- syslog-ng - lists.balabit.hu

RE: [Abacus] Virus
by Lyle 22 Jun '01

22 Jun '01

www.eicar.org provides a test file just for this purpose and almost all virus software honors this test file for testing purposes. Lyle -----Original Message----- From: colette tostivint [mailto:colette.tostivint@fortuneo.com] Sent: Friday, June 22, 2001 8:31 AM To: maik.fischer(a)rb3m.com Cc: abacus(a)psionic.com; syslog-ng(a)lists.balabit.hu Subject: [Abacus] Virus Hi everybody I need a virus to do tests for a new mail server. Can you send a virus, please.. Thanks Colette _______________________________________________

1 0

Virus
by colette tostivint 22 Jun '01

22 Jun '01

Hi everybody I need a virus to do tests for a new mail server. Can you send a virus, please.. Thanks Colette

2 1

syslog entries without hostnames
by David Douthitt 20 Jun '01

20 Jun '01

It seems like there are a LOT of these. Isn't it possible to make some options to handle them? I was thinking of options, but... what about this? Check the hostname of the message against the hostname using DNS and see if they match. If not, shift the message over and put the hostname in - and perhaps label it to show that it was inserted.... So a message from 192.168.3.3 (hostname folly) that contained no hostname but said: "last message repeated 5 times" would then become: Jun-XX XX:XX:XX folly* last message repeated 5 times ...and the log might look like this: Jun-XX XX:XX:XX folly su: access denied Jun-XX XX:XX:XX folly* last message repeated 5 times Jun-XX XX:XX:XX folly --mark-- Well? Only problem I could see is if the hostname in the syslog entry doesn't match the name of the host as a normal event; I don't see this happening. This does, however, generate more DNS traffic, unless you cache the entries - maybe within syslog-ng.

3 4

riverstone devices not logging hostname
by Mickey Everts 18 Jun '01

18 Jun '01

For some reason, our Riverstone routers are not logging their hostnames or IP's. Here is a sample entry: Jun 01 07:28:13 %L2TM-W-INVALID_VLAN, Port et.1.1 receiving frames from non-member VLAN(3265). Possible misconfiguration. Any ideas? All our other network devices work fine, so it's probably something with them, but I was hoping I could fix it on the server side. Is anyone else here using Riverstone? Here is some more info on our setup: Riverstone (http://www.riverstonenetworks.com) info: -- Software Information Software Version : 7.0.0.0 Copyright : Copyright (c) 2000-2001 Riverstone Networks Syslog host: XX.XX.XX.XX, Facility: LOG_LOCAL0 Minimum syslog level: INFO, Buffer Size: 50 messages Source IP address: XX.XX.XX.XX -- Here are my syslog-ng (version 1.4.10) options: -- # Global options { sync(0); log_fifo_size (1000); long_hostnames(off); use_fqdn(yes); use_dns (yes); time_reopen (10); create_dirs (no); keep_hostname (yes); }; -- Regards, -MiC Mickey Everts 415.901.2223 direct Unix System Administrator 415.901.2000 main Yipes Communications, Inc. 415.533.1402 cell http://www.yipes.com/ 415.358.4112 fax

1 0

Access Control List on AIX system
by Kai Wang 18 Jun '01

18 Jun '01

I have been using syslog-ng 1.4.11 for several months. I found the "kill -HUP" command doesn't change an existing log file mode, which means not only the mode and ownership haven't been changed but also the Access Control List(acl) hasn't been changed. I just downloaded and run syslog-ng 1.5.7. I found a big change of this. When you do "kill -HUP", the log files' mode and ownership have been reset and the acl has been disabled. Mode and ownership are not a problem. But I really want to keep the old acl or allow me to reset it like the file mode and ownership. Kai

2 1

syslog-ng / logcheck
by colette tostivint 15 Jun '01

15 Jun '01

Hi everybody I setup a syslog server and upgrade it with syslog-ng for logging lot of firewall pix and routeurs. I use a script Logcheck-1.1.1 to send me the most important logs. Is syslog-ng compatible with logcheck ??? I don't believe. Thanks Colette Tostivint

3 2

compress?
by Rory Toma 15 Jun '01

15 Jun '01

Is compress on the list to be added soon? I'd like to know before I go off and try to add it. Thx. -- Rory Toma rory(a)colinburns.com Game Master http://www.colinburns.com Colin Burns Games

1 0

using ^ and/or $ in a regular expression match
by nick 15 Jun '01

15 Jun '01

Is it possible to use a ^ and $ in a regular expression in syslog-ng? This filter doesnt seem to catch the logged status message below, but if I remove the ^ from the match, then the status message is excluded.. Does syslog-ng just not support ^ and/or $, or is there something else I have to do to get them working? filter f_lost { facility(local0) and program(lost[0-9]*) and not match(^status); }; Jun 14 16:59:39 local@biggayal lost: tcpserver: status: 0/5 -- nick

1 0

separating logs by hostname
by Greg Heim 14 Jun '01

14 Jun '01

I keep reading that syslog-ng has the capability to divert into different log files based on hostname. I'm doing this with an older version by manually specifying for each machine as shown below. I'd like to avoid mucking with the config file every time we add or remove a machine (all the time). I've downloaded 1.5.7, but can't find any examples of this. Is there a simple way to do this or do I need to just add an entry for every new host? filter f_shaggy { host(shaggy); }; destination d_shaggy { file("/var/syslog-ng/shaggy"); }; log { source(src); filter(f_shaggy); destination(d_shaggy); }; TIA, Greg

2 1

syslog on a dec ev6 (es 40) with osf 4.0f?
by Daan Hoogland 14 Jun '01

14 Jun '01

Does anyone have any experience? I try to make this work with gcc and with cxx (from compaq), but neither does. The cxx version cores on startup. The gcc 2.95.2 version starts with 4 alignement messages, and then only reports internal messages and no udp. It also cores when i send it a HUP, after it has said to have reinitialized. I think it is only in compiler options but really haven't a clue. I tried 1.4.11 and 1.5.7. Compiling with -Wcast-align gives warnings on socket operations where a sockaddr_in is used as a sockaddr. Is there an explanation/man/info file for the mechanism with the .x files? tia

1 0

RE: [syslog-ng]newbie Solaris question
by Hamilton, Andrew Mr RAYTHEON 5 SIG CMD 13 Jun '01

13 Jun '01

What do you mean you can't get it to output every message it receives? I have used syslog-ng on Solaris for 2 years with very few problems and I log over 1000 devices. Do you know if it is receiving messages? You're not running syslogd as well are you? In low volumes the defaults for garbage collection should be sufficient. How many hosts are you logging? Try setting sync(0). Regards, Drew -----Original Message----- From: T. Esting [mailto:T_Esting@excite.com] Sent: Tuesday, June 12, 2001 6:16 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]newbie Solaris question I've been trying to get both 1.4.11 and 1.5.7 to run on my Solaris system, and have met with limited success. Compiling and installing were fairly easy, as was creating a configuration file. I understand from the docs that the mark() feature still doesn't work, and from the mailing list that sync_freq() should actually be sync(). I am having trouble, however, with flushing output in low-volume scenarios. Here is the configuration file I am using: options { use_dns(no); log_fifo_size(XXX); gc_idle_threshold(YYY); gc_busy_threshold(ZZZ); use_time_recvd(yes); }; source sun { sun-streams ( "/dev/log" door("/etc/.syslog_door")); internal(); }; destination testout { file ( "/var/adm/testout.txt" sync(WWW)); } ; log { source (sun); destination (testout); }; I've tried various values for WWW, XXX, YYY, and ZZZ, even setting WWW to 1. I have not been able to influence syslog-ng to write out every message it receives. Does anyone have any pointers on what I might want to try next to get syslog-ng to more reliably receive and log messages on Solaris? Thanks. _______________________________________________________ Send a cool gift with your E-Card http://www.bluemountain.com/giftcenter/ _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

have the priority field in the log
by Kai Wang 13 Jun '01

13 Jun '01

Hi, Our network group found that they can view log messages with the priority field on the routers. But after the logs arrive the unix syslog server, the priority field is gone. They prefer to have such a field in their log. Is there a way to have the priority field in the log message by syslog-ng? Kai

2 1

newbie Solaris question
by T. Esting 12 Jun '01

12 Jun '01

I've been trying to get both 1.4.11 and 1.5.7 to run on my Solaris system, and have met with limited success. Compiling and installing were fairly easy, as was creating a configuration file. I understand from the docs that the mark() feature still doesn't work, and from the mailing list that sync_freq() should actually be sync(). I am having trouble, however, with flushing output in low-volume scenarios. Here is the configuration file I am using: options { use_dns(no); log_fifo_size(XXX); gc_idle_threshold(YYY); gc_busy_threshold(ZZZ); use_time_recvd(yes); }; source sun { sun-streams ( "/dev/log" door("/etc/.syslog_door")); internal(); }; destination testout { file ( "/var/adm/testout.txt" sync(WWW)); } ; log { source (sun); destination (testout); }; I've tried various values for WWW, XXX, YYY, and ZZZ, even setting WWW to 1. I have not been able to influence syslog-ng to write out every message it receives. Does anyone have any pointers on what I might want to try next to get syslog-ng to more reliably receive and log messages on Solaris? Thanks. _______________________________________________________ Send a cool gift with your E-Card http://www.bluemountain.com/giftcenter/

1 0

syslogd core on garbage-collect filter
by jamie rishaw 11 Jun '01

11 Jun '01

Greetings all, Hope this isn't FAQ.. I'm trying to filter all of the "garbage collect" messages into /dev/null (but for initial testing, a file). syslog-ng is coring, tho, after startup with code (below). operation without the bad code, however, is fine. I am running syslog-ng 1.4.11 on FreeBSD 4.3-STABLE. bad code: -- start -- # I dont want garbage collecting messages log { source("s_int"); filter("f_isgarbage"); destination("d_garbage"); }; filter f_isgarbage { match("garbage collect"); }; destination d_garbage { file("/logs/garbage"); }; -- end -- related code (does not affect): --start-- source s_int { internal(); }; --end-- startup: noc# /usr/local/sbin/syslog-ng -v binding fd 3, inetaddr: 0.0.0.0, port: 514 binding fd 4, unixaddr: /var/run/log within 60 seconds: -rw------- 1 root wheel 380928 Jun 11 11:16 syslog-ng.core noc# gdb /usr/local/sbin/syslog-ng syslog-ng.core GNU gdb 4.18 (no debugging symbols found)... Core was generated by `syslog-ng'. Program terminated with signal 6, Abort trap. Reading symbols from /usr/lib/libc.so.4...(no debugging symbols found)...done. Reading symbols from /usr/libexec/ld-elf.so.1...(no debugging symbols found)... done. #0 0x280af8e0 in kill () from /usr/lib/libc.so.4 (gdb) bt #0 0x280af8e0 in kill () from /usr/lib/libc.so.4 #1 0x280eb62e in abort () from /usr/lib/libc.so.4 #2 0x280c83cf in __assert () from /usr/lib/libc.so.4 #3 0x805203a in io_iter () #4 0x8049ace in main_loop () #5 0x8049de3 in main () #6 0x80496f9 in _start () Thanks in advance for any advice/help, jamie -- jamie rishaw <jrishaw(a)playboy.com> sr. wan/unix engineer/ninja // playboy enterprises inc. opinions stated are mine, and are not necessarily those of the bunny.

1 0

sending alerts to phones
by foob＠return0.net 10 Jun '01

10 Jun '01

Maybe a bit off topic - but the syslog-ng feature to pipe logs to programs got me thinking: does anyone know of a provider or service that will allow me to send mobile SMS messages from the command line? I like the idea of getting alerts if, say, login fails for root and other such naughtyness :) - foob

4 4

destination { program(); } failures...
by David Douthitt 08 Jun '01

08 Jun '01

I've been trying to use: destination { program("/usr/bin/notify"); }; ...and it doesn't work. No error messages. No log messages. No nothing at all. Then I had a flash, and tried checking my hypothesis against the documentation - nothing there. Then I tried checking my hypothesis in the example *.conf files - nothing there. Then I tried it in practice: destination { program(/usr/bin/notify); }; This works better, but only seems to work when it starts up, but not thereafter. /usr/bin/notify is a /bin/sh script. Does this just not work in v1.4.10?? It's getting rather frustrating. I'm running in Red Hat Linux 6.2 without all the bells and whistles (like X). I'd *REALLY* like to get this to work - it's one of the big draws to syslog-ng for me.

6 12

Re: [syslog-ng]SNMP source and destination
by todd.glassey＠att.net 07 Jun '01

07 Jun '01

The nice thing about SNMP style traffic logs is that you can process them with MRTG and generate good graphical content for reports and the like. I suggest that you look at http://www.mrtg.org for more details on this. T. -- Regards, Todd > I don't know if anyone has answered this, and I'm too lazy to look in > the archive. But here it goes: > > On Tue, Jun 05, 2001 at 01:44:30PM -0400, Mark W. Alexander wrote: > > I just installed syslog-ng as a syslog concentrator for multiple > > network management applications that feed off syslog. I need to do the > > same thing with SNMP traps. I tried simple source and destination on > > the SNMP udp ports and it does grab and forward but not in any manner > > that makes sense to SNMP listeners on the detinations. > > Assuming you were using syslog-ng this make sense. Syslog and SNMP > Trap are very different protocols. > > > Has anyone done any work on SNMP specific sources or destinations? If > > not, is anyone else interested and can anyone give me a gentle push > > into the sources (like where the udp source/destination code is)? > > I have, but since I am not a big fan of SNMP I used an SNMP Trap > daemon that turned everything into syslog traffic (decoding what it > could of those nasty SNMP OIDs). This has worked well for me, as it > unifies logging into one resource. > > http://net-snmp.sourceforge.net/ > > Another package, Scotty, is also quite good, and is written in TCL/Tk. > I don't have the URL handy. > ---------------------------------------------------------------------------- > __o Bradley Arlt Email: arlt(a)cpsc.ucalgary.ca o__ > _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ > (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_) > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Question on using syslog-ng
by Heeres, Ken 07 Jun '01

07 Jun '01

I am looking for a package that will provide application level logging and it looks to me like syslog-ng has the capabilities I am looking for. I am not quite sure that I would want to replace syslogd with syslog-ng. Would it be possible to have syslog-ng coexist with syslogd by having it listen on a different port? I would have write a version of syslog to communicate using the alternate port. Correct? Thanks, Ken ---------------------------------------------- Kenneth J. Heeres Johns Hopkins University Group Supervisor Applied Physics Laboratory Ground Applications Group (SIG) Johns Hopkins Road Laurel, MD 20723-6099 Wash.: 240-228-5853 Balt: 443-778-5853 kenneth.heeres(a)jhuapl.edu

4 3

RE: [syslog-ng]Feature Request
by Andrew Fort 07 Jun '01

07 Jun '01

David, I guess you dont need this badly enough to hack it yourself :-) But if anyone is interested in adding this functionality for a patch, start here-- main.c main_loop() for the config file parsing debug output. center.c do_distribute_log() for the core of the filter matching. Also, do_distribute_log() could benefit from some sort of accelerated matching to (possibly) improve performance in heavy-filtering configurations, at the moment it's O(n) n~= number of rules. >Let me say first that this is a fantastic piece of software - I'm >starting to implement it in our UNIX environment. It's almost TOO >powerful :-) But that is a Good Thing. > >I don't THINK this is in the current sources, but anyway.... > >I'd like to have some serious debugging available in the logs ... for >example, right now we get: > >syslog-ng[99]: Syntax error reading config file, using old >configuration > >...and this is all you know. To actually find out the error, you have >to run syslog-ng from the command line. Then testing gets complicated >as you attempt to restart the active syslog-ng while finding out what >the syntax errors are by running it at the command line. Wouldn't be >better to do the following: > >syslog-ng[99]: Syntax error in configuration file /etc/syslog-ng.conf >at line 45 >syslog-ng[99]: Retaining old configuration > >Also, messages like these would be nice for debugging purposes: > >syslog-ng[99]: Message from source(src) received: level auth.info >syslog-ng[99]: Log #1: filter not matched >syslog-ng[99]: Log #2: filter not matched >syslog-ng[99]: Log #3: filter not matched >syslog-ng[99]: Log #4: filter f_authonly matched >syslog-ng[99]: Log #4: log used >syslog-ng[99]: Log #5: filter not matched >syslog-ng[99]: Log #6: source not matched > >...and so on. > >It would even be nice to be able to send a SIGINT or a SIGUSR1 or a >SIGUSR2 to the running syslog to manipulate the debugging messages >similar to BIND. > >_______________________________________________ >syslog-ng maillist - syslog-ng(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/syslog-ng >

2 1

Feature Request
by David Douthitt 06 Jun '01

06 Jun '01

Let me say first that this is a fantastic piece of software - I'm starting to implement it in our UNIX environment. It's almost TOO powerful :-) But that is a Good Thing. I don't THINK this is in the current sources, but anyway.... I'd like to have some serious debugging available in the logs ... for example, right now we get: syslog-ng[99]: Syntax error reading config file, using old configuration ...and this is all you know. To actually find out the error, you have to run syslog-ng from the command line. Then testing gets complicated as you attempt to restart the active syslog-ng while finding out what the syntax errors are by running it at the command line. Wouldn't be better to do the following: syslog-ng[99]: Syntax error in configuration file /etc/syslog-ng.conf at line 45 syslog-ng[99]: Retaining old configuration Also, messages like these would be nice for debugging purposes: syslog-ng[99]: Message from source(src) received: level auth.info syslog-ng[99]: Log #1: filter not matched syslog-ng[99]: Log #2: filter not matched syslog-ng[99]: Log #3: filter not matched syslog-ng[99]: Log #4: filter f_authonly matched syslog-ng[99]: Log #4: log used syslog-ng[99]: Log #5: filter not matched syslog-ng[99]: Log #6: source not matched ...and so on. It would even be nice to be able to send a SIGINT or a SIGUSR1 or a SIGUSR2 to the running syslog to manipulate the debugging messages similar to BIND.

1 0

Problems with "nscache.c" on Solaris 7
by Stefano Pasquale 06 Jun '01

06 Jun '01

Hi, I tried to compile syslog-ng. I downloaded libol-0.2.22, configured, compiled, made and made-install, and then I downloaded syslog-ng-1.5.6, configured and compiled. An error occurred with "nscache.c". I used gcc 2.8.1: sp87286@shine->/tmp/syslog-ng-1.5.6 > gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.7/2.8.1/specs gcc version 2.8.1 Beware I didn't modify anything in any config/Make-files May someone help me? Thanks Here is the relevant output of what I did. root@shine:/ # cd /tmp/libol-0.2.22 root@shine:/tmp/libol-0.2.22 # make install Making install in utils /bin/sh /tmp/libol-0.2.22/mkinstalldirs /usr/local/bin .././install-sh -c make_class /usr/local/bin/make_class Making install in src /bin/sh /tmp/libol-0.2.22/mkinstalldirs /usr/local/lib /bin/sh ../libtool --mode=install .././install-sh -c libol.la /usr/local/lib/libol.la .././install-sh -c .libs/libol.so.0.0.0 /usr/local/lib/libol.so.0.0.0 (cd /usr/local/lib && rm -f libol.so.0 && ln -s libol.so.0.0.0 libol.so.0) (cd /usr/local/lib && rm -f libol.so && ln -s libol.so.0.0.0 libol.so) chmod +x /usr/local/lib/libol.so.0.0.0 .././install-sh -c .libs/libol.lai /usr/local/lib/libol.la .././install-sh -c .libs/libol.a /usr/local/lib/libol.a ranlib /usr/local/lib/libol.a chmod 644 /usr/local/lib/libol.a ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - use the `-RLIBDIR' linker flag See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- /bin/sh /tmp/libol-0.2.22/mkinstalldirs /usr/local/include/libol mkdir /usr/local/include/libol .././install-sh -c -m 644 abstract_io.h /usr/local/include/libol/abstract_io.h .././install-sh -c -m 644 alist.h /usr/local/include/libol/alist.h .././install-sh -c -m 644 format.h /usr/local/include/libol/format.h .././install-sh -c -m 644 gc.h /usr/local/include/libol/gc.h .././install-sh -c -m 644 io.h /usr/local/include/libol/io.h .././install-sh -c -m 644 jpoll.h /usr/local/include/libol/jpoll.h .././install-sh -c -m 644 list.h /usr/local/include/libol/list.h .././install-sh -c -m 644 objbase.h /usr/local/include/libol/objbase.h .././install-sh -c -m 644 objects.h /usr/local/include/libol/objects.h .././install-sh -c -m 644 objtypes.h /usr/local/include/libol/objtypes.h .././install-sh -c -m 644 pkt_buffer.h /usr/local/include/libol/pkt_buffer.h .././install-sh -c -m 644 queue.h /usr/local/include/libol/queue.h .././install-sh -c -m 644 read_line.h /usr/local/include/libol/read_line.h .././install-sh -c -m 644 resource.h /usr/local/include/libol/resource.h .././install-sh -c -m 644 stream_buffer.h /usr/local/include/libol/stream_buffer.h .././install-sh -c -m 644 werror.h /usr/local/include/libol/werror.h .././install-sh -c -m 644 xalloc.h /usr/local/include/libol/xalloc.h .././install-sh -c -m 644 command.h /usr/local/include/libol/command.h .././install-sh -c -m 644 io_commands.h /usr/local/include/libol/io_commands.h .././install-sh -c -m 644 abstract_io.h.x /usr/local/include/libol/abstract_io.h.x .././install-sh -c -m 644 alist.h.x /usr/local/include/libol/alist.h.x .././install-sh -c -m 644 io.h.x /usr/local/include/libol/io.h.x .././install-sh -c -m 644 list.h.x /usr/local/include/libol/list.h.x .././install-sh -c -m 644 read_line.h.x /usr/local/include/libol/read_line.h.x .././install-sh -c -m 644 resource.h.x /usr/local/include/libol/resource.h.x .././install-sh -c -m 644 io_commands.h.x /usr/local/include/libol/io_commands.h.x .././install-sh -c -m 644 command.h.x /usr/local/include/libol/command.h.x .././install-sh -c -m 644 queue.h.x /usr/local/include/libol/queue.h.x .././install-sh -c -m 644 olconfig.h /usr/local/include/libol/olconfig.h /bin/sh /tmp/libol-0.2.22/mkinstalldirs /usr/local/bin ./install-sh -c libol-config /usr/local/bin/libol-config root@shine:/tmp/libol-0.2.22 # root@shine:/tmp/libol-0.2.22 # root@shine:/tmp/libol-0.2.22 # sp87286@shine->/tmp/syslog-ng-1.5.6 > echo $LD_LIBRARY_PATH /usr/dt/lib:/usr/local/lib:/usr/dt/lib:/usr/local/lib: sp87286@shine->/tmp/syslog-ng-1.5.6 > ./configure loading cache ./config.cache checking for a BSD compatible install... ./install-sh -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... (cached) yes checking for working aclocal... missing checking for working autoconf... missing checking for working automake... missing checking for working autoheader... missing checking for working makeinfo... missing checking whether build environment is sane... yes checking for gcc... (cached) gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for gcc option to accept ANSI C... (cached) none needed checking for bison... (cached) bison -y checking how to run the C preprocessor... (cached) gcc -E checking for flex... (cached) flex checking for flex... (cached) flex checking for yywrap in -lfl... (cached) yes checking lex output file root... (cached) lex.yy checking whether yytext is a pointer... (cached) yes checking whether make sets ${MAKE}... (cached) yes checking for ANSI C header files... (cached) yes checking for malloc.h... (cached) yes checking for unistd.h... (cached) yes checking for door.h... (cached) yes checking for stropts.h... (cached) yes checking for sys/strlog.h... (cached) yes checking for stdarg.h... (cached) yes checking for sys/klog.h... (cached) no checking for working const... (cached) yes checking whether time.h and sys/time.h may both be included... (cached) yes checking for modern utmp... (cached) yes checking whether to compile klogctl... no checking size of short... (cached) 2 checking size of int... (cached) 4 checking size of long... (cached) 4 checking for I_CONSLOG... (cached) yes checking for working alloca.h... (cached) yes checking for alloca... (cached) yes checking for vprintf... (cached) yes checking for door_create in -ldoor... (cached) yes checking for select... (cached) yes checking for snprintf... (cached) yes checking for vsnprintf... (cached) yes checking for strerror... (cached) yes checking for inet_aton... (cached) no checking for strncpy... (cached) yes checking for getutent... (cached) yes checking for getopt_long... (cached) no checking for strcasecmp... (cached) yes checking for strptime... (cached) yes checking for pthread.h... (cached) yes checking for pthread_create in -lpthread... (cached) yes checking whether to enable Sun STREAMS support... yes checking whether to enable Sun door support... yes checking libol version >= 0.2.22... ok creating ./config.status creating Makefile creating src/Makefile creating src/tests/Makefile creating doc/Makefile creating doc/sgml/Makefile creating contrib/Makefile creating utils/Makefile creating syslog-ng.spec creating src/config.h src/config.h is unchanged sp87286@shine->/tmp/syslog-ng-1.5.6 > sp87286@shine->/tmp/syslog-ng-1.5.6 > make Making all in src make all-recursive Making all in . gcc -DHAVE_CONFIG_H -I. -I/tmp/syslog-ng-1.5.6/src -I. -O2 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c nscache.c nscache.c: In function `nscache_new': nscache.c:112: `INADDR_NONE' undeclared (first use in this function) nscache.c:112: (Each undeclared identifier is reported only once nscache.c:112: for each function it appears in.) *** Error code 1 make: Fatal error: Command failed for target `nscache.o' Current working directory /tmp/syslog-ng-1.5.6/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /tmp/syslog-ng-1.5.6/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /tmp/syslog-ng-1.5.6/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' sp87286@shine->/tmp/syslog-ng-1.5.6 > -- Stefano Pasquale

2 1

Filtering "syslog-ng daemon" logs
by Eric Parusel 05 Jun '01

05 Jun '01

Hi, I'd like to filter out the syslog-ng logs that I get in my /var/log/messages file. Can I use a command-line flag to turn off these logs?: Jun 4 10:20:00 ldap1 syslog-ng[84369]: io.c: do_write: write() failed (errno 32), Broken pipe Jun 4 10:20:00 ldap1 syslog-ng[84369]: Connection broken, reopening in 60 seconds Jun 4 10:21:00 syslog1 syslog-ng[274]: AF_INET client connected from 127.0.0.1, port 1046 If not, can will the following filter work? filter f_nosyslog-ng { program("syslog-ng") and ( match("io\.c\:") or match("Connection\ broken\,\ reopening") or match("SIGHUP") or match("AF_INET_client") ); }; Did I use the brackets correctly? filter foo { program() and (match() or match() ); }; I'm no expert with regular expressions or syslog-ng filters, so bear with me :) As well, I'm using a tcp connection over stunnel, I would assume that it is normal to receive these messages occasionally? Thanks, Eric Parusel Systems Administrator Global Relay Communications

2 1

AIX and repeated message formats - fix?
by Jon Marks 04 Jun '01

04 Jun '01

Earlier I posted a message asking about whether syslog-ng had standard equipment for dealing with a couple of strange message types: 1) Messages forwarded by AIX syslogd which contain the string "Message forwarded from [hostname]: " ... and 2) Messages of the form: "last message repeated _n times" I haven't received any responses. I've read traffic in the mailing list archives (e.g. December 2000) regarding the topic, but I haven't found any solutions. If I've missed something vital, please help me and let me know about it.. I certainly apologize if I haven't been observant enough to skim the answers from the available resources. I've taken a stab at solving the problem myself, and I thought I'd share it with all of you. Those of you who are so much more familiar with the source than I, please comment about whether you find I might have broken other functionality or adversely affected performance. I'm glad for you suggestions, or if this can help somebody else. For my installation, being able to handle AIX messages is particularly important. My solution is just a simple and straightforward refactoring in log.c/parse_log_msg(). A patch against the 1.4.11 source distribution is attached to this message. I've tested it only on AIX, but I think it ought to work elsewhere since it only adds standard library stuff. (Basically, a couple of memcmp's). Some commented-out debugging output (to stderr) is there, too, if you'd want to enable it. I'll describe the intended effects of this patch: 1) Messages forwarded by AIX systems are recognized, and the source hostname is taken from the string appended by AIX syslogd. For example, MMM DD HH:MM:SS Message forwarded from <hostname>: ... will use <hostname> for the source address. "Message" isn't taken as the source host. 2) If the message is forwarded by AIX syslogd but originally of syslog-ng origin, it'll have the form MMM DD HH:MM:SS Message forwarded from <hostname>: source@hostname ... In this case, "source@hostname" will be used as the source hostname (so that syslog-ng's source info is preserved). 3) If the message doesn't contain a hostname because it's of the form MMM DD HH:MM:SS last message repeated *n* times then it won't try to extract one (so it won't improperly use 'last'). The hostname will just come later when in sources.c it's gotten from the message source socket or wherever. 4) If the message is a "last message repeated ..." which was *also* forwarded by an AIX syslogd, it'll get the hostname extracted from AIX's "Message forwarded from ..." message. I'm no expert in the syslog protocol/format, and I can see there is variablilty in implementation. So I'm certain there are plenty of cases that are left unaddressed. If you don't find this patch helpful in general, perhaps its useful for some common cases. One thing that's not addressed: When a "last message repeated ..." line is received, it's certainly helpful to know *which* was the last line-- the one that got repeated. If you're outputting to files by PROGRAM, then no program name is inherently available from this kind of message itself. And syslog-ng isn't keeping track of what PROGRAM logged last from a particular source host. So these "last message repeated ..." messages won't fall into the same logs as the lines for the PROGRAMs which produced the repeated messages. No simple solution is readily apparent to me... Also, please note that "keep_hostname(yes)" is important, otherwise the AIX sender of forwarded messages is used anyway-- despite that the real origin is available. If you use chain_hostnames(yes), then this info ought to be preserved anyway. Again, please comment and critique! Thanks very much. -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

3 5

Log paths that DON'T stop matching....
by David Douthitt 04 Jun '01

04 Jun '01

It's hard to explain what I want, but here I'll try. A normal log path is thus: log { source(...); filter(...); destination(...); }; ...and when a match occurs (source and filter) then the message is sent to the destination and matching stops. To do what I'd like, with what I've seen so far, is to do something like this: log { source(a); filter(f_ba); destination(c); destination(d); }; log { source(a); filter(f_bb); destination(c); destination(e); }; log { source(a); filter(f_bc); destination(c); destination(f); }; log { source(a); filter(f_bd); destination(c); destination(g); }; log { source(a); filter(f_other); destination(c); }; What I'd like would be something closer to this - taking "passthru" to be an option to NOT stop filtering: log { source(a); filter(f_ba); destination(d); passthru; }; log { source(a); filter(f_bb); destination(e); passthru; }; log { source(a); filter(f_bc); destination(f); passthru; }; log { source(a); filter(f_bd); destination(g); passthru; }; log { source(a); filter(f_other); destination(c); }; This would be very much useful in situations like: log { source(internal); filter(f_crit); destination(pager); } log { source(internal); filter(DEFAULT); destination(mesg); } Or other similar...

2 2

Irix Support?
by Sean Brannon 02 Jun '01

02 Jun '01

I've grep'd thru the last 1.5 years of this mailing list and not come up with a definitive answer so I have to ask: Does syslog-ng compile and function properly on Irix 6.5.x? TIA....

1 0