- syslog-ng - lists.balabit.hu

Logging Java stack traces with syslog-ng and log4j
by Vaibhav Goel 19 Apr '05

19 Apr '05

Hi all I am trying to get syslog-ng to log a java stack trace such as one shown below. PST:2005-03-15/10:46:49.657 [ExecuteThread: '23' for queue: 'weblogic.kernel.Default'] LOGERROR jwsm.com.cucbc.taglib.content.IncludeTagContent -- ServletExce ption on include tag javax.servlet.ServletException: Got error: 404 at com.cucbc.servlet.SimpleMDRequestDispatcher.handleError(SimpleMDRequestD ispatcher.java:72) at com.cucbc.servlet.AbstractMDRequestDispatcher.checkForError(AbstractMDRe questDispatcher.java:87) at com.cucbc.servlet.AbstractMDRequestDispatcher.include(AbstractMDRequestD ispatcher.java:71) at com.cucbc.taglib.content.IncludeTagContent.write(IncludeTag.java:137) at com.cucbc.taglib.content.ContentTagSupport.doEndTag(ContentTagSupport.ja va:52) at jsp_servlet._personal.__index._jspService(index.jsp:63) at weblogic.servlet.jsp.JspBase.service(JspBase.java:33) at weblogic.servlet.internal.ServletStubImpl$ServletInvocationAction.run(Se rvletStubImpl.java:996) etc... I have a filter match "LOGERROR" configured for syslog-ng. It matches fine and logs the line: PST:2005-03-15/10:46:49.657 [ExecuteThread: '23' for queue: 'weblogic.kernel.Default'] LOGERROR jwsm.com.cucbc.taglib.content.IncludeTagContent -- ServletExce ption on include tag However, the stack trace after that is ignored.... Any way to get that? I guess a regexp match on LOGERROR is out of the question... Thanks

2 1

Re: [syslog-ng]trouble configuring syslog-ng with libraries
by John Thrumston 15 Apr '05

15 Apr '05

I tried the ./configure --enable-dynamic-linking as it suggests, got the exact same results. Sunfreeware has a newer version of GLIB (SMCglib-2.6.2 out there. My questions are, if I add that package. 1) how will the server know which version to use? 2. Will this corrupt any other packages that may currently be using the SUNWGlib that was installed? Sorry to ask all these questions, I just don't know library functions very well and don't want to blow the box up so to speak. Thanks again for your help. Balazs Scheidler <bazsi(a)balabit.hu> wrote: On Thu, 2005-04-14 at 10:09 -0700, John Thrumston wrote: > thank you, that appears to have fixed that, but now I get the > following. > > checking for glib-2.0... yes > checking GLIB_CFLAGS... -I/usr/include/glib-2.0 > -I/usr/lib/sparcv9/glib-2.0/include > checking GLIB_LIBS... -L/usr/lib/sparcv9 -lglib-2.0 > checking for eventlog... yes > checking EVTLOG_CFLAGS... -I/usr/local/include/eventlog > checking EVTLOG_LIBS... -L/usr/local/lib -levtlog > checking for static GLib libraries... no > configure: error: static GLib libraries not found, either link GLib > dynamically using the --enable-dynamic-linking or install a static > GLib > > as you can see, it found glib but for some reason errors out. I have > added every directory if found thru find to the PKG_CONFIG_PATH > variable but that doesn't seem to help. What should I be looking for? Just do as the configure script says: either install a static glib (it is named libglib.a, not .la!) or if you don't mind linking to libraries in /usr (which could be NFS mounted for instance) then specify --enable-dynamic-linking to the configure script. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --------------------------------- Do you Yahoo!? Make Yahoo! your home page

2 1

RE: [syslog-ng]Match macro in filename?
by Vaibhav Goel 14 Apr '05

14 Apr '05

Thanks Nate. I am using (trying to) an alternate approach now...I am going to write a perl script that gets everything from STDIN and parses the log data, does some regexp matching and writes out the logs based on that....check this simple script (which does not wanna work): #!/usr/bin/perl -w my $input = <STDIN> ; if ($input =~ /xyz/) { $var = "xyz.log"; open(LOG, ">>/tmp/$var"); print LOG "$input"; close(LOG); } This does not seem to want to work using syslog-ng (it works fine from the commandline though),...any ideas anyone? -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Nate Campi Sent: April 14, 2005 2:12 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Match macro in filename? On Thu, Apr 14, 2005 at 07:55:24AM -0700, Vaibhav Goel wrote: > > Cool that it is 1.9.4. Is 1.9.4 production ready by any chance? I am > currently using 1.6.5. If not, is there any other way you can suggest > to solve this "problem"? I am not averse to writing some scripts etc.. Good news on the feature in the 1.9 branch! As for using 1.6.5, someone else just brought this up the other day, see this thread: https://lists.balabit.hu/pipermail/syslog-ng/2005-April/007260.html -- Nate "If you put a billion monkeys in front of a billion typewriters typing at random, they would reproduce the entire collected works of Usenet in about ... five minutes." -Anon. "Come to think of it, there are already a million monkeys on a million typewriters, and the Usenet is NOTHING like Shakespeare!" -Blair Houghton _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

RE: [syslog-ng]Match macro in filename?
by Vaibhav Goel 14 Apr '05

14 Apr '05

Actually my bad...it does work...in fact writes 1 line of log entry but then no more. The script exits after that one entry (ie not running like my "cat" test in the background)... -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Vaibhav Goel Sent: April 14, 2005 2:23 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Match macro in filename? Thanks Nate. I am using (trying to) an alternate approach now...I am going to write a perl script that gets everything from STDIN and parses the log data, does some regexp matching and writes out the logs based on that....check this simple script (which does not wanna work): #!/usr/bin/perl -w my $input = <STDIN> ; if ($input =~ /xyz/) { $var = "xyz.log"; open(LOG, ">>/tmp/$var"); print LOG "$input"; close(LOG); } This does not seem to want to work using syslog-ng (it works fine from the commandline though),...any ideas anyone? -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Nate Campi Sent: April 14, 2005 2:12 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Match macro in filename? On Thu, Apr 14, 2005 at 07:55:24AM -0700, Vaibhav Goel wrote: > > Cool that it is 1.9.4. Is 1.9.4 production ready by any chance? I am > currently using 1.6.5. If not, is there any other way you can suggest > to solve this "problem"? I am not averse to writing some scripts etc.. Good news on the feature in the 1.9 branch! As for using 1.6.5, someone else just brought this up the other day, see this thread: https://lists.balabit.hu/pipermail/syslog-ng/2005-April/007260.html -- Nate "If you put a billion monkeys in front of a billion typewriters typing at random, they would reproduce the entire collected works of Usenet in about ... five minutes." -Anon. "Come to think of it, there are already a million monkeys on a million typewriters, and the Usenet is NOTHING like Shakespeare!" -Blair Houghton _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

syslog-ng/localhost/stunnel
by Dmitry 14 Apr '05

14 Apr '05

Nice Day. I am using syslog-ng with stunnel destination crypto2SS { tcp("127.0.0.1" port (514)); }; On central log host I have: source crypto { tcp(ip("127.0.0.1") port (514) keep-alive(yes)); }; destination r_facil {file(".../$HOST/$YEAR-$MONTH-$DAY/$FACILITY-$LEVEL.log"); }; and I have strange soft, that send to syslog throught 127.0.0.1:514 Problem: on my central host syslog-ng put logs into dir .../localhost (messages from this strange soft, other log put correct). I am trying to play with keep_hostname and chain_hostnames, but always got "localhost/localhost". Can anybody help me ? Thanx

2 1

RE: [syslog-ng]Match macro in filename?
by Vaibhav Goel 14 Apr '05

14 Apr '05

Cool that it is 1.9.4. Is 1.9.4 production ready by any chance? I am currently using 1.6.5. If not, is there any other way you can suggest to solve this "problem"? I am not averse to writing some scripts etc.. Thanks! -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: April 14, 2005 2:43 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Match macro in filename? On Wed, 2005-04-13 at 21:48 -0700, Nate Campi wrote: > On Wed, Apr 13, 2005 at 09:38:11AM -0700, Vaibhav Goel wrote: > > > > Is there any way to get a match filter in an output filename? > > > > For example: > > > > filter f_xyz { match("xyz"); }; > > > > should output to > > > > xyz.log > > There is no way to have syslog-ng remember the contents of a match and > use it later in another statement. In fact, this is possible in 1.9.4 (the future 2.0.x branch) where you can use regex's selection features in macro expansion. For example: filter f_xyz { match("(xyz)"); }; destination l_xyz { file("/var/log/$1"); }; However trusting the contents of the logs for something like filenames might not be the best solution. (although syslog-ng filters spurious filenames by checking '../' and '../' strings in filenames just before handing those over to open(). -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Re: [syslog-ng]trouble configuring syslog-ng with libraries
by John Thrumston 14 Apr '05

14 Apr '05

thank you, that appears to have fixed that, but now I get the following. checking for glib-2.0... yes checking GLIB_CFLAGS... -I/usr/include/glib-2.0 -I/usr/lib/sparcv9/glib-2.0/include checking GLIB_LIBS... -L/usr/lib/sparcv9 -lglib-2.0 checking for eventlog... yes checking EVTLOG_CFLAGS... -I/usr/local/include/eventlog checking EVTLOG_LIBS... -L/usr/local/lib -levtlog checking for static GLib libraries... no configure: error: static GLib libraries not found, either link GLib dynamically using the --enable-dynamic-linking or install a static GLib as you can see, it found glib but for some reason errors out. I have added every directory if found thru find to the PKG_CONFIG_PATH variable but that doesn't seem to help. What should I be looking for? Thank you for the help earlier. Balazs Scheidler <bazsi(a)balabit.hu> wrote: On Thu, 2005-04-14 at 07:52 -0700, John Thrumston wrote: > I am trying to load syslog-ng for the first time. I am loading it on a > Solaris 9 box. I am using syslog-ng.1.9.4 downloaded from the host > site. > > I believe I have all the libraries needed. I am not really sure. when > I run > ./configure --enable-tcp_wrappers I get the following error at the end > of the configure. > > checking for eventlog... Package eventlog was not found in the > pkg-config search path. > Perhaps you should add the directory containing `eventlog.pc' > to the PKG_CONFIG_PATH environment variable > No package 'eventlog' found > configure: error: Library requirements (eventlog) not met; consider > adjusting the PKG_CONFIG_PATH environment va > riable if your libraries are in a nonstandard prefix so pkg-config can > find them. > > I have searched google and such for where I might find this eventlog > or the library variable event.pc put cannot locate it. I did a find on > the system and this event.pc doesn't exist. > > I am not sure what other questions you might have but I could use any > help that can be provided. eventlog is available from the same directory where you downloaded syslog-ng from. http://www.balabit.com/downloads/syslog-ng/1.9/src -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html --------------------------------- Do you Yahoo!? Yahoo! Small Business - Try our new resources site!

2 1

trouble configuring syslog-ng with libraries
by John Thrumston 14 Apr '05

14 Apr '05

I am trying to load syslog-ng for the first time. I am loading it on a Solaris 9 box. I am using syslog-ng.1.9.4 downloaded from the host site. I believe I have all the libraries needed. I am not really sure. when I run ./configure --enable-tcp_wrappers I get the following error at the end of the configure. checking for eventlog... Package eventlog was not found in the pkg-config search path. Perhaps you should add the directory containing `eventlog.pc' to the PKG_CONFIG_PATH environment variable No package 'eventlog' found configure: error: Library requirements (eventlog) not met; consider adjusting the PKG_CONFIG_PATH environment va riable if your libraries are in a nonstandard prefix so pkg-config can find them. I have searched google and such for where I might find this eventlog or the library variable event.pc put cannot locate it. I did a find on the system and this event.pc doesn't exist. I am not sure what other questions you might have but I could use any help that can be provided. Thanks --------------------------------- Do you Yahoo!? Yahoo! Small Business - Try our new resources site!

2 1

SQL Warnings (2)
by Metal Gear 14 Apr '05

14 Apr '05

Hi all, When i type http://localhost/syslog/index.php in my browser the following errors comes up Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /www/htdocs/web/index.php on line 35=20 Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /www/htdocs/web/index.php on line 53=20 All logs from syslog-ng are logged to mysql (database syslog and table logs) I have defined in db_fns.php $result =3D mysql_pconnect("", "", ""); becauz i have made a user mysql with no password and when i write mysql on shell in connects directly. Your help in this regard would highly be appreciated Thanks

1 0

Match macro in filename?
by Vaibhav Goel 14 Apr '05

14 Apr '05

Hi all Is there any way to get a match filter in an output filename? For example: filter f_xyz { match("xyz"); }; should output to xyz.log Thanks!

3 2

accept syslog from remote hosts ?
by ip.guy 13 Apr '05

13 Apr '05

hi all how does one allow remote syslog (not syslog-ng) servers currently logging to the syslog on the central log server (running vanilla syslog) access to dump syslog entires into syslog-ng when started ? if i tail /var/log/messages when syslog-ng is running and syslog is stopped, i can see local messages but nothing from remote hosts which are setup to log to the host. see below re my syslog-ng conf file. options { long_hostnames(off); sync(0); stats(43200); dns_cache(yes); use_fqdn(no); keep_hostname(yes); use_dns(yes); }; source shell { internal(); unix-stream("/dev/log"); tcp(ip(192.49.109.241) port(514) max-connections(300)); }; destination localhost { file("/var/log/messages"); }; log { source(shell); destination(localhost); };

2 1

Syslog-ng test suite
by Jenny-Lou Sequeira 13 Apr '05

13 Apr '05

Is there any test suite available for syslog-ng? Thanks, Jenny-Lou

1 0

syslog-ng 1.6.7 has been released
by Balazs Scheidler 13 Apr '05

13 Apr '05

Hi, I have incorporated the latest spoof-source specific changes and released a new stable version with the following NEWS entry: News for the 1.6.7 release Sat, 09 Apr 2005 12:46:51 +0200 * Fixed a memory leak and possible fd leak in spoof-source support. * Fixed destination port byte order on little-endian machines, triggered when a non-514 port was used. * Added fedora-core specific packaging files. I have updated the download page which is available at this URL: http://www.balabit.hu/products/syslog-ng/upgrades.bbq Happy logging, -- Bazsi

2 1

how to pass a value from an expanded macro to an external program?
by Andrew_Hilton＠ElementK.com 12 Apr '05

12 Apr '05

I am attempting to mail log alerts for failed attempts by root through sshd. I have various boxes logging remotely (through their native syslogd) to a central log server running syslog-ng 1.6.6 (on redhat ES3.0). I have the following in my syslog-ng conf specific to ssh: # i know this catches all, and not just root filter f_ssh_login_attempt { program("sshd.*") and match("(Failed)") and not match("Accepted"); }; destination d_mail-alert { program("/usr/local/bin/syslog-mail $HOST $PROGRAM"); }; log { source (s_udp); filter(f_ssh_login_attempt); destination(d_mail-alert); }; I was hoping to be able to pass the $HOST (or other macros) to the script, but this doesn't seem to work? the script is nothing more then a shell script which attempts to use $1 $2 in the subject line of the mail message. the script does generate an email with the syslog message in the body, but $1 and $2 are empty. how do I pass a value from an expanded macro to an external program? I will be installing swatch at some point, but since I already had syslog-ng running... thanks

3 5

match to an empty messages line
by Stephan Hendl 12 Apr '05

12 Apr '05

Hi all, recently I included fibrechannel switches in my central syslog-ng. The switches often send empty line among important lines. I want to drop the empty ones. How can I achieve that by means of filter rules? Stephan

2 1

1.6.7 on AIX/GCC
by Gehring, Andrew x66132 12 Apr '05

12 Apr '05

I'm trying to compile syslog-ng 1.6.7 on AIX 5.3 with GCC 3.3.2 Successfully compiled, and installed (/usr/local) libol 0.3.14 ./configure --with-libol=/usr/local and I get the following: checking libol version >= 0.3.14... configure: error: libol-config not found in the specified location libol-config is in /usr/local/bin, and /usr/local/bin is in the $PATH. If I set --with-libol=/usr/local/bin, then it doesn't find libol.h. II've set LDFLAGS and CPPFLAGS, also to no avail.. Thanks for any guidance... Andrew _ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

2 1

Lots of warnings.........
by Metal Gear 12 Apr '05

12 Apr '05

Hi all, When i type http://localhost/syslog/index.php in my browser the following errors comes up. Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /www/htdocs/web/index.php on line 35 Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /www/htdocs/web/index.php on line 53 All logs from syslog-ng are logged to mysql (database syslog and table logs). I have defined in db_fns.php $result = mysql_pconnect("", "", ""); becauz when i write mysql on shll in connects directly. Could someone can help me... thanks

1 0

problem with syslog-ng
by niraj 08 Apr '05

08 Apr '05

I m facing problem with this code . When I execute this program it forks 2 process A zombie syslog-ng process on the forked ID syslog-ng on the next pid but without while loop every thing is working properly TIA niraj #include<iostream> #include<unistd.h> using namespace std; int main() { int cpid; cpid=fork(); if(cpid==0) { if(execv( "/usr/local/sbin/syslog-ng" ,NULL)==-1) { cout<<"hello"<<endl; } cout<<"ok"<<endl; } while(1) { ; } return 0; } ~ ~

3 3

Syslog-ng 1.6.6 Redhat ES 3.0 - too many open files
by henry＠shoelacecity.com 08 Apr '05

08 Apr '05

I've sucessfully beaten down the memory leak issues I've been experiencing thanks to Balazs suggested patches. I am now experiencing a different sort of "leak". I worked back from the log files to identify the problem, but not the cause. I restart syslog-ng weekly. Towards the end of each week, I notice log messages: syslog-ng[15710]: STATS: dropped 12828 syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) A quick "lsof -c syslog-ng" revealed a few hundred open files. I restarted syslog-ng and checked for open files - the number was about 25. In the past hour of monitoring, that number has jumped to over 70. The "files" that appear to be increasing are these (from the output of lsof) : syslog-ng 17081 root 61u raw 51703353 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 62u raw 51711769 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 63u raw 51721047 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 64u raw 51727149 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 65u raw 51738764 00000000:00FF->00000000:0000 st=07 My syslog-ng.conf specifies only 4 real log file to write to, and one pipe(for mysql writing), and two UDP destinations (spoof enabled). CPU utilization on the machine is less than 5%, and there's plenty of free memory. Any thoughts? I'd hate to have to restart syslog-ng daily.

3 8

central logging host - failback
by truth99＠gmx.net 08 Apr '05

08 Apr '05

Hello, we have some servers that send there logs to an central logging server - my question: is there any fallback-solution if the central logging server is not reachable? The "client" server are ramdisk systems with no space for local-logging. Best Regards, Oliver -- Was ist das denn? Das sind Beschleunigungslöcher, die machen den Computer schneller. ( Frei nach Homer J. Simpson ) Handyrechnung zu hoch? Tipp: SMS und MMS mit GMX Seien Sie so frei: Alle Infos unter http://www.gmx.net/de/go/freesms

2 2

Checkpoint NG FP2 to syslog-ng
by tito.basa 08 Apr '05

08 Apr '05

hi! how do you configure Checkpoint NG FP2 to send logs to a remote syslog-ng? i want to try in on UDP first before going the TCP way... googling around even on phoneboy.com gives vague results TIA tito

1 0

Need unsubscribe address.
by Michael Di Martino 07 Apr '05

07 Apr '05

Regards, Michael Di Martino Director of MIS The telx Group Office: 212 480 3300 X.2022 Cell: 646 207 6603 mdm(a)telx.com -------------------------- Sent from my BlackBerry Wireless Handheld

1 0

How do I log reboots?
by Niels 04 Apr '05

04 Apr '05

Hi, I have syslog-ng running. I'd like to have a /var/log/reboot file with times of reboots of the server. How would I do that? Thanks, Niels

3 4

Apache to syslog-ng
by Jason Stafford 02 Apr '05

02 Apr '05

Howdy, Would someone please shed some light on the correct way to get logs out of apache and into syslog-ng without causing the apache to crash? I'm currently using custom log and sending that via a pipe to logger. Howerver for some reason apache will just stop responding and stop handling requests. To fix this i just restart syslog-ng and it starts working. I posted earlier with my config and someone recommend that i send it all via udp to a central server cause this might be related to the pipe. I have since done this and i did not fix the problem. What i really need is a way to get the logs out of apache wihtout using logger? Thanks, Jason

3 4

ld: cannot find -levtlog --> switching to syslog-ng 1.6
by Philipp Snizek 02 Apr '05

02 Apr '05

Hi as I failed to install syslog-ng 1.9.3 with libol 0.3.9 and eventlog-0.2.3.latest_snapshot I successfully have installed syslog-ng 1.6.6! However, I first installed libol 0.3.9. All fine. And then, when I ran ./configure in the src dir of syslog-ng 1.6.6 it said that the libol => 0.3.14 was missing. I swichted back to 0.3.14 and ./configure ran through and then I could make && make install syslog-ng 1.6.6. My system is a slackware 10.1 with a self compiled kernel 2.6.8.1 Thanks Philipp

1 0