '05

17 Oct '05

Hi All, How can I have messages on the remote syslog-ng server and on local files? Thanks in advance. Atif

1 0

syslog-ng 1.9.6 released
by Balazs Scheidler 16 Oct '05

16 Oct '05

Hi, I've released yet another version in the syslog-ng development series targeted at the stable 2.0, dubbed 1.9.6. It has the following NEWS entry: 1.9.6 Sat, 15 Oct 2005 18:07:07 +0200 * Added new options to control buffer flushing (flush_lines and flush_timeout, see the documentation for more details) * Fixes in local timezone detection, it should properly detect DSTs on Linux, Solaris and probably BSDs. * Fixed facility/priority filtering. * Fixed owner/group/permission setting on target files/directories. * Copied the contrib directory as found in 1.6.x to this tree. * TZ macro is now an alias of TZOFFSET, as I could not find a portable way to determine the string representation of any given timezone offset. * Added some more unit tests. -- Bazsi

2 1

RE: [syslog-ng] syslog-ng 1.9.6 compile error
by Marvin Nipper 15 Oct '05

15 Oct '05

MANY thanks on the time-related fixes. The 1.9.6 compilations seemed to go great in that regard. But then it generated an error much further down in the compilation process. Maybe it's just something stupid that I've done(??). Your input would be appreciated. (The config and a chunk of the compilation output is pasted in below.) THANKS for all of the great work on the new version. Marvin ./configure checking for a BSD-compatible install... ./install-sh -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... no checking for nawk... nawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc option to accept ANSI C... none needed checking for bison... no checking for byacc... no checking for flex... no checking for lex... lex checking for yywrap in -lfl... no checking for yywrap in -ll... yes checking lex output file root... lex.yy checking whether yytext is a pointer... no checking whether make sets $(MAKE)... (cached) yes checking for ranlib... ranlib checking how to enable static linking for certain libraries... GNU or Solaris checking how to run the C preprocessor... gcc -E checking for egrep... egrep checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... no checking for unistd.h... yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking openssl/ssl.h usability... no checking openssl/ssl.h presence... no checking for openssl/ssl.h... no checking getopt.h usability... no checking getopt.h presence... no checking for getopt.h... no checking whether struct tm is in sys/time.h or time.h... time.h checking for struct tm.tm_gmtoff... no checking for door_create in -ldoor... yes checking for socket in -lsocket... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for strdup... yes checking for strtol... yes checking for inet_aton... no checking for inet_ntoa... yes checking for getopt_long... no checking for pkg-config... /usr/local/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for GLIB_CFLAGS... -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include checking for GLIB_LIBS... -L/usr/local/lib -lglib-2.0 -liconv checking for EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking for EVTLOG_LIBS... -L/usr/local/lib -levtlog checking for static GLib libraries... yes configure: creating ./config.status config.status: creating dist.conf config.status: creating Makefile config.status: creating src/Makefile config.status: creating doc/Makefile config.status: creating doc/docvars.xml config.status: creating contrib/Makefile config.status: creating tests/Makefile config.status: creating tests/unit/Makefile config.status: creating tests/functional/Makefile config.status: creating config.h config.status: executing depfiles commands secdevrsn01 # make make all-recursive Making all in src if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT misc.o -MD -MP -MF ".deps/misc.Tpo" \ -c -o misc.o `test -f 'misc.c' || echo './'`misc.c; \ then mv -f ".deps/misc.Tpo" ".deps/misc.Po"; \ else rm -f ".deps/misc.Tpo"; exit 1; \ fi ...... numerous successful compiles in here...... rm -f libsyslog-ng.a ar cru libsyslog-ng.a misc.o utils.o messages.o gsockaddr.o syslog-names.o macros.o logmsg.o cfg.o logpipe.o driver.o sgroup.o dgroup.o center.o filter.o logsource.o logreader.o logwriter.o affile.o afunix.o afinet.o afsocket.o afstreams.o afuser.o afprog.o afinter.o cfg-lex.o cfg-grammar.o fdwrite.o fdread.o memtrace.o templates.o children.o ranlib libsyslog-ng.a if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -I/usr/local/include/eventlog -D_GNU_SOURCE -g -O2 -Wall -g -MT main.o -MD -MP -MF ".deps/main.Tpo" \ -c -o main.o `test -f 'main.c' || echo './'`main.c; \ then mv -f ".deps/main.Tpo" ".deps/main.Po"; \ else rm -f ".deps/main.Tpo"; exit 1; \ fi gcc -g -O2 -Wall -g -o syslog-ng main.o libsyslog-ng.a -lnsl -lsocket -ldoor -Wl,-Bstatic -ll -L/usr/local/lib -lglib-2.0 -liconv -L/usr/local/lib -levtlog -Wl,-Bdynamic Undefined first referenced symbol in file LOG_FAC libsyslog-ng.a(filter.o) ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /var/opt/packages/syslog-ng-1.9.6/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /var/opt/packages/syslog-ng-1.9.6 *** Error code 1 make: Fatal error: Command failed for target `all'

2 1

RE: [syslog-ng] syslog-ng 1.9.6 compile error
by Marvin Nipper 15 Oct '05

15 Oct '05

Sorry, I should have stated in the previous post that this is all in a Solaris 8 Sparc environment.

1 0

log does not appear on the clients
by Atif Munir 15 Oct '05

15 Oct '05

I have make a syslog-ng server and the clients are pushing their syslog (by default daemon) messages to syslog-ng server. The logs are fine on the server but I am unable to view the logs on the clients dmesg(/var/adm/messages). I m interested to have the logs on both sides...I mean on the syslog-ng server and on the clients it self. The clients have /etc/syslog.conf as under. =====================/etc/syslog.conf===================== *.err;kern.notice;auth.notice @loghost #*.err;kern.notice;auth.notice /dev/sysmsg *.err;kern.debug;daemon.notice;mail.crit @loghost *.err;kern.debug;daemon.notice;mail.crit /var/adm/messages *.alert;kern.err;daemon.err operator *.alert root *.emerg * mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost) ifdef(`LOGHOST', , user.err @loghost user.err /dev/sysmsg user.err @loghost user.err /var/adm/messages user.alert `root, operator' user.emerg * ) ====================================================== Thanks in advance . Atif

2 1

Incompatibility beetween syslogNG 1.6.8(lattest stable) and libol 0.3.8 ?????
by CIKALA Frederic ROSI/DOSI 14 Oct '05

14 Oct '05

Hello Before trying to install the 0.2.24 version of libol, i want to be sure that stable syslog NG version 1.6.8 is not compatible with the 0.3.8 version of libol. According to https://lists.balabit.hu/pipermail/syslog-ng/2001-December/002794.html, a stable version should be used with a 0.2 verison of libol, where as the stderr advises me to use a 0.3 version :-/ :-\ ... checking libol version >= 0.3.16... no configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch [root@XXXX-Linux syslog-ng-1.6.8]# .... Thus, i'm totally confused and need Help thanks for those who will answer, there is no others clue on the web ;( *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

2 1

RE: [syslog-ng] Incompatibility beetween syslogNG 1.6.8(lattest stable)and libol 0.3.8 ?????
by William Bell 14 Oct '05

14 Oct '05

I can save you some trouble, grab one of the latest daily snapshots of the 1.6.8 verison, it configures libol in the process, it has never lead me astray. William -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of CIKALA Frederic ROSI/DOSI Sent: Friday, October 14, 2005 7:39 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] Incompatibility beetween syslogNG 1.6.8(lattest stable)and libol 0.3.8 ????? Hello Before trying to install the 0.2.24 version of libol, i want to be sure that stable syslog NG version 1.6.8 is not compatible with the 0.3.8 version of libol. According to https://lists.balabit.hu/pipermail/syslog-ng/2001-December/002794.html, a stable version should be used with a 0.2 verison of libol, where as the stderr advises me to use a 0.3 version :-/ :-\ ... checking libol version >= 0.3.16... no configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch [root@XXXX-Linux syslog-ng-1.6.8]# .... Thus, i'm totally confused and need Help thanks for those who will answer, there is no others clue on the web ;( *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. *********************************** _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Newbi with syslogNG & libol : Libol not recognize :(
by CIKALA Frederic ROSI/DOSI 14 Oct '05

14 Oct '05

Hello' I've found the server to install syslog-ng and i downloaded the stable version with the 0.3.8 version of the libol librairie. I found a document on the web which explain HowTo install it ... therefore i tried, but i got some problem during installation. First i've installed the libol libs (0.3.8) with the ./configure, make, make install - and it seems to be all right. Then, i tried the same sequence with syslogNG and i' got an error concerning libol, as following : [root@XXX-Linux syslog-ng-1.6.8]# ./configure checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes ... ... checking libol version >= 0.3.16... no configure: error: Required libol version not found, make sure that your libol version is in the 0.3.x branch [root@XXX-Linux syslog-ng-1.6.8]# Where as libol seems to be great installed : [root@XXX-Linux download]# libol-config --version 0.3.8 I saw a paper about this problem ( https://lists.balabit.hu/pipermail/syslog-ng/2004-April/006023.html ) but the answer is not goood for me cause' it tells that it is a version problem (like 0.3.9 is too old, and older than the 0.3.13 ... i cannot understand this :-/) so i'm quite Lost ... can anyone help please ? *********************************** Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message electronique est susceptible d'alteration. Le Groupe France Telecom decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. Si vous n'etes pas destinataire de ce message, merci de le detruire immediatement et d'avertir l'expediteur. *********************************** This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. Messages are susceptible to alteration. France Telecom Group shall not be liable for the message if altered, changed or falsified. If you are not receiver of this message, please cancel it immediately and inform the sender. ***********************************

1 0

RE: [syslog-ng] v1.6.8: usertty fails for usernames > 7 characters
by Patterson, Jay 14 Oct '05

14 Oct '05

I commented out some expressions on lines 103 and 108 of src/afuser.c src/afuser.c:103 ( /*self->username->length == strlen(ut->ut_user) &&*/ src/afuser.c:108 ( /*self->username->length == strlen(ut->ut_name) &&*/ These expressions appear to be optimizations that avoid doing a subsequent memcpy when the two strings obviously won't match, so I think commenting them out is harmless. From what I can tell, the strlen function will return a length much greater than the actual length for user names that go over 7 (or 31 for ut_user) characters, as there is no null-terminator in that case. I guess it eventually finds a zero somewhere beyond that point in memory. Experimentation with getutent more or less convinced me of that, as 8 character user names were returned with a bit of additional text, the null-string interpretation of ut_id. I had to touch afuser.c to set its modification date back to Jan 31 2003 after editing. Something in the build process breaks if the modification date on the file is too recent. This fixed the problem I was having with 8-character arguments to usertty Jay Patterson OpenView Consultant E-Mail: Jay.Patterson(a)T-Mobile.com Phone: 862-812-3436 -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] Sent: Thursday, October 13, 2005 2:12 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] v1.6.8: usertty fails for usernames > 7 characters syslog-ng-1.6.8 compiled with GCC 3.4.2 on Solaris 2.8 syslog-ng won't write to userttys for login names that are greater than 7 characters Equivalent functionality on syslogd works Never used getutent until today, but ... After using getutent a little, I've come to the conclusion that the utmp fields are not null-terminated. Coincidently, ut_name has a size of 8 ut_user has a size of 32 The code near source file "afuser.c", line 98, seems to treat the ut_name and ut_user fields as if they were null-terminated. Jay Patterson OpenView Consultant E-Mail: Jay.Patterson(a)T-Mobile.com Phone: 862-812-3436

1 0

v1.6.8: usertty fails for usernames > 7 characters
by Patterson, Jay 13 Oct '05

13 Oct '05

syslog-ng-1.6.8 compiled with GCC 3.4.2 on Solaris 2.8 syslog-ng won't write to userttys for login names that are greater than 7 characters Equivalent functionality on syslogd works Never used getutent until today, but ... After using getutent a little, I've come to the conclusion that the utmp fields are not null-terminated. Coincidently, ut_name has a size of 8 ut_user has a size of 32 The code near source file "afuser.c", line 98, seems to treat the ut_name and ut_user fields as if they were null-terminated. Jay Patterson OpenView Consultant E-Mail: Jay.Patterson(a)T-Mobile.com Phone: 862-812-3436

1 0

bugreport for 1.9.5 on solaris
by Nate Campi 13 Oct '05

13 Oct '05

I built 1.9.5 and eventlog-0.2.3+20050116+1856 on Solaris 8. It wouldn't start with command line arguments like "--pidfile=/foo/syslog-ng.pid", I had to change it to "-p /foo/syslog-ng.pid". The usage message it spits out claims that the --long syntax is supported. The other thing is that "bad_hostname()" isn't implemented in 1.9.5, but I'm sure you already knew that. The 2.0 reference guide lists this as a supported option though. Just FYI. -- Nate NT is the only OS that has caused me to beat a piece of hardware to death with my bare hands.

8 16