- syslog-ng - lists.balabit.hu

UNSUBSCRIBE.
by Virgil 06 Dec '04

06 Dec '04

1 0

FYI: Performance
by Jay Guerette 03 Dec '04

03 Dec '04

( I hope I don't offend anyone with an attachment, it's only 8k. ) My largest single-server syslog-ng implementation currently handles over 13M lines per day, totalling about 1.8Gb per day. I've only recently been able to gather this data by creating a process to count incoming lines, sum their lengths, and report via syslog at 1 minute intervals. See attached graph ( if the attachment survived ). I added this configuration before all other entries to make sure it sees everything: <syslog-ng.conf> destination syslog-perf { program(syslog-perf); }; log { source(syslog); destination(syslog-perf); }; </syslog-ng.conf> I originally tried this in Perl, then Bash, but neither could keep up with the incoming messages. This works like a champ. It compiles on Linux. The output format is specific to my syslog-to-rrd implementation, but you get the idea. It is suitable for an installation that is assured of at least 1 message for each reporting interval! <syslog-perf.c> #include <stdio.h> #include <time.h> #include <syslog.h> #define BUFFER_SIZE 8192 #define REPORT_INTERVAL 60 void main(void) { char buf[BUFFER_SIZE]; long count, bytes; time_t lastupdate; lastupdate = time(NULL); while (fgets(buf, BUFFER_SIZE, stdin)) { count++; bytes += (strlen(buf) - 1); if (time(NULL) > (lastupdate + REPORT_INTERVAL)) { openlog("127.0.0.1", LOG_NDELAY, LOG_LOCAL3); syslog(LOG_INFO, "Syslog-ng\\Lines=%d Syslog-ng\\Bytes=%d", count, bytes); closelog(); lastupdate += REPORT_INTERVAL; count = 0; bytes = 0; } } } </syslog-perf.c>

7 12

Separator for $MSGONLY
by Thomas Lohschmidt 03 Dec '04

03 Dec '04

Hi folks, I've got a small feature request regarding the $MSGONLY macro. I've noticed there is a colon ':' hard coded in macros.c as separator between preamble and the message content. I would like to have this character configurable. We use a lot of solaris boxes sending messages using the logger command and it puts some additional information in brackets in front of the message which I don't want to see in my logfiles. So I hardcoded the closing bracket ']' into macros.c as a workaroung to achieve the desired result. It would be nice to have a parameter in the config file, say "msgonly_sep" or something like that, so I don't have to patch new releases of syslog-ng. Regards Thomas Der Inhalt dieser E-Mail ist vertraulich. Falls Sie nicht der angegebene Empfänger sind oder falls diese E-Mail irrtümlich an Sie adressiert wurde, verständigen Sie bitte den Absender sofort und löschen Sie die E-Mail sodann. Das unerlaubte Kopieren sowie die unbefugte Übermittlung sind nicht gestattet. Die Sicherheit von Übermittlungen per E-Mail kann nicht garantiert werden. Falls Sie eine Bestätigung wünschen, fordern Sie bitte den Inhalt der E-Mail als Hardcopy an. The contents of this e-mail are confidential. If you are not the named addressee or if this transmission has been addressed to you in error, please notify the sender immediately and then delete this e-mail. Any unauthorized copying and transmission is forbidden. E-Mail transmission cannot be guaranteed to be secure. If verification is required, please request a hard copy version.

2 1

stripping domain name
by ravi pina 03 Dec '04

03 Dec '04

does a combination of options exist to have the HOST macro return the hostname up to but not including the domain name? for example i have host.site.domain.com and with fqdn(yes) i get that where if fqdn(no) i just get 'host' -r

1 0

RE: [syslog-ng]Syslog-ng log file rollover question
by Xiaodong Lin 02 Dec '04

02 Dec '04

Thanks, Bazsi! R_versions of the macros work. Xiaodong -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: Thursday, December 02, 2004 4:44 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Syslog-ng log file rollover question On Wed, 2004-12-01 at 21:55, Xiaodong Lin wrote: > Hi all, > > I am wondering whether anyone here knows how to config syslog-ng to > perform log file rollover. I was told that I can roll over a log file > in syslog-ng by configuring syslog-ng in a format which includes time > related macroes, such as $MONTH, $DAY, $HOUR, $MIN. For example > > destination snort { file("/var/snort/snort-$MONTH$DAY$HOUR$MIN"); }; > > In this case, the log file should roll over to a new file every 1 > minute. However, I found it doesn't work and syslog-ng keeps appending > its received syslog message into a log file, for example > snort-08091208. > > Does anyone know how to do it or figure out what I have done wrong? Or > does syslog-ng support the log file rollover? it should work, however the macros referenced above use the timestamp found in the log message itself, thus if there is a timestamp with invalid stamp you might see messages appearing in wrong files. You might want to check out the S_ and R_ versions of the macros above. (one refers to the timestamp of the message, the other the time the message was received by syslog-ng) -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Syslog-ng log file rollover question
by Xiaodong Lin 02 Dec '04

02 Dec '04

Hi all, I am wondering whether anyone here knows how to config syslog-ng to perform log file rollover. I was told that I can roll over a log file in syslog-ng by configuring syslog-ng in a format which includes time related macroes, such as $MONTH, $DAY, $HOUR, $MIN. For example destination snort { file("/var/snort/snort-$MONTH$DAY$HOUR$MIN"); }; In this case, the log file should roll over to a new file every 1 minute. However, I found it doesn't work and syslog-ng keeps appending its received syslog message into a log file, for example snort-08091208. Does anyone know how to do it or figure out what I have done wrong? Or does syslog-ng support the log file rollover? Thanks! Xiaodong

3 2

RES: [syslog-ng]php-syslog-ng
by Eduardo Oliveira Scricco (Service) 30 Nov '04

30 Nov '04

> why dont you use the latest version ? When I tried to install syslog-ng-1.6.2-1 (the lastest compiled version I've found for Suse), I had this error: error: failed dependencies: libc.so.6(GLIBC_2.3) is needed by syslog-ng-1.6.2-1 So, I tri to upgrade glibc, but... error: failed dependencies: glibc = 2.2.5 is needed by lsb-runtime-1.2-37 glibc = 2.2.5 is needed by glibc-devel-2.2.5-213 glibc = 2.2.5 is needed by glibc-locale-2.2.5-213 libdb.so.2 is needed by db-utils-4.0.14-194 libdb.so.2 is needed by gnome-libs-1.4.1.7-134 libdb.so.2 is needed by gdk-pixbuf-0.18.0-108 libdb.so.2 is needed by xchat-1.8.10-59 libdb.so.2 is needed by eel-1.0.2-509 libdb.so.2 is needed by gnome-print-0.36-210 libdb.so.2 is needed by libglade-0.16-835 libdb.so.2 is needed by medusa-0.5.1-644 libdb.so.2 is needed by rpm-3.0.6-418 libdb.so.2 is needed by bonobo-1.0.20-221 libdb.so.2 is needed by bonobo-conf-0.14-505 libdb.so.2 is needed by susewm-3.6.0-159 libdb.so.2 is needed by kdebase3-SLES-8-73 libdb.so.2(GLIBC_2.0) is needed by db-utils-4.0.14-194 libdb.so.2(GLIBC_2.0) is needed by gnome-libs-1.4.1.7-134 libdb.so.2(GLIBC_2.0) is needed by rpm-3.0.6-418 libdb.so.2(GLIBC_2.0) is needed by susewm-3.6.0-159 As I don't want to upgrade all these items, I prefeer not to install it. > > * app-admin/syslog-ng > Latest version available: 1.6.5-r1 > Latest version installed: 1.6.5-r1 > Size of downloaded files: 387 kB > Homepage: http://www.balabit.com/products/syslog_ng/ > Description: syslog replacement with advanced filtering features > License: GPL-2 > > i got php-syslog-ng working perfectly, i even hacked it to my > needs.. its great. > > Petre Daniel > System & Network Administrator > Romania Data Systems Pitesti > http://www.rdspt.ro > Phone: +40-348-400401

2 1

php-syslog-ng
by Eduardo Oliveira Scricco (Service) 30 Nov '04

30 Nov '04

Hi all, Using syslog-ng 1.4.14 at Suse Linux 8.1 I'm trying to run php-syslog-ng (a syslog webviewer), but it does not work. For it works, is needed to log to a database, as MySQL. PHP-Syslog-ng website have on step-by-step script, that I used. When I try to run syslog-ng, it complains about this line (in syslog-ng.conf is at one line): destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(net); destination(d_mysql); }; I believe this "template" isn't supported in this syslog version. Is that true? The problem is I couldn't upgrade it to version 1.5 or higher, because of libs dependencies... Have one of you logged to mySQL using syslog-ng 1.4.14? Thanks a lot, Eddie

2 1

syslog-ng chrooted vs timezone
by Horvath Gabor Kalman 30 Nov '04

30 Nov '04

Hi! I have a problem with syslog-ng running in chroot: Nov 17 15:45:02 burp /USR/SBIN/CRON[26238]: ... Nov 17 14:47:42 burp syslog-ng[16074]: syslog-ng version 1.6.4 going down Nov 17 14:47:47 burp syslog-ng[26331]: syslog-ng version 1.6.4 starting Nov 17 14:47:47 burp syslog-ng[26331]: io.c: do_read: read() failed (errno 1), Operation not permitted Nov 17 14:48:27 burp syslog-ng[26331]: syslog-ng version 1.6.4 going down It seems that all messages that are generated internally within syslog-ng are logged with false timstamps. The system is debian testing. I am testing syslog-ng in chroot before deploying it on our production syslog server. :) Good thing I did this test. The second start in the log snippet was done by hand. Not from the init script. I am also interested to know what that io.c message is. It does not seem to affect syslog-ng. I had another problem: when logrotate rotated the logs the sent a reload to the chrooted syslog-ng process, it kept the syslog open. So after that was deleted it kept happily logging there not into the newly created file. I works just fine if I send restart instead of reload. Thanks in advance. g.

2 5

compiling error syslog-ng 1.6.5
by Lopez Fernandez, Jose 30 Nov '04

30 Nov '04

Hi, I`m compiling syslog-NG 1.6.5 but i get this error: configure:2159: gcc --version </dev/null >&5 gcc (GCC) 3.4.2 Copyright (C) 2004 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. configure:2162: $? = 0 configure:2164: gcc -v </dev/null >&5 Reading specs from /usr/local/lib/gcc/sparc-sun-solaris2.8/3.4.2/specs Configured with: ../configure --with-as=/usr/ccs/bin/as --with-ld=/usr/ccs/bin/ld --disable-nls Thread model: posix gcc version 3.4.2 configure:2167: $? = 0 configure:2169: gcc -V </dev/null >&5 gcc: `-V' option must have argument configure:2172: $? = 1 configure:2195: checking for C compiler default output file name configure:2198: gcc conftest.c >&5 ld: fatal: file values-Xa.o: open failed: No such file or directory ld: fatal: File processing errors. No output written to a.out collect2: ld returned 1 exit status configure:2201: $? = 1 ideas? help? :-) Greetings, Jose Lopez Dieses Dokument ist vertraulich und ausschliesslich fuer den Adressaten bestimmt. Falls Sie diese E-Mail versehentlich bekommen haben, informieren Sie uns bitte unverzueglich und loeschen Sie diese Nachricht von Ihrem Computer. Jegliche Art von Reproduktion, Verbreitung, Vervielfaeltigung, Modifikation, Verteilung und/oder Publikation dieser E-Mail Nachricht ist untersagt. Die in dieser E-Mail enthaltenen Angaben und Erklaerungen sind unverbindlich. Haftungsansprueche des Empfaengers jeglicher Art werden ausgeschlossen. Die GZS schliesst ausser fuer den Fall von Vorsatz oder grober Fahrlaessigkeit die Haftung fuer jeglichen Verlust oder Schaeden durch virenbefallene Software oder E-Mails aus. ----------------------------------------------------------------------------------------------------------- This message contains confidential information and is intended only for the named individual. If you are not the named addressee, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this message in error and delete this e-message from your system. No reliance may be placed on this message without written confirmation of its contents from an authorized representative. GZS accepts no liability for loss or damage caused by software viruses except in case of gross negligence or willful behaviour.

1 0

Re: [Fwd: [syslog-ng]feature request to Stats ouput]
by Jay Guerette 29 Nov '04

29 Nov '04

No comment on the potential issue.... just a 'me too'. I'd love to see a 'processed' count. My syslog server is processing about 10M lines/day, by my best estimate, but would like to know more precisely. A byte count would be nice, too; currently about 1.2GB day. I'd like to generate RRD graphs, if I could get that data. I tried writing a couple programs to do line & byte counts, and set it up as a 'program' destination, but it would sometimes drop stuff when it looked away from it's input long enough to write the stats to a log. Probably when the there was a burst well above the ~ 115 messages/sec average. User-specified destinations & macro/template formating for stats output would be fantastic! > Stats: dropped is great, would this be better?: > Stats: x processed y buffered/queued z dropped > > * I'm seeing syslog-ng process sizes in 20-30MB and am wondering if my > queue sizes should be upped.

2 1

syslog-ng freezes under FreeBSD
by Jost Menke 29 Nov '04

29 Nov '04

Hi all, I have installed syslog-ng-1.6.5 on a FreeBSD 5.3 release system with 3 remote machines logging to it. Logging works fine for several hours, but after some time it completely freezes without a clear reason. The process can only be stopped with kill -9. Any ideas? Regards, Jost Menke -- NEU +++ DSL Komplett von GMX +++ http://www.gmx.net/de/go/dsl GMX DSL-Netzanschluss + Tarif zum superg�nstigen Komplett-Preis!

2 3

hello list. problem : remote logging with syslog-ng
by petre daniel 29 Nov '04

29 Nov '04

hello, i need to log from several locations/devices (cisco switches/linux routers) to a central syslog-ng into a certain file for each. where do i read about this or how its done? thx a lot. Petre Daniel System & Network Administrator Romania Data Systems Pitesti http://www.rdspt.ro <http://www.rdspt.ro/> Phone: +40-348-400401 ---------------------------------------------------------------------- Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such a case, you should destroy this message and kindly notify the sender by reply e-mail. ----------------------------------------------------------------------

1 0

Needed features: include statements and greater-than/less-than options for log level/priorities
by Jesse Molina 27 Nov '04

27 Nov '04

Greetings! I have looked for this information elsewhere but have not found it, thus I bring it to the community. I have two questions regarding the syslog-ng configuration file; #1.) Is there an "include" statement to grab additional configuration parameters, similar to httpd.conf or named.conf? I suspect the answer is no. I am responsible for a couple of syslog-ng implementations that have gotten to be huge and working with a single file is getting to be a problem. #2.) I would like to state functions such as "greater than" and "less than" for logging levels/priorities. This functionality is available in the BSD syslogd and some others, but I am not aware of any such thing in syslog-ng. I can't imagine that this hasn't come up before. To get around this, I made a an ugly 55-line syslog-ng configuration with filters to which I can reference, but I really don't want them all in my syslog-ng.conf, thus question number 1. I did google around and found these articles, in reference to question number 1; http://citadelle.intrinsec.com/mailing/current/HTML/ml_syslogng/0307.html http://citadelle.intrinsec.com/mailing/current/HTML/ml_syslogng/0304.html But that's about it. Thanks for reading. Flog me if I need to RTFM. -- # Jesse Molina # Mail = jesse(a)opendreams.net # Page = page-jesse(a)opendreams.net # Cell = 1.407.970.0280 # Web = http://www.opendreams.net/jesse/

2 2

Antw: [syslog-ng]Problem generating syslog-ng on HP-UX 11i v1 (PA-RISC 2.0)
by Stephan Hendl 26 Nov '04

26 Nov '04

Hi, it might be there is a problem with the sources section in your confg file. I think that you cannot use the /dev/log device twice for sourcing the syslog data. >source stdlog { pipe("/dev/log" pad_size(2048)); }; >source s_sys { pipe("/dev/log"); internal(); }; I use (with 11.0 PA RISC 2.0) source s_sys { pipe(/dev/log pad_size(2048)); internal(); }; This works fine in a productive environment. One of our central syslog server runs syslog-ng-1.6.4 on 11.0. Stephan >>> jsianes(a)grupohispatec.com 24.11.2004 20:01:12 >>> I have a lot of problems trying to create a syslog-ng binary in HP-UX 11i v1 for PA-RISC 2.0 architecture: HP-UX asterix B.11.11 U 9000/810 2013576237 unlimited-user license All compilation issues goes right, but when I try to run it create a core. This is all the test I have made: root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> /usr/local/sbin/syslog-ng -dv Memory fault(coredump) root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> gdb /usr/local/sbin/syslog-ng HP gdb 3.3 for PA-RISC 1.1 or 2.0 (narrow), HP-UX 11.00. Copyright 1986 - 2001 Free Software Foundation, Inc. Hewlett-Packard Wildebeest 3.3 (based on GDB) is covered by the GNU General Public License. Type "show copying" to see the conditions to change it and/or distribute copies. Type "show warranty" for warranty/support. .. (gdb) r -dv Starting program: /usr/local/sbin/syslog-ng -dv Program received signal SIGSEGV, Segmentation fault. 0x197dc in c_vformat_length () at format.c:178 178 format.c: No such file or directory. (gdb) bt #0 0x197dc in c_vformat_length () at format.c:178 #1 0x1c4f4 in msg_vformat () at werror.c:132 #2 0x1c5b4 in werror () at werror.c:152 #3 0xc224 in make_syslog_config (name=0x40001220 "/usr/local/etc/syslog-ng/syslog-ng.conf", backend=0x40006a80) at cfgfile.c:344 #4 0x71bc in main (argc=2, argv=0x7f7f0814) at main.c:479 (gdb) quit The program is running. Exit anyway? (y or n) y root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> I have try with both, stable an snapshot versions. The result is the same, a crash at the beginning. This is my configuration file: root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> cat /etc/syslog-ng/syslog-ng.conf # syslog-ng configuration file. # # This should behave pretty much like the original syslog on HP-UX. But # it could be configured a lot smarter. # # See syslog-ng(8) and syslog-ng.conf(8) for more information. # # 20000925 gb(a)sysfive.com options { sync (0); time_reopen (10); log_fifo_size (2048); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source stdlog { pipe("/dev/log" pad_size(2048)); }; source s_sys { pipe("/dev/log"); internal(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/adm/syslog-ng/syslog.log"); }; destination d_mail { file("/var/adm/syslog-ng/mail.log"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(mail) and level(debug); }; filter f_filter2 { (facility(mail) and level(debug)) or level(info); }; filter f_filter3 { level(alert); }; filter f_filter4 { level(emerg); }; log { source(s_sys); filter(f_filter1); destination(d_mail); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_cons); destination(d_mlrt); }; log { source(s_sys); filter(f_filter4); destination(d_mlal); }; root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> Here is the configure output: root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> ./configure --with-debug checking for a BSD-compatible install... /opt/imake/bin/install -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... no checking for nawk... no checking for awk... awk checking whether make sets $(MAKE)... yes checking whether build environment is sane... yes checking for gcc... no checking for cc... cc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... no checking whether cc accepts -g... yes checking for cc option to accept ANSI C... none needed checking for style of include used by make... GNU checking dependency style of cc... hp checking for cc option to accept ANSI C... none needed checking for bison... bison -y checking for flex... flex checking for yywrap in -lfl... no checking for yywrap in -ll... yes checking lex output file root... lex.yy checking whether yytext is a pointer... yes checking whether make sets $(MAKE)... (cached) yes checking how to run the C preprocessor... cc -E checking for egrep... grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... no checking for unistd.h... yes checking malloc.h usability... yes checking malloc.h presence... yes checking for malloc.h... yes checking for unistd.h... (cached) yes checking door.h usability... no checking door.h presence... no checking for door.h... no checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... yes checking sys/strlog.h presence... yes checking for sys/strlog.h... yes checking stdarg.h usability... yes checking stdarg.h presence... yes checking for stdarg.h... yes checking sys/klog.h usability... no checking sys/klog.h presence... no checking for sys/klog.h... no checking arpa/nameser.h usability... yes checking arpa/nameser.h presence... yes checking for arpa/nameser.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking for an ANSI C-conforming const... yes checking whether time.h and sys/time.h may both be included... yes checking for modern utmp... no checking for global timezone variable... no checking for short... yes checking size of short... 2 checking for int... yes checking size of int... 4 checking for long... yes checking size of long... 4 checking for I_CONSLOG... no checking for O_LARGEFILE... yes checking for res_init in <resolv.h>... checking for working alloca.h... yes checking for alloca... yes checking for vprintf... yes checking for _doprnt... yes checking for res_init in -lresolv... no checking for __res_init in -lresolv... no checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for gethostbyname in -lnsl... yes checking for select... yes checking for snprintf... yes checking for vsnprintf... yes checking for strerror... yes checking for inet_aton... yes checking for strncpy... yes checking for getutent... yes checking for getopt_long... no checking for strcasecmp... yes checking for strptime... yes checking for TCP wrapper library... checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking whether to enable spoof_source support... no checking libol version >= 0.3.14... ok configure: creating ./config.status config.status: creating Makefile config.status: creating src/Makefile config.status: creating src/tests/Makefile config.status: creating doc/Makefile config.status: creating doc/sgml/Makefile config.status: creating contrib/Makefile config.status: creating syslog-ng.spec config.status: creating src/config.h config.status: src/config.h is unchanged config.status: executing depfiles commands root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> In compilation time, here is the output: root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> make No suffix list. Making all in src make all-recursive Making all in . source='main.c' object='main.o' libtool=no \ depfile='.deps/main.Po' tmpdepfile='.deps/main.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'main.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`main.c source='sources.c' object='sources.o' libtool=no \ depfile='.deps/sources.Po' tmpdepfile='.deps/sources.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'sources.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`sources.c source='center.c' object='center.o' libtool=no \ depfile='.deps/center.Po' tmpdepfile='.deps/center.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'center.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`center.c source='filters.c' object='filters.o' libtool=no \ depfile='.deps/filters.Po' tmpdepfile='.deps/filters.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'filters.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`filters.c source='destinations.c' object='destinations.o' libtool=no \ depfile='.deps/destinations.Po' tmpdepfile='.deps/destinations.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'destinations.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`destinations.c source='log.c' object='log.o' libtool=no \ depfile='.deps/log.Po' tmpdepfile='.deps/log.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'log.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`log.c source='cfgfile.c' object='cfgfile.o' libtool=no \ depfile='.deps/cfgfile.Po' tmpdepfile='.deps/cfgfile.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'cfgfile.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`cfgfile.c source='cfg-grammar.c' object='cfg-grammar.o' libtool=no \ depfile='.deps/cfg-grammar.Po' tmpdepfile='.deps/cfg-grammar.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'cfg-grammar.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`cfg-grammar.c source='cfg-lex.c' object='cfg-lex.o' libtool=no \ depfile='.deps/cfg-lex.Po' tmpdepfile='.deps/cfg-lex.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'cfg-lex.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`cfg-lex.c source='affile.c' object='affile.o' libtool=no \ depfile='.deps/affile.Po' tmpdepfile='.deps/affile.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'affile.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`affile.c source='afsocket.c' object='afsocket.o' libtool=no \ depfile='.deps/afsocket.Po' tmpdepfile='.deps/afsocket.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afsocket.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afsocket.c source='afunix.c' object='afunix.o' libtool=no \ depfile='.deps/afunix.Po' tmpdepfile='.deps/afunix.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afunix.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afunix.c source='afinet.c' object='afinet.o' libtool=no \ depfile='.deps/afinet.Po' tmpdepfile='.deps/afinet.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afinet.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afinet.c source='afinter.c' object='afinter.o' libtool=no \ depfile='.deps/afinter.Po' tmpdepfile='.deps/afinter.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afinter.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afinter.c source='afuser.c' object='afuser.o' libtool=no \ depfile='.deps/afuser.Po' tmpdepfile='.deps/afuser.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afuser.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afuser.c source='afstreams.c' object='afstreams.o' libtool=no \ depfile='.deps/afstreams.Po' tmpdepfile='.deps/afstreams.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afstreams.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afstreams.c source='afprogram.c' object='afprogram.o' libtool=no \ depfile='.deps/afprogram.Po' tmpdepfile='.deps/afprogram.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afprogram.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afprogram.c source='afremctrl.c' object='afremctrl.o' libtool=no \ depfile='.deps/afremctrl.Po' tmpdepfile='.deps/afremctrl.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'afremctrl.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`afremctrl.c cc: "afremctrl.c", line 58: warning 604: Pointers are not assignment-compatible. cc: "afremctrl.c", line 58: warning 563: Argument #1 is not the correct type. cc: "afremctrl.c", line 58: warning 604: Pointers are not assignment-compatible. cc: "afremctrl.c", line 58: warning 563: Argument #2 is not the correct type. source='nscache.c' object='nscache.o' libtool=no \ depfile='.deps/nscache.Po' tmpdepfile='.deps/nscache.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'nscache.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`nscache.c source='utils.c' object='utils.o' libtool=no \ depfile='.deps/utils.Po' tmpdepfile='.deps/utils.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'utils.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`utils.c source='syslog-names.c' object='syslog-names.o' libtool=no \ depfile='.deps/syslog-names.Po' tmpdepfile='.deps/syslog-names.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'syslog-names.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`syslog-names.c source='macros.c' object='macros.o' libtool=no \ depfile='.deps/macros.Po' tmpdepfile='.deps/macros.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'macros.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`macros.c source='getopt.c' object='getopt.o' libtool=no \ depfile='.deps/getopt.Po' tmpdepfile='.deps/getopt.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'getopt.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`getopt.c source='getopt1.c' object='getopt1.o' libtool=no \ depfile='.deps/getopt1.Po' tmpdepfile='.deps/getopt1.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src -I. -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'getopt1.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/'`getopt1.c cc -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o getopt.o getopt1.o -lnsl -ll /usr/local/lib/libol.a -lnsl -lxnet /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file (main.o) was detected. The linked output may not run on a PA 1.x system. Making all in tests source='test_nscache.c' object='test_nscache.o' libtool=no \ depfile='.deps/test_nscache.Po' tmpdepfile='.deps/test_nscache.TPo' \ depmode=hp /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/depcomp \ cc -DHAVE_CONFIG_H -I. -I/root/syslog/syslog-ng-1.6.5+20041124/src/tests -I../../src -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c `test -f 'test_nscache.c' || echo '/root/syslog/syslog-ng-1.6.5+20041124/src/tests/'`test_nscache.c cc -g -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o test_nscache test_nscache.o ../nscache.o -lnsl -ll /usr/local/lib/libol.a -lnsl -lxnet /usr/ccs/bin/ld: (Warning) At least one PA 2.0 object file (test_nscache.o) was detected. The linked output may not run on a PA 1.x system. Making all in doc No suffix list. Making all in sgml No suffix list. No suffix list. Making all in contrib No suffix list. No suffix list. root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> At the end, the installation process: root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> make install No suffix list. Making install in src Making install in . /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/mkinstalldirs /usr/local/sbin /opt/imake/bin/install -c syslog-ng /usr/local/sbin/syslog-ng Making install in tests Making install in doc No suffix list. Making install in sgml No suffix list. No suffix list. No suffix list. No suffix list. /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/mkinstalldirs /usr/local/man/man5 /opt/imake/bin/install -c -m 644 /root/syslog/syslog-ng-1.6.5+20041124/doc/syslog-ng.conf.5 /usr/local/man/man5/syslog-ng.conf.5 /bin/sh /root/syslog/syslog-ng-1.6.5+20041124/mkinstalldirs /usr/local/man/man8 /opt/imake/bin/install -c -m 644 /root/syslog/syslog-ng-1.6.5+20041124/doc/syslog-ng.8 /usr/local/man/man8/syslog-ng.8 Making install in contrib No suffix list. No suffix list. No suffix list. No suffix list. root@asterix:/root/syslog/syslog-ng-1.6.5+20041124> Anyone have an idea what this coredump is happends and how to solve it? Thanks for all your help. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

syslog-ng mysql syntax error
by Lopez Fernandez, Jose 25 Nov '04

25 Nov '04

hi, thats nice to know :-) well... someone out there who has a compiled version 1.6.5 for solaris 8 / sparc? ;-) i have no possibility to compile it till next week :-( regards, Jose Lopez ------------------------------------------------------------------------ ----------- =20 I was having exactly the same problem with syslog-ng 1.6.4, upgrading to 1.6.5 fixed the problem. Regards James Masson ________________________________ From: syslog-ng-admin(a)lists.balabit.hu [mailto:HYPERLINK "mailto:syslog-ng-admin@lists.balabit.hu"syslog-ng-admin(a)lists.balabit.h u <mailto:HYPERLINK > ] On Behalf Of Lopez Fernandez, Jose Sent: 25 November 2004 11:29 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng mysql syntax error =09 =09 Hi,=20 since some days i get errors in like this:=20 ERROR 1064 at line 4: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'ws-61078', 'kern', 'crit', 'crit', '02', '2004-11-24', '10:55:=20 It seems, that the Quotes after the MSG-Tag are missing. so the insert-command for MySql isn`t complete.=20 I can`t see any fault in my config.=20 This is my config (syslog-ng 1.6.4):=20 options {stats(28800); long_hostnames(on); sync(0); log_fifo_size(2000); use_dns(on); };=20 2 #=20 3 ## Log syslog-ng to mysql database=20 4 ##=20 5 destination d_mysql {=20 6 pipe("/tmp/mysql.pipe"=20 7 template("INSERT INTO logs (host, facility, priority, level, tag, date,=20 8 time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG',=20 9 '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes));=20 10 };=20 11 source local { sun-streams("/dev/log") ; internal();};=20 12 source net { udp(); };=20 13 log { source(net); destination(d_mysql);};=20 14 log { source(local); destination(d_mysql);};=20 I have read, that someone had this problem too in the mailingslist, but i didn`t find any suggestion for a workaorund=20 or a solution. I`m now analysing this problem 2 days an didn`t find any workaround / solution. Hope someone could=20 help me :-)=20 thanks,=20 Jose Lopez=20 =09 =09 Dieses Dokument ist vertraulich und ausschliesslich fuer den Adressaten bestimmt. Falls Sie diese E-Mail versehentlich bekommen haben, informieren Sie uns bitte unverzueglich und loeschen Sie diese Nachricht von Ihrem Computer. Jegliche Art von Reproduktion, Verbreitung, Vervielfaeltigung, Modifikation, Verteilung und/oder Publikation dieser E-Mail Nachricht ist untersagt.=20 Die in dieser E-Mail enthaltenen Angaben und Erklaerungen sind unverbindlich. Haftungsansprueche des Empfaengers jeglicher Art werden ausgeschlossen. Die GZS schliesst ausser fuer den Fall von Vorsatz oder grober Fahrlaessigkeit die Haftung fuer jeglichen Verlust oder Schaeden durch virenbefallene Software oder E-Mails aus. =09 ------------------------------------------------------------------------ ----------------------------------- This message contains confidential information and is intended only for the named individual. If you are not the named addressee, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this message in error and delete this e-message from your system. No reliance may be placed on this message without written confirmation of its contents from an authorized representative. GZS accepts no liability for loss or damage caused by software viruses except in case of gross negligence or willful behaviour. =09

1 0

Change slash to other char in variable PROGRAM
by Jozef Drahovsky 25 Nov '04

25 Nov '04

Hello, I have small problem. In experimental pc have universal configuration: destination logex { file( "/var/log-ng/$YEAR-$MONTH-$DAY/$HOST-$PROGRAM.txt" perm(0664) dir_owner(www) dir_perm(0775) create_dirs(yes) ); }; All function is right. (syslog-ng-1.6.0.r3 .... syslog-ng-1.6.5) Problem accured when variable $PROGRAM contains slash "/" How change slash and other notprinted charactres to "_" Example: TASK: 92 ?? Is 0:01.76 /usr/sbin/cron LOGFILE: /var/log-ng/2004-11-25/test-/usr/sbin/cron.txt ---> /var/log-ng/2004-11-25/test-usr_sbin_cron.txt Jozef Drahovsky

2 1

RE: [syslog-ng]syslog-ng mysql syntax error
by James Masson 25 Nov '04

25 Nov '04

I was having exactly the same problem with syslog-ng 1.6.4, upgrading to 1.6.5 fixed the problem. Regards James Masson ________________________________ From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Lopez Fernandez, Jose Sent: 25 November 2004 11:29 To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng mysql syntax error Hi, since some days i get errors in like this: ERROR 1064 at line 4: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'ws-61078', 'kern', 'crit', 'crit', '02', '2004-11-24', '10:55: It seems, that the Quotes after the MSG-Tag are missing. so the insert-command for MySql isn`t complete. I can`t see any fault in my config. This is my config (syslog-ng 1.6.4): options {stats(28800); long_hostnames(on); sync(0); log_fifo_size(2000); use_dns(on); }; 2 # 3 ## Log syslog-ng to mysql database 4 ## 5 destination d_mysql { 6 pipe("/tmp/mysql.pipe" 7 template("INSERT INTO logs (host, facility, priority, level, tag, date, 8 time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', 9 '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); 10 }; 11 source local { sun-streams("/dev/log") ; internal();}; 12 source net { udp(); }; 13 log { source(net); destination(d_mysql);}; 14 log { source(local); destination(d_mysql);}; I have read, that someone had this problem too in the mailingslist, but i didn`t find any suggestion for a workaorund or a solution. I`m now analysing this problem 2 days an didn`t find any workaround / solution. Hope someone could help me :-) thanks, Jose Lopez Dieses Dokument ist vertraulich und ausschliesslich fuer den Adressaten bestimmt. Falls Sie diese E-Mail versehentlich bekommen haben, informieren Sie uns bitte unverzueglich und loeschen Sie diese Nachricht von Ihrem Computer. Jegliche Art von Reproduktion, Verbreitung, Vervielfaeltigung, Modifikation, Verteilung und/oder Publikation dieser E-Mail Nachricht ist untersagt. Die in dieser E-Mail enthaltenen Angaben und Erklaerungen sind unverbindlich. Haftungsansprueche des Empfaengers jeglicher Art werden ausgeschlossen. Die GZS schliesst ausser fuer den Fall von Vorsatz oder grober Fahrlaessigkeit die Haftung fuer jeglichen Verlust oder Schaeden durch virenbefallene Software oder E-Mails aus. ------------------------------------------------------------------------ ----------------------------------- This message contains confidential information and is intended only for the named individual. If you are not the named addressee, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this message in error and delete this e-message from your system. No reliance may be placed on this message without written confirmation of its contents from an authorized representative. GZS accepts no liability for loss or damage caused by software viruses except in case of gross negligence or willful behaviour.

1 0

syslog-ng mysql syntax error
by Lopez Fernandez, Jose 25 Nov '04

25 Nov '04

Hi, since some days i get errors in like this: ERROR 1064 at line 4: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'ws-61078', 'kern', 'crit', 'crit', '02', '2004-11-24', '10:55: It seems, that the Quotes after the MSG-Tag are missing. so the insert-command for MySql isn`t complete. I can`t see any fault in my config. This is my config (syslog-ng 1.6.4): options {stats(28800); long_hostnames(on); sync(0); log_fifo_size(2000); use_dns(on); }; 2 # 3 ## Log syslog-ng to mysql database 4 ## 5 destination d_mysql { 6 pipe("/tmp/mysql.pipe" 7 template("INSERT INTO logs (host, facility, priority, level, tag, date, 8 time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', 9 '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); 10 }; 11 source local { sun-streams("/dev/log") ; internal();}; 12 source net { udp(); }; 13 log { source(net); destination(d_mysql);}; 14 log { source(local); destination(d_mysql);}; I have read, that someone had this problem too in the mailingslist, but i didn`t find any suggestion for a workaorund or a solution. I`m now analysing this problem 2 days an didn`t find any workaround / solution. Hope someone could help me :-) thanks, Jose Lopez Dieses Dokument ist vertraulich und ausschliesslich fuer den Adressaten bestimmt. Falls Sie diese E-Mail versehentlich bekommen haben, informieren Sie uns bitte unverzueglich und loeschen Sie diese Nachricht von Ihrem Computer. Jegliche Art von Reproduktion, Verbreitung, Vervielfaeltigung, Modifikation, Verteilung und/oder Publikation dieser E-Mail Nachricht ist untersagt. Die in dieser E-Mail enthaltenen Angaben und Erklaerungen sind unverbindlich. Haftungsansprueche des Empfaengers jeglicher Art werden ausgeschlossen. Die GZS schliesst ausser fuer den Fall von Vorsatz oder grober Fahrlaessigkeit die Haftung fuer jeglichen Verlust oder Schaeden durch virenbefallene Software oder E-Mails aus. ----------------------------------------------------------------------------------------------------------- This message contains confidential information and is intended only for the named individual. If you are not the named addressee, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this message in error and delete this e-message from your system. No reliance may be placed on this message without written confirmation of its contents from an authorized representative. GZS accepts no liability for loss or damage caused by software viruses except in case of gross negligence or willful behaviour.

1 0

Sending source IP from syslog-ng
by Michael Gehrmann 25 Nov '04

25 Nov '04

Hi All, I have seen a number of queries on a number of lists in regards to sending the source ip address of messages that are forwarded from a syslog-ng server. I have found a solution! You need to do the following: Enter the option --enable-spoof-source when running ./configure (This requires libnet, use RPM for RedHat) 'make' and 'make install' syslog-ng In your syslog-ng config add the spoof-source(yes) option to your destination (UDP only) e.g. destination log_host { udp("10.0.0.1" port(514) spoof_source(yes)); }; On a syslogd server (Solaris, Standard *nix) you should see the originating host ip after the timestamp. Hope this helps. -- Michael Gehrmann Security Administrator CITEC www.citec.com.au, Your business solutions partner

2 1

Problem generating syslog-ng on HP-UX 11i v1 (PA-RISC 2.0)
by Jose Javier Sianes Ruiz 24 Nov '04

24 Nov '04

1 0

unsubscribe
by Ian Hunt 23 Nov '04

23 Nov '04

Ian Hunt email: ian.hunt(a)swapswire.com Tel: +44 (0) 207 868 2452 --------------------------------------------------------------------- This is a commercial communication sent by SwapsWire Limited. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version. Please contact info(a)swapswire.com if you no longer wish to receive commercial communications from us, identifying the email addresses to which you no longer wish commercial emails to be sent.

1 0

feature request to Stats ouput
by Dave Johnson 23 Nov '04

23 Nov '04

Stats: dropped is great, would this be better?: Stats: x processed y buffered/queued z dropped * I'm seeing syslog-ng process sizes in 20-30MB and am wondering if my queue sizes should be upped.

1 0

Re: [syslog-ng]syslog-ng truncating pipe template output
by James Masson 22 Nov '04

22 Nov '04

Hi Balazs As requested.... 0x0000: 4500 0164 68db 0000 3f11 7baa ac16 0078 E..dh...?.{....x 0x0010: c0a8 28cd 0bfa 0202 0150 9f48 3c31 3635 ..(......P.H<165 0x0020: 3e64 652d 6777 2d31 3a20 4e65 7453 6372 >de-gw-1:.NetScr 0x0030: 6565 6e20 6465 7669 6365 5f69 643d 6465 een.device_id=de 0x0040: 2d67 772d 3120 205b 4e6f 204e 616d 655d -gw-1..[No.Name] 0x0050: 7379 7374 656d 2d6e 6f74 6966 6963 6174 system-notificat 0x0060: 696f 6e2d 3030 3235 3728 7472 6166 6669 ion-00257(traffi 0x0070: 6329 3a20 7374 6172 745f 7469 6d65 3d22 c):.start_time=" 0x0080: 3230 3034 2d31 312d 3232 2031 373a 3035 2004-11-22.17:05 0x0090: 3a30 3622 2064 7572 6174 696f 6e3d 3220 :06".duration=2. 0x00a0: 706f 6c69 6379 5f69 643d 3120 7365 7276 policy_id=1.serv 0x00b0: 6963 653d 6874 7470 2070 726f 746f 3d36 ice=http.proto=6 0x00c0: 2073 7263 207a 6f6e 653d 5472 7573 7420 .src.zone=Trust. 0x00d0: 6473 7420 7a6f 6e65 3d55 6e74 7275 7374 dst.zone=Untrust 0x00e0: 2061 6374 696f 6e3d 5065 726d 6974 2073 .action=Permit.s 0x00f0: 656e 743d 3636 3120 7263 7664 3d39 3434 ent=661.rcvd=944 0x0100: 2073 7263 3d31 3732 2e32 322e 302e 3233 .src=XXX.XX.X.XX 0x0110: 2064 7374 3d36 362e 3136 332e 3137 352e .dst=XX.XXX.XXX. 0x0120: 3132 3820 7372 635f 706f 7274 3d33 3930 XXX.src_port=390 0x0130: 3020 6473 745f 706f 7274 3d38 3020 7372 0.dst_port=80.sr 0x0140: 632d 786c 6174 6564 2069 703d 3231 372e c-xlated.ip=XXX. 0x0150: 3135 312e 3234 302e 3320 706f 7274 3d32 XXX.XXX.X.port=2 0x0160: 3939 3600 996. I read about that Netscreen problem too, but I have a colleague who has exactly the same syslog-ng.conf entries and Netscreen OS version, and his works! I think Netscreen fixed that issue a while back, my issue occurs with at least 3 different Netscreen OS version. Thanks James Masson

1 0

question re: "STATS: dropped" errors
by Jef Elliott 22 Nov '04

22 Nov '04

Hi, We have a system here running 1.6.4 (on debian linux, the stable disto), and it keeps griping about STATS: dropped > 0 (usually anywhere from 3 to 9). I've read through the archives, and see messages mentioning possible reasons for this, as well as some of the potential cures. I disabled the pipe for the xconsole, and that seems to have stopped the complaining. My question though relates to why this one system is the only complaining about this. I don't think that we have a syslog-ng server problem, as we have close to 80 systems logging to it. This is the only system that gives me this error. I don't think there are any local issues or services causing a problem, as this is a freshly imaged system, not running anything in particular, and not in production. What else could possibly be causing an issue on this one host? All other systems using syslog-ng have the exact same config file as this host and I'm at a loss as to what else could be causing the trouble. Any insights/links/help is appreciated. Thanks jef

1 0