- syslog-ng - lists.balabit.hu

syslog-ng do not work....
by Alessandro Fiorenzi 28 Jan '04

28 Jan '04

Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio CLUSIT, ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

3 2

fallback behaviour
by Andrew Culver 28 Jan '04

28 Jan '04

If I have some log paths, then a log path using the fallback flag, then some more log paths... will that path with the fallback flag not capture message that the log paths after it capture? For example, can I do the following: log { source(src); filter(filt_a); desintation(dest_a); }; log { source(src); destination(dest_b); flags(fallback); }; log { source(src); filter(filt_b); destination(dest_c); }; Will messages not filtered by filt_a be captured by the second log path and then again by the third? If not, is there any way to do this? My understanding was the old filter(DEFAULT) would behave like this, but flags(fallback) would not. Can the same effect still be accomplished? TIA, Andrew

2 1

RE: [syslog-ng] file permissions
by Andrews, Glenn J (Glenn) 28 Jan '04

28 Jan '04

Now for some reason I am getting these messages in /var/log/syslog Jan 27 18:31:34 ma106068-nm01 syslog-ng[2603]: Cannot open file /var/log/HOSTS/10.140.20.12/20040127/ for writing (Is a directory) I have deleted the entire tree from HOSTS on down and killed and restarted syslog-ng. But I still get this error. This is my destination line in syslog-ng.conf destination hosts { file("/var/log/HOSTS/$HOST/$YEAR$MONTH$DAY/$FACILTY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; and options... options { sync (0); perm (0644); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (no); }; Glenn Andrews N.E. Premise Operations Data / Voice Networking Services gjandrews(a)lucent.com <<mailto:gjandrews@lucent.com>>

2 1

file permissions
by Andrews, Glenn J (Glenn) 27 Jan '04

27 Jan '04

Is there a way to set file permssions on the logs syslog-ng creates ? It seems to create them with 600 root:root which makes them read/write by root only. Can I set them to 644 ? Glenn Andrews N.E. Premise Operations Data / Voice Networking Services gjandrews(a)lucent.com <mailto:gjandrews@lucent.com> << mailto:gjandrews@lucent.com <mailto:gjandrews@lucent.com> >> -----Original Message----- From: Andrew Culver [mailto:aculver@uwo.ca] Sent: Tuesday, January 27, 2004 12:45 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng do not work.... Maybe this is too simple but.. is that your entire config file? Do you not have destination and log directives? ----- Original Message ----- From: Alessandro Fiorenzi <mailto:a.fiorenzi@infogroup.it> To: Syslog-ng <mailto:syslog-ng@lists.balabit.hu> Sent: Tuesday, January 27, 2004 10:52 AM Subject: [syslog-ng]syslog-ng do not work.... Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

2 1

RE: [syslog-ng]syslog-ng do not work....
by Hamilton Andrew 27 Jan '04

27 Jan '04

I would, at the very least, get the latest, which is, I believe, 1.6.1. The 1.4.x line is very old and not nearly as feature rich as 1.6.x. Drew -----Original Message----- From: Alessandro Fiorenzi [mailto:a.fiorenzi@infogroup.it] Sent: Tuesday, January 27, 2004 11:41 AM To: Syslog-ng Subject: RE: [syslog-ng]syslog-ng do not work.... Well I have syslog-ng version 1.4.17, perhaps could be that, infact dns_cache(yes) use_time_recvd(yes) does not go . Alessandro On Tue, 2004-01-27 at 17:01, Hamilton Andrew wrote: What version of syslog-ng are you using? dnscache(yes) should be dns_cache(yes) use_time_recvd(true) should be use_time_recvd(yes) try pipe("/proc/kmsg" log_prefix("kernel: ")); instead of file(... Regards, Drew -----Original Message----- From: Alessandro Fiorenzi [mailto:a.fiorenzi@infogroup.it] Sent: Tuesday, January 27, 2004 10:53 AM To: Syslog-ng Subject: [syslog-ng]syslog-ng do not work.... Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" ------------------------------------------------------------------------- ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

1 0

RE: [syslog-ng]syslog-ng do not work....
by Hamilton Andrew 27 Jan '04

27 Jan '04

What version of syslog-ng are you using? dnscache(yes) should be dns_cache(yes) use_time_recvd(true) should be use_time_recvd(yes) try pipe("/proc/kmsg" log_prefix("kernel: ")); instead of file(... Regards, Drew -----Original Message----- From: Alessandro Fiorenzi [mailto:a.fiorenzi@infogroup.it] Sent: Tuesday, January 27, 2004 10:53 AM To: Syslog-ng Subject: [syslog-ng]syslog-ng do not work.... Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" -------------------------------------------------------------------------

2 1

RE: [syslog-ng]syslog-ng do not work....
by Schernau, Ed 27 Jan '04

27 Jan '04

FYI, use_time_recvd only works if you are logging with a template. Or has this been fixed in the latest? -----Original Message----- From: Alessandro Fiorenzi [mailto:a.fiorenzi@infogroup.it] Sent: Tuesday, January 27, 2004 10:53 AM To: Syslog-ng Subject: [syslog-ng]syslog-ng do not work.... Hi, I have set this configuration on central logserver options { long_hostnames(off); sync(0); log_fifo_size(1000); dnscache(yes); use_fqdn(yes); use_time_recvd(true); }; source src { internal(); file("/proc/kmsg" log_prefix("kernel: ")); tcp(ip(192.168.52.100) port(514) max-connections(1000)); udp(ip(0.0.0.0) port(514)); }; but it does not work. The fist errore is on dnscache(yes);, if i remove this I get the second on use_time_recvd(true);, remove this one I get errore on file("/proc/kmsg" log_prefix("kernel: ")); .... why? Thanks Fiorenzi A. ------------------------------------------------------------------------ INFOGROUP S.P.A http://www.infogroup.it ------------------------------------------------------------------------- DR. FIORENZI ALESSANDRO Consulente Tribunale Firenze - sicurezza informatica - Security Administrator Socio <file:///home/fiore/signature/www.clusit.it> CLUSIT, <file:///home/fiore/signature/www.alsi.it> ALSI Tel : +39.055.43.65.742 CE : +39.335.64.144.77 @Email : a.fiorenzi(a)infogroup.it PGP Key: http://www.infogroup.it/ds/fiorenzi.asc ------------------------------------------------------------------------- "Faber est suae quisque fortunae" ------------------------------------------------------------------------- *****This information may be confidential and/or privileged. Use of this information by anyone other than the intended recipient is prohibited. If you received this in error, please inform the sender and remove any record of this message.*****

1 0

Anyone have syslog-ng running on Darwin/Mac OS X?
by Cary, Kim 26 Jan '04

26 Jan '04

Hi All, The libol & syslog-ng compile with no fuss on Mac OS X (10.3.2/GCC 3.3). However, it exits when I kill syslogd and try to run syslog-ng. Any success stories, tips for fixing? Any pointers so I can figure out what the issue is? Thanks for any reply. ksc

2 1

syslog-ng 1.4.17 netzwerk logging
by julius 26 Jan '04

26 Jan '04

i used the example Debian GNU/Linux config and added these options on the log host(192.168.0.1): source s_tcp { tcp(ip(0.0.0.0) port(514) max-connections(10)); }; log { source(s_tcp); destination(messages); }; and on the "source host" (192.168.0.3): destination d_tcp { tcp(192.168.0.1); }; log { source(src); filter(f_messages); destination(d_tcp); }; now i get name queries from my bind thats running on the source host, but syslog queries the bind without stopping, the name server uses nearly 100% from the 133mhz... whats wrong?

2 1

receiving external events
by Wang, Philip R. 25 Jan '04

25 Jan '04

I am new to syslog-ng. I used the following config file to test it out under Solaris. Then I used a pc application to generate udp message to port 514. I started the process using "syslog-ng -f filename". I can see log message in "messages" indicating the process started. However, when I send the simulated message from my PC app. It does not show up in the log file. I was reading some Linux syslog-ng document: an chapter from a book. It mentioned using the '-r' option to allow accepting remote message. I have syslog 1.6.1 and it does not have this option. Not sure if I missed anything? Philip --------------------------------------------------------------------- source local { internal(); udp();}; destination all { file("/opt/syslog-ng/messages"); }; log { source(local); destination(all); }; -----------------------------------------------------------------------

2 1

filter(DEFAULT)
by Andrew Culver 25 Jan '04

25 Jan '04

I have the following defined in my config: log { source(s_main); filter(DEFAULT); destination(d_default); }; But syslog-ng gives the following error: Starting syslog-ng: unresolved reference: DEFAULT Error initializing configuration, exiting. Anyone know why this might be and what I can do to fix it? TIA Andrew

2 1

Priorities
by Andrew Culver 25 Jan '04

25 Jan '04

Does the filter option: level(debug) filter messages of level debug _and higher_ or only messages of that level? Andrew

2 1

dir creation with IP/Host
by Dylan H. Bouterse 23 Jan '04

23 Jan '04

I have successfully installed syslog-ng and have it doing most of what I want it to do, with the exception of one thing. I have a host that is not reporting it's IP in a standard format (or I guess that's what's happening) because syslog-ng is creating a new directory based on what looks to be command types. See below: %SYS-I-INITSYS, %SSH-W-IDLE_TIMEOUT, %CLI-E-NOFACINST, So my question is, is there a way to force a specific host to a specific log file before the auto-creation of directories happens? Below is a snipped of my log file. Hopefully I am including all the info I need to help figure this out, but if I'm not, please let me know. options { chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; Dylan Bouterse Network Manager Global Card Services (407) 206-7714 office dhbouterse(a)fhmsi.com Note: This e-mail and any attachments may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of this e-mail and any attachments is strictly prohibited. If you have received this e-mail in error, please notify us immediately by returning it to the sender and deleting it from your computer system. Thank you for your cooperation. First Horizon Merchant Services.

2 1

receiving udp from remote servers
by Wang, Philip R. 23 Jan '04

23 Jan '04

I am new to syslog-ng. I used the following config file to test it out under Solaris. Then I used a pc application to generate udp message to port 514. I started the process using "syslog-ng -f filename". I can see log message in "messages" indicating the process started. However, when I send the simulated message from my PC app. It does not show up in the log file. I was reading some Linux syslog-ng document: an chapter from a book. It mentioned using the '-r' option to allow accepting remote message. I have syslog 1.6.1 and it does not have this option. Not sure if I missed anything? Philip --------------------------------------------------------------------- source local { internal(); udp();}; destination all { file("/opt/syslog-ng/messages"); }; log { source(local); destination(all); }; -----------------------------------------------------------------------

2 1

multiple listen port for centralized syslog-ng
by Alessandro Fiorenzi 23 Jan '04

23 Jan '04

Hi, I would like to setup a very customized version centralize syslog-ng. I would like to divide out server into tree areas - General Porpouse Server - IDS - Firewall for wich I would like to have multiple istance of syslog-ng listening each one on different port like: - General Porpouse Server: port 10000 - IDS : port 10001 - Firewall : port 10002 Is it possible to do? or how can I do to distinguish ? Thanks

2 1

Using full hostnames
by Andrew Culver 20 Jan '04

20 Jan '04

I'm trying to use full hostnames such as www.my.domain.com for both inside the log files, and also for the $HOST macro in the config files (for creating directories based on host). What options should I use to achieve this? I've tried a few different options, but I am only able to get either www or src@www inside the log, and the directories are always simply www. TIA, Andrew

2 1

RE: [syslog-ng]funny character is being inserted into each log li ne + perm(-1) n ot working
by Clemson, Chris 20 Jan '04

20 Jan '04

thank you, that fixed it! > > Correct, this has been fixed by a patch posted to this list > > earlier, and > > in the last 1.6.1 syslog-ng release (which has the posted > > patch merged) > > oh, thanks for the reply! > i must have missed that, i'll check it out > > cheers, > > chris > > -- > The content of this e-mail is confidential, may contain > privileged material > and is intended solely for the recipient(s) named above. If > you receive this > in error, please notify Software AG immediately and delete > this e-mail. > > Software AG (UK) Limited > Registered in England & Wales 1310740 > Registered Office: Hudson House, Hudson Way, > Pride Park, Derby DE24 8HS > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > -- The content of this e-mail is confidential, may contain privileged material and is intended solely for the recipient(s) named above. If you receive this in error, please notify Software AG immediately and delete this e-mail. Software AG (UK) Limited Registered in England & Wales 1310740 Registered Office: Hudson House, Hudson Way, Pride Park, Derby DE24 8HS

1 0

RE: [syslog-ng]syslog-ng-1.6.1 make error.
by Andrews, Glenn J (Glenn) 19 Jan '04

19 Jan '04

Yes that corrected the problem. I installed autoconf-2.1.3 and all it right with the world again :-) Glenn -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Sunday, January 18, 2004 10:15 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng-1.6.1 make error. On Fri, 2004-01-16 at 23:52, Andrews, Glenn J (Glenn) wrote: > I have install libol 0.3.12 and I am trying to install > syslog-ng-1.6.1. > The libol install ok. The syslog-ng "./configured" ok but when I try > to make > I get this error... syslog-ng still uses autoconf2.13 and you probably use a newer, incompatible version. it is also interesting that make wants to rebuild the configure script, it is not normally needed, probably one of the timestamps were bogus. > > cd /tmp/syslog-ng-1.6.1 && autoheader > WARNING: Using auxiliary files such as `acconfig.h', `config.h.bot' > WARNING: and `config.h.top', to define templates for `config.h.in' > WARNING: is deprecated and discouraged. > > WARNING: Using the third argument of `AC_DEFINE' and > WARNING: `AC_DEFINE_UNQUOTED' allows to define a template without > WARNING: `acconfig.h': > > WARNING: AC_DEFINE([NEED_MAIN], 1, > WARNING: [Define if a function `main' is needed.]) > > WARNING: More sophisticated templates can also be produced, see the > WARNING: documentation. > autom4te: need GNU m4 1.4 or later: /usr/ccs/bin/m4 > autoheader: /usr/local/bin/autom4te failed with exit status: 1 > *** Error code 1 > make: Fatal error: Command failed for target > `/tmp/syslog-ng-1.6.1/src/stamp-h.in' > Current working directory /tmp/syslog-ng-1.6.1/src > *** Error code 1 > make: Fatal error: Command failed for target `all-recursive' > > I have m4 1.4 in my path. Is there something I am missing ? > > Glenn Andrews > Data / Voice Networking Services > 1 Robbins Road, Westford, MA 01886 > gjandrews(a)lucent.com <<mailto:gjandrews@lucent.com>> > > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

compiling syslog-ng (latest version) on solaris 9
by Markus Reger 18 Jan '04

18 Jan '04

hello to everybody Made several attempts to compile syslog-ng. Compilation of libol went fine. Whenever I "make" syslog-ng I encounter the error: gcc -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -o syslog-ng main.o sources.o center.o filters.o destinations.o log.o cfgfile.o cfg-grammar.o cfg-lex.o affile.o afsocket.o afunix.o afinet.o afinter.o afuser.o afstreams.o afprogram.o afremctrl.o nscache.o utils.o syslog-names.o macros.o getopt.o getopt1.o -lpthread -lnsl -lsocket -ldoor -lresolv /usr/local/lib/libol.a -lsocket -lnsl -lxnet Undefined first referenced symbol in file yywrap cfg-lex.o ld: fatal: Symbol referencing errors. No output written to syslog-ng collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `syslog-ng' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /install/syslog-ng/syslog-ng-1.6.0rc4/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Has anyone ever compiled on Solaris 9 - gcc 3.3. Thanks in advance for every hint. kr

2 1

Configuration file problem
by Laurent Mesuré 18 Jan '04

18 Jan '04

Hi, i've using this in my suslog-ng.conf file: destination d_msgs { file("/var/log/messages" template("$FULLDATE $HOST $FACILITY.$PRIORITY $MSG\n")); }; put syslog-ng give a parse error on the template part. why does it? i can t find any reason :(( can someone help me? Laurent

2 1

syslog-ng 1.6.1 released
by Balazs Scheidler 18 Jan '04

18 Jan '04

Hi, I have released syslog-ng 1.6.1 with the following NEWS entry: News for the 1.6.1 release Fri, 9 Jan 2004 10:27:38 +0100 * added a new macro named "PRI" which inserts the decimal value of the message priority (pri + level value combined) * fixed a problem in PIX timestamp parsing which inserted an unnecessary NUL character to the message Otherwise it is equivalent to 1.6.0rc4. I have also opened the 1.7.x development branch, even though I want to put this implementation of syslog-ng into maintenance mode. This means that the next stable release of syslog-ng will probably be based on my 1.9.x codebase. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

4 4

syslog-ng-1.6.1 make error.
by Andrews, Glenn J (Glenn) 18 Jan '04

18 Jan '04

I have install libol 0.3.12 and I am trying to install syslog-ng-1.6.1. The libol install ok. The syslog-ng "./configured" ok but when I try to make I get this error... cd /tmp/syslog-ng-1.6.1 && autoheader WARNING: Using auxiliary files such as `acconfig.h', `config.h.bot' WARNING: and `config.h.top', to define templates for `config.h.in' WARNING: is deprecated and discouraged. WARNING: Using the third argument of `AC_DEFINE' and WARNING: `AC_DEFINE_UNQUOTED' allows to define a template without WARNING: `acconfig.h': WARNING: AC_DEFINE([NEED_MAIN], 1, WARNING: [Define if a function `main' is needed.]) WARNING: More sophisticated templates can also be produced, see the WARNING: documentation. autom4te: need GNU m4 1.4 or later: /usr/ccs/bin/m4 autoheader: /usr/local/bin/autom4te failed with exit status: 1 *** Error code 1 make: Fatal error: Command failed for target `/tmp/syslog-ng-1.6.1/src/stamp-h.in' Current working directory /tmp/syslog-ng-1.6.1/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' I have m4 1.4 in my path. Is there something I am missing ? Glenn Andrews Data / Voice Networking Services 1 Robbins Road, Westford, MA 01886 gjandrews(a)lucent.com << mailto:gjandrews@lucent.com <mailto:gjandrews@lucent.com> >>

2 1

syslog-ng hanging
by david＠reno2.com 17 Jan '04

17 Jan '04

I have noticed that syslog-ng has been hanging on my 2.6.0 kernel gentoo host. I saw in a previous post that strace was requested, so here is some info: cindy etc # ps -ef |grep syslog-ng root 3381 1 0 15:36 ? 00:00:00 /usr/sbin/syslog-ng root 11416 9238 0 20:34 pts/1 00:00:00 grep syslog-ng cindy etc # cindy etc # strace -f -v -i -t -p 3381 Process 3381 attached - interrupt to quit 20:34:39 [4011e878] read(3, <unfinished ...> Process 3381 detached cindy etc # (The above unfinished part happens after I CTRL-C) Using following version of syslog-ng: [ebuild R ] app-admin/syslog-ng-1.6.0_rc3-r1 I will leave the system in this state until tomorrow morning (Mon, Dec 29, 7AM PST) in case any further diagnostic info is requested by then. I appreciate any help that you can give, Regards, David

2 1

syslog-ng unstable???
by Alexander von Hedenstroem 17 Jan '04

17 Jan '04

Hi, I like the concept of syslog-ng and so I decided to install it. I run a Debian stable (woody), and the version that comes with it is 1.5.15-1.1. I didn't change much on its configuration files, merely adding the udp logging source. That's all, honestly. And it worked pretty stable for a couple of weeks. Some day, I noticed that the server load was constantly around 80% because of rpc.statd and another process. I was wondering why, until I noticed that syslog-ng was not running! So I restarted it, and the load was gone. Why could it happen that syslog-ng terminates? Thanks, _ + mail: hedenstroem(a)pyromedia.de ( ) ASCII Ribbon Campaign + ICQ: #21622350 X - against HTML mail / \ - against MS attachments

2 1

error "Cannot assign requested address"
by Matthew Bassili 17 Jan '04

17 Jan '04

List members, I am trying to setup syslog-ng (Red Hat9, syslog build 1.6.0rc4) with the following syslog-ng.conf file: ############################################################### # First, set some global options # options { keep_hostname(yes); long_hostnames(off); sync(0); log_fifo_size(1024); log_msg_size(8192); }; ############################################################### # # source local { unix-dgram("/dev/log"); internal(); pipe("/proc/kmsg" log_prefix("kernel: ")); }; #source nocpix # { udp(ip("172.31.30.2") port(514)); # }; source nocpix-out { udp(ip("147.76.127.44") port(514)); }; #source mb2-pix # { udp(ip("172.18.1.6") port(514)); # }; source other { udp(); }; # # ############################################################### # # destination local { file("/var/log/syslog-ng/local/local.$YEAR.$MONTH.$DAY"); }; destination other { file("/var/log/syslog-ng/other/other.$YEAR.$MONTH.$DAY"); }; destination nocpix { file("/var/log/syslog-ng/nocpix/nocpix.$YEAR.$MONTH.$DAY"); }; #destination mb2 { file("/var/log/syslog-ng/mb2/mb2.$YEAR.$MONTH.$DAY"); }; # # ############################################################### # # filter f_auth { facility(auth, authpriv); }; filter f_authpriv { facility(authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_messages { facility(daemon, kern, user); }; filter f_news { facility(news); }; filter f_spooler { facility(uucp,news) and level(crit); }; filter f_syslog { not facility(auth, authpriv) and not facility(mail); }; filter f_user { facility(user); }; # # ############################################################### # # log { source(local); destination(local);}; #log { source(nocpix); destination(nocpix);}; log { source(nocpix-out); destination(nocpix);}; #log { source(mb2-pix); destination(mb2);}; log { source(other); destination(other);}; & I get the following error message on startup: "Starting syslog-ng: io.c: bind_inet_socket() bind failed 147.76.127.44:514 Cannot assign requested address" When I comment out the line " source nocpix-out { udp(ip("147.76.127.44") port(514)); };" Everything works fine using udp();, but I really want to separate the sources so I can direct the log files to a different directory. Any help would be GREATLY appreciated. Matthew Bassili Senior Network Engineer NEC Business Solutions P/L 649 Springvale Rd Mulgarve, 3170 AUSTRALIA e-mail: matthew.bassili(a)nec.com.au

2 1