- syslog-ng - lists.balabit.hu

Re: [syslog-ng]syslog-ng 1.6.0rc1 available
by EDL.Essed＠belastingdienst.nl 24 Feb '03

24 Feb '03

Hi, I'm having problems building, checking for libol fails. ./configure --with-libol=/home/essee05/logging/src/libol-0.3.9 checking libol version >= 0.3.9... no configure: error: Required libol version not found Looking at configure.in, I see the sed part has changed. Changing it back to the 3 lines from 1.5.26 makes it work again. Next to that the lex part fails to compile, but this might be related, as I get a warning that I don't have autoheader on my system, needed after changing configure.in: flex cfg-lex.l && mv lex.yy.c cfg-lex.c gcc -DHAVE_CONFIG_H -I. -I/home/essee05/logging/src/syslog-ng-1.6.0rc1/src -I. -g -O2 -Wall -I/home/essee05/logging/src/libol-0.3.9/src -D_GNU_SOURCE -c cfg-lex.c cfg-lex.l:83: `KW_FILE_TEMPLATE' undeclared here (not in a function) cfg-lex.l:83: initializer element is not constant cfg-lex.l:83: (near initialization for `keywords[39].kw_token') make: 1254-004 The error code from the last command is 1. Any help appriciated. Esteban. ___________________________________________ Esteban Essed B/CICT, Sector Continuiteit MPS/Midrange WBC-F305 Tel: (055 - 528) 3586 ___________________________________________ wok, n.: Something to thwow at a wabbit. ___________________________________________ ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

2 1

mailing list archives
by Nate Campi 21 Feb '03

21 Feb '03

The list archives at https://lists.balabit.hu/pipermail/syslog-ng/ aren't working anymore. -- Nate Campi http://www.campin.net

1 0

[PATCH] more complete RPMs for RedHat 7.3 and beyond.
by Blaise St-Laurent 21 Feb '03

21 Feb '03

I've attached a spec file that makes building and installing syslog-ng 1.6.0rc1 on Redhat quite a bit easier. Once the rpm files are built, all that is required is a service syslog stop chkconfig --del syslog chkconfig --add syslog-ng service syslog-ng start I've altered the spec file (i also fixed a typo in the source: url) and added the necessary files (/etc/sysconfig/syslog-ng) to be able to use the supplied init script (as found in the contrib directory) Hopefully this can get into the next version so i can stop giving my client a custom build :) If there are any problems, please report them to me. Blaise St-Laurent Senior Security Architect 613-266-4258 ____________________________________________________________________ Okiok Data http://www.okiok.com (450) 681-1681 Solutions de sécurité d'entreprise et d'affaires électroniques Enterprise and e-business security solutions This e-mail message (including attachments, if any) is intended for the use of the individual or entity to which it is addressed and may contain information that is privileged, proprietary, confidential and exempt from disclosure. If you are not the intended recipient, you are notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender and erase this e-mail message immediately. Le présent message électronique (y compris les pièces qui y sont annexées, le cas échéant) s'adresse au destinataire indiqué et peut contenir des renseignements de caractère privé ou confidentiel. Si vous n'êtes pas le destinataire de ce document, nous vous signalons qu'il est strictement interdit de le diffuser, de le distribuer ou de le reproduire. Si ce message vous a été transmis par erreur, veuillez en informer l'expéditeur et le supprimer immédiatement.

1 0

syslog-ng 1.6.0rc1 available
by Balazs Scheidler 20 Feb '03

20 Feb '03

Hi, Let me use this opportunity to also announce our new website and the new features it provides. * Until now both the English and Hungarian contents were available on both www.balabit.com and www.balabit.hu, this has now changed. English content is only available on www.balabit.com, Hungarian is only available at www.balabit.hu. * Daily snapshots are now available in the src-snapshot directory of a given major version. These snapshots are generated from my internal CVS tree, thus patches sent to the mailing list are usually integrated. Snapshots have a version number like 1.6.0rc1+20030220 where '+' separates the current actual version number and the date the snapshot was generated. Snapshots are not tested in any way, so it is possible that they do not compile, however new patches are integrated there first. * Security advisories are put into a single location so both Zorp and syslog-ng related advisories can be found at the same location. And now the more important thing: I have released syslog-ng 1.6.0rc1 which is available at http://www.balabit.com/products/syslog-ng/upgrades.bbq or in Hungarian: http://www.balabit.hu/products/syslog-ng/upgrades.bbq with the following changes: News for the 1.6.0rc1 release Thu, 20 Feb 2003 11:19:52 +0100 * Reconnect if a problem occurs during connection establishment (earlier only ECONNREFUSED was handled) * Fixed the file source to close the file descriptor prior to opening it again during HUP, fixes kernel log reading on BSD systems. * applied a patch by Achim Gsell to add template() functions to all destination drivers -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

writing to /dev/log hungs system
by Elan Ruusamäe 20 Feb '03

20 Feb '03

hi since time to time all applications hung that write to syslog, and i cannot ^C ^Z ^\ them ;( i cannot su to root and kill syslog-ng too. this has happened several times over several machines i've turned off dns lookups, since i guessed dns downtime affects this, but that did not help the problem, when it's arisen, gets solved by some 6 hours i guess the hung arises on high flood to syslog here's some strace too: socket(PF_UNIX, SOCK_DGRAM, 0) = 3 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 connect(3, {sin_family=AF_UNIX, path="/dev/log"}, 16) = -1 EPROTOTYPE (Protocol wrong type for socket) close(3) = 0 socket(PF_UNIX, SOCK_STREAM, 0) = 3 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 connect(3, {sin_family=AF_UNIX, path="/dev/log"}, 16 <HUNGS HERE> i'm using syslog-ng 1.4.17 os is linux, redhat based kernel varies, but mostly 2.4.18 (redhat patches) config options: options { long_hostnames(off); sync(0); use_dns (no); use_fqdn (no); }; source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); }; -- glen

2 1

RE: [syslog-ng]Trouble using syslog-ng on Solaris 8
by Michael Breton 19 Feb '03

19 Feb '03

> -----Original Message----- > From: Robin Brown [mailto:robin_brown@totalcomm.com] > Sent: Wednesday, February 19, 2003 1:36 PM > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng]Trouble using syslog-ng on Solaris 8 > > > Hi, running solaris 8 and syslog-ng 1.5.26. It all seems to > start just > fine, no errors at startup or when running. But none of the logs get > populated and I can see the UDP traffic is still coming in. > Any way to > see if it's simply not matching the host criteria for some reason? > > Below is my config, any help is appreciated: Config looks fine. What verison of libol did you install? There was a bug in a prior version that did the same thing to me. Just upgrade to the latest version of libol and recompile syslog-ng. libol does not need to be installed (Although it can be), but make sure syslog-ng isn't being compiled with the old version of libol. Michael Breton Commtel

2 1

RE: [syslog-ng]Trouble using syslog-ng on Solaris 8
by Hamilton, Andrew 19 Feb '03

19 Feb '03

oops. I should have left out the source(local) on the log line. Drew -----Original Message----- From: Hamilton, Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Wednesday, February 19, 2003 1:43 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]Trouble using syslog-ng on Solaris 8 Your config looks ok. If it is starting ok, make sure you are not still running syslogd. Also, you might try to log everything to a test log file to make sure your host is what you expect in your filters. You can set up something like this: destination all_net { file ("/var/log/net/$HOST.log"); }; log { source(local); source(net); destination(all_net); }; That would at least tell you the hosts that your syslog-ng daemon is seeing. Also you can run syslog-ng with the "-dv" switch to see if syslog-ng is actually catching the traffic. Regards, Drew -----Original Message----- From: Robin Brown [mailto:robin_brown@totalcomm.com] Sent: Wednesday, February 19, 2003 1:36 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Trouble using syslog-ng on Solaris 8 Hi, running solaris 8 and syslog-ng 1.5.26. It all seems to start just fine, no errors at startup or when running. But none of the logs get populated and I can see the UDP traffic is still coming in. Any way to see if it's simply not matching the host criteria for some reason? Below is my config, any help is appreciated: source net { udp(); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door"));internal(); }; filter f_mine { host("router1") or host("router2") or host("router3"); }; filter f_theirs { host("xxx.xxx.xxx.79"); }; filter f_next { host("xxx.xxx.xxx.230") or host ("xxx.xxx.xxx.129"); }; filter f_right { host("xxx.xxx.xxx.14"); }; destination mine { file("/var/log/mine.log"); }; destination theirs { file("/var/log/theirs.log"); }; destination next { file("/var/log/next.log"); }; destination right { file("/var/log/right.log"); }; destination all { file("/var/adm/messages"); }; log { source(net); filter(f_mine); destination(mine); }; log { source(net); filter(f_theirs); destination(theirs); }; log { source(net); filter(f_next); destination(next); }; log { source(net); filter(f_right); destination(right); }; log { source(local); destination(all); }; Regards, Robin _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]Trouble using syslog-ng on Solaris 8
by Hamilton, Andrew 19 Feb '03

19 Feb '03

Your config looks ok. If it is starting ok, make sure you are not still running syslogd. Also, you might try to log everything to a test log file to make sure your host is what you expect in your filters. You can set up something like this: destination all_net { file ("/var/log/net/$HOST.log"); }; log { source(local); source(net); destination(all_net); }; That would at least tell you the hosts that your syslog-ng daemon is seeing. Also you can run syslog-ng with the "-dv" switch to see if syslog-ng is actually catching the traffic. Regards, Drew -----Original Message----- From: Robin Brown [mailto:robin_brown@totalcomm.com] Sent: Wednesday, February 19, 2003 1:36 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Trouble using syslog-ng on Solaris 8 Hi, running solaris 8 and syslog-ng 1.5.26. It all seems to start just fine, no errors at startup or when running. But none of the logs get populated and I can see the UDP traffic is still coming in. Any way to see if it's simply not matching the host criteria for some reason? Below is my config, any help is appreciated: source net { udp(); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door"));internal(); }; filter f_mine { host("router1") or host("router2") or host("router3"); }; filter f_theirs { host("xxx.xxx.xxx.79"); }; filter f_next { host("xxx.xxx.xxx.230") or host ("xxx.xxx.xxx.129"); }; filter f_right { host("xxx.xxx.xxx.14"); }; destination mine { file("/var/log/mine.log"); }; destination theirs { file("/var/log/theirs.log"); }; destination next { file("/var/log/next.log"); }; destination right { file("/var/log/right.log"); }; destination all { file("/var/adm/messages"); }; log { source(net); filter(f_mine); destination(mine); }; log { source(net); filter(f_theirs); destination(theirs); }; log { source(net); filter(f_next); destination(next); }; log { source(net); filter(f_right); destination(right); }; log { source(local); destination(all); }; Regards, Robin _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

Trouble using syslog-ng on Solaris 8
by Robin Brown 19 Feb '03

19 Feb '03

Hi, running solaris 8 and syslog-ng 1.5.26. It all seems to start just fine, no errors at startup or when running. But none of the logs get populated and I can see the UDP traffic is still coming in. Any way to see if it's simply not matching the host criteria for some reason? Below is my config, any help is appreciated: source net { udp(); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door"));internal(); }; filter f_mine { host("router1") or host("router2") or host("router3"); }; filter f_theirs { host("xxx.xxx.xxx.79"); }; filter f_next { host("xxx.xxx.xxx.230") or host ("xxx.xxx.xxx.129"); }; filter f_right { host("xxx.xxx.xxx.14"); }; destination mine { file("/var/log/mine.log"); }; destination theirs { file("/var/log/theirs.log"); }; destination next { file("/var/log/next.log"); }; destination right { file("/var/log/right.log"); }; destination all { file("/var/adm/messages"); }; log { source(net); filter(f_mine); destination(mine); }; log { source(net); filter(f_theirs); destination(theirs); }; log { source(net); filter(f_next); destination(next); }; log { source(net); filter(f_right); destination(right); }; log { source(local); destination(all); }; Regards, Robin

1 0

syslog-ng at CeBIT 2003
by Balazs Scheidler 19 Feb '03

19 Feb '03

syslog-ng at CeBIT 2003 CeBIT is one of the largest IT trade shows in Europe and this year it will be a good meeting point where syslog-ng users and developers can meet and discuss the future of this successful open source project. You can find us at stand A15 in Hall 8. Syslog-ng development is currently funded by BalaBit IT Ltd, a successful Hungarian security firm now heading to the international market with its software products, primarily syslog-ng and Zorp. I assume syslog-ng itself does not need to be introduced here. The news about syslog-ng is that syslog-ng as a product will be announced. Zorp is a firewall product primarily targeted at medium to high risk environments. The firewall core has the following important features: * application layer protocol analysis, enforcing 100% RFC compliance for the following protocols: FINGER, FTP, HTTP, IMAP, LDAP, LP, NNTP, PLUG, POP3, SSL/TLS, RADIUS Oracle SQLNET, TELNET, TFTP, WHOIS * flexible decision engine, so both decisions and exception to those can freely be described * modularity so you can attach different proxies together in a way similar to how protocols are assembled together (HTTP within SSL) * strong authentication support * integrated PKI for X.509 key management Zorp Professional is distributed as a complete solution with its own operating system (Zorp OS), management server (ZMS) and management console (ZMC). Both Zorp and syslog-ng is available as free software under the terms of the GNU GPL, though some of the functions are missing or are limited. Our visit to CeBIT is aimed at the introduction of Zorp and syslog-ng to the commercial sector. We are primarily focusing on companies which are able to provide either Zorp or syslog-ng related support and system integration services. Interested parties should contact mailto:info@balabit.com to make appointments during the trade show. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 3

syslog-ng log file rotation based on size
by Nate Campi 18 Feb '03

18 Feb '03

Many of us run syslog-ng on systems with a 2 gig file size limit. An attacker can flood our loghost until logs reach 2 gigs in size, at which point syslog-ng cannot write to the file any further. If you run cfengine on your loghost, you can make it rotate logs based on size: -------------------------------------------------------- disable: loghost:: /var/log/messages size=>2000mb rotate=100 define=syslog_rotated /var/log/syslog size=>2000mb rotate=100 define=syslog_rotated processes: loghost.syslog_rotated:: "syslog-ng" signal=hup shellcommands: loghost.syslog_rotated:: "/bin/echo a log file in /var/log was rotated to avoid the 2 gig file limit on loghost|/usr/bin/mail -s'cfengine did an emergency syslog log rotation on loghost' oncall@example" -------------------------------------------------------- I'm sure there's other out of band mechanisms that could be used (a shell script whipped up in a few minutes could do it, run from cron), but it's important to think about it. Even if you have huge disks, if your OS/filesystem/file utilities can't handle large files you're in trouble. Perhaps down the road syslog-ng could include a feature to help with this. It doesn't eliminate the threat of attackers flooding your logs, but at least it could make every effort to keep from losing logs (until your filesystem fills up or the host's CPU/memory resources get overloaded under the flood, I know this isn't perfect). Even if the host OS can handle huge files, from an administration standpoint it's sometimes best to keep them smaller and deal with them in smaller chunks anyways; especially when you need to rotate logs off a machine to save local disk space. Any hope of such a feature Bazsi? Perhaps in syslog-ng 2? -- Nate Campi http://www.campin.net The porcupine with the sharpest quills gets stuck on a tree more often.

5 11

Re: fdread.h in syslog-ng-1.9.1
by Balazs Scheidler 18 Feb '03

18 Feb '03

On Sun, Feb 16, 2003 at 08:54:17AM -0500, mclinden(a)informed.net wrote: > Greetings! > > The file src/fdread.h seems to be missing from the latest tarball of > syslog-ng-1.9.1 Please try the daily snapshots at http://www.balabit.com/downloads/syslog-ng/1.9/src-snapshot/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

balabit.hu site redesign
by Nate Campi 18 Feb '03

18 Feb '03

The balabit site looks good, but without syslog-ng and libol versions side by side on the dowload page it is hard to know which goes with which. I suggest pairing up the libol and syslog-ng versions like before. We might have a lot of confused people posting to this list. -- Nate Campi http://www.campin.net

2 2

AW: [syslog-ng]versions
by Mischke Martin 17 Feb '03

17 Feb '03

yeah i tried 1.5.26 and it works fine for me as far as i tested. The problem is, i need templates for logging into MySQL DB's directly. AFAIK 1.4.x doesn't support templates. So i can't revert to 1.4.x right?!? -----Ursprüngliche Nachricht----- Von: Balazs Scheidler [mailto:bazsi@balabit.hu] Gesendet: Montag, 17. Februar 2003 14:48 An: syslog-ng(a)lists.balabit.hu Betreff: Re: [syslog-ng]versions On Mon, Feb 17, 2003 at 10:55:29AM +0100, Mischke Martin wrote: > Hi, > I'm new to this list. > I want to install syslog-ng. But I'm confused about all the versions. > Which one are you all using?!? > Stable says: 1.4.17 > But there's already version 1.9. you should use 1.5.26 and revert to 1.4.17 if you have problems. 1.9.x is for developers only. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

versions
by Mischke Martin 17 Feb '03

17 Feb '03

Hi, I'm new to this list. I want to install syslog-ng. But I'm confused about all the versions. Which one are you all using?!? Stable says: 1.4.17 But there's already version 1.9. Thanks in advance. Martin Mischke

2 1

Loggin Server (part 2)
by Iulian Topliceanu 17 Feb '03

17 Feb '03

Hej again, I'm sort of confused... syslogd sends its logs via UDP (right?)... and I've noticed that syslog-ng gets them viat TCP?! (or does it refer just ot the stunnel?) Is there a possibility to combine syslog (on the client machine) with syslog-ng on the logging machine? Am I missing something? Pease help! Iulian Topliceanu

2 1

Loggin Server
by Iulian Topliceanu 17 Feb '03

17 Feb '03

Hej, I've installed syslog-ng-1.4.17 on RedHat 8.0 everything works OK till I try to set it to get logs from other machines which are running RedHat 8.0 too but are using syslogd (and are logging remote) I am using this line(s) on the syslo-ng machine: source src { unix-stream("/dev/log"); internal(); }; source remote { tcp(ip("0.0.0.0") port(514) keep-alive(yes)); }; But it doesn't work! I don't want to use stunnel, what did I set wrong? Syslogd is getting the remote logs, why doesn't syslog-ng? Could anyone send me a conf file? Iulian Topliceanu

1 0

Betr.: Re: Betr.: Re: [syslog-ng]yywrap
by EDL.Essed＠belastingdienst.nl 17 Feb '03

17 Feb '03

I tried it, but still the same problem. But you're right about configure not able to find the flex library (that's the error I see in config.log). I should have written LIBPATH (instead of LIBDIR), that is what is set to /usr/local/lib, where libfl.a is located. But I don't know if that is enough. Actually, that was my question, is LIBPATH enough to set? (obviously not as it doesn't work, it is exported). Thanks, Esteban. ___________________________________________ Esteban Essed B/CICT, Sector Continuiteit MPS/Midrange WBC-F305 Tel: (055 - 528) 3586 ___________________________________________ wok, n.: Something to thwow at a wabbit. ___________________________________________ |---------+--------------------------------> | | "Achim Gsell" | | | <achim(a)cybercity.ch> | | | Verzonden door: | | | syslog-ng-admin@lists| | | .balabit.hu | | | | | | | | | 14-02-2003 19:34 | | | Antwoord a.u.b. aan | | | syslog-ng | | | | |---------+--------------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | Aan: syslog-ng(a)lists.balabit.hu | | cc: | |Onderwerp: Re: Betr.: Re: [syslog-ng]yywrap | >-------------------------------------------------------------------------------------------------------------------------------| On Friday 14 February 2003 09:46, EDL.Essed(a)belastingdienst.nl wrote: > LEXLIB in src/Makefile is set to nothing (empty). Set LEXLIB=-lfl in src/Makefile by hand and try to compile it. If this works, the configure script has a problem in finding the flex library. > Checking output of configure gives me: > > checking for flex... flex > checking for flex... (cached) flex > checking for yywrap in -lfl... no > > Checking config.log, I see libfl.a can not be found. > libfl.a is installed in /usr/local/lib > LIBDIR=/lib:/usr/local/lib > > Any other env variable I should set? I'm not familiar with AIX, but are you shure it's enough to set the env. variable LIBDIR (at least: you should export it)??? Achim _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

1 0

syslog-ng 1.4.17 crash
by Elad Levy 16 Feb '03

16 Feb '03

Hello, I have a few linux servers with syslog-ng 1.4.17 logging to a central syslog-ng 1.4.17 logserver. Whenever I disconnect the client the server crash and vice versa. can anyone verify ? thanks in advance, Elad. -- http://fastmail.fm - The way an email service should be

1 0

Logcheck/LogSentry doesn't work right with syslog-ng! How fix...(thinks all is an emergency)
by seberino＠spawar.navy.mil 15 Feb '03

15 Feb '03

LogCheck aka LogSentry look for strange behavior in log files. I just tried syslog-ng for first time and noticed now LogCheck thinks everything is an emergency. How make them like each other??? Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-0804 Email: seberino(a)spawar.navy.mil _______________________________________

2 3

Betr.: Re: [syslog-ng]yywrap
by EDL.Essed＠belastingdienst.nl 14 Feb '03

14 Feb '03

LEXLIB in src/Makefile is set to nothing (empty). Checking output of configure gives me: checking for flex... flex checking for flex... (cached) flex checking for yywrap in -lfl... no Checking config.log, I see libfl.a can not be found. libfl.a is installed in /usr/local/lib LIBDIR=/lib:/usr/local/lib Any other env variable I should set? Thanks, Esteban Essed. On Friday 14 February 2003 08:21, EDL.Essed(a)belastingdienst.nl wrote: > To compile syslog-ng on AIX I need to add "%option noyywrap" to cfg-lex.l, > otherwise ld complains about "Undefined symbol: .yywrap". > > Is there something I'm missing, as this turns up everytime I try to build a > new source distribution. > I'm using gcc 2.9 and flex 2.5.4 "yywrap()" should be a function in the flex library "libfl.{a,so}". Check whether "LEXLIB" is set to "-lfl" in "src/Makefile" or not. Otherwise check the output of the configure script for the following lines: checking for flex... flex checking for yywrap in -lfl... yes Achim ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

2 1

Betr.: [syslog-ng]??? Parse error reading configuration file, exiting.
by EDL.Essed＠belastingdienst.nl 14 Feb '03

14 Feb '03

internel -> internal ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

2 1

yywrap
by EDL.Essed＠belastingdienst.nl 14 Feb '03

14 Feb '03

Hi, To compile syslog-ng on AIX I need to add "%option noyywrap" to cfg-lex.l, otherwise ld complains about "Undefined symbol: .yywrap". Is there something I'm missing, as this turns up everytime I try to build a new source distribution. I'm using gcc 2.9 and flex 2.5.4 Thanks, Esteban Essed ------------------------------------------------------------------------------ De Belastingdienst gebruikt e-mail niet voor officiele mededelingen. ==============================================================================

2 1

??? Parse error reading configuration file, exiting.
by seberino＠spawar.navy.mil 14 Feb '03

14 Feb '03

Please help... this /etc/syslog-ng/syslog-ng.conf looks fine to me. I cannot find why syslog-ng barfs on it... source src {unix-stream("/dev/log"); pipe("/proc/kmsg"); internel();}; destination dest {file("/var/log/messages");}; log {source(src); destination(dest);}; thanks! Chris -- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-0804 Email: seberino(a)spawar.navy.mil _______________________________________

1 0

Re: [syslog-ng]syslog-ng - crond
by Ted_Rule＠flextech.co.uk 13 Feb '03

13 Feb '03

There is probably another caveat/clarification which should be added here.... On old glibc systems, which don't fix the issue for EITHER unix-dgram or unix-stream sockets, my partial fix has been to ensure keepalive(yes) on /dev/log and use unix-stream sockets instead of syslogd's default unix-dgram. This ensures the problem doesn't occur on a SIGHUP, only on a complete restart of syslog-ng which is fortunately very rare. By reverting to unix-dgram, on old glibc machines, the issue will resurface for both SIGHUP and restart of syslog-ng I believe as syslog-ng closes all unix-dgram on SIGHUP, so any update to FAQ et al needs to make clear that this fix should only be applied on glibc >2.2.? For glibc < 2.2 one probably has to revert to unix-stream and nasty kludges to the boot scripts of various daemons such as sendmail whose parent process never cleans up the "orphaned" /dev/log connection. Ted Achim Gsell <achim(a)cybercity.ch> on 13/02/2003 14:25:44 Please respond to syslog-ng(a)lists.balabit.hu To: syslog-ng(a)lists.balabit.hu cc: (bcc: Ted Rule/160GPS/Flextech/UK) Subject: Re: [syslog-ng]syslog-ng - crond On Thursday 13 February 2003 15:06, Peter Bieringer wrote: > source local { > + unix-stream("/dev/log"); ^??? > + unix-stream("/dev/log" keep-alive(yes) max-connections(512)); > - udp(ip(0.0.0.0) port(514)); > + #udp(ip(0.0.0.0) port(514)); > internal(); > }; On Thursday 13 February 2003 14:38, Balazs Scheidler wrote: > sysklogd uses a unix-dgram source by default, Try: unix-dgram("/dev/log") Achim _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html ************************************************************************************************ This E-mail message, including any attachments, is intended only for the person or entity to which it is addressed, and may contain confidential information. If you are not the intended recipient, any review, retransmission, disclosure, copying, modification or other use of this E-mail message or attachments is strictly forbidden. If you have received this E-mail message in error, please contact the author and delete the message and any attachments from your computer. You are also advised that the views and opinions expressed in this E-mail message and any attachments are the author's own, and may not reflect the views and opinions of FLEXTECH Television Limited. ************************************************************************************************

2 1