- syslog-ng - lists.balabit.hu

Information request
by Rui Teixeira 22 Sep '03

22 Sep '03

Hi to all, I'm a student finishing a degree in Computer Science (Informatic Engenier) with a final project with the name "XML - based Logging Platform". The main ideia of the project is to convert the current log's into XML so that they can be kept in disk for future use (backup) and inserted in a Database. I know that most of you may think the use of XML may be unnecessary, but i'm thinking in making a standart so that future student's may upgrade my work and use with other system's. The final part of the project will be making a web interface so that an admin may search the log's for specific information sothat he can compare different services log's to find some sort of information. - a quick example is to find someone connected in a network by DHCP ( you only know the mac address and the ip that DHCP released) by crossing their ip with the log generated by the pop3d service. with this you can find the username and associate the machine to a person. This is just a quick example of the possibilities of crossing the information in a quick and easy way. The main reason for me to write to this list is my interest in using Syslog-ng to generate (if possible) my XML format and to send the data to a secure machine where the infrormation will be kept. My biggest questions are: - can i change the syslog-ng code to a academic work - does the team behind syslog-ng intend to make a simmilar system in a near future - and if is it viable to use Syslog-ng to write my XML standard and send it to a secure machine Thanks in advance Rui Teixeira

2 1

Still getting "Assertion `i == nfds' failed." error
by Dennis Skinner 22 Sep '03

22 Sep '03

Still getting this error: syslog-ng: io.c:270: io_iter: Assertion `i == nfds' failed. syslog-ng version 1.6.0rc3 libol 0.3.10 RedHat 9 I only have 3 sources: internal and 2 udp sources (no /proc/kmsg or /dev/log). It runs fine for a short while and then dies with the above error. Sometimes it runs for a minute or so and sometimes for 15-20 mins without a problem before it dies (logging properly from the various servers while it runs). I had setup the local syslogd to pass its messages to syslog-ng via udp. I stopped syslogd (and klogd) and getting same problem. Tried running both using chroot option and not, same thing. Seems to run forever in debug mode. I can see it does garbage collection every now and then. If it tells you anything, this is what it does during gc: io.c: Preparing fd 9 for writing gc_mark: Marking object of class 'syslog_backend' (0) gc_mark: Marking object of class 'syslog_config' (1) gc_mark: Marking object of class 'resource_list' (2) gc_mark: Marking object of class 'io_fd' (3) gc_mark: Marking object of class 'pkt_buffer' (4) gc_mark: Marking object of class 'io_fd' (4) gc_mark: Marking object of class 'pkt_buffer' (5) gc_mark: Marking object of class 'io_fd' (5) gc_mark: Marking object of class 'pkt_buffer' (6) gc_mark: Marking object of class 'io_fd' (6) gc_mark: Marking object of class 'pkt_buffer' (7) gc_mark: Marking object of class 'io_fd' (7) gc_mark: Marking object of class 'pkt_buffer' (8) gc_mark: Marking object of class 'io_fd' (8) gc_mark: Marking object of class 'pkt_buffer' (9) gc_mark: Marking object of class 'io_fd' (9) gc_mark: Marking object of class 'pkt_buffer' (10) gc_mark: Marking object of class 'io_fd' (10) gc_mark: Marking object of class 'pkt_buffer' (11) gc_mark: Marking object of class 'io_fd' (11) gc_mark: Marking object of class 'log_reader' (12) gc_mark: Marking object of class 'afsocket_source_connection' (13) gc_mark: Marking object of class 'afinet_source' (14) gc_mark: Marking object of class 'inet_address_info' (15) gc_mark: Marking object of class 'object_queue' (15) gc_mark: Marking object of class 'log_source_group' (15) gc_mark: Marking object of class 'log_source_group' (16) gc_mark: Marking object of class 'log_source_driver' (17) gc_mark: Marking object of class 'log_center' (17) gc_mark: Marking object of class 'log_connection' (18) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'log_endpoint_info' (19) gc_mark: Marking object of class 'log_dest_group' (20) gc_mark: Marking object of class 'affile_dest' (21) gc_mark: Marking object of class 'affile_dest_writer' (22) gc_mark: Marking object of class 'affile_dest_writer' (23) gc_mark: Marking object of class 'affile_dest_writer' (24) gc_mark: Marking object of class 'affile_dest_writer' (25) gc_mark: Marking object of class 'affile_dest_writer' (26) gc_mark: Marking object of class 'affile_dest_writer' (27) gc_mark: Marking object of class 'affile_dest_writer' (28) gc_mark: Marking object of class 'affile_dest_writer' (29) gc_mark: Marking object of class 'log_connection' (19) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'log_source_group' (21) gc_mark: Marking object of class 'afinet_source' (22) gc_mark: Marking object of class 'inet_address_info' (23) gc_mark: Marking object of class 'object_queue' (23) gc_mark: Marking object of class 'afsocket_source_connection' (24) gc_mark: Marking object of class 'io_fd' (25) gc_mark: Marking object of class 'log_reader' (26) gc_mark: Marking object of class 'afsocket_source_close_callback' (26) gc_mark: Marking object of class 'log_endpoint_info' (20) gc_mark: Marking object of class 'log_dest_group' (21) gc_mark: Marking object of class 'affile_dest' (22) gc_mark: Marking object of class 'afsocket_source_close_callback' (12) gc_mark: Marking object of class 'UNKNOWN' (1) gc_mark: Marking object of class 'affile_dest_reaper' (1) gc_mark: Marking object of class 'affile_dest_reaper' (1) gc_mark: Marking object of class 'affile_dest_reaper' (1) gc_mark: Marking object of class 'affile_dest_reaper' (1) gc_mark: Marking object of class 'affile_dest_reaper' (1) gc_mark: Marking object of class 'affile_dest_reaper' (1) gc_mark: Marking object of class 'affile_dest_reaper' (1) gc_mark: Marking object of class 'affile_dest_reaper' (1) io.c: Preparing fd 10 for writing Marking fd 12 for closing. Any other ideas? -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

2 2

RE: [syslog-ng]Feature Request: More flexibility for automatic "l og rotation"
by Hamilton Andrew 22 Sep '03

22 Sep '03

Marc, This has been discussed lots of times over the past couple of years, and while the things you are asking for seem fairly simple they would add to syslog-ng's complexity. That may not seem like a bad thing but keep in mind that for log intensive networks using a central server, every little bit makes a difference. I think for the most part we on this list have agreed that syslog-ng is to be a logger, and for log rotation you would use a different application, that way everyone that uses syslog-ng would be able to rotate their logs as they see fit. I don't know what platform you are working on but there are a lot of good log rotaters out there. Your ideas are sound but IMO syslog-ng needs to be just a logger. Regards, Drew -----Original Message----- From: Marc Haber [mailto:mh+syslog-ng@zugschlus.de] Sent: Monday, September 22, 2003 7:26 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Feature Request: More flexibility for automatic "log rotation" Hi, I am pretty new to this list. Pardon me if this has been discussed recently, but I'd like to hear the opinion of other syslog-ng users and the author. I am responsible for a number of hosts that use aide as a file system based intrusion detection system. Using aide is quite incompatible with the conservative way of rotating logs since all rotated files change their names on each rotation when logrotate is used (moving foo.n.gz to foo.n+1.gz, compressing foo.1 to foo.2.gz, moving foo to foo.1 and creating a new foo). In this place, syslog-ng's ability to expand log file names and thus directly log to files like syslog.20030911 comes in quite handy. However, some of our hosts generate very small log files, and having one log file per day would greatly increase the number of files. Hence, these hosts currently have their logrotate configured to rotate the log file when it exceeds the size of 6 MB. I'd like to have this behavior natively in syslog-ng. The following proposed changes to the file() driver will allow me to solve my problems, but they're pretty radical since they change some of the file() driver's fundamental semantics while preserving backwards compatibility. A state file is used, which can be regarded as ugly. Another possibility would be to leave file() as it is and to create a new destination driver that could probably be called stateful_file(). I am proposing to introduce the following new options for the file destination driver: Name Type Description state_file() string Set the path to the state file for this file() instance create_new_size() number After exceeding the size given here, create new file create_new_freq() time Create new file each <time> seconds create_new_time() string Create new file on a time matching the expression If state_file() is empty, nothing changes. This preserves backwards compatibility of the file() driver. If state_file() is not empty, its argument is expanded for each incoming message and the result taken as the path to a file containing the path to the real log file. After obtaining the path to the real log file, its size and age are checked. If one of the criteria for new file creation is matched, the old file is closed, and a new log file created by expanding the positional parameter to the file() driver. The new file path is written to the state file, replacing the old path. That way, the positional parameter to the file() driver, the name of the log file, is only expanded when a new file should be created instead of with each message. The process of expanding a file name on each message is moved to the state file. Having a state file makes it easier to continue where we left off after syslog-ng was restarted, and it makes it easy for a gzipping cronjob to determine if a non-compressed file in the log directory is still written to by syslog-ng or if it can be safely compressed. I am currently inclined to leave it to the local administrator to specify a log file name mask that will not make new files clash with old ones, but some algorithms to resolve clashes could be implemented as well. For example, a Macro CLASHNUM could be implemented which is guaranteed by syslog-ng to have a value that will make the generated file name unique. That Macro should be expanded last after all other expansions have been done since we need to have the other parts of the file name fixed before we can determine clash or non-clash. While we're at it, I'd appreciate a link() option that specifies a file name that the current log is always linked to. This makes it easier to satisfy processes that want to read from the current syslog by being able to give them a static file name even if the "real" log file has a dynamic name like syslog.yyyymmdd. What do you think about this change? Thank you very much for sharing your opinion. Greetings Marc -- ---------------------------------------------------------------------------- - Marc Haber | "I don't trust Computers. They | Mailadresse im Header Karlsruhe, Germany | lose things." Winona Ryder | Fon: *49 721 966 32 15 Nordisch by Nature | How to make an American Quilt | Fax: *49 721 966 31 29 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

bug report: unparsable UDP syslog message
by Thomas Morin 22 Sep '03

22 Sep '03

Hi, First of all I'd like to say I'm impressed by syslog-ng. I think this is a great software: powerful, configurable and elegant. Thanks for making it free software ! That said, I hope a little bug report can improve the thing.. :) Context: I'm using a syslog plugin written for the log4j package (java logging) to send syslog messages to a central log host (syslog-ng 1.6.0rc3). There is one case where some messages are not properly read by syslog-ng, and which trigger "unparsable log message" errors, though they seem to be properly formed syslog messages. The precise packets triggering this case [tcpdump and ethereal helped me a lot here] are UDP syslog packets which are not terminated by a NULL byte, but which contain one or many NEWLINE bytes inside the message, and after some of those NEWLINES we find a '<' character (actually because log4j is used to dump some xml formatted data) : <xx>javaProgram: here is the dump:\n<xml stuff>\n<foo/></xml> The same UDP datagram with a NULL byte in the end doesn't trigger the "unparseable log message" error. The code in src/sources.c (lines 112-120) seems to use the first newline char as the end of line if it doesn't find a '\0', even if this newline char is not the end of our packet. This makes the < of '<xml' be seen as the start of a syslog message, and syslog-ng then tries to interpret '<xml stuff>' as a syslog standard prefix, which of course fails, so we got this "unparseable log message" error. At least, that's what I would concluded, but I'm not C expert, nor very knowledgeable about syslog-ng. If I read the RFC well, not terminating a syslog message by a NULL byte is fine, so I would say this is a syslog-ng bug. I hope the information provided can help you correct this bug. Cheers, -Thomas PS: this report was already sent a few days ago, but I wasn't subscribed at the time, and the mail was moderated/filtered, and hasn't reached the list yet... -- == Thomas Morin == PGP Id:8CEA233D Key FP:503BF6CFD3AE8719377B832A02FB94E08CEA233D --

1 1

Feature Request: More flexibility for automatic "log rotation"
by Marc Haber 22 Sep '03

22 Sep '03

Hi, I am pretty new to this list. Pardon me if this has been discussed recently, but I'd like to hear the opinion of other syslog-ng users and the author. I am responsible for a number of hosts that use aide as a file system based intrusion detection system. Using aide is quite incompatible with the conservative way of rotating logs since all rotated files change their names on each rotation when logrotate is used (moving foo.n.gz to foo.n+1.gz, compressing foo.1 to foo.2.gz, moving foo to foo.1 and creating a new foo). In this place, syslog-ng's ability to expand log file names and thus directly log to files like syslog.20030911 comes in quite handy. However, some of our hosts generate very small log files, and having one log file per day would greatly increase the number of files. Hence, these hosts currently have their logrotate configured to rotate the log file when it exceeds the size of 6 MB. I'd like to have this behavior natively in syslog-ng. The following proposed changes to the file() driver will allow me to solve my problems, but they're pretty radical since they change some of the file() driver's fundamental semantics while preserving backwards compatibility. A state file is used, which can be regarded as ugly. Another possibility would be to leave file() as it is and to create a new destination driver that could probably be called stateful_file(). I am proposing to introduce the following new options for the file destination driver: Name Type Description state_file() string Set the path to the state file for this file() instance create_new_size() number After exceeding the size given here, create new file create_new_freq() time Create new file each <time> seconds create_new_time() string Create new file on a time matching the expression If state_file() is empty, nothing changes. This preserves backwards compatibility of the file() driver. If state_file() is not empty, its argument is expanded for each incoming message and the result taken as the path to a file containing the path to the real log file. After obtaining the path to the real log file, its size and age are checked. If one of the criteria for new file creation is matched, the old file is closed, and a new log file created by expanding the positional parameter to the file() driver. The new file path is written to the state file, replacing the old path. That way, the positional parameter to the file() driver, the name of the log file, is only expanded when a new file should be created instead of with each message. The process of expanding a file name on each message is moved to the state file. Having a state file makes it easier to continue where we left off after syslog-ng was restarted, and it makes it easy for a gzipping cronjob to determine if a non-compressed file in the log directory is still written to by syslog-ng or if it can be safely compressed. I am currently inclined to leave it to the local administrator to specify a log file name mask that will not make new files clash with old ones, but some algorithms to resolve clashes could be implemented as well. For example, a Macro CLASHNUM could be implemented which is guaranteed by syslog-ng to have a value that will make the generated file name unique. That Macro should be expanded last after all other expansions have been done since we need to have the other parts of the file name fixed before we can determine clash or non-clash. While we're at it, I'd appreciate a link() option that specifies a file name that the current log is always linked to. This makes it easier to satisfy processes that want to read from the current syslog by being able to give them a static file name even if the "real" log file has a dynamic name like syslog.yyyymmdd. What do you think about this change? Thank you very much for sharing your opinion. Greetings Marc -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Karlsruhe, Germany | lose things." Winona Ryder | Fon: *49 721 966 32 15 Nordisch by Nature | How to make an American Quilt | Fax: *49 721 966 31 29

1 0

Network Intelligence
by Gianpiero Porchia 19 Sep '03

19 Sep '03

Hi, I'm going to evaluate a Network Intelligence solutions, for log aggregation purposes. What do you think about their system (Envision)? I know that the system is Windows based, so to be more secure I would like to use a syslog-ng server as log relayer, and then send the logs to Envision. What do you think about that? Thanks in advance. - gian _____ Ing. Gianpiero Porchia Security Engineer ATS - Advanced Telecom Systems Designing, Testing, Managing Network Quality Via Salgari, 17 - 41100 Modena - ITALY Tel +39 059 821332 Fax +39 059 821492 Cel +39 335 330413 E-mail: gianpiero.porchia(a)atsweb.it messenger.msn.com: http://messenger.msn.com/, gianpiero.porchia(a)atsweb.it Web site: http://www.atsweb.it PGP Key ID: 0xCAE064A4 (pgpkeys.mit.edu:11371) Fingerprint: 080D AD88 C18A FCA3 91BC 0DF2 F05F 7489 CAE0 64A4

1 0

Year in the log
by Zhou, Tao (Tao) 18 Sep '03

18 Sep '03

Is there a way for syslog-ng to include year in a logged message? For example, Sep 17 2003 20:00:00 ... Thanks. Tao Zhou

2 1

bug report: unparsable UDP syslog message
by Thomas Morin 18 Sep '03

18 Sep '03

Hi, First of all I'd like to say I'm impressed by syslog-ng. I think this is a great software: powerful, configurable and elegant. Thanks for making it free software ! That said, I hope a little bug report can improve the thing.. :) Context: I'm using a syslog plugin written for the log4j package (java logging) to send syslog messages to a central log host (syslog-ng 1.6.0rc3). There is one case where some messages are not properly read by syslog-ng, and which trigger "unparsable log message" errors, though they seem to be properly formed syslog messages. The precise packets triggering this case [tcpdump and ethereal helped me a lot here] are UDP syslog packets which are not terminated by a NULL byte, but which contain one or many NEWLINE bytes inside the message, and after some of those NEWLINES we find a '<' character (actually because log4j is used to dump some xml formatted data) : <xx>javaProgram: here is the dump:\n<xml stuff>\n<foo/></xml> The same UDP datagram with a NULL byte in the end doesn't trigger the "unparseable log message" error. The code in src/sources.c (lines 112-120) seems to use the first newline char as the end of line if it doesn't find a '\0', even if this newline char is not the end of our packet. This makes the < of '<xml' be seen as the start of a syslog message, and syslog-ng then tries to interpret '<xml stuff>' as a syslog standard prefix, which of course fails, so we got this "unparseable log message" error. At least, that's what I would concluded, but I'm not C expert, nor very knowledgeable about syslog-ng. If I read the RFC well, not terminating a syslog message by a NULL byte is fine, so I would say this is a syslog-ng bug. I hope the information provided can help you correct this bug. Cheers, -Thomas PS: please Cc me any answer since I'm not subscribed to this mailing list. -- == Thomas Morin == PGP Id:8CEA233D Key FP:503BF6CFD3AE8719377B832A02FB94E08CEA233D --

1 0

RE: [syslog-ng]New user of syslog-ng..problems with installation
by Christoph.Eckart＠COMPUTACENTER.COM 17 Sep '03

17 Sep '03

I did it - thx Best regards Christoph Eckart

1 0

RE: [syslog-ng]New user of syslog-ng..problems with installation
by Christoph.Eckart＠COMPUTACENTER.COM 17 Sep '03

17 Sep '03

It's Red Hat 9 and i will get the following output: First i type "./configure && make && make install" and get something like that: loading cache ./config.cache checking for a BSD compatible install... (cached) /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... (cached) yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... yes checking for gcc... (cached) gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ANSI C... (cached) none needed checking for bison... (cached) bison -y checking how to run the C preprocessor... (cached) gcc -E checking for flex... (cached) flex checking for flex... (cached) flex checking for yywrap in -lfl... (cached) yes checking lex output file root... (cached) lex.yy checking whether yytext is a pointer... (cached) yes checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... (cached) yes checking for malloc.h... (cached) yes checking for unistd.h... (cached) yes checking for door.h... (cached) no checking for stropts.h... (cached) yes checking for sys/strlog.h... (cached) no checking for stdarg.h... (cached) yes checking for sys/klog.h... (cached) yes checking for arpa/nameser.h... (cached) yes checking for tcpd.h... (cached) yes checking for working const... (cached) yes checking whether time.h and sys/time.h may both be included... (cached) yes checking for modern utmp... (cached) yes checking whether to compile klogctl... yes checking size of short... (cached) 2 checking size of int... (cached) 4 checking size of long... (cached) 4 checking for I_CONSLOG... (cached) no checking for O_LARGEFILE... (cached) yes checking for res_init in <resolv.h>... (cached) yes checking for working alloca.h... (cached) yes checking for alloca... (cached) yes checking for vprintf... (cached) yes checking for res_init in -lresolv... (cached) no checking for __res_init in -lresolv... (cached) yes checking for door_create in -ldoor... (cached) no checking for socket in -lsocket... (cached) no checking for gethostbyname in -lnsl... (cached) yes checking for select... (cached) yes checking for snprintf... (cached) yes checking for vsnprintf... (cached) yes checking for strerror... (cached) yes checking for inet_aton... (cached) yes checking for strncpy... (cached) yes checking for getutent... (cached) yes checking for getopt_long... (cached) yes checking for strcasecmp... (cached) yes checking for strptime... (cached) yes checking for TCP wrapper library... (cached) -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking libol version >= 0.3.9... which: no libol-config in (/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin) ./configure: line 1: libol-config: command not found ./configure: line 1: libol-config: command not found ./configure: line 1: libol-config: command not found ./configure: line 3084: test: : integer expression expected ok creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating syslog-ng.spec creating src/config.h src/config.h is unchanged Making all in src make[1]: Entering directory `/usr/local/syslog-ng-1.6.0rc3/src' make all-recursive make[2]: Entering directory `/usr/local/syslog-ng-1.6.0rc3/src' Making all in . make[3]: Entering directory `/usr/local/syslog-ng-1.6.0rc3/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/syslog-ng-1.6.0rc3/src -I. -g -O2 -Wall -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:39: parse error before "UINT32" log.h:39: warning: no semicolon at end of struct or union log.h:43: parse error before "pri" log.h:43: warning: type defaults to `int' in declaration of `pri' log.h:43: warning: data definition has no type or storage class log.h:44: parse error before "flags" log.h:44: warning: type defaults to `int' in declaration of `flags' log.h:44: warning: data definition has no type or storage class log.h:51: parse error before '}' token In file included from log.h:54, from sources.h:32, from cfgfile.h:29, from main.c:27: log.h.x:4: field `super' has incomplete type log.h.x:9: confused by earlier errors, bailing out make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/syslog-ng-1.6.0rc3/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/syslog-ng-1.6.0rc3/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/syslog-ng-1.6.0rc3/src' make: *** [all-recursive] Error 1 After that i type "./configure" and the messages i will get is: loading cache ./config.cache checking for a BSD compatible install... (cached) /usr/bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... (cached) yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking whether build environment is sane... yes checking for gcc... (cached) gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ANSI C... (cached) none needed checking for bison... (cached) bison -y checking how to run the C preprocessor... (cached) gcc -E checking for flex... (cached) flex checking for flex... (cached) flex checking for yywrap in -lfl... (cached) yes checking lex output file root... (cached) lex.yy checking whether yytext is a pointer... (cached) yes checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... (cached) yes checking for malloc.h... (cached) yes checking for unistd.h... (cached) yes checking for door.h... (cached) no checking for stropts.h... (cached) yes checking for sys/strlog.h... (cached) no checking for stdarg.h... (cached) yes checking for sys/klog.h... (cached) yes checking for arpa/nameser.h... (cached) yes checking for tcpd.h... (cached) yes checking for working const... (cached) yes checking whether time.h and sys/time.h may both be included... (cached) yes checking for modern utmp... (cached) yes checking whether to compile klogctl... yes checking size of short... (cached) 2 checking size of int... (cached) 4 checking size of long... (cached) 4 checking for I_CONSLOG... (cached) no checking for O_LARGEFILE... (cached) yes checking for res_init in <resolv.h>... (cached) yes checking for working alloca.h... (cached) yes checking for alloca... (cached) yes checking for vprintf... (cached) yes checking for res_init in -lresolv... (cached) no checking for __res_init in -lresolv... (cached) yes checking for door_create in -ldoor... (cached) no checking for socket in -lsocket... (cached) no checking for gethostbyname in -lnsl... (cached) yes checking for select... (cached) yes checking for snprintf... (cached) yes checking for vsnprintf... (cached) yes checking for strerror... (cached) yes checking for inet_aton... (cached) yes checking for strncpy... (cached) yes checking for getutent... (cached) yes checking for getopt_long... (cached) yes checking for strcasecmp... (cached) yes checking for strptime... (cached) yes checking for TCP wrapper library... (cached) -lwrap checking whether to enable Sun STREAMS support... no checking whether to enable Sun door support... no checking whether to enable TCP wrapper support... no checking libol version >= 0.3.9... which: no libol-config in (/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin) ./configure: line 1: libol-config: command not found ./configure: line 1: libol-config: command not found ./configure: line 1: libol-config: command not found ./configure: line 3084: test: : integer expression expected ok creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating syslog-ng.spec creating src/config.h src/config.h is unchanged And "make" shows me: Making all in src make[1]: Entering directory `/usr/local/syslog-ng-1.6.0rc3/src' make all-recursive make[2]: Entering directory `/usr/local/syslog-ng-1.6.0rc3/src' Making all in . make[3]: Entering directory `/usr/local/syslog-ng-1.6.0rc3/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/syslog-ng-1.6.0rc3/src -I. -g -O2 -Wall -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:39: parse error before "UINT32" log.h:39: warning: no semicolon at end of struct or union log.h:43: parse error before "pri" log.h:43: warning: type defaults to `int' in declaration of `pri' log.h:43: warning: data definition has no type or storage class log.h:44: parse error before "flags" log.h:44: warning: type defaults to `int' in declaration of `flags' log.h:44: warning: data definition has no type or storage class log.h:51: parse error before '}' token In file included from log.h:54, from sources.h:32, from cfgfile.h:29, from main.c:27: log.h.x:4: field `super' has incomplete type log.h.x:9: confused by earlier errors, bailing out make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/usr/local/syslog-ng-1.6.0rc3/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/syslog-ng-1.6.0rc3/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/syslog-ng-1.6.0rc3/src' make: *** [all-recursive] Error 1 It's a closed book for me - sorry! Please help... Best regards Christoph Eckart European Information Management CC CompuNet AG & Co. oHG A part of Computacenter plc Europaring 34-40, 50170 Kerpen, Germany Phone: +49 (0)2273 597-68072, , E-Mail : Christoph.Eckart(a)COMPUTACENTER.COM Visit us on the Internet: http://www.computacenter.com This email is confidential. If you are not the intended recipient, you must not disclose or use the information contained in it. If you have received this mail in error, please tell us immediately by return email and delete the document.

1 0

RE: [syslog-ng]New user of syslog-ng..problems with installation
by Hamilton Andrew 16 Sep '03

16 Sep '03

Christoph, What is your platform? Could you include the make output? You normally don't need scsh unless you are actually changing something in the code. Regards, Drew -----Original Message----- From: Christoph.Eckart(a)COMPUTACENTER.COM [mailto:Christoph.Eckart@COMPUTACENTER.COM] Sent: Tuesday, September 16, 2003 10:55 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]New user of syslog-ng..problems with installation Hello everybody, I am a new user of syslog-ng. I tried a lot to install the package however kept getting warnings saying "nothing to be done" "leaving directory".I also downloaded the compatible version of libol and also scsh. I found a similar problem with someone else on the mailing list and reading the answer , I downloaded scsh. Could anyone please help ?? Thanks a lot, Best regards Christoph Eckart This email is confidential. If you are not the intended recipient, you must not disclose or use the information contained in it. If you have received this mail in error, please tell us immediately by return email and delete the document. _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

New user of syslog-ng..problems with installation
by Christoph.Eckart＠COMPUTACENTER.COM 16 Sep '03

16 Sep '03

Hello everybody, I am a new user of syslog-ng. I tried a lot to install the package however kept getting warnings saying "nothing to be done" "leaving directory".I also downloaded the compatible version of libol and also scsh. I found a similar problem with someone else on the mailing list and reading the answer , I downloaded scsh. Could anyone please help ?? Thanks a lot, Best regards Christoph Eckart This email is confidential. If you are not the intended recipient, you must not disclose or use the information contained in it. If you have received this mail in error, please tell us immediately by return email and delete the document.

1 0

Failed Assertion Error
by Dennis Skinner 11 Sep '03

11 Sep '03

Hello all, I found reference to this error for people using syslog-ng 1.4.x, but looking through the list archives, I don't see any reference to it recently. I start syslog-ng and after a few minutes, I get something similar to: syslog:io.c:263: failed assertion `i == nfds' I got this with syslog-ng 1.5 and 1.6 rc3. Both are using libol 0.3.10. This is on a base redhat 9 install. Any ideas? -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

3 10

logging woes
by Roger 10 Sep '03

10 Sep '03

I'm using syslog-ng v1.9.1+ and am having some trouble getting the behavior of syslog-ng down. I took this syslog-ng.conf file from a sun - hense the sun-streams reference - and put it on a linux system. With this on the sun, any syslog message from host a.b.c.d would be put in the directory /var/log/syslog-ng/hostname/messages Instead I'm getting all local syslog messages just fine BUT any remote messages aren't getting through. I did a lsof -Pni and syslog-ng IS listening on ports 514 both tcp and udp - I even created the directories and messages file - chmoded the permissions to 777 - all to have no messages dumped to their respective directories. I started syslog-ng up w/ the options '-de' and sniffed the network. Packets are being sent to the daemon and the debug messages look as so log_reader_fd_prepare(); window_size='100' but still no directories creates or information put in files. Any ideas on what I'm doing wrong? options { # use_fqdn (yes); #makes log names to long use_dns (yes); create_dirs (yes); log_fifo_size (1000); }; source local { unix-stream("/dev/log"); }; #source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source udp_net { udp(); }; source tcp_net { tcp(); }; destination all { file("/var/log/syslog-ng/messages" owner (root) group (wheel) perm (0640) ); }; destination network { file("/var/log/syslog-ng/$HOST/messages" owner (root) group (wheel) dir_group (wheel) perm (0640) dir_perm (0750) ); }; log { source(local); destination(all); }; log { source(tcp_net); source(udp_net); destination(network); };

2 1

problem with syslog-ng
by Suchun Wu 08 Sep '03

08 Sep '03

I'm trying to use syslog-ng-1.6.0rc3 on Solaris8. The compilation and installation passed. But when I run the start-up script, I got the following: sun-door support is not compiled in, door=/etc/.syslog_door Error initializing configuration, exiting. Any help is appreciated Suchun

1 0

syslog-ng and IPSEC does anyone have any experiences eit the combination?
by Marc Spitzer 08 Sep '03

08 Sep '03

I am doing some logging infrastructure research and I am looking into syslog-ng and IPSEC, does any experience with this setup? Thanks marc -- NOTICE: If received in error, please destroy and notify sender. Sender does not waive confidentiality or privilege, and use is prohibited.

2 1

Annie Chaiyakul/it/idecpharm/US is out of the office.
by Annie Chaiyakul 08 Sep '03

08 Sep '03

I will be out of the office starting 09/07/2003 and will not return until 09/15/2003. I will out of office until 09/15/03. For immediate issues, please contact the IT help desk and for urgent UNIX specific needs, please contact Emily Yau. Thank you.

1 0

Syslogd and Syslog-ng shareing ports.
by Jay Davis 07 Sep '03

07 Sep '03

I tested quite a bit with syslogd and syslog-ng and am now having a problem. I need syslogd and syslog-ng to share port 514 for inbound syslog messages. When I tested in the lab this was not a problem. Now it seems the only way I can get syslog-ng to listen to the correct IPaddress port pair is to specify that port in the config file. When I do this syslog-ng takes over port 514 and syslogd can not listen anymore :( Here is the config slightly sanitized. Any ideas? This is on solaris 2.8 standard build with all good patches. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); dns_cache_size(1000); dns_cache_expire_failed(5); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; #source s_udpmessages {udp(ip(SPECIFIC IP) port(514));}; source s_udpmessages {udp(ip(0.0.0.0) port(514));}; destination l_mesg { file("/export/epm/syslog-ng/logs/local.log"); }; destination d_mesg { file("/export/epm/syslog-ng/logs/network.log"); }; destination d_acpt { udp("LOWER ENVIRON IP" port(514)); }; filter f_filter5 { facility(local5) and level(emerg,alert,crit,err,warning,notice,info); }; filter f_filter6 { facility(local6) and level(emerg,alert,crit,err,warning,notice,info); }; filter f_filter7 { facility(local7) and level(emerg,alert,crit,err,warning,notice,info); }; log { source(s_udpmessages); filter(f_filter5); destination(d_mesg); }; log { source(s_udpmessages); filter(f_filter6); destination(d_mesg); }; log { source(s_udpmessages); filter(f_filter7); destination(d_mesg); }; log { source(s_udpmessages); filter(f_filter5); destination(d_acpt); }; log { source(s_udpmessages); filter(f_filter6); destination(d_acpt); }; log { source(s_udpmessages); filter(f_filter7); destination(d_acpt); };

1 0

Re: syslog-ng digest, Vol 1 #1034 - 12 msgs (Vacation)
by TIM MOORE 05 Sep '03

05 Sep '03

FYI: I will be out on vacation from 8/28 until 9/8. Please contact the NOC if you need immediate assistance. Thanks, Tim Moore

1 0

AIX Problem with wait.c and getopt.h
by Jose Tomas Garcia 05 Sep '03

05 Sep '03

I obtain tne next error: #> make make all-recursive Making all in src gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/glib-2.0/include -D_GNU_SOURCE -Wall -g -c main.c main.c:39: wait.h: A file or directory in the path name does not exist. main.c:42: getopt.h: A file or directory in the path name does not exist. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 1. Stop. make: 1254-004 The error code from the last command is 2. Stop. ---------------------------------- I'm using: AIX 4.3.3 syslog-ng-1.9.1 flex-2.5.4a-6 gcc-2.9.aix51.020209-1 g++-2.9.aix51.020209-1 bison-1.34-2 automake-1.5-1 m4-1.4-14 autoconf-2.53-1 MySQL-client-3.23.47-3 MySQL-3.23.47-3 What is the problem? Regards, ===== -- Jose Tomas Garcia Caceres Caracas-Venezuela +58(2)910-7719 _________________________________________________________ Do You Yahoo!? La mejor conexión a internet y 25MB extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Problem with syslog-ng and Sys::Syslog
by Jyri Hovila 05 Sep '03

05 Sep '03

Hi! (Jarkko: Sori että häiritsen sinua tällaisella. Ajattelin että saattaisit olla kiinnostunut.) I'm having a weird problem with syslog-ng (version 1.5.24) and Perl module Sys::Syslog. I use Perl 5.8.0 and OpenBSD 3.3. When logging a timestamp using Sys::Syslog, it gets corrupted: This: syslog('local3|info',"TESTING - 12:34:56"); Turns into this: Sep 5 23:49:12 my.server.com root: TESTING - 12: 34:56 Notice the extra space between "12:" and "34". The problem does *not* occur if I do ``logger -p local3.info "TESTING - 12:34:56"''. I don't know if the problem is actually within syslog-ng or Sys::Syslog. Any ideas what could be wrong and how it could be fixed? Thanks! =) - Jyri

2 1

exit matching rules after first match
by Fanselow, William 05 Sep '03

05 Sep '03

Is there any way to configure syslog-ng to exit the matching rules upon it's first match, much as most firewalls do (it appears that all matching rules are checked even after a match has been made). This would make my config file much simpler and presumably ease processing resources. If this feature doesn't currently exist, wouldn't it be a cool addition to future releases! ------------------------ William Fanselow Level(3) Communications 720.888.8363 ------------------------

1 0

RE: [syslog-ng]DNS Problem?
by Glasser, Rob 03 Sep '03

03 Sep '03

Actually all systems are using Veritas Volume Manager to mirror the disk. Rob Glasser desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net -----Original Message----- From: nate [mailto:nate@campin.net] Sent: Tuesday, September 02, 2003 4:16 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]DNS Problem? On Tue, Sep 02, 2003 at 03:45:46PM -0700, Glasser, Rob wrote: > Wow, old thread of mine. > > It appears to be disk/load related on the syslog server itself. These > messages only appear in the middle of the night when a find job runs > on the directories and files syslog-ng writes to and deletes old files > (syslog-ng writes to files with a datestamp in the filename). When I > don't run this script I don't have any problems. Funny thing is this > happens on my boxes that are Netra 1125's, dual 400Mhz procs, 18GB > 10000 RPM disks, but doesn't happen on my boxes that are Ultra 1's, > single 84Mhz prco, 9GB 7200 RPM disks. Go figure. We're moving this > stuff onto new hardware on a SAN so hopefully the problems will go > away then. Wild guess, are you using disksuite to mirror/manage those fast disks? That'll slow things way the hell down and take up all your CPU time when funning find. -- Nate "If builders built buildings they way computer programmers write programs, the first woodpecker that came along would have destroyed all civilization." - Weinberg's Law _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]DNS Problem?
by Glasser, Rob 03 Sep '03

03 Sep '03

Wow, old thread of mine. It appears to be disk/load related on the syslog server itself. These messages only appear in the middle of the night when a find job runs on the directories and files syslog-ng writes to and deletes old files (syslog-ng writes to files with a datestamp in the filename). When I don't run this script I don't have any problems. Funny thing is this happens on my boxes that are Netra 1125's, dual 400Mhz procs, 18GB 10000 RPM disks, but doesn't happen on my boxes that are Ultra 1's, single 84Mhz prco, 9GB 7200 RPM disks. Go figure. We're moving this stuff onto new hardware on a SAN so hopefully the problems will go away then. Rob Glasser -----Original Message----- From: Unger, Christian [mailto:C.unger@st-ag.de] Sent: Tuesday, June 10, 2003 11:33 PM To: syslog-ng(a)lists.balabit.hu Subject: AW: [syslog-ng]DNS Problem? May you using, Windows 2000 ADS integraded DNS Servers. Then you should look into you logfiles of the Windows box. The 2000 DNS Server dies some time on havy load. MS knows that problem and so the DNS kommt with a autorestart funktion. But you can get a dns time out during the restart. Or your ADS is in combination with Exchange 2000, so the DNS (DC Server) has some time havy load during the LDAP querys from Exchange. The DNS Respons now needs extremly long. If you have this you should need 3 DS in the primary Exchange 2000 Site and split the Exchange querys over the tree global catalog Server. Thas my 2000 knowlage ;) I hope it helps someone. -----Ursprüngliche Nachricht----- Von: Glasser, Rob [mailto:rob.glasser@attws.com] Gesendet: Mittwoch, 11. Juni 2003 00:50 An: syslog-ng(a)lists.balabit.hu Betreff: RE: [syslog-ng]DNS Problem? These are internal systems located in the same datacenter although not necessarily on the same network. reverse lookups work, in fact for any system that has a problem, it's usually only one message out of hundreds for the day that has the problem, all other messages from those systems resolve fine. Rob Glasser desk (425)288-2562; cell (206)915-4327 rob.glasser(a)attws.com / 2069154327(a)mobile.att.net -----Original Message----- From: Nicholas Bernstein [mailto:nick@docmagic.com] Sent: Tuesday, June 10, 2003 3:47 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]DNS Problem? First off, what hosts are they failing to resolve? If they are hosts from somewhere out on the internet, they might not have an in-addr.arpa address associated with the ip, and may not be reverse lookup-able. Have you tried to verify that the systems can look up the ip? E.G. 'host a.b.c.d '? On Tue, 2003-06-10 at 15:40, Glasser, Rob wrote: > I'm having some name lookup weirdness and not sure of the cause. > Thought I'd post the scenario to the group before I start tweaking my > configuration to see if it can be fixed. > > First off, I'm running syslog-ng 1.6.0rc3, and on the systems I'm > having problems, they are Sun Netra systems, dual procs, 2GB of > memory, running Solaris 8. My options look like this: > > log_fifo_size(2048); > time_reopen(10); > use_fqdn(yes); > keep_hostname(no); > use_dns(yes); > dns_cache(yes); > long_hostnames(off); > > I have 2 servers with this configuration acting as centralized > loghosts for a datacenter. They are identical boxes, running > identical syslog-ng configurations, on the same VLAN as the DNS > servers they point to. > > Both of these boxes will periodically fail to lookup a name? and log > an entry under it's IP address instead of it's fully qualified host > name. There appears to be no pattern what so ever to it, and the log > entries that get logged by IP are different on each syslog-ng server. > The load on these systems is pretty minimal. The number of messages > logged by IP address is averaging about 10 a day out of about 13000 > messages being logged. > > To make things even more interesting, I have a similar setup in > another datacenter, but they are older smaller systems, only Ultra > 1's, single proc, with only 128 MB of memory, running Solaris 2.6, > acting as centralized servers for about 3 times the number of > servers. The syslog-ng version and configuration is identical. On > these systems I can not find any entries logged by IP address, > everything appears to be working fine. > > Any ideas what might be causing this? My gut reaction is to blame it > on the DNS boxes since the problem is only happening in one data > center and not another, but wanted to see if anyone else has already > been down this road first. > > Thanks > > Rob Glasser > AT&T Wireless > UNIX Systems Administrator > -- +---------------------------------------------------------------+ | Nicholas Bernstein | nick(a)docmagic.com | | UNIX Systems Administrator | http://www.docmagic.com | | Document Systems Inc. | | | gpg: F706 8C4E 78FA DDDD 53A0 019F D983 FE28 2002 D1F3 | +---------------------------------------------------------------+ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

2 1

Sending mail to root?
by Florian Lindner 02 Sep '03

02 Sep '03

Hello, I try to define a destination which sends the log entry to root: destination d_mailroot { program("/usr/bin/mail -s '[syslog] Exception detected' root"); }; But this is not working. mail does not notice that it should close stdin and send the mail. I think something like a EOF or at least in single line with a dot. How can I accomplish sending the mail? Thanks, Florian

4 17