- syslog-ng - lists.balabit.hu

file() syntax
by Nicholas Berry 02 Oct '01

02 Oct '01

Just for background info, I compiled syslog-ng v1.5.9 under Solaris 8. I would like to make a statement similar to this: log { file("/var/log/$host/$year/$month"); }; to write the log to "/var/log/ns01/2001/10". I know this is possible by several filters, but that would be a ton of filters (especially since this will be breaking up at least 20 hosts). I've read over the online documentation and the man page for syslog-ng.conf and the closest I've seen to what I'm looking for is the file( ) macros. Can someone provide examples of using the macros or point me to online documentation outlining this? _________________________________________________________________ Nicholas Berry RagingWire Telecommunications, Inc. Systems Engineer 2710 Gateway Oaks-South, Suite 300 nberry(a)ragingwire.com Sacramento, CA 95833 http://www.ragingwire.com Tel: 916.286.4048 Fax: 916.921.4048

2 1

Unaligned trap errors on Alpha-Linux
by Jon Stearley 28 Sep '01

28 Sep '01

has a fix been found to the "unaligned trap" messages alpha users have been seeing? http://lists.balabit.hu/pipermail/syslog-ng/2000-May/000609.html http://lists.svlug.org/pipermail/svlug/2000-October/004209.html http://pusa.uv.es/~ulisses/kernelnewbies/kernelnewbies.25Jul00 i've got tons of them i'd like to eliminate from my alpha/linux-2.2.18/redhat6.2/syslog-ng-1.4.12/libol-0.2.23 clusters. it looks like an internal message, but it still occurs when i take internal() out of my source definition (?). thx for any pointers. -- +--------------------------------------------------------------+ | Jon Stearley (505) 845-7571 (FAX 844-2067) | | Compaq Federal LLC High Performance Solutions | | Sandia National Laboratories Scalable Systems Integration | +--------------------------------------------------------------+ here's one of my hosts, it keeps repeating: Sep 23 17:43:35 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005278: 00000001201249cc 2d 0 Sep 23 17:43:35 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 000000012000527c: 00000001201249f4 29 1 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 00000001200051d8: 00000001201249f4 2d 0 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005220: 00000001201249f4 29 16 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005278: 00000001201249cc 2d 0 Sep 23 17:43:41 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 000000012000527c: 00000001201249f4 29 1 Sep 23 17:44:12 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 00000001200051d8: 00000001201249f4 2d 0 Sep 23 17:44:12 src(a)if-1/if-1.n-0.y-6 syslog-ng(444): unaligned trap at 0000000120005220: 00000001201249f4 29 16

2 2

Thanks.
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 28 Sep '01

28 Sep '01

All, Thanks for all your help and advice over the last couple of years. I have tried to give back some of the help I have gotten as well as some of the experience I have gained using the software. This has been an outstanding piece of software and has been very helpful to the organization for which I work. But my contract here is up and I am moving on to a straight programming job, (no more sysadmin work). Anyway, best of luck to all of you. Bazsi, thanks for the hard work and support. Andrew Hamilton

2 1

perm() bug in 1.4.13?
by Michael D. (Mick) Bauer 27 Sep '01

27 Sep '01

If I define a logfile with perms "-rw-r------" using the following in syslog.conf: destination d_micklog { file("/var/log/micklog" owner(mick) group(wheel) perm(0640)); }; a file is created that looks like this (ls -l output): -rw------- 1 mick wheel 57 Sep 27 10:03 /var/log/micklog Why aren't the "group" bits being set? At first I thought maybe I needed to "invert" the mode a là umode, but that isn't it. Ideas? TIA, Mick Bauer /=============================\ | Michael D.(Mick) Bauer | | Network Security Consultant | | St. Paul, Minnesota (USA) | | mick<at>visi.com | \=============================/

2 1

Losing events with syslog-ng and netfilter
by Jerome Poggi 27 Sep '01

27 Sep '01

Hi, I use syslog-ng 1.5.10 with Linux kernel 2.4.10 and netfilter 1.2.3 When Netfilter log 8 events, syslog-ng log only the half. Did you see this thinks before ? -- Jerome POGGI

1 0

RE: [syslog-ng]Does syslog-ng support remote logging?
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 27 Sep '01

27 Sep '01

You should have a source set up that receives UDP packets. Just include it in your source statement. Regards, Drew -----Original Message----- From: A. Dumas [mailto:a.dumas@snet.net] Sent: Thursday, September 27, 2001 4:15 AM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]Does syslog-ng support remote logging? I've had syslog-ng on a Linux 7.1 box for a couple months and it's been running great. I'm attempting to setup remote logging on the various Cisco routers on my network and have them point to syslog-ng. I think the Cisco configurations are set up correctly since I have a sniffer on the network and I can see the packets going to the Linux box, but nothing shows up in syslog-ng that I can see. What should I be using in the syslog-ng configuration to isolate the relevant data? I've unsuccessfully tried several.

1 0

Does syslog-ng support remote logging?
by A. Dumas 27 Sep '01

27 Sep '01

Ive had syslog-ng on a Linux 7.1 box for a couple months and its been running great. Im attempting to setup remote logging on the various Cisco routers on my network and have them point to syslog-ng. I think the Cisco configurations are set up correctly since I have a sniffer on the network and I can see the packets going to the Linux box, but nothing shows up in syslog-ng that I can see. What should I be using in the syslog-ng configuration to isolate the relevant data? Ive unsuccessfully tried several.

1 0

[aaron@schrab.com: Bug#78445: syslog-ng: The included libol uses va_list incorrectly.]
by Balazs Scheidler 26 Sep '01

26 Sep '01

----- Forwarded message from Aaron Schrab <aaron(a)schrab.com> ----- From: Aaron Schrab <aaron(a)schrab.com> To: 78445(a)bugs.debian.org Cc: control(a)bugs.debian.org Reply-To: Aaron Schrab <aaron(a)schrab.com>, 78445(a)bugs.debian.org Subject: Bug#78445: syslog-ng: The included libol uses va_list incorrectly. Date: Sat, 22 Sep 2001 10:47:33 -0500 tags 78445 patch thanks The msg_vformat function from libol passes the same va_list to two different functions, expecting that the first won't affect the second. This assumption isn't true on powerpc, so when the second function gets it, there aren't any arguments left to read. The included patch fixes this by making a copy of the va_list before passing it for the first time. I checked for other occurences of this problem, but this seems to be the only one. My patched copy has been handling my logging for a few hours now and it seems to work fine. The unpatched one died immediately. *** /tmp/syslog-ng.diff diff -Pur syslog-ng-1.5.9/debian/libol.patch syslog-ng-1.5.9.ats/debian/libol.patch --- syslog-ng-1.5.9/debian/libol.patch Wed Dec 31 18:00:00 1969 +++ syslog-ng-1.5.9.ats/debian/libol.patch Sat Sep 22 06:06:43 2001 @@ -0,0 +1,37 @@ +diff -ur libol-0.2.24.orig/src/format.h libol-0.2.24/src/format.h +--- libol-0.2.24.orig/src/format.h Sat Jul 10 08:23:09 1999 ++++ libol-0.2.24/src/format.h Sat Sep 22 05:56:59 2001 +@@ -28,6 +28,12 @@ + + #include <stdarg.h> + ++#ifndef va_copy ++# ifdef __va_copy ++# define va_copy __va_copy ++# endif ++#endif ++ + struct ol_string *c_format(const char *format, ...); + UINT32 c_format_length(const char *format, ...); + UINT32 c_format_write(const char *format, UINT32 length, UINT8 *buffer, ...); +diff -ur -x configure libol-0.2.24.orig/src/werror.c libol-0.2.24/src/werror.c +--- libol-0.2.24.orig/src/werror.c Fri Feb 4 13:02:04 2000 ++++ libol-0.2.24/src/werror.c Sat Sep 22 05:58:41 2001 +@@ -117,9 +117,16 @@ + { + UINT8 errorbuf[BUF_SIZE]; + int length; +- ++#ifdef va_copy ++ va_list args_copy; ++ va_copy (args_copy, args); ++#endif ++ + length = c_vformat_length(f, args); + if (length <= BUF_SIZE) { ++#ifdef va_copy ++ va_copy (args, args_copy); ++#endif + c_vformat_write(f, sizeof(errorbuf), errorbuf, args); + MSG_WRITE(level, length, errorbuf); + } diff -Pur syslog-ng-1.5.9/debian/rules syslog-ng-1.5.9.ats/debian/rules --- syslog-ng-1.5.9/debian/rules Sat Sep 22 06:08:56 2001 +++ syslog-ng-1.5.9.ats/debian/rules Sat Sep 22 06:09:13 2001 @@ -17,7 +17,7 @@ rm $(LIBOLDIR)/ltmain.sh $(LIBOLDIR)/config.sub $(LIBOLDIR)/config.guess \ $(LIBOLDIR)/aclocal.m4 $(LIBOLDIR)/missing \ $(LIBOLDIR)/ltconfig $(LIBOLDIR)/mkinstalldirs - (cd $(LIBOLDIR); ./autogen.sh; ./configure --prefix=/usr/lib; $(MAKE) ) + (cd $(LIBOLDIR); patch -p1 < ../debian/libol.patch; ./autogen.sh; ./configure --prefix=/usr/lib; $(MAKE) ) echo "libol: Done" # mv -f ltmain.sh ltmain.sh.save # mv -f config.sub config.sub.save -- System Information Debian Release: testing/unstable Architecture: powerpc Kernel: Linux frell 2.4.10-pre10-ben0 #1 Thu Sep 20 00:45:23 CDT 2001 ppc Locale: LANG=C, LC_CTYPE=en_US Versions of packages syslog-ng depends on: ii libc6 2.2.4-1 GNU C Library: Shared libraries an ----- End forwarded message ----- -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

1.4.13 HUP issues
by Nathan Wertman 26 Sep '01

26 Sep '01

While trying to parse my logs for some pppd information about connect times and such I noticed a really wierd problem. When software uses an openlog to open a 'channel' to the log, and when syslog-ng is HUP'ed (during my logrotate script) the process that was writing to the log no longer puts any information into the log. This bug has been fixed in the unstable tree but I would rather not use the unstable tree on my server, especially for something as important as system logging. Has anyone else seen this? Is there a patch for it? I have just begun hacking on syslog-ng so this patch is a little out of my league until I figure out how the code works, but I would like to get syslog-ng up and running as soon as possible. If you need more information please let me know and I will be happy to provide you with it. Nathan Wertman "Those who will not reason, are bigots, those who cannot, are fools, and those who dare not are slaves." - George Gordon Noel Byron (1788 - 1824) (Lord Byron)

2 1

no logging with udp()
by MagerValp 26 Sep '01

26 Sep '01

I just spent an hour trying to figure out why our clients couldn't log to the syslog-ng server anymore. To make a long story short, a patch had replaced the original syslogd start script so both daemons were started. syslogd started first and managed to bind to udp port 514 so syslog-ng never even saw the messages. It didn't complain over not being able to bind the port though -- I would have expected it to say "failed to bind udp port 514" or something like that. Think you could make syslog-ng whine more if it can't bind the port? OK, now all I have left to fix is the raid system, the backbone switch, our two printers on this floor, and the backup system. I won't be going to bed early tonight... -- ___ . . . . . + . . o _|___|_ + . + . + . . Per Olofsson, konstnär o-o . . . o + MagerValp(a)cling.gu.se - + + . http://www.cling.gu.se/~cl3polof/

1 0

2 problems: Max connections and connection lost
by Jasper Jans 26 Sep '01

26 Sep '01

Hi all - first of all could you please reply to this email address as well since I'm not subscribed on this list: jjans(a)bio.vu.nl current setup: Syslog-ng compiled and running on one machine as a syslog master server and syslog-ng running on several other machines that forward their messages to the master machine. problem 1: Sep 26 11:41:13 umbriel syslog-ng[65195]: Error accepting AF_INET connection from: 10.100.2.100:1049, opened connections: 10, max: 10 The master server (umbriel) states it is out of connections? Is this a configuration option that can be set, do I need to hack the source code and recompile - or is it not doable at all over one connection and is all I can do fire off a second syslog-ng process on a different port and use that for 10 more hosts (in total I'm looking into supporting about 80 hosts). problem 2: Sep 26 06:37:04 umbriel syslog-ng[65195]: AF_INET client connected from 10.4.129.8, port 36539 Sep 26 08:35:04 ariel syslog-ng[27849]: io.c: do_write: write() failed (errno 32), Broken pipe Sep 26 08:35:04 ariel syslog-ng[27849]: pkt_buffer::do_flush(): Error flushing data Sep 26 08:35:04 ariel syslog-ng[27849]: Connection broken, reopening in 60 seconds I'm seeing *a lot* of these kinda of messages in the log file. Is there something that can be done about this? Like timeout settings that can be increased etc, etc? Thanks, Jasper

3 3

segfault on solaris 2.7
by Jon Drukman 24 Sep '01

24 Sep '01

just grabbed 1.4.12 from the site and built from source. solaris 2.7, all recommended sun patches installed. here's what happens: lwp_create(0xFFBEF598, LWP_DETACHED|LWP_SUSPENDED, 0xFF105DFC) = 3 lwp_continue(3) = 0 lwp_create() (returning as new lwp ...) = 0 lwp_schedctl(SC_STATE|SC_BLOCK, -1, 0xFF105CFC) = 0 lwp_schedctl(SC_DOOR, 0, 0x00000000) = 4 door_bind(4) = 0 close(4) = 0 close(3) = 0 sigaction(SIGWAITING, 0xFF13D7F8, 0x00000000) = 0 lwp_self() = 1 Incurred fault #6, FLTBOUNDS %pc = 0x81C7E008 siginfo: SIGSEGV SEGV_MAPERR addr=0x81C7E008 Received signal #11, SIGSEGV [caught] siginfo: SIGSEGV SEGV_MAPERR addr=0x81C7E008 sysconfig(_CONFIG_SIGRT_MIN) = 38 sigprocmask(SIG_SETMASK, 0xFF13D9A8, 0x00000000) = 0 sigaction(SIGSEGV, 0xFFBEF6D0, 0x00000000) = 0 sigprocmask(SIG_SETMASK, 0xFF1496D8, 0x00000000) = 0 sysconfig(_CONFIG_SIGRT_MIN) = 38 setcontext(0xFFBEF888) Incurred fault #6, FLTBOUNDS %pc = 0x81C7E008 siginfo: SIGSEGV SEGV_MAPERR addr=0x81C7E008 Received signal #11, SIGSEGV [default] siginfo: SIGSEGV SEGV_MAPERR addr=0x81C7E008 *** process killed *** # sotruss /usr/local/sbin/syslog-ng -d syslog-ng -> libc.so.1:*atexit(0xff3babf8, 0x0, 0x0) syslog-ng -> libc.so.1:*atexit(0x1f364, 0xff3babf8, 0xff0b8048) syslog-ng -> libc.so.1:*malloc(0x3c, 0x71239160, 0x0) syslog-ng -> libc_psr.so.1:*memset(0x35a30, 0x0, 0x30) syslog-ng -> libc_psr.so.1:*memcpy(0xffbefb30, 0x334d4, 0x70) syslog-ng -> libc.so.1:*getenv(0x22538, 0x34800, 0x1) syslog-ng -> libc.so.1:*strcmp(0xffbefd2e, 0x226f8, 0x2) /usr/bin/sotruss[86]: 29449 Segmentation Fault(coredump)

1 0

wrong number of arguments calling init_file in libol
by William D. Colburn (aka Schlake) 24 Sep '01

24 Sep '01

In libol init_file() takes an additional "struct ol_string *fname" that isn't in the syslog-ng afstreams.c call. wcolburn@rainbow<~/compile/sun4>$ grep -C -n init_file syslog-ng-1.4.12/src/afstreams.c libol-0.2.24/src/io.c syslog-ng-1.4.12/src/afstreams.c-165- NEW(stream_fd, f); syslog-ng-1.4.12/src/afstreams.c-166- syslog-ng-1.4.12/src/afstreams.c:167: init_file(backend, &f->super, fd); syslog-ng-1.4.12/src/afstreams.c-168- f->super.prepare = prepare_stream_fd; syslog-ng-1.4.12/src/afstreams.c-169- f->super.read = stream_read_callback; -- libol-0.2.24/src/io.c-629- libol-0.2.24/src/io.c-630-/* Initializes a file structure, and adds it to the backend's list. */ libol-0.2.24/src/io.c:631:void init_file(struct io_backend *b, struct nonblocking_fd *f, int fd, libol-0.2.24/src/io.c-632- struct ol_string *fname) libol-0.2.24/src/io.c-633-{ -- -- William Colburn, "Sysprog" <wcolburn(a)nmt.edu> Computer Center, New Mexico Institute of Mining and Technology http://www.nmt.edu/tcc/ http://www.nmt.edu/~wcolburn

1 0

problem in destination string
by Askhat Gabdulov 23 Sep '01

23 Sep '01

Hi i try to post log messages to another server for this i add in config file : destination d_mesg { tcp(ip(xxx.xxx.x.xx) port(6969); max-connections(10)); }; but when i run syslog-ng daemon i get parse error at line that wrote i try : destination d_mesg { tcp(ip(xxx.xxx.x.xx) port(6969); }; and i get match error what is wrong?

2 2

RE: [syslog-ng]compile fail on FreeBSD 4.4-RC
by Hedberg, Eric 21 Sep '01

21 Sep '01

Ran into the same issue with 1.5.8 as well. Essentially: In nscache.h insert above the other includes: #include <sys/types.h> #include <sys/socket.h> and in nscache.c, comment out: #include <netdb.h> #include <netinet/in.h> And it should build. > -----Original Message----- > From: Ilya [mailto:mail@krel.org] > Sent: Thursday, September 20, 2001 10:04 PM > To: syslog-ng(a)lists.balabit.hu > Subject: Re: [syslog-ng]compile fail on FreeBSD 4.4-RC > > > stavke was not available at the time. and surely 4.4 RC is > more stable than > current > anyways, it gives same result on Stable now. seems to me its > ipv6 related > is there way to turn off ipv6 support during syslog-ng compilation? > > > ----- Original Message ----- > From: "Brad Arlt" <arlt(a)cpsc.ucalgary.ca> > To: <syslog-ng(a)lists.balabit.hu> > Sent: Thursday, September 20, 2001 3:16 PM > Subject: Re: [syslog-ng]compile fail on FreeBSD 4.4-RC > > > > On Thu, Sep 20, 2001 at 12:04:56AM -0400, Ilya wrote: > > > any ideas? > > > > Since RC means release cantidate (I think/hope), my vote is the same > > as the compilers > > > > nscache.c:247: This may be due to a compiler bug or to > impossible asm > > nscache.c:247: statements or clauses. > > > > There really shouldn't be *any* syntax errors in system > files, unless > > they are included after syslog-ng or libol header files (which could > > propigate errors in them to the system files via the magic of parse > > errors). This smacks of compiler/cpp/header file problems to me. > > > > Either try a known good version of syslog-ng (1.4.x?) or try FreeBSD > > 4.4-STABLE or FreeBSD-Current. > > > > > > gcc -DHAVE_CONFIG_H -I. -I/usr/tmp/syslog-ng-1.5.10/src -I. > -g -O2 -Wall > > > -I/usr/local/include/libol -D_GNU_SOURCE -c nscache.c > > > In file included from nscache.c:55: > > > /usr/include/netinet/in.h:233: syntax error before `in_addr_t' > > > /usr/include/netinet/in.h:285: syntax error before `u_char' > > > In file included from /usr/include/netinet/in.h:475, > > > from nscache.c:55: > > > /usr/include/netinet6/in6.h:122: syntax error before `u_int8_t' > > > /usr/include/netinet6/in6.h:144: syntax error before `u_int8_t' > > > /usr/include/netinet6/in6.h:149: syntax error before `u_int32_t' > > > /usr/include/netinet6/in6.h:610: syntax error before `*' > > > /usr/include/netinet6/in6.h:612: syntax error before `*' > > > /usr/include/netinet6/in6.h:612: warning: data definition > has no type or > > > storage class > > > /usr/include/netinet6/in6.h:613: syntax error before `u_int8_t' > > > /usr/include/netinet6/in6.h:614: syntax error before `u_int8_t' > > > /usr/include/netinet6/in6.h:629: syntax error before `u_int8_t' > > > /usr/include/netinet6/in6.h:634: syntax error before `u_int8_t' > > > /usr/include/netinet6/in6.h:636: syntax error before `u_int8_t' > > > nscache.c: In function `nscache_new': > > > nscache.c:112: structure has no member named `s_addr' > > > nscache.c: In function `nscache_lookup': > > > nscache.c:178: structure has no member named `s_addr' > > > nscache.c:183: structure has no member named `s_addr' > > > nscache.c:183: structure has no member named `s_addr' > > > nscache.c:245: structure has no member named `s_addr' > > > nscache.c:245: structure has no member named `s_addr' > > > nscache.c:247: fixed or forbidden register 0 (ax) was > spilled for class > > > AREG. > > > nscache.c:247: This may be due to a compiler bug or to > impossible asm > > > nscache.c:247: statements or clauses. > > > nscache.c:247: This is the instruction: > > > (insn 56 55 58 (parallel[ > > > (set (reg:SI 2 %ecx) > > > (udiv:SI (reg/v:SI 2 %ecx) > > > (reg:SI 1 %edx))) > > > (set (reg:SI 1 %edx) > > > (umod:SI (reg/v:SI 2 %ecx) > > > (reg:SI 1 %edx))) > > > ] ) 243 {udivmodsi4} (insn_list 49 (insn_list 55 (nil))) > > > (expr_list:REG_DEAD (reg/v:SI 2 %ecx) > > > (expr_list:REG_DEAD (reg:SI 1 %edx) > > > (expr_list:REG_UNUSED (reg:SI 2 %ecx) > > > (nil))))) > > > *** Error code 1 > > > > > > Stop in /usr/tmp/syslog-ng-1.5.10/src. > > > > > > > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > -------------------------------------------------------------- > ------------ > -- > > __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ > > _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ > > (_)/(_) -Eat well, sleep peacefully, drink lots, and ride > like hell. > (_)\(_) > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng >

1 0

syslog-ng-1.4.12 and libol-0.2.23 - Solaris7 and gcc-2.95.3
by Christian Korschan 21 Sep '01

21 Sep '01

Dear all, I just tried to build syslog-ng-1.4.12 under Solaris 7 with gcc-2.95.3 (after libol-0.2.23 was installed) and the build fails with: . . gcc -DHAVE_CONFIG_H -I. -I/ctbto/idc/cisd/source/build/IDC/work/syslog-ng-1.4.12/src -I. -I/opt/IDC/include -O2 -Wall -I/opt/IDC/include/libol -D_GNU_SOURCE -c afuser.c gcc -DHAVE_CONFIG_H -I. -I/ctbto/idc/cisd/source/build/IDC/work/syslog-ng-1.4.12/src -I. -I/opt/IDC/include -O2 -Wall -I/opt/IDC/include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c: In function `io_stream_get': afstreams.c:167: too few arguments to function `init_file' make[3]: *** [afstreams.o] Error 1 make[3]: Leaving directory `/ctbto/idc/cisd/source/build/IDC/work/syslog-ng-1.4.12/src' syslog-1.4.11 with libol-0.2.21 built fine under S7/SPARC and Intel and S8/SPARC. any glue ? Thanks in advance -- Christian Korschan Systems Specialist CTBTO/IDC Vienna International Centre Email: Christian.Korschan(a)CTBTO.ORG P.O. BOX 1200 Phone: +43(1)26030 6184 A-1400 Vienna, Austria FAX: +43(1)26030 5932

1 0

how to get FQDN?
by Rimdenok, Sviatoslav 21 Sep '01

21 Sep '01

Dear All, I've installed syslog-ng version 1.4.13, - it is really nice tool !! There is syslog-ng installed on each unix system. At the same time all logs are sent to the central server (where syslog-ng is installed also). At the cental server I'm triying to spread logs in the different directories by using macros like $HOST, $YEAR and so on. When I'm using $HOST directories I didn't manage to get the full domain name, - only short of it. For example, the full domain name is "server.domain.com".. but $HOST = "server".. Could you please give me a small hint what I should to change (in the system configuration, in the syslog-ng config-file)? I've tried to find the answer in the maillist archive but didn't succeed. Thank you very much! here is options section of syslog-ng.conf file (I'm using the same options on all servers): ------------------------------------------------------------ options { sync (0); time_reopen (5); log_fifo_size (1000); long_hostnames (on); use_dns (yes); use_fqdn (yes); create_dirs (yes); keep_hostname (yes); use_time_recvd(yes); }; ------------------------------------------------------------ Thanks again for your help and great tool ! regards, Slava > Sviatoslav Rimdenok > System Administrator > > COLT Telecom AG > Badenerstrasse 820 > CH-8048 Zuerich > > t (+41) +1 5 600 900 > f (+41) +1 5 600 910 > e sviatoslav.rimdenok(a)colt.ch > www.colt.ch > > we make business straight.forward >

1 0

Difficulty with source(net) on Solaris 8 [syslog-ng-1.5.9]
by Ken Paris 21 Sep '01

21 Sep '01

Greetings, I need assistance to configure syslog-ng to log external SYSLOG messages. I have successfully compiled the development branch version 1.5.9 as well as libol-0.2.24 on my Solaris8 box. I am running into the same problem with logging external syslog messages as I did with version 1.4.9a. kparis@dv-netlog$ ps -aef | grep sysl root 203 1 0 Sep 14 ? 0:00 /usr/sbin/syslogd root 10614 1 0 12:23:51 ? 0:00 /usr/local/sbin/syslog-ng - f /usr/local/etc/syslog-ng.conf -p /var/run/syslog-ng.pid I can snoop the interface and see the SYSLOG packets arrive: kparis@dv-netlog$ sudo snoop 172.16.3.254 Using device /dev/hme (promiscuous mode) 172.16.3.254 -> dv-netlog SYSLOG C port=57636 <5>371: Sep 17 13:23 I can see the messages appear into the standard syslogd destination /var/adm/messages: kparis@dv-netlog$ sudo tail -f /var/adm/messages Sep 17 13:27:39 [172.16.3.254.225.36] 371: Sep 17 13:23:54: %SYS-5-CONFIG_I: Configured from console by kparis on vty0 (172.16.0.60) Only local messages (such as sudo) appear in /var/log/default. kparis@dv-netlog$ sudo tail -f /var/log/default Sep 17 13:17:06 dv-netlog sudo: [ID 850335 local2.notice] kparis : TTY=pts/4 ; PWD=/uhome/kparis ; USER=root ; COMMAND=/usr/sbin/snoop 172.16.3.254 Sep 17 13:27:28 dv-netlog sudo: [ID 850335 local2.notice] kparis : TTY=pts/3 ; PWD=/usr/local/install ; USER=root ; COMMAND=/usr/bin/cat /var/run/syslog-ng.pid No external soruced messages appear into this same log as would be expected. My syslog-ng configuration file is as follows: kparis@dv-netlog$ more /usr/local/etc/syslog-ng.conf options { sync(0); keep_hostname(yes); chain_hostnames(no); log_fifo_size (30000); }; source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); }; source s_int { internal(); }; source s_net_udp { udp(); }; destination d_local { file("/var/log/default"); }; destination d_int { file("/var/log/internal"); }; log { source(s_local); source(s_net_udp); destination(d_local); }; log { source(s_int); destination(d_int); }; I am seeing a difference with truss on the syslog-ng process in that I no longer see the recvfrom() entries. kparis@dv-netlog$ sudo truss -p `sudo cat /var/run/syslog-ng.pid` poll(0xFFBEF5E8, 4, 100) = 0 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) poll(0xFFBEF5E8, 4, 60000) = 0 time() = 1000758508 poll(0xFFBEF5E8, 4, 100) = 0 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) = 0 poll(0xFFBEF5E8, 4, 60000) = 1 getmsg(2, 0xFFBECCF0, 0xFFBECCE0, 0xFFBECCC4) = 0 time() = 1000758520 time() = 1000758520 time() = 1000758520 time() = 1000758520 poll(0xFFBEF5E8, 4, 100) = 1 write(0, " S e p 1 7 1 3 : 2 8".., 151) = 151 time() = 1000758520 poll(0xFFBEF5E8, 4, 100) = 0 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) Err#62 ETIME time() = 1000758531 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) = 0 poll(0xFFBEF5E8, 4, 60000) = 1 getmsg(2, 0xFFBECCF0, 0xFFBECCE0, 0xFFBECCC4) = 0 time() = 1000758539 time() = 1000758539 time() = 1000758539 time() = 1000758539 poll(0xFFBEF5E8, 4, 100) = 1 write(0, " S e p 1 7 1 3 : 2 8".., 139) = 139 time() = 1000758539 poll(0xFFBEF5E8, 4, 100) = 0 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) = 0 poll(0xFFBEF5E8, 4, 60000) = 1 getmsg(2, 0xFFBECCF0, 0xFFBECCE0, 0xFFBECCC4) = 0 time() = 1000758548 time() = 1000758548 time() = 1000758548 time() = 1000758548 poll(0xFFBEF5E8, 4, 100) = 1 write(0, " S e p 1 7 1 3 : 2 9".., 150) = 150 time() = 1000758548 poll(0xFFBEF5E8, 4, 100) = 0 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) poll(0xFFBEF5E8, 4, 60000) = 0 time() = 1000758609 poll(0xFFBEF5E8, 4, 100) = 0 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) = 0 poll(0xFFBEF5E8, 4, 60000) = 1 getmsg(2, 0xFFBECCF0, 0xFFBECCE0, 0xFFBECCC4) = 0 time() = 1000758668 time() = 1000758668 time() = 1000758668 time() = 1000758668 poll(0xFFBEF5E8, 4, 100) = 1 write(0, " S e p 1 7 1 3 : 3 1".., 147) = 147 time() = 1000758668 poll(0xFFBEF5E8, 4, 100) = 0 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) = 0 poll(0xFFBEF5E8, 4, 60000) = 1 getmsg(2, 0xFFBECCF0, 0xFFBECCE0, 0xFFBECCC4) = 0 time() = 1000758683 time() = 1000758683 time() = 1000758683 time() = 1000758683 poll(0xFFBEF5E8, 4, 100) = 1 write(0, " S e p 1 7 1 3 : 3 1".., 151) = 151 time() = 1000758683 poll(0xFFBEF5E8, 4, 100) = 0 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) poll(0xFFBEF5E8, 4, 60000) = 0 time() = 1000758743 poll(0xFFBEF5E8, 4, 100) = 0 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) poll(0xFFBEF5E8, 4, 60000) = 0 time() = 1000758803 poll(0xFFBEF5E8, 4, 100) = 0 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) Err#62 ETIME time() = 1000758831 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) poll(0xFFBEF5E8, 4, 60000) = 0 time() = 1000758863 poll(0xFFBEF5E8, 4, 100) = 0 poll(0xFFBEF5E8, 4, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...)

6 7

Documentation
by Mariusz 20 Sep '01

20 Sep '01

Is anybody going to write a full documentation to this software - maybe it is nice and configurable but main its disadvantage is that there is no full documentation. Regards Mariusz -- r e k l a m a Lista Plac [ http://listaplac.onet.pl ]

1 0

newbie problem
by Henry Dziewa 18 Sep '01

18 Sep '01

Hi there, I just compiled and installed syslog-ng-1.5.9. Everything seems to be working ok but I'm not able to receive any traps from my cisco devices. I tried multiple devices and nothing seems to be getting to the syslog server. I know that they work fine with regular syslog on o0ther machines. I'm using Solaris 2.6. Here is a config file I found on this list and tried to use: options { time_reopen ( 0 ); sync ( 0 ); chain_hostnames ( no ); use_dns ( yes ); use_fqdn ( yes ); }; ########################################### # Global Source statments for the program ########################################### source src { sun-streams ( "/dev/log" door( "/etc/.syslog_door" )); internal ( ); # tcp ( max-connections( 1000 ) ); udp ( ); }; destination d_all_ms { file("/logs/machine_specific/$HOST/all.$YEAR$MONTH$DAY" group(systems) perm(0664) dir_perm(0664) create_dirs(yes) );}; destination d_cisco { file("/logs/cisco/cisco.messages" );}; # CISCO (local7) messages: filter f_cisco { facility(local7); }; # NO CISCO (local7) messages: filter f_no_cisco { not facility(local7); }; #Forward all messages to machine specific log monitored by system admins log { source(src); filter(f_no_cisco); destination(d_all_ms); }; # Log all messages coming in on local7 facility to /logs/cisco/cisco.messages log { source(src); filter(f_cisco); destination(d_cisco); }; The only messages I'm getting is from d_all_ms for the local machine: Sep 18 12:22:44 sys-backup syslog-ng[10513]: STATS: dropped 0 Sep 18 12:22:45 sys-backup syslog-ng[10513]: STATS: dropped 0 Sep 18 12:22:46 sys-backup syslog-ng[10513]: STATS: dropped 0 Sep 18 12:22:47 sys-backup syslog-ng[10513]: STATS: dropped 0 Any help would be very appreciated !

1 0

Random crashes with version 1.5.10 under Linux.
by Stephane Enten 18 Sep '01

18 Sep '01

I'm experiencing weird crashes with the mentioned version of syslog-ng running on Linux. Syslog-ng starts fine and without any warning/error, but within minutes it crashes with signal 11 (segfault) or 6 (aborted). Running syslog-ng with -d shows this error before crash: ol_object_check: Type error! I've been running it in debug and with strace logs for days no but haven't found anything obvious. Does anyone already got this behaviour ? Regards, Stephane

2 2

Difficulty compiling syslog-ng 1.4.12 on Solaris 8
by Ken Paris 17 Sep '01

17 Sep '01

Greetings, Since I am having trouble with getting syslog-ng 1.4.9a to log external messages, I am attempting to get the next stable version,1.4.12 going. On Solaris 8, I will go to a Development version if there is a consensus that I would fair better. What 1.5 version would be suggested. Disclaimer: Compiling software is not my specialty by any strech of the imagination, but I seem to get by ;-) Platform: SunOS dv-netlog 5.8 Generic_108528-09 sun4u sparc SUNW,Ultra-5_10 configure seems to do fine ... sudo ./configure loading cache ./config.cache checking for a BSD compatible install... ./install-sh -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... (cached) yes checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking whether build environment is sane... yes checking for gcc... (cached) gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ANSI C... (cached) none needed checking for bison... no checking for byacc... no checking how to run the C preprocessor... (cached) gcc -E checking for flex... (cached) lex checking for flex... (cached) lex checking for yywrap in -ll... (cached) yes checking lex output file root... (cached) lex.yy checking whether yytext is a pointer... (cached) no checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... (cached) yes checking for malloc.h... (cached) yes checking for unistd.h... (cached) yes checking for door.h... (cached) yes checking for stropts.h... (cached) yes checking for sys/strlog.h... (cached) yes checking for stdarg.h... (cached) yes checking for working const... (cached) yes checking whether time.h and sys/time.h may both be included... (cached) yes checking for modern utmp... (cached) yes checking size of short... (cached) 2 checking size of int... (cached) 4 checking size of long... (cached) 4 checking for I_CONSLOG... (cached) yes checking for working alloca.h... (cached) yes checking for alloca... (cached) yes checking for vprintf... (cached) yes checking for door_create in -ldoor... (cached) yes checking for select... (cached) yes checking for snprintf... (cached) yes checking for vsnprintf... (cached) yes checking for strerror... (cached) yes checking for inet_aton... (cached) no checking for strncpy... (cached) yes checking for getutent... (cached) yes checking for getopt_long... (cached) no checking for strcasecmp... (cached) yes checking for pthread.h... (cached) yes checking for pthread_create in -lpthread... (cached) yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking libol version >= 0.2.23... ok creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating syslog-ng.spec creating src/config.h Make seems like a problem and does not complete. kparis@dv-netlog$ sudo make Making all in src make[1]: Entering directory `/usr/local/install/syslog-ng-1.4.12/src' make all-recursive make[2]: Entering directory `/usr/local/install/syslog-ng-1.4.12/src' Making all in . make[3]: Entering directory `/usr/local/install/syslog-ng-1.4.12/src' gcc -DHAVE_CONFIG_H -I. -I/usr/local/install/syslog-ng-1.4.12/src -I. -O2 - Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c: In function `io_stream_get': afstreams.c:167: too few arguments to function `init_file' make[3]: *** [afstreams.o] Error 1 make[3]: Leaving directory `/usr/local/install/syslog-ng-1.4.12/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/install/syslog-ng-1.4.12/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/local/install/syslog-ng-1.4.12/src' make: *** [all-recursive] Error 1 If any additional info is required, I will be more than happy to provide it if I know how to. Any assistance would be appreciated. Best regards, Ken Paris/ Senior Network Engineer Bluestar Solutions, Inc.

1 0

afstreams.c:167: too few arguments to function `init_file'
by Manutsiri Chansutthirangkool 17 Sep '01

17 Sep '01

Dear All I got a problem when I tried to intall syslog-ng-1.4.12 with libol-0.2.23 on solaris sparc 2.6. When I run make, it appeared as following: gcc -DHAVE_CONFIG_H -I. -I/export/home/nms/software/syslog/syslog-ng-1.4.12/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c afstreams.c afstreams.c: In function `io_stream_get': afstreams.c:167: too few arguments to function `init_file' *** Error code 1 make: Fatal error: Command failed for target `afstreams.o' Current working directory /export/home/nms/software/syslog/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /export/home/nms/software/syslog/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /export/home/nms/software/syslog/syslog-ng-1.4.12/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' What is the problem? Regards, Manutsiri Chansutthirangkool

3 3

Difficulty with source(net) on Solaris 8 [syslog-ng-1.4.9a]
by Ken Paris 16 Sep '01

16 Sep '01

Greetings, I did as you suggested and I do see the recvfrom() when a message arrives. Never uised truss befor. Interesting, but nothing into the log file. kparis@netlog$ ps -aef | grep sysl kparis 25013 24857 0 13:38:59 pts/1 0:00 grep sysl root 23643 1 0 Sep 12 ? 0:00 /usr/local/sbin/syslog-ng - f /usr/local/etc/syslog-ng.conf -p /var/run/syslog-n truss -p 23643 poll(0xFFBEF658, 3, 60000) = 1 recvfrom(3, " < 5 > 6 7 5 : S e p ".., 519, 0, 0xFFBEF448, 0xFFBEF444) = 99 time() = 1000499766 poll(0xFFBEF658, 3, 100) = 0 poll(0xFFBEF658, 3, 60000) (sleeping...) signotifywait() (sleeping...) lwp_cond_wait(0xFF0F55C8, 0xFF0F55D8, 0xFF1D5C48) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) door_return(0x00000000, 0, 0x00000000, 0) (sleeping...) This repeats anytime I change the config on the cisco device ( which immediately sends a message to loghost ) My current config is: kparis@netlog$ cat syslog-ng.conf options { sync(0); keep_hostname(yes); chain_hostnames(no); log_fifo_size (30000); }; source s_local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal (); }; source s_net_udp { udp(); }; destination d_local { file("/var/log/default"); }; log { source(s_local); source(s_net_udp); destination(d_local); }; kparis@netlog$ ls -l /var/log total 34 -rw------- 1 root sys 0 Aug 17 14:41 authlog -rw------- 1 root root 9057 Sep 14 13:29 default .... I can see this indicates the message is arriving to syslog-ng. Am I close ? I am not sure how to proceed from this point. Thanks for your suggestions and support. Best regards, Ken Paris/ >try truss-ing syslog-ng whether it receives packets. you should see >recvfrom() calls when a message arrives. > >-- >Bazsi

2 1

Example configurations
by Feldmann Scott M. 13 Sep '01

13 Sep '01

Can someone please forward on to me your configurations that are directing log files comming from snmptrapd. I have been unable to figure out how to split them based on the host of the original snmp trap. Thank you for your help. > Scott Feldmann > Senior Network Infrastructure Analyst > UW Hospital and Clinics Information Systems > E-Mail: sm.feldmann(a)hosp.wisc.edu >

1 0