- syslog-ng - lists.balabit.hu

No indication of facility/level on AIX 4.3.3 using syslog-ng 1.4. 14
by Gehring, Andrew x66132 23 Apr '02

23 Apr '02

Is there something special I need to define or configure to have syslog-ng on AIX (4.3.3) write the facility/severity as part of the messages? On solaris we saw [facility/severity] written with each messages, but we don't get this on AIX... Did I miss something while configuring/compiling? Thanks, Andrew

3 4

AIX 4.3.3 and pipe problem?
by Gehring, Andrew x66132 23 Apr '02

23 Apr '02

I'm running syslog-ng on AIX 4.3.3 and while it works fine for system log calls, it doesn't seem to connect to a defined pipe and send information to it based on a logger call... below is a test conf file that I'm using. Send a message with logger is shows up in the d_mesg, but not to the d_pipe (Netcool is attached to the pipe. lsof shows the /var/adm/messages file being open, and again not the pipe... source s_sys { unix-dgram ("/dev/log"); internal (); } destination d_mesg { file("/var/adm/messages"); }; destination d_pipe { pipe("/var/adm/mypipe"); }; log { source (s_sys); destination (d_mesg); destination (d_pipe); }; Any one seen this, or something like it? TIA, Andrew

2 1

rotation log for syslog-ng
by J�r�me Tournier 23 Apr '02

23 Apr '02

Hello, i am trying to use syslog-ng. Could anyone brievely explain me how to have rotation log ? I can find any document about that. Is it possible ? Haw can i fixe the size of the files, and how can i specifie the number of files i want ? Thanks -- Jérôme

1 0

Re: Im sorry Im writing direct to you but the list is not working Re: [syslog-ng]filtering with regexp
by Balazs Scheidler 23 Apr '02

23 Apr '02

On Mon, Apr 22, 2002 at 12:02:05PM -0700, mar tin wrote: > Im sorry Im writing direct to you but the list is not > working.. I get all the messages back! > > now I've the lines duplicated: > I have them in auth.log and cron.log! > how can I tell syslog to put them only in cron.log? syslog-ng forwards messages to all matching destinations. you have two options to change this behaviour: * use filters that match only the lines you are interested in * use the flags(fallback) feature of syslog-ng 1.5.x > > --- Balazs Scheidler <bazsi(a)balabit.hu> wrote: > > On Thu, Apr 18, 2002 at 01:06:32PM -0700, mar tin > > wrote: > > > Hello :) > > > When cron runs, it sends the following lines > > > Apr 18 16:50:01 martinII PAM_unix[26181]: (cron) > > > session opened for user smmsp by (uid=0) > > > Apr 18 16:50:01 martinII PAM_unix[26182]: (cron) > > > session opened for user runa by (uid=0) > > > Apr 18 16:50:01 martinII PAM_unix[26183]: (cron) > > > session opened for user runa by (uid=0) > > > Apr 18 16:50:02 martinII PAM_unix[26181]: (cron) > > > session closed for user smmsp > > > Apr 18 16:50:25 martinII PAM_unix[26183]: (cron) > > > session closed for user runa > > > Apr 18 16:50:27 martinII PAM_unix[26182]: (cron) > > > session closed for user runa > > > > > > I want to filter those lines and send them to > > other > > > files, so I did: > > > > > > filter f_cron2{match("(cron) session opened");}; > > > log { source(src); filter(f_cron2); > > > destination(cron);}; > > > > > > but it sends the lines to auth.log! > > > > > > what am I doing wrong? > > > > match() expects an extended regular expression, thus > > '(' and ')' are > > interpreted as special characters. You need to > > escape them via '\', but as > > this is the escape character in the string, you need > > to double the backslash > > like: > > > > match("\$cron\$ session opened") > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C > > 0944 9CFD 804E C82C 8EB1 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > __________________________________________________ > Do You Yahoo!? > Yahoo! Games - play chess, backgammon, pool and more > http://games.yahoo.com/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

program destination prob ?
by Thomas Ackermann 19 Apr '02

19 Apr '02

hy! i'm using syslog-ng to send remote log messages over an stunnel to a log server. everything's running quite fine, besides one little problem i have.. i'm starting the stunnel with program("/usr/sbin/stunnel -r 192.168.3.125:6543 -c"); when the stunnel is killed or quits because of a bad connection, syslog-ng doesn't even bother 'bout trying to restart it. is that a wanted behaviour and, or, is there a way to gat syslog-ng to respawn processes called with program() ? thx, thomas

4 4

Re: [syslog-ng]Different messages being logged
by Michael Renner 19 Apr '02

19 Apr '02

At 15:46 19.04.2002 +0100, you wrote: >log { source(s_sys); filter(f_filter1); destination(d_cons); }; >log { source(s_sys); filter(f_filter2); destination(d_mesg); }; >log { source(s_sys); filter(f_filter3); destination(d_auth); }; >log { source(s_sys); filter(f_filter4); destination(d_mail); }; >log { source(s_sys); filter(f_filter5); destination(d_mlal); }; >log { source(s_sys); filter(f_filter6); destination(d_spol); }; > > >The syslog.conf from my HPUX box has the following line added >*.info;mail.none @central-syslog-server > >I figure its got something to do with filters, but I dont know where to >start. Basically I want everything logged and then I'll start deciding what >to filter out. Maybe there are messages sent on facilities which aren't mentioned in your filters (like local1..7), try putting a "catch-everything-which-hasnt-been-logged-yet" rule somewhere in there. In 1.5.* it's something like log { source(s_sys); destination(leftover); flags(fallback); }; unfortunately i can't remember the syntax for 1.4.* anymore. You should also use something like "*.* @central-syslog-server" on the syslogd's if you really want all messages from the hpux'n. mfg/best regards -- Michael Renner Junior System Engineer Inode Telekommunikationsdienstleistungs GmbH - http://www.inode.at support(a)inode.at, Tel.: 05 9999-0, Fax.: 05 9999-2699

1 0

Different messages being logged
by Tom Horan 19 Apr '02

19 Apr '02

Hi, I'm running syslog-ng 1.4.14 on a RedHat 7 box, using it to log messages from a mixture of 10.20 and 11.0 HP-UX boxes. The HP boxes are using their own syslog here. I've got messages coming in from the hosts fine, but some stuff isnt coming through - ie syslog on the local box has more messages that the log on the central syslog-ng server. In particular is anything coming from vmunix. Here is what my config file looks like, it is taken from a sample config with just the udp added in and the $HOST variable added in for paths. options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (no); }; source s_sys { unix-stream ("/dev/log"); internal(); udp(ip(10.16.6.102) port(51 4)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/syslog/$HOST/messages"); }; destination d_auth { file("/var/syslog/$HOST/secure"); }; destination d_mail { file("/var/syslog/$HOST/maillog"); }; destination d_spol { file("/var/syslog/$HOST/spooler"); }; destination d_boot { file("/var/syslog/$HOST/boot.log"); }; destination d_mlal { usertty("*"); }; filter f_filter1 { facility(kern); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit)); }; log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; The syslog.conf from my HPUX box has the following line added *.info;mail.none @central-syslog-server I figure its got something to do with filters, but I dont know where to start. Basically I want everything logged and then I'll start deciding what to filter out. Can anyone help me out here ? Thanks, Tom ************************************************************************ This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.esatbusiness.com Subscribe to the Esat Business Online Magazine: http://www.esatbusiness.com/news/subscribe.asp Subscribe to REALISE - the online magazine from BT Ignite: http://www.btignite.com/realise ************************************************************************

1 0

unsubscribe
by Chris Brown 19 Apr '02

19 Apr '02

Unsubscribe chris(a)nbs.co.uk

1 0

filtering with regexp
by mar tin 19 Apr '02

19 Apr '02

Hello :) When cron runs, it sends the following lines Apr 18 16:50:01 martinII PAM_unix[26181]: (cron) session opened for user smmsp by (uid=0) Apr 18 16:50:01 martinII PAM_unix[26182]: (cron) session opened for user runa by (uid=0) Apr 18 16:50:01 martinII PAM_unix[26183]: (cron) session opened for user runa by (uid=0) Apr 18 16:50:02 martinII PAM_unix[26181]: (cron) session closed for user smmsp Apr 18 16:50:25 martinII PAM_unix[26183]: (cron) session closed for user runa Apr 18 16:50:27 martinII PAM_unix[26182]: (cron) session closed for user runa I want to filter those lines and send them to other files, so I did: filter f_cron2{match("(cron) session opened");}; log { source(src); filter(f_cron2); destination(cron);}; but it sends the lines to auth.log! what am I doing wrong? __________________________________________________ Do You Yahoo!? Yahoo! Tax Center - online filing with TurboTax http://taxes.yahoo.com/

2 1

Macro $MSG and '\'
by Jerome Peducasse 18 Apr '02

18 Apr '02

Hello, When I use template("$DATE $HOST [$FACILITY.$LEVEL] $PROGRAM $MSG\n"), messages like: Apr 16 16:02:28 xml-indexer1.conso.fr.ke.echo/xml-indexer1-0-0.conso.fr.ke.echo /ke/bin/afp.kelight[29524]: failed to init index '/ke/data/afp/group_by' in enum echo::keret echo::XmlServer::start(const char *):XmlServer.cc:235 become Apr 16 16:17:27 xml-indexer1.conso.fr.ke.echo [local0.err] /ke/bin/afp.kelight /ke/bin/afp.kelight[9294]: failed to init index \'/ke/data/afp/group_by\' in enum echo::keret echo::XmlServer::start(const char *):XmlServer.cc:235 ('/ke/data/afp/group_by' become \'/ke/data/afp/group_by\') Bye. -- Jerome Peducasse

2 2

FW:
by Robert Berlinger 18 Apr '02

18 Apr '02

Hi, Getting the following error sporadically: Apr 18 10:24:41 logserver syslog-ng[27078]: Error accepting AF_UNIX connection, opened connections: 4294967295, max: 100 There certainly isn't that many open connections. Running 1.4.14 on Redhat 7.2. Any pointers would be appreciated.

1 0

Lost of facility/level
by Jerome Peducasse 18 Apr '02

18 Apr '02

Hi, I'm using syslog-ng 1.5.15 and sometimes (probably during message burst), messages lost their facility/level and are logged with user/notice. Message format becomes: Mar 29 11:35:50 w3search3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:427 <130>Mar 29 11:35:50 w3search[19816]: read Context failed on socket=3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:434 instead of: Mar 29 11:32:07 w3search3 w3search[19817]: read Context failed on socket=3 in void echo::AtlasClient::onRead(void *):AtlasClient.cc:434 General log_fifo_size is set to 1000 and is set to 10000 for appropriate filter of this message: destination d_applicatif { file("/ke/logs/ke.log" owner(test) group(test) log_fifo_size(10000) ); }; filter f_applicatif { facility(local0); }; log { source(s_sys); filter(f_applicatif); destination(d_applicatif); destination(d_loghost_applicatif); flags(final); }; Any Idea ? -- Jerome Peducasse

2 15

Problem compiling on Solaris 8 (sparc)
by dcntrnoc＠cmp.com 18 Apr '02

18 Apr '02

Hi all, I'm trying to compile syslog-ng version 1.5.16 with gcc version 3.0.3. Yes, libol 0.3.2 is installed. I am receiving the following error. Any help would be appreciated. . . . gcc -DHAVE_CONFIG_H -I. -I/usr/local/src/syslog-ng/syslog-ng-1.5.16/src -I. -g -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c: In function `stream_read_callback': afstreams.c:148: too few arguments to function `make_log_info' make[3]: *** [afstreams.o] Error 1 make[3]: Leaving directory `/usr/local/src/syslog-ng/syslog-ng-1.5.16/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/syslog-ng/syslog-ng-1.5.16/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/src/syslog-ng/syslog-ng-1.5.16/src' make: *** [all-recursive] Error 1 Thanks in advance, Sharon. __________________________________________________________________________________________ Any views or opinions are solely those of the author and do not necessarily represent those of CMP Media. The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this message please do not read, copy, use or disclose this communication and notify the sender immediately. It should be noted that any review, retransmission, dissemination or other use of, or taking action or reliance upon, this information by persons or entities other than the intended recipient is prohibited. __________________________________________________________________________________________

3 2

RE: [syslog-ng]Installation Error
by Tom Horan 17 Apr '02

17 Apr '02

Did you get libol and installed that first ? It should be on the download page along with syslog-ng. ./thos -----Original Message----- From: Kaan Saldiraner [mailto:kaans@steltor.com] Sent: 17 April 2002 15:19 To: syslog-ng(a)lists.balabit.hu Cc: kaans(a)steltor.com Subject: [syslog-ng]Installation Error Hello Everyone, I just tried to compile syslog-ng on a mandrake 8.2 machine and at make i get these errors.. What do you think? Thanks --------------------------- [root@superfly syslog-ng-1.4.14]# make Making all in src make[1]: Entering directory `/tmp/syslog-ng-1.4.14/src' make all-recursive make[2]: Entering directory `/tmp/syslog-ng-1.4.14/src' Making all in . make[3]: Entering directory `/tmp/syslog-ng-1.4.14/src' gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.4.14/src -I. -O2 -Wall -I/usr /include/libol -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/tmp/syslog-ng-1.4.14/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-1.4.14/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/tmp/syslog-ng-1.4.14/src' make: *** [all-recursive] Error 1 Kaan Saldiraner Steltor Inc. (514)733-8500 x6503 www.steltor.com _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng ************************************************************************ This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. http://www.esatbusiness.com Subscribe to the Esat Business Online Magazine: http://www.esatbusiness.com/news/subscribe.asp Subscribe to REALISE - the online magazine from BT Ignite: http://www.btignite.com/realise ************************************************************************

1 0

Installation Error
by Kaan Saldiraner 17 Apr '02

17 Apr '02

Hello Everyone, I just tried to compile syslog-ng on a mandrake 8.2 machine and at make i get these errors.. What do you think? Thanks --------------------------- [root@superfly syslog-ng-1.4.14]# make Making all in src make[1]: Entering directory `/tmp/syslog-ng-1.4.14/src' make all-recursive make[2]: Entering directory `/tmp/syslog-ng-1.4.14/src' Making all in . make[3]: Entering directory `/tmp/syslog-ng-1.4.14/src' gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.4.14/src -I. -O2 -Wall -I/usr /include/libol -D_GNU_SOURCE -c main.c In file included from main.c:26: syslog-ng.h:31:21: objects.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:30:23: read_line.h: No such file or directory In file included from sources.h:32, from cfgfile.h:29, from main.c:27: log.h:30:16: io.h: No such file or directory In file included from cfgfile.h:29, from main.c:27: sources.h:33:18: list.h: No such file or directory main.c:29:20: format.h: No such file or directory main.c:30:20: werror.h: No such file or directory main.c:31:19: queue.h: No such file or directory make[3]: *** [main.o] Error 1 make[3]: Leaving directory `/tmp/syslog-ng-1.4.14/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/tmp/syslog-ng-1.4.14/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/tmp/syslog-ng-1.4.14/src' make: *** [all-recursive] Error 1 Kaan Saldiraner Steltor Inc. (514)733-8500 x6503 www.steltor.com

1 0

[PATCH] make log_msg_size tunable
by Balazs Scheidler 17 Apr '02

17 Apr '02

Hi, The attached patch makes the maximum length of a log message tunable as a global option. Testers welcome. Usage: options { log_msg_size(8192); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 1

chain_hostnames and template
by Jerome Peducasse 16 Apr '02

16 Apr '02

Hello, How can I use template and keep chain_hostname in log format ? In documentation, I don't see macro allows it. Thx. -- Jerome Peducasse

2 1

Syslog-ng Reliability
by Victor 15 Apr '02

15 Apr '02

Well, I got syslog-ng setup and running. Runs great. I have to say, this is a realy nice way of doing logging. Major kudos to developers. a few questions: 1. How reliable is network server operation of Syslog-ng under heavy load? I am running remote servers using tcp() and anticipate a lot of throughput. Will syslog-ng not drop stuff like syslogd does? 2. log_fifo_size(100) is this in bytes or kbytes or what? Is this a memory buffer before a write is done? 3. I didn't find the documentation in the man page for variables like $YEAR, $MONTH, $HOST, etc. Where is the list of these? 4. Any idea when compress(on) function will be implemented?

2 1

Installing Syslog-NG
by Victor 13 Apr '02

13 Apr '02

Hi, I have a linux system and I want to try to install Syslog-ng to stream apache logs from one box to a central box (since regular syslog is not reliable) How do I install syslog-ng on a new system? It seems to be running syslogd and klogd. Do I just shutdown syslogd only? Or both? Or does syslogd-ng run alongside the two? Could you also post an example of a config file that mimics the /var/log/maillog,kernlog, etc type of logging in a syslog-ng server config setup? Thanks for any help. P.S. Is there perhaps a howto dealing with installation of Syslog-ng on a running system? Thanks

1 0

RE: [syslog-ng]syslog-ng 1.5.16 released
by Clausing, James A (Jim), SOLCM 12 Apr '02

12 Apr '02

It was solaris 8, configure options don't really matter (in my case, I didn't use any, just ./configure), the problem is that going from 1.5.15 to 1.5.16, the make_log_info function now takes 3 arguments rather than 2 and this call only had 2. I'm using gcc-2.95.3 (same problem with 3.0.4). The compiler complained about mismatch in number of arguments. ---Jim -----Original Message----- From: Ed Ravin [mailto:eravin@panix.com] Sent: Friday, April 12, 2002 2:51 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]syslog-ng 1.5.16 released "Clausing, James A (Jim), SOLCM" writes: > > syslog-ng 1.5.16 didn't build for me without the following patch. I'm not > sure what the prefix should be so I just used NULL. And what operating system and platform are you running? What were your arguments to ./configure? > --- syslog-ng-1.5.16/src/afstreams.c Sun Jul 8 17:04:21 2001 > +++ syslog-ng-1.5.16-patched/src/afstreams.c Fri Apr 12 18:09:01 2002 > @@ -145,7 +145,7 @@ > > length = eol - bol; > if (length) { > - li = make_log_info(length, bol); > + li = make_log_info(length, bol, NULL); > li->pri = pri; > HANDLE_LOG(self->pipe, li); > } _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

RE: [syslog-ng]syslog-ng 1.5.16 released
by Clausing, James A (Jim), SOLCM 12 Apr '02

12 Apr '02

syslog-ng 1.5.16 didn't build for me without the following patch. I'm not sure what the prefix should be so I just used NULL. --- syslog-ng-1.5.16/src/afstreams.c Sun Jul 8 17:04:21 2001 +++ syslog-ng-1.5.16-patched/src/afstreams.c Fri Apr 12 18:09:01 2002 @@ -145,7 +145,7 @@ length = eol - bol; if (length) { - li = make_log_info(length, bol); + li = make_log_info(length, bol, NULL); li->pri = pri; HANDLE_LOG(self->pipe, li); } -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Friday, April 12, 2002 6:34 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]syslog-ng 1.5.16 released Hi, I have released syslog-ng 1.5.16 with the following NEWS entry: News for the 1.5.16 release Fri, 12 Apr 2002 09:42:28 +0200 Changes: * added log_prefix support for file sources (for adding 'kernel: ' prefix to messages from /proc/kmsg) * fixed the internal DNS cache, so now it really works * fixed localip() and localport() directives for afinet destinations (they erroneously changed the destination address) * Detect O_LARGEFILE on the system and use it if available * Never close fds 0, 1, 2 and, use /dev/null for 0 and 1, and keep 2 open for messages during reinitialization * Added UNIXTIME, R_UNIXTIME, S_UNIXTIME macros to templates and filenames * Fixed TCP wrapper support. Our webserver is currently down, but as soon as it comes back up, I'll upload this release to the usual place: http://www.balabit.hu/en/downloads/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 2

syslog-ng-1.5.15 with tcp-wrapper support
by Stefan M. Brandl 12 Apr '02

12 Apr '02

Hi, I tried to compile syslog-ng-1.5.15 with tcp-wrapper support but had no success. First I had to patch afinet.c with the patch mentioned in http://lists.balabit.hu/pipermail/syslog-ng/2002-February/002962.html But when compiling I get: make[3]: Entering directory `/root/syslog-ng-1.5.15/src' make_class <afinet.c >afinet.c.xT Warning: use of macro doesn't match definition (syntax-rules '() ((let-and (expr) clause clauses ...) (and expr (let-and clause clauses ...))) ((let-and (name expr) clause clauses ...) (let ((name expr)) (and name (let-and clause clauses ...)))) ((let-and expr) expr)) Error: attempt to call a non-procedure ('syntax-error '(#{Name let-and} ((pair? expr)) (op-matches (match # #)) (arg-matches (match # #)) (append op-matches arg-matches)) '#{Procedure 2489 (unnamed in make-name-generator in names)} '#{Procedure 2486 (unnamed in make-keyword-comparator in names)}) make[3]: *** [afinet.c.x] Error 1 make[3]: Leaving directory `/root/syslog-ng-1.5.15/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/root/syslog-ng-1.5.15/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/root/syslog-ng-1.5.15/src' make: *** [all-recursive] Error 1 Is this a know problem or am I missing something? Regards Stefan

3 2

Re: [syslog-ng]syslog-ng-1.5.15 with tcp-wrapper support
by Stefan M. Brandl 12 Apr '02

12 Apr '02

Ed Ravin eravin(a)panix.com wrote: > This is a bug of some kind in make_class, which comes with the lib-ol > package (and is probably installed in your /usr/local/bin). A kind soul > on the syslog-ng list turned in this patch to fix make_class (you'll > want to edit by hand or apply with "patch -l" since I'm screwing up > the whitespace by posting it this way). > > --- /usr/local/bad/make_class Wed Feb 6 15:59:34 2002 > +++ ./make_class Wed Mar 6 12:10:32 2002 > @@ -19,7 +19,7 @@ > ;; FIXME: Turn this into a scheme48 module > > (define-syntax let-and > - (syntax-rules '() > + (syntax-rules () > ((let-and (expr) clause clauses ...) > (and expr (let-and clause clauses ...))) > ((let-and (name expr) clause clauses ...) Great, this works. Thanks Stefan

1 0

Newbie: System inter-process communication ?
by Jacques.Riopel＠equant.com 11 Apr '02

11 Apr '02

Hi all. Using syslog-ng version 1.4.15. I'm trying to set up a network of machines all running syslog-ng in a testbed. Some machines run Solaris 5.8, others are Sun-Cobalts runing a flavor of Linux. I have successfully compiled when necessary and replaced all the syslogd with syslog-ng on my 4 test machines. Now the hard part is making them all talk to each other, and discovering how to set them to use different ports and TCP vs UDP in some cases. I have the following questions so far: Question 1: Is it possible to specify the upd port to listen on, ie something like "source s_udp { udp (666); };" and then instruct the syslog-ng on the sending machine to use that UDP port as a destination? When I tried the above, I got a parsing error when starting up syslog-ng. My whole test scenario is to have one machine called "A1" at the top level "A", that will listen on port 514 for syslog messages using a TCP connection from machine "B1" at level "B". Machine "B1" is a syslog consolidator, that passes syslog messages to A1 over TCP(514) and receives syslogs from other machines "C1", "C2" on level "C". I want to try to configure machine "C1" to output to machine "B1" using UDP(514), and at the same time have machine "C2" forward its syslogs to machine "B1" using TCP(514). It's possible to have many machines at level "C" all writing to machine "B1"'s port TCP(514), right? For the bonus point, can someone help me with the pertinent syntax for source, destination and log statements for my 4 machines? My job depends on me making this work... 8-) (If someone can replace my generic code below with exact code that will be parsed OK...) Machine A1 (10.5.11.9 - Solaris 5.8) source s_tcp { }; destination d_jnr { usertty("jnriopel"); }; log { source (s_tcp); destination (d_jnr); }; Machine B1 (10.5.10.4 - Linux) source s_tcp { frommachineC2}; source s_udp { frommachineC1}; destination d_tcp { tomachineA1 }; log { source (s_tcp, s_udp); destination (d_tcp); }; Machine C1 (10.5.2.8 - Linux) source src {unix stream }; destination d_udptoB1 { udp (machineB1 }; log { source (src); destination (d_udptoB1); }; Machine C2 (10.5.2.16 - Linux) source src {unix stream }; destination d_TCPtoB1 { tcp (machineB1 }; log { source (src); destination (d_TCPtoB1); }; Question 2: PMI, but I understand from my IP theory that I can send messages to another machine using UDP whether that machine is listening or not and not get errors, whereas is I want to talk using TCP, the machine I am talking to needs to have a listen set up first, ie I need to have syslog-ng running on A1 before I can start it on B1 otherwise B1 will complain about not being able to set up the connection, right? Will messages get lost or queued while waiting for A1 to start listening? Question 3: What is the syntax of the source and destination statements for two machines using syslog-ng and wanting to communicate over TCP port 666, say? (As in my link between A1 and B1 above except for the non-standard port number.) Jacques

2 1

program destination, not respawning programs ?
by Thomas Ackermann 11 Apr '02

11 Apr '02

hy! i'm using syslog-ng to send remote log messages over an stunnel to a log server. everything's running quite fine, besides one little problem i have.. i'm starting the stunnel with program("/usr/sbin/stunnel -r 192.168.3.125:6543 -c"); when the stunnel is killed or quits because of a bad connection, syslog-ng doesn't even bother 'bout trying to restart it. is that a wanted behaviour and, or, is there a way to gat syslog-ng to respawn processes called with program() ? thx, thomas

1 0