- syslog-ng - lists.balabit.hu

libol license?
by atonns＠mail.ivillage.com 30 Apr '04

30 Apr '04

This isn't syslog-ng related directly but... I just downloaded libol-0.3.13.tar.gz from http://www.balabit.com/downloads/syslog-ng/libol/0.3/ It says on that page: Some of our download able products are free software, licensed under GNU General Public License, others have a more restrictive license. The exact license terms of those programs are available in a file named COPYING or LICENSE. However, there is no COPYING or LICENSE files in the libol-0.3.13.tar.gz tarball. This is an oversight, right? I assume it would be the LGPL, correct? -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 1

RE: [syslog-ng]Not finding libol, please help
by Edwards, Thomas 30 Apr '04

30 Apr '04

Get the new version of libol, it needs 0.3.13. You can get it here http://www.balabit.com/downloads/libol/0.3/libol-0.3.13.tar.gz Here is the main page. http://www.balabit.com/downloads/libol/0.3/ When I upgraded libol it went smoothly. -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Keith Olmstead Sent: Friday, April 30, 2004 10:28 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Not finding libol, please help Hello, Trying to upgrade my syslog-ng install and during the config, it is not finding my libol. checking libol version >= 0.3.13... no configure: error: Required libol version not found but I have libol installed. libol-config --version 0.3.9 Just a default install of libol. Can anyone help me as to why it is not seeing libol. It is in my path and I can not find a reason why it is not finding it. This is on a RH9 box. Thanks, Keith -- _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ******************************************** This message is intended only for the use of the Addressee and may contain information that is PRIVILEGED and CONFIDENTIAL. If you are not the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please erase all copies of the message and its attachments and notify us immediately. Thank you. ********************************************

1 0

Not finding libol, please help
by Keith Olmstead 30 Apr '04

30 Apr '04

Hello, Trying to upgrade my syslog-ng install and during the config, it is not finding my libol. checking libol version >= 0.3.13... no configure: error: Required libol version not found but I have libol installed. libol-config --version 0.3.9 Just a default install of libol. Can anyone help me as to why it is not seeing libol. It is in my path and I can not find a reason why it is not finding it. This is on a RH9 box. Thanks, Keith --

1 0

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 29 Apr '04

29 Apr '04

Aw crap. Forget all this. I looked at it again, and anyone would be able to DoS sec.pl using logger. ::sigh:: It looks like signal propagation from syslog-ng to sec.pl is the right way of doing this. -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > -----Original Message----- > From: atonns(a)mail.ivillage.com [mailto:atonns@mail.ivillage.com] > Sent: Thursday, April 29, 2004 12:13 PM > To: syslog-ng(a)lists.balabit.hu > Subject: RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does > > After a night of sleeping on it, I came up with a alternate > solution - have > SEC detect restarts of syslog-ng. Below is the result. The > only fuzzy part > is in the sec-cleanup.pl script below - what to do if you > don't get a TERM > signal from sec.pl. I don't think using "logger" is the best > idea since > things are restarting, etc. etc. I _guess_ it could send email out. In > reality, it's all up to the end user. > > ### syslog-ng.conf ### > > source s_src { > sun-stream("/dev/log" door("/etc/.syslog_door")); > tcp(max-connections(1024)); > udp(); > internal(); > }; > > destination d_sec { > program("/usr/local/sbin/sec.pl -intevents -input=\"-\" > -conf=/usr/local/etc/sec.conf"); > }; > > log { > source(s_src); > destination(d_sec); > }; > > ### sec.conf ### > > type=Single > continue=TakeNext > ptype=RegExp > pattern=syslog-ng version .+ going down > desc=syslog-ng shutdown > action= shellcmd /usr/local/sbin/sec-cleanup.pl > > type=Single > continue=TakeNext > ptype=RegExp > pattern=SIGHUP received, restarting syslog-ng > desc=syslog-ng restart > action= shellcmd /usr/local/sbin/sec-cleanup.pl > > ### sec-cleanup.pl ### > > #!/usr/local/bin/perl -w > # > # sec-cleanup.pl > # > # ATonns Thu Apr 29 11:42:10 EDT 2004 > # > # $Id$ > # > > use strict; > my $PROGNAME="sec-cleanup.pl"; > my $waittime = 10; # in seconds > > ## CODE ## > > my $pid = $$; > my $ppid = getppid; > $SIG{'TERM'} = sub { > print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: got TERM > signal, exiting gracefully.\n"; > exit(0); > }; > print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: killing parent > $ppid\n"; > kill('TERM',$ppid); > sleep($waittime); > print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: not > good - timed out > waiting for TERM signal. Exiting.\n"; > exit(1); > > -- > "Computer science is as much about computers as > astronomy is about telescopes" -- Edsger Dijkstra > --------------------------------------------------------- > Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - > iVillage Inc. is a > leading women's media company that includes iVillage.com, Women.com, > gURL.com, Astrology.com, Promotions.com, iVillage Parenting > Network, The > Newborn Channel, Lamaze Publishing, Business Women's Network, > Diversity Best > Practices, Best Practices in Corporate Communications, and iVillage > Consulting. The information contained in this communication may be > confidential, is intended only for the use of the recipient > named above, and > may be construed under applicable law to be a commercial > email. If you have > received this communication in error, please delete this > message from your > computer system. If you are the recipient named above and do > not wish to > receive any future commercial emails, please reply to the > sender with a > message stating such preference. > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

1 0

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 29 Apr '04

29 Apr '04

After a night of sleeping on it, I came up with a alternate solution - have SEC detect restarts of syslog-ng. Below is the result. The only fuzzy part is in the sec-cleanup.pl script below - what to do if you don't get a TERM signal from sec.pl. I don't think using "logger" is the best idea since things are restarting, etc. etc. I _guess_ it could send email out. In reality, it's all up to the end user. ### syslog-ng.conf ### source s_src { sun-stream("/dev/log" door("/etc/.syslog_door")); tcp(max-connections(1024)); udp(); internal(); }; destination d_sec { program("/usr/local/sbin/sec.pl -intevents -input=\"-\" -conf=/usr/local/etc/sec.conf"); }; log { source(s_src); destination(d_sec); }; ### sec.conf ### type=Single continue=TakeNext ptype=RegExp pattern=syslog-ng version .+ going down desc=syslog-ng shutdown action= shellcmd /usr/local/sbin/sec-cleanup.pl type=Single continue=TakeNext ptype=RegExp pattern=SIGHUP received, restarting syslog-ng desc=syslog-ng restart action= shellcmd /usr/local/sbin/sec-cleanup.pl ### sec-cleanup.pl ### #!/usr/local/bin/perl -w # # sec-cleanup.pl # # ATonns Thu Apr 29 11:42:10 EDT 2004 # # $Id$ # use strict; my $PROGNAME="sec-cleanup.pl"; my $waittime = 10; # in seconds ## CODE ## my $pid = $$; my $ppid = getppid; $SIG{'TERM'} = sub { print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: got TERM signal, exiting gracefully.\n"; exit(0); }; print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: killing parent $ppid\n"; kill('TERM',$ppid); sleep($waittime); print STDOUT localtime(time) . " ${PROGNAME}\[$pid\]: not good - timed out waiting for TERM signal. Exiting.\n"; exit(1); -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

1 0

Sylog-ng OpenBSD Problems
by Johannes Geier 29 Apr '04

29 Apr '04

Hello, I run syslog-ng-1.5.24 on OpenBSD 3.4 sparc64, i have some problems, its not working in the way i want it, my config looks in this way: options { long_hostnames(off); chain_hostnames(off); use_fqdn (yes); sync(0); }; source s_udp { udp(); }; destination test { file("/var/log/info"); }; log { source(s_udp); destination(test); }; no biggie at all tail -f /var/log/info shows: Apr 28 16:23:18 syslog/syslog 1552866: Apr 28 16:42:18: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1:14, changed state to down Apr 28 16:23:23 syslog/syslog 1552872: Apr 28 16:42:24: %LINK-3-UPDOWN: Interface Serial1/0:2, changed state to down There is no Router source IP, just syslog/syslog syslog is the name of the logging box # uname -a OpenBSD syslog.srv.test.com 3.4 GENERIC#85 sparc64 when i run that box with the normal syslogd the source ip, gets shown, and even when i erase all options in syslog-ng.conf : source s_udp { udp(); }; destination test { file("/var/log/info"); }; log { source(s_udp); destination(test); }; the source ip never comes in, i just want the sourceip no dns name nothing any ideas? Greets Johannes -- Die e-Mail-Boxes von Brennercom sind Virus-gesichert und Spam-gefiltert. Le caselle e-Mail di Brennercom sono protette da sistemi antivirus e antispam. http://www.brennercom.it

2 4

RE: [syslog-ng]cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 29 Apr '04

29 Apr '04

Nate, I don't think it's perl, but syslog-ng. What version of syslog-ng are you running? I looked at the source for 'afprogram.c' in both 1.6.2 and the 1.7.0+20040428 where it forks the child to run the program. Using the code as follows, how could you do anything _but_ run /bin/sh -c ... if (pid == 0) { int fd = open("/dev/null", O_WRONLY); dup2(msgpipe[0], 0); dup2(fd, 1); dup2(fd, 2); close(fd); close(msgpipe[1]); execl("/bin/sh", "/bin/sh", "-c", self->progname->data, NULL); _exit(127); } I'm still reading through the code, but I don't think that syslog-ng passes along the necessary signals to it's children. When I HUP syslog-ng, it spawns another sec.pl as well, not SIGTERM'ing the first one. Am I not understanding the behavior of syslog-ng, doing something wrong, or is this some sort of bug in syslog-ng? FYI, sec.pl's behavior is documented as follows in the SEC man page: SIGTERM SEC will terminate gracefully (all SEC child processes will receive SIGTERM). Shouldn't syslog-ng do the same? Thanks, Tony -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com > -----Original Message----- > From: Nate Campi [mailto:nate@campin.net] > Sent: Wednesday, April 28, 2004 5:06 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]cannot get sec.pl to exit after syslog-ng does > > I read your message too fast the first time, it appears that you still > have it spawned by a shell with no shell redirection characters. > > 23330 ? S 2:11 /sbin/syslog-ng > 23331 ? S 0:00 \_ /usr/bin/perl /usr/bin/swatch > --script-dir=/root --read-pipe=cat /dev > 23346 ? S 0:31 | \_ perl /root/.swatch_script.23331 > 23370 ? S 0:02 | \_ cat /dev/fd/0 > 23334 ? S 3:24 \_ /usr/bin/perl -w > /usr/local/sbin/sec.pl -input=- -conf=/usr/local/etc > > I don't have a shell starting sec on linux. Maybe it's perl on solaris > doing this. I can't say. > -- > Nate > > "Guide to understanding a net.addict's day: Slow day: didn't have much > to do, so spent three hours on usenet. Busy day: managed to work in > three hours of usenet. Bad day: barely squeezed in three hours of > usenet." - Unknown > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 2

cannot get sec.pl to exit after syslog-ng does
by atonns＠mail.ivillage.com 28 Apr '04

28 Apr '04

I've tried the various configurations in the FAQ and I still get sec.pl spawned by a shell. Then after killing syslog-ng, sec.pl doesn't exit. Below are the configs and the output from ptree. I'm using Solaris 7, syslog-ng 1.6.2, sec 2.2.2 and perl 5.00503. I'm thinking of adding stats(60) to the syslog-ng config and then using the -input_timeout and -timeout_script options for sec.pl, but I have figured out how the sub-script would tell the difference between the abandoned sec.pl and the new one that's a child of the current syslog-ng. as per FAQ: ----------- destination d_sec { program("/usr/local/sbin/sec.pl -intevents -input=\"-\" -conf=/usr/local/etc/sec.conf"); }; 25879 /usr/local/sbin/syslog-ng 25880 /bin/sh -c /usr/local/sbin/sec.pl -intevents -input="-" -conf=/usr/local/etc/se 25881 /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=- -conf=/usr/lo another config: --------------- destination d_sec { program("/usr/local/sbin/sec.pl -intevents -input=\"-\" -conf=/usr/local/etc/sec.conf > /var/log/sec.log 2>&1"); }; 26428 /usr/local/sbin/syslog-ng 26429 /bin/sh -c /usr/local/sbin/sec.pl -intevents -input="-" -conf=/usr/local/etc/se 26430 /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=- -conf=/usr/lo pure desperation: ----------------- destination d_sec { program("/usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=\"-\" -conf=/usr/local/etc/sec.conf"); }; 27478 /usr/local/sbin/syslog-ng 27479 /bin/sh -c /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input="-" 27480 /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=- -conf=/usr/lo -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns(a)mail.ivillage.com iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.

2 2

No facility/level logged
by me 28 Apr '04

28 Apr '04

Hello, I've compiled syslog-ng for AIX 5L and want the facility/level information be logged to the log file(s) (I assume this shuold be included in the message part as described in the syslog protocol rfc). Well, my investigations lend me to the "syslog" subroutine, which is called during the log of an event. This concerns in fact the os and not really syslog-ng. But maybe someone had the same requirement... Thanks for any feedback! Btw: Solaris syslogd logs this way, including the facility/level information. -- "Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen! Jetzt aktivieren unter http://www.gmx.net/info

3 3

program destination driver and template option
by Jim Mozley 28 Apr '04

28 Apr '04

I'm using syslog-ng 1.6.2 which I believe from the changelog supports the template option for the program driver. When I comment/uncomment the line from the config file below the destination will work with the template options commented out, but not with them uncommented. destination d_add_message { program("/path/to/my/test.pl" #template("$HOST $MESSAGE") template_escape(no) ); }; No parse errors are reported when syslog-ng starts. I have googled for examples of correct usage (although I cannot get through to the faq site at present) and cannot see anything wrong with the above, although I assume the problem is with the conf file definition. Jim Mozley

1 0

unsubscribe
by Minson, John Spawar 28 Apr '04

28 Apr '04

unsubscribe -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu]On Behalf Of me Sent: Wednesday, April 28, 2004 8:29 AM To: syslog-ng(a)lists.balabit.hu Cc: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]No facility/level logged Hi, that will work for sure, as soon as I have compiled syslog-ng-1.9.1... Thank you very much! /me > 2004-04-27, k keltezéssel 09:56-kor me ezt írta: > > Hello, > > I've compiled syslog-ng for AIX 5L and want the facility/level > information > > be logged to the log file(s) (I assume this shuold be included in the > > message part as described in the syslog protocol rfc). Well, my > > investigations lend me to the "syslog" subroutine, which is called > during > > the log of an event. This concerns in fact the os and not really > syslog-ng. > > But maybe someone had the same requirement... > > > > Thanks for any feedback! > > probably you want to define a file template > > destination d_messages { file("/var/log/messages" template("<$PRI> $DATE > $HOST $MSG\n"); }; > > -- > Bazsi > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > -- "Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen! Jetzt aktivieren unter http://www.gmx.net/info _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Using a perl script with the pipe destination driver
by Jim Mozley 28 Apr '04

28 Apr '04

I have a perl script that reads from a pipe using the following construct: while ( 1 ) { die "$pipe is not a pipe!" unless ( -p $pipe ); open PIPE, $pipe or die "Cannot open $pipe: $!"; my @lines = <PIPE>; close PIPE; for ( @lines ) { # do some stuff } } The "do some stuff part" loads info into a database (the messages are processed before being put into the database and two hashes keep cached information relevant to this in order to speed up the process). I can test using: cat syslog > pipe and the script does its stuff, loading single syslog messages or a days worth (around 3000 messages in 8 seconds). I then try to add a destination within syslog-ng.conf: destination d_pipe { pipe("/path/to/pipe"); }; and log { source(all); destination(d_pipe); }; This doesn't work as I expected. It seems as if I have some kind of locking problem; as I send test syslog messages nothing happens, then if I stop syslog-ng all the test messages I have added (using logger) are then processed by the script. I can then restart syslog-ng, send messages and again they are not read by the script until syslog-ng is stopped. I was able to use the construct: open PIPE, $pipe or die "Cannot open $pipe: $!"; while ( <LOGPIPE> ) { # do something e.g. test write to file }; as a test and this worked OK, seeming to process each message as I entered it (although I didn't try a volume test). Based on what I'd found so far I had a few questions: - can anyone explain what I think is the locking problem with the first approach (apologies if I'm asking a general unix or perl question, but testing the pipe outside of syslog-ng seemed to work ok)? - If I use the second approach are log messages written atomically such that I will get them one at a time? - One of the reasons I adopted the first approach is that I can throw a lot of messages at the pipe and still have them processed and put in the DB in a short space of time. I was concerned that if I used the second approach and syslog-ng was passing messages into the pipe faster than they could be processed, I would end up loosing messages. I'm sure that there is either an OS or syslog-ng buffer that is configurable but I assume its finite. We are logging a lot of events from network equipment and in the event of a "message storm" when network problems occur I wanted to ensure all of the messages are captured. I'm using perl 5.8 and syslog-ng 1.6.2 on Solaris 8. Jim Mozley

2 2

killed by HUP signal on Mac OS X 10.3
by Jeremy Mates 28 Apr '04

28 Apr '04

The syslog-ng daemon dies on Mac OS X when a HUP signal is sent: $ sudo /usr/local/sbin/syslog-ng -d io.c: Preparing fd 4 for reading io.c: Preparing fd 5 for reading syslog-ng version 1.6.2 starting io.c: Preparing fd 7 for writing io.c: Preparing fd 8 for writing SIGHUP received, restarting syslog-ng poll.c:282: failed assertion `pArray != (struct pollfd *) NULL' zsh: abort sudo /usr/local/sbin/syslog-ng -d Software versions involved: syslog-ng 1.6.2 libol 0.3.13 gcc 3.3 20030304 (Apple Computer, Inc. build 1495) Mac OS X 10.3.3 (build 7F44) Running ktrace shows the following: 12661 syslog-ng RET write 149/0x95 12661 syslog-ng CALL select(0x9,0xbffff3a0,0xbffff420,0xbffff4a0,0xbffff520) 12661 syslog-ng RET select -1 errno 4 Interrupted system call 12661 syslog-ng PSIG SIGHUP caught handler=0x2a94 mask=0x0 code=0x0 12661 syslog-ng CALL sigaction(0x1,0xbfffecb0,0xbfffed20) 12661 syslog-ng RET sigaction 0 12661 syslog-ng CALL #184(0xbfffee58,0x1) 12661 syslog-ng RET #184 JUSTRETURN 12661 syslog-ng CALL write(0x2,0xbffff540,0x26) 12661 syslog-ng GIO fd 2 wrote 38 bytes "SIGHUP received, restarting syslog-ng " 12661 syslog-ng RET write 38/0x26 12661 syslog-ng CALL write(0x2,0xbfffeb50,0x40) 12661 syslog-ng GIO fd 2 wrote 64 bytes "poll.c:282: failed assertion `pArray != (struct pollfd *) NULL' " 12661 syslog-ng RET write 64/0x40 12661 syslog-ng CALL sigprocmask(0x3,0xbffff324,0) 12661 syslog-ng RET sigprocmask 0 12661 syslog-ng CALL getpid 12661 syslog-ng RET getpid 12661/0x3175 12661 syslog-ng CALL kill(0x3175,0x6) 12661 syslog-ng RET kill 0 12661 syslog-ng PSIG SIGIOT SIG_DFL

3 3

help me for the drop messages
by Luigi Augello 27 Apr '04

27 Apr '04

Hello at all sorry Bazsi I had copied teh wrong address. rewrite the messages Hello at all I have a problem with a message STATS dropped probably because the database is busy, syslog-ng can not write fast enough and drop messages. Anyone have the solution. I'm desperado!!! Is possible to configure syslo-ng opportunely? Tanks a lot

1 0

Corruption in program destination
by Andy Kirkpatrick 27 Apr '04

27 Apr '04

Hi everyone, I have syslog-ng set up to accept syslog entries over UDP from remote hosts: source src { unix-dgram("/dev/log"); internal(); udp(); }; The log entries in question come from various machines, all arrive with facility local6 and get written to /var/log/local6 nicely: destination local6 { file("/var/log/local6" owner("root") group("adm") perm("640")); }; filter local6 { facility(local6); }; log { source(src); filter(local6); destination(local6); }; However the same data when written to a program destination gets corrupted: destination logprocess { program("/usr/local/bin/logprocess.pl"); }; log { source(src); filter(local6); destination(logprocess); }; Whereas in /var/log/local6 I get each line whole and pristine, my logprocess script gets lines that are occasionally overwritten, with one log entry truncated and another starting halfway through it. The lines are all under 120 bytes in length so its not a log_msg_size issue. This only seems to occur when more than one remote host is sending to syslog-ng at once. Thinking it might be a buffer overrun when the server is busy I increased log_fifo_size to 8000 but that made no difference. Any ideas? Thanks, Andy Kirkpatrick

1 0

RE: [syslog-ng]Program destination ?
by Andy Kirkpatrick 27 Apr '04

27 Apr '04

Hi David, This is just a guess, but the output buffer of syslog-ng would be holding more than one line, which is set with option log_fifo_size. Consoles tend to be line buffered while pipes are block/chunk/arbitrarily buffered. Try sending a few hundred messages and see if they come through all at once. Or it could be more related to the sync option, the number of lines buffered before being written to file (not sure if that applies to program targets). I can't see anything wrong with your config, we have a similar setup where I work and I haven't seen the problem you mention. HTH, Andy Kirkpatrick -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of David Vaartjes Sent: Friday, 23 April 2004 8:16 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Program destination ? Hello list, I'm testing syslog-ng to send certain messages to the stdin of a program. I've set the following lines in "syslog-ng.conf" to accomplish this: <CONFIG-LINES> destination alerter { program("/home/dv/download/perl-test.pl"); }; filter f_special { match("special"); }; log { source(src); filter(f_special); destination(alerter); }; </CONFIG-LINES> The perl-test.pl looks like: <PERL-TEST.PL> #!/usr/bin/perl while (<>) { print $_ . "\n"; } </PERL-TEST.PL> If I do a 'logger -p daemon.notice "special"' the message is not send to the stdin of perl-test.pl. However, if i do a 'echo "test" > /proc/3240/fd/0" the data is send to the stdin of perl-test.pl and shown on the console by perl-test.pl as expected. I can't figure out why syslog isn't sending messages to perl-test.pl. If i change the "destination" in syslog-ng.conf to write to a file, everything works fine. Hope someone can shed some light on this one. Thanks in advance, David _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Program destination ?
by David Vaartjes 25 Apr '04

25 Apr '04

Hello list, I'm testing syslog-ng to send certain messages to the stdin of a program. I've set the following lines in "syslog-ng.conf" to accomplish this: <CONFIG-LINES> destination alerter { program("/home/dv/download/perl-test.pl"); }; filter f_special { match("special"); }; log { source(src); filter(f_special); destination(alerter); }; </CONFIG-LINES> The perl-test.pl looks like: <PERL-TEST.PL> #!/usr/bin/perl while (<>) { print $_ . "\n"; } </PERL-TEST.PL> If I do a 'logger -p daemon.notice "special"' the message is not send to the stdin of perl-test.pl. However, if i do a 'echo "test" > /proc/3240/fd/0" the data is send to the stdin of perl-test.pl and shown on the console by perl-test.pl as expected. I can't figure out why syslog isn't sending messages to perl-test.pl. If i change the "destination" in syslog-ng.conf to write to a file, everything works fine. Hope someone can shed some light on this one. Thanks in advance, David

2 1

RE: [syslog-ng]syslog-ng 1.6.1
by Andrews, Glenn J (Glenn) 22 Apr '04

22 Apr '04

Well the local1.info works to /var/log/network when I do # logger -p local1.info -t local1 "This is a test for local1.info" but when I do ... # logger -p local1.warning -t local1 "this is a test on local1.warning" I get vvvv in /var/log/syslog Apr 22 16:33:57 10.100.40.20 syslog-ng[874]: io.c: do_write: write() failed (errno 32), Broken pipe Apr 22 16:33:57 10.100.40.20 syslog-ng[874]: pkt_buffer::do_flush(): Error flushing data Apr 22 16:33:57 10.100.40.20 syslog-ng[874]: Connection broken to AF_INET(10.100.40.1:514), reopening in 10 seconds Glenn -----Original Message----- From: Coward, Robert (Contractor) [mailto:Robert.Coward@deploymenthealth.osd.mil] Sent: Thursday, April 22, 2004 2:47 PM To: syslog-ng(a)lists.balabit.hu Cc: Andrews, Glenn J (Glenn) Subject: RE: [syslog-ng]syslog-ng 1.6.1 Looks fine to me. Although, I do not know what this line does: source network { udp(); tcp(); }; Since you do not have a log line that references the "network" source, I don't know wht its there. Maybe more stuff in your config, I can't see. Everything else looks okay. --- 22 April 2004 "As nightfall does not come all at once, neither does oppression. In both instances, there is a twilight. And it is in such twilight that we all must be aware of change in the air, however slight, lest we become unwitting victims of darkness." (William O. Douglas, 1939-1975) --- Robert V. Coward UNIX System Administrator Computer Science Corporation "Andrews, Glenn J (Glenn)" <gjandrews(a)lucent.com> on 04/22/2004 02:33:01 PM To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> cc: "'Coward, Robert (Contractor)'" <Robert.Coward(a)deploymenthealth.osd.mil> Subject: RE: [syslog-ng]syslog-ng 1.6.1 Excellent. So just to be sure I understand ya.. **************************************************** options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (no); }; source local { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { udp(); tcp(); }; destination networklog { file("/var/log/network"); }; destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; filter f_network_logs { facility(local1) and level(info); }; filter f_network_logs2 { facility(local1) and level(warning); }; log { source(local); filter(f_network_logs); destination(networklog); }; log { source(local); filter(f_network_logs2); destination(syslog(a)10.100.40.1); }; **************************************************** Is this correct ? Glenn -----Original Message----- From: Coward, Robert (Contractor) [mailto:Robert.Coward@deploymenthealth.osd.mil] Sent: Thursday, April 22, 2004 1:15 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng 1.6.1 Glenn, What you need is a filter, I think. Heres how: source src { unix-stream ("/dev/log"); internal (); }; destination network_logs { file("/var/log/network.log"); }; filter f_network_logs { facility(local1) and level(info); }; Now do the logging: log { source(src); destination(network_logs); filter(f_network_logs); }; I think that should work for the first one. For the second one i think you will need to set a filter like the first but set the destination like so: destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; I think thats about it. --- 22 April 2004 "Allow the President to invade a neighboring nation whenever he shall deem it necessary to repel an invasion and you allow him to do so whenever he may choose to say he deems it necessary for such purpose, and you allow him to make war at pleasure.... If today he should choose to say he thinks it necessary to invade Canada to prevent the British from invading us, how could you stop him? You may say to him, "I see no probability of the British invading us," but he will say to you, "Be silent; I see it, if you don't." (Abrham Lincoln, 1809-1865) --- Robert V. Coward UNIX System Administrator Computer Science Corporation _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog-ng 1.6.1
by Coward, Robert (Contractor) 22 Apr '04

22 Apr '04

Looks fine to me. Although, I do not know what this line does: source network { udp(); tcp(); }; Since you do not have a log line that references the "network" source, I don't know wht its there. Maybe more stuff in your config, I can't see. Everything else looks okay. --- 22 April 2004 "As nightfall does not come all at once, neither does oppression. In both instances, there is a twilight. And it is in such twilight that we all must be aware of change in the air, however slight, lest we become unwitting victims of darkness." (William O. Douglas, 1939-1975) --- Robert V. Coward UNIX System Administrator Computer Science Corporation "Andrews, Glenn J (Glenn)" <gjandrews(a)lucent.com> on 04/22/2004 02:33:01 PM To: "'syslog-ng(a)lists.balabit.hu'" <syslog-ng(a)lists.balabit.hu> cc: "'Coward, Robert (Contractor)'" <Robert.Coward(a)deploymenthealth.osd.mil> Subject: RE: [syslog-ng]syslog-ng 1.6.1 Excellent. So just to be sure I understand ya.. **************************************************** options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (no); }; source local { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal (); }; source network { udp(); tcp(); }; destination networklog { file("/var/log/network"); }; destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; filter f_network_logs { facility(local1) and level(info); }; filter f_network_logs2 { facility(local1) and level(warning); }; log { source(local); filter(f_network_logs); destination(networklog); }; log { source(local); filter(f_network_logs2); destination(syslog(a)10.100.40.1); }; **************************************************** Is this correct ? Glenn -----Original Message----- From: Coward, Robert (Contractor) [mailto:Robert.Coward@deploymenthealth.osd.mil] Sent: Thursday, April 22, 2004 1:15 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng 1.6.1 Glenn, What you need is a filter, I think. Heres how: source src { unix-stream ("/dev/log"); internal (); }; destination network_logs { file("/var/log/network.log"); }; filter f_network_logs { facility(local1) and level(info); }; Now do the logging: log { source(src); destination(network_logs); filter(f_network_logs); }; I think that should work for the first one. For the second one i think you will need to set a filter like the first but set the destination like so: destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; I think thats about it. --- 22 April 2004 "Allow the President to invade a neighboring nation whenever he shall deem it necessary to repel an invasion and you allow him to do so whenever he may choose to say he deems it necessary for such purpose, and you allow him to make war at pleasure.... If today he should choose to say he thinks it necessary to invade Canada to prevent the British from invading us, how could you stop him? You may say to him, "I see no probability of the British invading us," but he will say to you, "Be silent; I see it, if you don't." (Abrham Lincoln, 1809-1865) --- Robert V. Coward UNIX System Administrator Computer Science Corporation _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog-ng 1.6.1
by Andrews, Glenn J (Glenn) 22 Apr '04

22 Apr '04

Excellent. So just to be sure I understand ya.. **************************************************** options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (no); }; source local { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source network { udp(); tcp(); }; destination networklog { file("/var/log/network"); }; destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; filter f_network_logs { facility(local1) and level(info); }; filter f_network_logs2 { facility(local1) and level(warning); }; log { source(local); filter(f_network_logs); destination(networklog); }; log { source(local); filter(f_network_logs2); destination(syslog(a)10.100.40.1); }; **************************************************** Is this correct ? Glenn -----Original Message----- From: Coward, Robert (Contractor) [mailto:Robert.Coward@deploymenthealth.osd.mil] Sent: Thursday, April 22, 2004 1:15 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog-ng 1.6.1 Glenn, What you need is a filter, I think. Heres how: source src { unix-stream ("/dev/log"); internal (); }; destination network_logs { file("/var/log/network.log"); }; filter f_network_logs { facility(local1) and level(info); }; Now do the logging: log { source(src); destination(network_logs); filter(f_network_logs); }; I think that should work for the first one. For the second one i think you will need to set a filter like the first but set the destination like so: destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; I think thats about it. --- 22 April 2004 "Allow the President to invade a neighboring nation whenever he shall deem it necessary to repel an invasion and you allow him to do so whenever he may choose to say he deems it necessary for such purpose, and you allow him to make war at pleasure.... If today he should choose to say he thinks it necessary to invade Canada to prevent the British from invading us, how could you stop him? You may say to him, "I see no probability of the British invading us," but he will say to you, "Be silent; I see it, if you don't." (Abrham Lincoln, 1809-1865) --- Robert V. Coward UNIX System Administrator Computer Science Corporation _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog-ng 1.6.1
by Coward, Robert (Contractor) 22 Apr '04

22 Apr '04

Glenn, What you need is a filter, I think. Heres how: source src { unix-stream ("/dev/log"); internal (); }; destination network_logs { file("/var/log/network.log"); }; filter f_network_logs { facility(local1) and level(info); }; Now do the logging: log { source(src); destination(network_logs); filter(f_network_logs); }; I think that should work for the first one. For the second one i think you will need to set a filter like the first but set the destination like so: destination syslog(a)10.100.40.1 { tcp("10.100.40.1" port(514)); }; I think thats about it. --- 22 April 2004 "Allow the President to invade a neighboring nation whenever he shall deem it necessary to repel an invasion and you allow him to do so whenever he may choose to say he deems it necessary for such purpose, and you allow him to make war at pleasure.... If today he should choose to say he thinks it necessary to invade Canada to prevent the British from invading us, how could you stop him? You may say to him, "I see no probability of the British invading us," but he will say to you, "Be silent; I see it, if you don't." (Abrham Lincoln, 1809-1865) --- Robert V. Coward UNIX System Administrator Computer Science Corporation

1 0

Avoid multiple, repeated Logmessage flooding ?
by Michael Arndt 22 Apr '04

22 Apr '04

Hello * is there any practicable solution with syslog-ng to avoid the following problem: 40 hosts have the same problem and flood the central loghost with the identical, many times repeated message to avoid this ideally one would need an equivalent to : "last message repeated n times" Questions: is there any possibility on the receiver (central loghost) to filter or drop multiple identical messages ? E.g. each hosts entry enters a centarl log only once or n times ? On sender side a ringbuffer filter perl script could be a solution: ringbuffer flushes identical messages in buffer and forwards it only one time for each count of messages. Has anyone more efficient solutions ? thanks Micha

1 0

syslog-ng 1.6.1
by Andrews, Glenn J (Glenn) 21 Apr '04

21 Apr '04

I have been asked to add some entries to /etc/syslog.conf. (They don't know I am using syslog-ng 1.6.1 :-) ). I am uncertain as to what the entries would translate to in syslog-ng 'language'. Here are the entries.. local1.info /var/log/network.log local1.warning @10.100.40.1 Glenn.

1 0

Patch for mysql destination in syslog-ng 1.6.2
by Steven Van Acker 20 Apr '04

20 Apr '04

Hi, I have added a new log destination to syslog-ng. The patch can be found here: http://deepstar.ekonomika.be/Projects/patches/syslog-ng-1.6.2-with.mysql.de… More information here: http://deepstar.ekonomika.be/Projects/patches/syslog-ng-1.6.2-with.mysql.de… greets, -- Steven

2 1

STATS: dropped > 0 messages on centralized syslog
by Luigi Augello 20 Apr '04

20 Apr '04

Hello at all I have a problem with a message STATS dropped actually I test a syslog server that I would use to register the logs of all administrative machines and I use a databases. The log go to databases through a pipe. I have read of this problem resolved by Manfred but I dont have understand which operations are necessary Tank a lot Luigi

1 0