- syslog-ng - lists.balabit.hu

Macro Substitution
by Jeremy Shaffner 11 Oct '01

11 Oct '01

Howdy, I'm currently using a template to output logs to a pipe for importing into a DB. Is it possible to isolate a portion of the $MSG macro using regexps? Such that it equates to: echo $MSG | sed 's/denied ip $1.1.1.1$ -> $2.2.2.2$/\1 \2/' I'm trying to put the IPs in their own column in the table. Thanks, -- -Jeremy

2 3

syslog-ng.conf.RedHat
by James Riordan 11 Oct '01

11 Oct '01

Howdy- I think that there might be an inconsistency between the behavior determined by syslog.conf and that by syslog-ng.conf.RedHat (from syslog-ng-1.4.12.tar.gz and syslog-ng-1.5.9.tar.gz). The stock syslog.conf file sends a message to /var/log/messages if it is of level info or higher unless it comes from facility mail, authpriv, or cron: # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages whereas, if I understand it correctly, the relevant lines from syslog-ng.conf.RedHat destination d_mesg { file("/var/log/messages"); }; filter f_filter2 { level(info) or facility(mail) or facility(authpriv); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; send a message to /var/log/messages if it is exactly of level info, or if it comes from facility mail or authpriv. I am not sure about the the internals of filter evaluation (is it lazy?) so as to write the fastest rule but filter f_filter2 { not level(debug) and not (facility(mail) or facility(authpriv) or facility(cron)); }; seems to work. Also, thanks for such a nice package. Regards, james -- Dr. James Riordan email: rij(a)zurich.ibm.com IBM Research notes: James Riordan/Zurich/IBM Säumerstrasse 4 Tel +41 (0) 1 724 89 81 CH-8803 Rüschlikon, Switzerland Fax +41 (0) 1 724 89 53

1 0

Fields defined in the logs
by Denis Doublet 10 Oct '01

10 Oct '01

> Hello, > > Using syslog-ng 1.5.9 on Solaris 7 and Solaris 8, > I would like to see logs containing the facility, level.... > I can't find how to add these fields to logs. > > Best Regards > > Denis

1 0

RE: [syslog-ng]Mystic crashes of 1.5.10
by Nicholas Berry 10 Oct '01

10 Oct '01

I too am having the same issue with crashing under Solaris 8 with syslog-ng 1.5.10, but my crashes happen several hours between each other. _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048 -----Original Message----- From: Andreas Schulze [mailto:Andreas.Schulze@mediaWays.NET] Sent: Wednesday, October 10, 2001 6:01 AM To: syslog-ng list Subject: [syslog-ng]Mystic crashes of 1.5.10 Hello Bazsi, thanks a lot for the stats() feature in the new version. But unfortunately 1.5.10 crashes a few minutes after starting. We are running your software on SUN Solaris 8 boxes. I read about a similiar problem with Linux boxes some weeks ago in this list. For your convenience the backtrace is attached. The calling deps between #17 and #1 can differ in each core. But it crashed _always_ in __sigprocmask () from /usr/lib/libthread.so.1 And it crashed _always_ by receiving SIGKILL. Seems a little bit mystic for me, because I don't know why and who's sending the SIGKILL. Coredumps by SIGSEGV are more familiar to me :) Thx. for a fast fix --Andreas > root@host [/root] >>gdb /usr/sbin/syslog-ng.1.5.10 core > GNU gdb 5.0 > Copyright 2000 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and > you are welcome to change it and/or distribute copies of it under > certain conditions. Type "show copying" to see the conditions. There > is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "sparc-sun-solaris2.8"... > > Core was generated by `/usr/sbin/syslog-ng.1.5.10 -v -f > /etc/syslog-ng/syslog-ng.conf'. Program terminated with signal 9, > Killed. Reading symbols from /usr/lib/libpthread.so.1...done. Loaded > symbols for /usr/lib/libpthread.so.1 Reading symbols from > /usr/lib/libdoor.so.1...done. Loaded symbols for /usr/lib/libdoor.so.1 > Reading symbols from /usr/lib/libl.so.1...done. > Loaded symbols for /usr/lib/libl.so.1 > Reading symbols from /usr/lib/libsocket.so.1...done. > Loaded symbols for /usr/lib/libsocket.so.1 > Reading symbols from /usr/lib/libnsl.so.1...done. > Loaded symbols for /usr/lib/libnsl.so.1 > Reading symbols from /usr/lib/libxnet.so.1...done. > Loaded symbols for /usr/lib/libxnet.so.1 > Reading symbols from /usr/lib/libc.so.1...done. > Loaded symbols for /usr/lib/libc.so.1 > Reading symbols from /usr/lib/libdl.so.1...done. > Loaded symbols for /usr/lib/libdl.so.1 > Reading symbols from /usr/lib/libmp.so.2...done. > Loaded symbols for /usr/lib/libmp.so.2 > Reading symbols from /usr/platform/SUNW,UltraSPARC-IIi-cEngine/lib/libc_psr.so.1...done. > Loaded symbols for /usr/platform/SUNW,UltraSPARC-IIi-cEngine/lib/libc_psr.so.1 > Reading symbols from /usr/lib/libthread.so.1...done. > Loaded symbols for /usr/lib/libthread.so.1 > #0 0xff0d9a04 in __sigprocmask () from /usr/lib/libthread.so.1 > (gdb) bt > #0 0xff0d9a04 in __sigprocmask () from /usr/lib/libthread.so.1 > #1 0xff0ce460 in _resetsig () from /usr/lib/libthread.so.1 > #2 0xff0cdc00 in _sigon () from /usr/lib/libthread.so.1 > #3 0xff0d0c14 in _thrp_kill () from /usr/lib/libthread.so.1 > #4 0xff14afe8 in raise () from /usr/lib/libc.so.1 > #5 0xff1357c4 in abort () from /usr/lib/libc.so.1 > #6 0x29324 in do_object_queue_mark () > #7 0x29d50 in ol_object_check () > #8 0x1f70c in do_handle_dest_writer (c=0x9ffc0, msg=0x60314) at affile.c:247 > #9 0x20c90 in do_handle_affile_log (c=0x4a7d0, msg=0x60314) at affile.c:738 > #10 0x1866c in do_handle_log (c=0x4a8d8, msg=0x60314) at destinations.c:103 > #11 0x17374 in do_distribute_log (c=0x47020, msg=0x60314) at center.c:149 > #12 0x169a8 in do_add_source_name (c=0x4a748, logmsg=0x60314) at sources.c:238 > #13 0x225e0 in do_handle_afinet_line (c=0x470c0, msg=0x60314) at afinet.c:107 > #14 0x160bc in do_handle_line (self=0x47108, length=110, > data=0x47120 "<189>121625: Oct 10 14:30:57 MESZ: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:1, changed state to upolding time expiredired0 secondsws-gtso-de15) 2/6 (1)..net) 2/48 (1)..", addr=0xffbef518, addrlen=16) > at sources.c:67 > #15 0x162f4 in do_read_line (h=0x470a0, read=0xffbef6b8) at sources.c:105 > #16 0x27bc4 in read_callback () > #17 0x27870 in io_iter () > #18 0x153ac in main_loop (backend=0x42eb0) at main.c:174 > #19 0x15e8c in main (argc=4, argv=0xffbefb2c) at main.c:469 > (gdb) q > root@host [/root] >> _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Feature request for stats() in 1.5.10
by Andreas Schulze 10 Oct '01

10 Oct '01

Hello Bazsi, thanks a lot for the stats() feature in the new version. Is it possible to break down the stats() output to the destination layer? I.e. generate stats() output per destination. It would be very useful, if it's possible to find out the destination that makes the 'dropping' problem. > STATS: dropped 234 on destination 'd_dest_1' > STATS: dropped 0 on destination 'd_dest_a' > STATS: dropped 34 on destination 'd_dest_x' > ... Thx. --Andreas

1 0

Mystic crashes of 1.5.10
by Andreas Schulze 10 Oct '01

10 Oct '01

Hello Bazsi, thanks a lot for the stats() feature in the new version. But unfortunately 1.5.10 crashes a few minutes after starting. We are running your software on SUN Solaris 8 boxes. I read about a similiar problem with Linux boxes some weeks ago in this list. For your convenience the backtrace is attached. The calling deps between #17 and #1 can differ in each core. But it crashed _always_ in __sigprocmask () from /usr/lib/libthread.so.1 And it crashed _always_ by receiving SIGKILL. Seems a little bit mystic for me, because I don't know why and who's sending the SIGKILL. Coredumps by SIGSEGV are more familiar to me :) Thx. for a fast fix --Andreas > root@host [/root] >>gdb /usr/sbin/syslog-ng.1.5.10 core > GNU gdb 5.0 > Copyright 2000 Free Software Foundation, Inc. > GDB is free software, covered by the GNU General Public License, and you are > welcome to change it and/or distribute copies of it under certain conditions. > Type "show copying" to see the conditions. > There is absolutely no warranty for GDB. Type "show warranty" for details. > This GDB was configured as "sparc-sun-solaris2.8"... > > Core was generated by `/usr/sbin/syslog-ng.1.5.10 -v -f /etc/syslog-ng/syslog-ng.conf'. > Program terminated with signal 9, Killed. > Reading symbols from /usr/lib/libpthread.so.1...done. > Loaded symbols for /usr/lib/libpthread.so.1 > Reading symbols from /usr/lib/libdoor.so.1...done. > Loaded symbols for /usr/lib/libdoor.so.1 > Reading symbols from /usr/lib/libl.so.1...done. > Loaded symbols for /usr/lib/libl.so.1 > Reading symbols from /usr/lib/libsocket.so.1...done. > Loaded symbols for /usr/lib/libsocket.so.1 > Reading symbols from /usr/lib/libnsl.so.1...done. > Loaded symbols for /usr/lib/libnsl.so.1 > Reading symbols from /usr/lib/libxnet.so.1...done. > Loaded symbols for /usr/lib/libxnet.so.1 > Reading symbols from /usr/lib/libc.so.1...done. > Loaded symbols for /usr/lib/libc.so.1 > Reading symbols from /usr/lib/libdl.so.1...done. > Loaded symbols for /usr/lib/libdl.so.1 > Reading symbols from /usr/lib/libmp.so.2...done. > Loaded symbols for /usr/lib/libmp.so.2 > Reading symbols from /usr/platform/SUNW,UltraSPARC-IIi-cEngine/lib/libc_psr.so.1...done. > Loaded symbols for /usr/platform/SUNW,UltraSPARC-IIi-cEngine/lib/libc_psr.so.1 > Reading symbols from /usr/lib/libthread.so.1...done. > Loaded symbols for /usr/lib/libthread.so.1 > #0 0xff0d9a04 in __sigprocmask () from /usr/lib/libthread.so.1 > (gdb) bt > #0 0xff0d9a04 in __sigprocmask () from /usr/lib/libthread.so.1 > #1 0xff0ce460 in _resetsig () from /usr/lib/libthread.so.1 > #2 0xff0cdc00 in _sigon () from /usr/lib/libthread.so.1 > #3 0xff0d0c14 in _thrp_kill () from /usr/lib/libthread.so.1 > #4 0xff14afe8 in raise () from /usr/lib/libc.so.1 > #5 0xff1357c4 in abort () from /usr/lib/libc.so.1 > #6 0x29324 in do_object_queue_mark () > #7 0x29d50 in ol_object_check () > #8 0x1f70c in do_handle_dest_writer (c=0x9ffc0, msg=0x60314) at affile.c:247 > #9 0x20c90 in do_handle_affile_log (c=0x4a7d0, msg=0x60314) at affile.c:738 > #10 0x1866c in do_handle_log (c=0x4a8d8, msg=0x60314) at destinations.c:103 > #11 0x17374 in do_distribute_log (c=0x47020, msg=0x60314) at center.c:149 > #12 0x169a8 in do_add_source_name (c=0x4a748, logmsg=0x60314) at sources.c:238 > #13 0x225e0 in do_handle_afinet_line (c=0x470c0, msg=0x60314) at afinet.c:107 > #14 0x160bc in do_handle_line (self=0x47108, length=110, > data=0x47120 "<189>121625: Oct 10 14:30:57 MESZ: %LINEPROTO-5-UPDOWN: Line protocol on Interface BRI0:1, changed state to upolding time expiredired0 secondsws-gtso-de15) 2/6 (1)..net) 2/48 (1)..", addr=0xffbef518, addrlen=16) > at sources.c:67 > #15 0x162f4 in do_read_line (h=0x470a0, read=0xffbef6b8) at sources.c:105 > #16 0x27bc4 in read_callback () > #17 0x27870 in io_iter () > #18 0x153ac in main_loop (backend=0x42eb0) at main.c:174 > #19 0x15e8c in main (argc=4, argv=0xffbefb2c) at main.c:469 > (gdb) q > root@host [/root] >>

1 0

RE: [syslog-ng]Disabling stats for syslog-ng
by Nicholas Berry 09 Oct '01

09 Oct '01

I was able to compile after defining PATH_SYSCONFDIR. This was not auto-generated when running ./configure, will this be fixed in the future or should I jot this down for future reference? -Nick -----Original Message----- From: Balazs Scheidler Sent: Tue 10/9/2001 2:31 AM To: syslog-ng(a)lists.balabit.hu Cc: Subject: Re: [syslog-ng]Disabling stats for syslog-ng On Thu, Oct 04, 2001 at 09:59:11AM -0700, Nicholas Berry wrote: > I have the GNU gcc 2.95.3, make, automake, autoconf, and libol 0.2.24 > > Here is the error I get after "./configure > --with-libol=/tmp/libol-0.2.24 && make" > gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.10/src -I. -g -O2 -Wall > -I/tmp/libol-0.2.24/src -D_GNU_SOURCE -c main.c > main.c:47: `PATH_SYSCONFDIR' undeclared here (not in a function) > main.c:47: parse error before string constant > main.c: In function `usage': > main.c:318: parse error before `PATH_SYSCONFDIR' > main.c: In function `main': > main.c:396: warning: passing arg 2 of `resolve_user_group' from > incompatible pointer type > main.c:396: warning: passing arg 3 of `resolve_user_group' from > incompatible pointer type > main.c:400: warning: passing arg 2 of `resolve_group' from incompatible > pointer type > *** Error code 1 > make: Fatal error: Command failed for target `main.o' is PATH_SYSCONFDIR defined in your config.h? (it is in mine) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Encrypted messages
by Forrest Aldrich 09 Oct '01

09 Oct '01

Where are the plans of implementing encrypted messaging/logging?

5 14

RE: [syslog-ng]Disabling stats for syslog-ng
by Nicholas Berry 09 Oct '01

09 Oct '01

I have the GNU gcc 2.95.3, make, automake, autoconf, and libol 0.2.24 Here is the error I get after "./configure --with-libol=/tmp/libol-0.2.24 && make" gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.10/src -I. -g -O2 -Wall -I/tmp/libol-0.2.24/src -D_GNU_SOURCE -c main.c main.c:47: `PATH_SYSCONFDIR' undeclared here (not in a function) main.c:47: parse error before string constant main.c: In function `usage': main.c:318: parse error before `PATH_SYSCONFDIR' main.c: In function `main': main.c:396: warning: passing arg 2 of `resolve_user_group' from incompatible pointer type main.c:396: warning: passing arg 3 of `resolve_user_group' from incompatible pointer type main.c:400: warning: passing arg 2 of `resolve_group' from incompatible pointer type *** Error code 1 make: Fatal error: Command failed for target `main.o' _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048 -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, October 04, 2001 9:26 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Disabling stats for syslog-ng On Thu, Oct 04, 2001 at 08:56:55AM -0700, Nicholas Berry wrote: > I could not get 1.5.10 to compile under Solaris 8. > > Is there a patch released to fix this? And what was the problem? -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

filtering programs and subprograms
by Baltasar Cevc 06 Oct '01

06 Oct '01

Hi, everybody! I'm using Syslog-NG on a Linux server - as I like the great set of features it supports. Now I wonder if there is any possibility to filter the program name and the next field (e.g. "kernel" and is "IN="). I need this in order to separate the packet filter logs from the other kernel stuff. Thanx for help in advance. bye.baltasar ::: B A L T A S A R C E V C mailto: baltasar(a)cevc-topp.de Tel.: +49 89 99020515

2 1

Help on fine tunning/bottlenecks
by Huelbe Arizon Garcia 05 Oct '01

05 Oct '01

Hello, [First of all, I would like to apologize for the long message...] In our company, we have lots of Network Access Servers (aka NAS) which we would like to have syslog. We tried to use the original syslog packed with Linux and we found it was 'dropping' a lot of information. Then, we changed to syslog-ng a few months ago. The results are much better, but the logs are still incomplete. It seems to have some 'bottleneck': when I put an equipment sending logs both to my main syslog server (which runs syslog-ng and receives syslog from all NAS) and other box running only common syslog (receiving external syslog only from this equipment), this second Linux box gets much more information than the first one (almost twice more events/lines). Well, I would like to ask for some tips to find the bottleneck or some configuration fine-tunning. I'll appreciate all comments. Here is my scenario: Main log server: Linux 2.2.14-5.0 Intel Pentium II 450Mhz 64 Mbytes RAM hda: QUANTUM FIREBALL CR6.4A, 6149MB w/418kB Cache (System disk) IDE hdc: QUANTUM FIREBALLlct15 30, 28629MB w/418kB Cache (Log files disk) IDE The syslog-senders (NAS): There are about 70 NAS, each sending up to 15Mbytes/day (about 115.000 lines) of syslog messages. When the log file is cut/rotated (at midnight sharp), the log file has about 600Mbytes The syslog-ng Version 1.5.9 Options configured: options { long_hostnames(off); use_dns(no); log_fifo_size(10000); gc_busy_threshold(10000); gc_idle_threshold(500); }; After running syslog for 20 hours, 'top' shows: 9:35pm up 175 days, 14:48, 1 user, load average: 0.38, 2.28, 2.59 29 processes: 28 sleeping, 1 running, 0 zombie, 0 stopped CPU states: 3.3% user, 1.3% system, 0.0% nice, 95.2% idle Mem: 64104K av, 58496K used, 5608K free, 9852K shrd, 4800K buff Swap: 265032K av, 4304K used, 260728K free 42520K cached PID USER PRI NI SIZE RSS SHARE STAT LIB %CPU %MEM TIME COMMAND 21337 root 20 0 512 472 176 S 0 3.5 0.7 108:16 syslog-ng (The load average is a little higher than normal as I ran grep/wc commands to check some statistics in this mail) Regards, Huelbe Garcia.

1 0

RE: [syslog-ng]Disabling stats for syslog-ng
by Nicholas Berry 04 Oct '01

04 Oct '01

I could not get 1.5.10 to compile under Solaris 8. Is there a patch released to fix this? _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048 -----Original Message----- From: Balazs Scheidler [mailto:bazsi@balabit.hu] Sent: Thursday, October 04, 2001 3:58 AM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng]Disabling stats for syslog-ng On Wed, Oct 03, 2001 at 09:25:00AM -0700, Nicholas Berry wrote: > My log is flooded with messages like the one listed below: Oct 3 > 16:22:04 local@smf-syslog syslog-ng[364]: STATS: dropped 0 > > Can I disable this? upgrade to 1.5.10 -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Documentation
by Ohrberg, Mick 04 Oct '01

04 Oct '01

Hi all, Is there any new, fully updated documentation (or a will to create such) for syslog-ng? I think that some well-written documentation would alleviate a lot of the questions that have been raised here. I also believe that a FAQ of some sort would be helpful. *plink of $.02* /Mick

2 1

Disabling stats for syslog-ng
by Nicholas Berry 04 Oct '01

04 Oct '01

My log is flooded with messages like the one listed below: Oct 3 16:22:04 local@smf-syslog syslog-ng[364]: STATS: dropped 0 Can I disable this? Is there documentation that outlines _all_ available parameters for the various directives (options, file, log, etc)? _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048

2 1

Computer name
by Laurent 04 Oct '01

04 Oct '01

Hello, Is some one can tell me how can i have ip adresse instead of the computer's name in log files ? Thanks -- Best regards, Laurent mailto:lau@ovh.net

2 1

TCP/IP connection - server SIGHUP problem
by Roman Ernst 03 Oct '01

03 Oct '01

First of all: thanks for your help with my little TCP/IP connection-drop-determination-problem. Of course the idea using a monitoring software would solve the problem, but I think many people don't have / use such a tool... So... it should be possible to catch such an error by other means... Somebody wrote that i could figure out via "netstat -an | grep tcp ...." whether connection is okay or not. Unfortenately when plugging out the network cable AIX does not recognize this, i.e. with netstat -an the connection seems to be still available. Only the client tries to close the connection when he tries to send a log message and can't reach the log server (after TCP timeout...). So... the client isn't the problem. But the server never tries to send a package to the client... so he will never recognize whether the client is available or not. Maybe it would be useful to introduce some sort of TCP heartbeat (server sends some packages to the client every xxx minutes) . This way the server take care of unreachable clients and logs such problems... If I'm totally wrong with my opinion please let me know... Okay... another problem: Sending a SIGHUP to the syslog-ng client results in restarting syslog-ng on the client, dropping connection to server, reconnecting to the server and initializing the new configuration (=> that's what the server log says...) => is it really necessary to drop the connection? Sending a SIGHUP to the syslog-ng server results in restarting the syslog-ng on the server and initializing the new configuration (that's what the server log says...) => So far so good... now the problem. If the client tries to send messages to the server the following happens (CLIENT and SERVER LOG) AF_INET client connected from 10.x.x.1, port xxxxx (SERVER LOG) io.c: do_write: write () failed (errno 32), Broken pipe (CLIENT + SERVER LOG) pkt_buffer::do_flush(): Error flushing data (CLIENT + SERVER LOG) Connection broken to AF_INET 10.x.x.2, reopening in 10 seconds (CLIENT + SERVER LOG) AND: one log message is missing afterwards... Okay... that's it. Maybe someone can help me. Thanks in advance! Best regards Roman Ernst

2 1

Can't background syslog-ng
by Andrew Dixon 02 Oct '01

02 Oct '01

Hi All, I'm trying to get syslog-ng-1.5.10 up under a Linux system running on a powerpc. I can compile without errors and if I run: #syslog-ng -F syslog-ng version ` starting 7 so that syslog-ng doesn't background itself it works fine. When I try to back ground it though it fails: #syslog-ng -d io.c: Preparing fd 268600320 for io.c: Preparing fd 0 for reading syslog-ng version ` starting 7gc_mark: Marking object of class '8!' (1) !ÿøàSegmentation fault Has anyone else come across this? I straced syslog-ng and it complained about "Inappropriate ioctl for device" but I'm not sure which device it's trying to manipulate. Any help would be greatly appreciated and if anyone else is running syslog-ng on a PPC Linux system it'd be nice that it is possible. Thanks, Andy P.S. here's the strace: #strace ./syslog-ng execve("./syslog-ng", ["./syslog-ng"], [/* 23 vars */]) = 0 uname({sys="Linux", node="wolf", ...}) = 0 brk(0) = 0x100281f0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30015000 open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 4 SYS_197(0x4, 0x7fffedd8, 0x7fffedd8, 0x30027850, 0x7f7f7f7f) = 0 mmap(NULL, 24719, PROT_READ, MAP_PRIVATE, 4, 0) = 0x30016000 close(4) = 0 open("/lib/libnsl.so.1", O_RDONLY) = 4 read(4, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\0J0"..., 1024) = 1024 SYS_197(0x4, 0x7fffede0, 0x7fffede0, 0x30015280, 0x30027d50) = 0 mmap(0xffc9000, 157316, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0xffc9000 mprotect(0xffdb000, 83588, PROT_NONE) = 0 mmap(0xffe9000, 16384, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0x10000) = 0xffe9000 mmap(0xffed000, 9860, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffed000 close(4) = 0 open("/lib/libc.so.6", O_RDONLY) = 4 read(4, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\2\251"..., 1024) = 1024 SYS_197(0x4, 0x7fffedc0, 0x7fffedc0, 0x30015460, 0x30027d50) = 0 mmap(0xfe6b000, 1366404, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0xfe6b000 mprotect(0xff85000, 211332, PROT_NONE) = 0 mmap(0xff8b000, 167936, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0x110000) = 0xff8b000 mmap(0xffb4000, 18820, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xffb4000 close(4) = 0 munmap(0x30016000, 24719) = 0 brk(0) = 0x100281f0 brk(0x10028240) = 0x10028240 brk(0x10029000) = 0x10029000 open("/etc/syslog-ng/syslog-ng.conf", O_RDONLY) = 4 brk(0x1002e000) = 0x1002e000 ioctl(4, TCGETS, 0x7ffff798) = -1 ENOTTY (Inappropriate ioctl for device) SYS_197(0x4, 0x7ffff288, 0x7ffff288, 0x100282e8, 0x10014904) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30016000 read(4, "#\n# Syslog-ng configuration file"..., 8192) = 5352 read(4, "", 4096) = 0 socket(PF_UNIX, SOCK_STREAM, 0) = 5 connect(5, {sin_family=AF_UNIX, path=" /var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) close(5) = 0 open("/etc/nsswitch.conf", O_RDONLY) = 5 SYS_197(0x5, 0x7ffff238, 0x7ffff238, 0x1002cb88, 0x18) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 read(5, "# /etc/nsswitch.conf\n#\n# Example"..., 4096) = 465 read(5, "", 4096) = 0 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/ld.so.cache", O_RDONLY) = 5 SYS_197(0x5, 0x7fff3fb0, 0x7fff3fb0, 0x30027850, 0x7f7f7f7f) = 0 mmap(NULL, 24719, PROT_READ, MAP_PRIVATE, 5, 0) = 0x30017000 close(5) = 0 open("/lib/libnss_compat.so.2", O_RDONLY) = 5 read(5, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\0\35"..., 1024) = 1024 SYS_197(0x5, 0x7fff3fb8, 0x7fff3fb8, 0x1002cbc0, 0) = 0 mmap(0xfe3f000, 113332, PROT_READ|PROT_EXEC, MAP_PRIVATE, 5, 0) = 0xfe3f000 mprotect(0xfe4b000, 64180, PROT_NONE) = 0 mmap(0xfe4f000, 49152, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 5, 0) = 0xfe4f000 close(5) = 0 munmap(0x30017000, 24719) = 0 uname({sys="Linux", node="wolf", ...}) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 socket(PF_UNIX, SOCK_STREAM, 0) = 5 connect(5, {sin_family=AF_UNIX, path=" /var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) close(5) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 brk(0x1002f000) = 0x1002f000 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/passwd", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff168, 0x7ffff168, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff1d8, 0x1) = 0 read(5, "root:$1$pemDIwo.$AwpdBMFJxfPUi/D"..., 4096) = 1090 close(5) = 0 munmap(0x30017000, 4096) = 0 open("/etc/group", O_RDONLY) = 5 SYS_204(0x5, 0x1, 0, 0x1, 0xffa67a0) = 0 SYS_204(0x5, 0x2, 0x1, 0x1, 0xffa67a0) = 0 SYS_197(0x5, 0x7ffff1a8, 0x7ffff1a8, 0, 0x1) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x30017000 _llseek(0x5, 0, 0, 0x7ffff218, 0x1) = 0 read(5, "root:*:0:\ndaemon:*:1:\nbin:*:2:\ns"..., 4096) = 498 close(5) = 0 munmap(0x30017000, 4096) = 0 brk(0x10030000) = 0x10030000 brk(0x10031000) = 0x10031000 brk(0x10032000) = 0x10032000 read(4, "", 8192) = 0 ioctl(4, TCGETS, 0x7ffff258) = -1 ENOTTY (Inappropriate ioctl for device) close(4) = 0 munmap(0x30016000, 4096) = 0 pipe([4, 5]) = 0 fork() = 289 close(5) = 0 read(4, "\0", 1) = 1 exit(0) = ? -- Andrew Dixon Software Engineer Seranoa Networks 978.897.3434 x231

2 2

syslog-ng 1.4.13 on solaris 5.6 and 5.8
by Jasper Jans 02 Oct '01

02 Oct '01

Balazs, Thanks for the help. If I use the ip address instead of the FQDN it does work. Strange to see the other hosts do work with the FQDN. Oh well - it's fixed. Jasper 4:58pm up 20 day(s), 20:52, 21 users, load average: 0.10, 0.12, 0.16

1 0

syslog-ng 1.4.13 on solaris 5.6 and 5.8
by Jasper Jans 02 Oct '01

02 Oct '01

Config file looks like this: jans01@mimas:/etc/local/syslog-ng-1.4.13/etc$ cat syslog-ng.conf # SYSLOG-NG Configuration File # # SSDC GENERIC 2001.06.22.00 options { long_hostnames (off) ; use_dns (no) ; use_fqdn (yes) ; keep_hostname (yes) ; chain_hostnames (no) ; } ; source syslog { sun-streams ("/dev/log" door ("/etc/.syslog_door")) ; internal () ; } ; destination d_loghost { tcp (host.domain.net port(514)) ; } ; destination d_messages { file ("/var/adm/messages") ; } ; filter f_messages { level (error) or facility (auth, kern) and level (notice) or facility (mail) and level (crit) ; } ; log { source (syslog) ; filter (f_messages) ; destination (d_messages) ; } ; log { source (syslog) ; destination (d_loghost) ; } ; nslookup on the syslog host works: ---- jans01@mimas:/etc/local/syslog-ng-1.4.13/etc$ nslookup host.domain.net Server: xxxxxx.xxxxx.xxxxx Address: xxx.xxx.xxx.xxx Name: xxxxxxxx.xxxxxxx.xxxxxx Address: xxx.xxx.xxx.xxx Aliases: host.domain.net ---- Hope this helps. Btw - I use this same configuration file on all the other hosts that do work as well. J.

2 1

syslog-ng 1.4.13 on solaris 5.6 and 5.8
by Jasper Jans 02 Oct '01

02 Oct '01

Hi, I'm running syslog-ng on Solaris machines. So far I have two machines with will not start syslog-ng properly. ----- root@mimas:/etc/local/syslog-ng-1.4.13/etc$ /etc/init.d/syslog-ng start Starting Syslog-NG Error creating AF_INET socket (Error 0) Error initializing configuration, exiting. root@mimas:/etc/local/syslog-ng-1.4.13/etc$ uname -a SunOS mimas 5.6 Generic_105181-23 sun4u sparc SUNW,Ultra-80 ----- The Solaris 5.8 machine has the same problem. Funny thing is - other Solaris 5.8 machines do run syslog-ng just fine. Idea's anyone? Thanks, Jasper 12:07pm up 20 day(s), 16:01, 20 users, load average: 0.14, 0.14, 0.13

2 2

syslog-ng 1.4.13 on solaris 5.6 and 5.8
by Jasper Jans 02 Oct '01

02 Oct '01

bash-2.04# truss ./syslog-ng -f /etc/local/syslog-ng-1.4.13/etc/syslog-ng.conf -dv execve("./syslog-ng", 0xEFFFFD48, 0xEFFFFD5C) argc = 4 stat("syslog-ng", 0xEFFFFA50) = 0 open("/var/ld/ld.config", O_RDONLY) Err#2 ENOENT open("/usr/lib/libpthread.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF7B0000 mmap(0x00000000, 81920, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF790000 mmap(0xEF7A2000, 5500, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 8192) = 0xEF7A2000 munmap(0xEF794000, 57344) = 0 memcntl(0xEF790000, 12160, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 open("/usr/lib/libdoor.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF7B0000 mmap(0x00000000, 73728, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF770000 mmap(0xEF780000, 3868, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF780000 munmap(0xEF772000, 57344) = 0 memcntl(0xEF770000, 2608, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 open("/usr/lib/libsocket.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF7B0000 mmap(0x00000000, 106496, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF750000 mmap(0xEF766000, 8185, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 24576) = 0xEF766000 open("/dev/zero", O_RDONLY) = 4 mmap(0xEF768000, 388, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xEF768000 munmap(0xEF758000, 57344) = 0 memcntl(0xEF750000, 12072, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 open("/usr/lib/libnsl.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF7B0000 mmap(0x00000000, 581632, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF680000 mmap(0xEF700000, 32812, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 458752) = 0xEF700000 mmap(0xEF70A000, 15880, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xEF70A000 munmap(0xEF6F2000, 57344) = 0 memcntl(0xEF680000, 70140, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 open("/usr/lib/libxnet.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0xEF7B0000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF7B0000 mmap(0x00000000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0xEF740000 close(3) = 0 open("/usr/lib/libc.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF730000 mmap(0x00000000, 704512, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF580000 mmap(0xEF622000, 29984, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 598016) = 0xEF622000 mmap(0xEF62A000, 4144, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xEF62A000 munmap(0xEF614000, 57344) = 0 memcntl(0xEF580000, 101660, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 open("/usr/lib/libdl.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0xEF730000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF730000 close(3) = 0 open("/usr/lib/libmp.so.2", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF720000 mmap(0x00000000, 81920, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF660000 mmap(0xEF672000, 3581, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 8192) = 0xEF672000 munmap(0xEF664000, 57344) = 0 memcntl(0xEF660000, 3020, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 open("/usr/platform/SUNW,Ultra-80/lib/libc_psr.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF654) = 0 mmap(0xEF720000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF720000 mmap(0x00000000, 16384, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF650000 close(3) = 0 open("/usr/lib/libthread.so.1", O_RDONLY) = 3 fstat(3, 0xEFFFF7EC) = 0 mmap(0xEF720000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xEF720000 mmap(0x00000000, 204800, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xEF540000 mmap(0xEF566000, 9808, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 90112) = 0xEF566000 mmap(0xEF56A000, 28804, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 4, 0) = 0xEF56A000 munmap(0xEF558000, 57344) = 0 memcntl(0xEF540000, 25132, MC_ADVISE, 0x0003, 0, 0) = 0 close(3) = 0 close(4) = 0 munmap(0xEF720000, 8192) = 0 brk(0x000375D8) = 0 sysconfig(_CONFIG_PAGESIZE) = 8192 sigfillset(0xEF629DD0) = 0 lwp_self() = 1 lwp_self() = 1 sigprocmask(SIG_SETMASK, 0x00000000, 0xEFFFF8D8) = 0 sigprocmask(SIG_SETMASK, 0xEF567E70, 0x00000000) = 0 sigaction(SIGLWP, 0xEF5684B0, 0x00000000) = 0 sigaction(SIGCANCEL, 0xEF5684B0, 0x00000000) = 0 sigaction(SIGSEGV, 0xEF5684B0, 0x00000000) = 0 brk(0x000375D8) = 0 brk(0x000395D8) = 0 open("/dev/zero", O_RDWR) = 3 mmap(0x00000000, 8454144, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_NORESERVE, 3, 0) = 0xEEC00000 close(3) = 0 mprotect(0xEEC00000, 8192, PROT_NONE) = 0 mprotect(0xEED02000, 8192, PROT_NONE) = 0 mprotect(0xEEE04000, 8192, PROT_NONE) = 0 mprotect(0xEEF06000, 8192, PROT_NONE) = 0 mprotect(0xEF008000, 8192, PROT_NONE) = 0 mprotect(0xEF10A000, 8192, PROT_NONE) = 0 mprotect(0xEF20C000, 8192, PROT_NONE) = 0 mprotect(0xEF30E000, 8192, PROT_NONE) = 0 lwp_create(0xEFFFF610, 0x0100, 0xEF40FE04) = 2 lwp_create(0xEFFFF610, 0x0100, 0xEF40FE04) = -276885348 door_create(0xEF552808, 0x00000000, 0x00000002) = 3 getpid() = 9323 [9322] lwp_schedctl(SC_STATE|SC_BLOCK, 3, 0xEFFFF814) = 0 door_info(3, 0xEF56A888) = 0 open("/dev/zero", O_RDWR) = 4 mmap(0x00000000, 24576, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_NORESERVE, 4, 0) = 0xEF640000 close(4) = 0 mprotect(0xEF640000, 8192, PROT_NONE) = 0 lwp_create(0xEFFFF5F8, 0x00C0, 0xEF645E04) = 3 lwp_continue(3) = 0 lwp_create(0x00000001, 0x6000, 0xEFFFF794) = 0 lwp_schedctl(SC_STATE|SC_BLOCK, -1, 0xEF645D0C) = 0 lwp_schedctl(SC_DOOR, 0, 0x00000000) = 4 door_bind(4) = 0 close(4) = 0 close(3) = 0 sigaction(SIGWAITING, 0xEF567CE0, 0x00000000) = 0 lwp_self() = 1 open("/etc/local/syslog-ng-1.4.13/etc/syslog-ng.conf", O_RDONLY) = 3 brk(0x000395D8) = 0 brk(0x0003D5D8) = 0 ioctl(3, TCGETA, 0xEFFFFA44) Err#25 ENOTTY fstat64(3, 0xEFFFF450) = 0 brk(0x0003D5D8) = 0 brk(0x0003F5D8) = 0 ioctl(3, TCGETA, 0xEFFFF3DC) Err#25 ENOTTY read(3, " # S Y S L O G - N G ".., 8192) = 676 read(3, 0x0003BF0C, 8192) = 0 brk(0x0003F5D8) = 0 brk(0x000415D8) = 0 ioctl(3, TCGETA, 0xEFFFF4B4) Err#25 ENOTTY llseek(3, 0, SEEK_CUR) = 676 close(3) = 0 open("/dev/log", O_RDONLY|O_NONBLOCK|O_NOCTTY) = 3 ioctl(3, I_STR, 0xEFFFFB18) = 0 stat("/etc/.syslog_door", 0xEFFFFA90) = 0 umount("/etc/.syslog_door") = 0 door_create(0x0001C728, 0x00000000, 0x00000000) = 4 getpid() = 9323 [9322] lwp_create(0xEFFFF650, 0x00C0, 0xEF20BE04) = 4 lwp_continue(4) = 0 lwp_create(0xEFFFF650, 0x00C0, 0xEF20BE04) = -268437784 lwp_self() = 4 lwp_schedctl(SC_STATE, -1, 0xEF20BD6C) = 0 yield() = 0 ioctl(4, I_CANPUT, 0x00000000) Err#89 ENOSYS door_info(4, 0xEFFFF9F8) = 0 mount("", "/etc/.syslog_door", MS_DATA, "namefs", 0xEFFFF9F4, 4) = 0 so_socket(2, 2, 6, "", 1) = 5 fcntl(5, F_GETFL, 0x00000000) = 2 fstat64(5, 0xEFFFF870) = 0 getsockopt(5, 65535, 8192, 0xEFFFF974, 0xEFFFF96C) = 0 fstat64(5, 0xEFFFF870) = 0 getsockopt(5, 65535, 8192, 0xEFFFF974, 0xEFFFF970) = 0 setsockopt(5, 65535, 8192, 0xEFFFF974, 4) = 0 fcntl(5, F_SETFL, 0x00000082) = 0 fcntl(5, F_SETFD, 0x00000001) = 0 io.c: connecting using fd 5 write(2, " i o . c : c o n n e c".., 28) = 28 open("/etc/netconfig", O_RDONLY) = 6 fstat64(6, 0xEFFFF1B8) = 0 brk(0x000415D8) = 0 brk(0x000435D8) = 0 ioctl(6, TCGETA, 0xEFFFF144) Err#25 ENOTTY read(6, " #\n # T h e " N e t".., 8192) = 1064 read(6, 0x0003FB6C, 8192) = 0 llseek(6, 0, SEEK_CUR) = 1064 llseek(6, 0, SEEK_SET) = 0 read(6, " #\n # T h e " N e t".., 8192) = 1064 read(6, 0x0003FB6C, 8192) = 0 llseek(6, 0, SEEK_CUR) = 1064 close(6) = 0 open64("/etc/.name_service_door", O_RDONLY) = 6 fcntl(6, F_SETFD, 0x00000001) = 0 door_info(6, 0xEF629C58) = 0 door_call(6, 0xEFFFD688) = 0 signotifywait() = 32 lwp_sigredirect(0, SIGWAITING) = 0 sigaction(SIGWAITING, 0xEF567D00, 0x00000000) = 0 open("/dev/zero", O_RDWR) = 7 mmap(0x00000000, 16384, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_NORESERVE, 7, 0) = 0xEF530000 close(7) = 0 mprotect(0xEF530000, 8192, PROT_NONE) = 0 lwp_create(0xEF40FAF0, 0x00C0, 0xEF533E04) = 5 lwp_continue(5) = 0 lwp_create(0x00000001, 0x4000, 0xEF40FC8C) = 0 lwp_schedctl(SC_STATE|SC_BLOCK, -1, 0xEF533D0C) = 0 time() = 1002019652 close(5) = 0 Error creating AF_INET socket (Error 0) write(2, " E r r o r c r e a t i".., 40) = 40 Error initializing configuration, exiting. write(2, " E r r o r i n i t i a".., 43) = 43 llseek(0, 0, SEEK_CUR) = 25235 _exit(2)

1 0

Monitoring connection
by Roman Ernst 02 Oct '01

02 Oct '01

Good morning! Have a question regarding syslog-ng TCP/IP connection... Is it possible to configure an SYSLOG-COLLECTION-SERVER to give any kind of alert whenever the connection between this server and any syslog-client is dropped? My problem is: if i plug out the network cable neither the server (AIX) nor the client (an AIX too) do recognize this within an acceptable period of time... Does there exist something like a "SERVER-CLIENT heartbeat" ??? Or... does anybody have an idea how to solve this problem another way? Best regards Roman Ernst

3 2

quick questions
by Ben Smee 02 Oct '01

02 Oct '01

heya, I am looking to setup syslog-ng for some tests here and I was wondering where the latest documentaion is available. I checked the man page but it suggests the html version is the latest, however, looking at the html version and comparing that to the samples that come with the latest package I can see that there are a huge number of features that appear to not be documented. Can anyone therefore point me to the best place to get the most updated doco's? Also is it possible to get a search function put on the list archive? Would make life easier :) thanks, -------------------- Benjamin Smee Technical Specialist Optus Business Operations (NAC) "YES" OPTUS ben.smee(a)optus.net.au Tel: +61-2-93420091 Fax: +61-2-93420998 Perilous to all of us are the devices of an art deeper than we possess ourselves. -- Gandalf the White

2 1

RE: RE:[syslog-ng]using ^ and/or $ in a regular expression match
by Masahiro Hirako 02 Oct '01

02 Oct '01

Thank you for the answer, Mr. Korschan, It worked! I misunderstood "the regular expression" as the one of the shells. Thanks a lot! >> The problem is '*' '?', or '+' in match() function. >> The following filter below seems to fail. >> >> ------------------------------- >> filter f1 { match("abc*");}; >> --------------------------------- >> >> I also tried match("abc\*"), match("abc\\*"), but those didn't work >> too. >> I know match("abc") is enough to resolve the sample problem, and it >> worked, but I want to make a filter like "abc*:xyz". >> >> Dose the match() function really resolve the regular expression? >> Or is the way I use match() wrong? >> > >Hmm - I assume you want to match "abc*:xyz": > >try match("abc.*") or match("abc.*:xyz") > >to be really exact you can try match("^abc.*:xyz$") > >Not that ".*" matches 0 or more characters, "\*" would match exactly >one "*" > >See regexp(5) (section may differ in your case) > >regards >-- >Christian Korschan Systems Specialist CTBTO/IDC >Vienna International Centre Email: Christian.Korschan(a)CTBTO.ORG >P.O. BOX 1200 Phone: +43(1)26030 6184 >A-1400 Vienna, Austria FAX: +43(1)26030 5932

1 0

RE:[syslog-ng]using ^ and/or $ in a regular expression match
by Masahiro Hirako 02 Oct '01

02 Oct '01

Hello, I've just begun using syslog-ng 1.4.12. Excuse me if the following problem is a FAQ, but I couldn't find an answer from the log, manual, reference. On Thu, 14 Jun 2001, nick nick(a)digitalwest.net wrote about the match() function problem, and I also have the similar one. (http://lists.balabit.hu/pipermail/syslog-ng/2001-June/001584.html) The problem is '*' '?', or '+' in match() function. The following filter below seems to fail. ------------------------------- filter f1 { match("abc*");}; --------------------------------- I also tried match("abc\*"), match("abc\\*"), but those didn't work too. I know match("abc") is enough to resolve the sample problem, and it worked, but I want to make a filter like "abc*:xyz". Dose the match() function really resolve the regular expression? Or is the way I use match() wrong? Thank you for reading. Masahiro Hirako

2 1