- syslog-ng - lists.balabit.hu

Dropping entries.
by Scott A. McIntyre 26 Jan '01

26 Jan '01

Hi, I'm trying to use syslog-ng as a syslog sink for a number of boxes, but I've found that something in the chain is dropping some number of the syslog events. Specifically, I've got 10 mail servers all logging their sendmail's into one file on the syslog sink -- much easier to parse this way. Unfortunately, I've discovered that a number of entries were logged on the local box were dropped somewhere on their way to the Big Log file on the syslog-ng machine. Is there anything I can try to make sure this doesn't happen? Any options I can tweak, that sort of thing. Would logging to individual files on a host by host basis be better, coupled with sylog-ng monitoring those local files to concatenate them all into one larger file? It may very well be a case of UDP getting lost on a busy network, but I'd like to do everything I can on the syslog-ng side first. Thanks, Scott

2 1

Filter Problem
by John A. Parker 26 Jan '01

26 Jan '01

My intent with the following filter, etc. is to exclude messages coming in from facility local7 from being logged to /var/adm/messages. It does not seem to work as those messages are making it there. Can anyone spot what might be wrong with the filter/destination/log stanza(s)? filter f_var_adm { level(emerg,alert,crit,err) or ( facility(kern) and level(debug) ) or ( facility(daemon) and level(notice) ) or ( facility(local2) and level(notice) ) or ( facility(auth) and level(notice,info) ) or ( facility(mail) and level(crit) ) and not ( facility(local7) ); }; destination d_var_adm { file("/var/adm/messages"); }; # Log all messages conforming to the f_var_adm filter to /var/adm/messages log { source(stdlog); filter(f_var_adm); destination(d_var_adm); };

1 0

RE: [syslog-ng]help w/config script
by Ohrberg, Mick 24 Jan '01

24 Jan '01

> I am trying to compile the following script on a Solaris Machine running > Solaris 7...I'm using Syslog-ng 1.4.10....I keep getting an error message > that reads unexpected token on the options line...which I do not understand > since I just copied the 1st part of the script from the default script > included with Syslog-ng... [snip] Arthur, I don't believe you want blanks between e.g 'sync' and '(0)', i.e you want to make it sync(0); instead of sync (0); /Mick

1 0

help w/config script
by Arthur Abrego 24 Jan '01

24 Jan '01

I am trying to compile the following script on a Solaris Machine running Solaris 7...I'm using Syslog-ng 1.4.10....I keep getting an error message that reads unexpected token on the options line...which I do not understand since I just copied the 1st part of the script from the default script included with Syslog-ng... options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); }; source s_net { tcp (ip(116.214.36.59) port(514)); }; destination d_kern { file("/var/log/syslog"); }; destination d_auth { file("/var/log/syslog"); }; destination d_user { file("/var/log/syslog"): }; destination d_daemon { file("/var/log/syslog"); }; destination d_cons { file("/dev/console") ; }; destination d_mesg { file("/var/adm/messages"); }; destination d_cron { file("/var/log/varlog"); }; destination d_local { file("/var/log"); }; destination d_mlop { usertty("operator"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; destination d_midget { tcp("216.141.36.59" port(514)); }; filter f_filter1 { level(emerg) or level(alert) or level(crit) or level(err)or (level(debug) or level(warning) or level(info)) }; filter f_filter2 { level(emerg) or level(alert) or level(warning) or (level(err) or level(crit)); }; filter f_filter3 { level(emerg) or level(alert) or level(warning) or (level(err) or level(crit) or level(debug)); }; filter f_filter4 { level(alert); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(kern) and level(notice); }; filter f_filter7 { facility(mail) and level(debug); }; filter f_filter8 { facility(user) and level(err); }; filter f_filter9 { facility(user) and level(alert); }; log { source(s_sys); filter(f_filter1); destination(d_kern); }; log { source(s_sys); filter(f_filter2); destination(d_auth); }; log { source(s_sys); filter(f_filter3); destination(d_daemon);}; log { source(s_sys); filter(f_filter4); destination(d_daemon);}; log { source(s_sys); filter(f_filter5); destination(d_daemon);}; log { source(s_sys); filter(f_filter6); destination(d_daemon);}; log { source(s_sys); filter(f_filter7); destination(d_daemon);}; log { source(s_sys); filter(f_filter8); destination(d_daemon);}; log { source(s_sys); filter(f_filter9); destination(d_daemon);}; log { source(s_sys); filter (DEFAULT); destination(d_midget); }; -- Arthur Abrego aabrego(a)onebox.com - email (512) 682-6934 x5113 - voicemail/fax __________________________________________________ FREE voicemail, email, and fax...all in one place. Sign Up Now! http://www.onebox.com

1 0

Re: [syslog-ng]sync question, feature request
by Thierry Besancon 22 Jan '01

22 Jan '01

Dixit Gregor Binder <gbinder(a)sysfive.com> (le Thu, 11 Jan 2001 17:05:03 +0100) : » > Nevertheless, I'm not sure that is really what you (and I) want. In my » > example, it creates files with the *dates of the syslog messages* what » > is different from the date of the day they are received. In my case, » > it seems I have syslog clients with unsynchronized clocks and I » > already have messages-20010704 for example (4th july 2001 !). » » I have requested the feature to change this behaviour some time ago, and » Balasz made it come true shortly after, it's an option. use_time_recvd() » boolean. It is not yet documented... But the source of course mention it. Thierry

4 4

program trouble
by Robert Andersson 22 Jan '01

22 Jan '01

Hi all! I have a problem with the program destination when having the following in my syslog-ng.conf file ###start options { long_hostnames(off); sync(0); }; source src { unix-stream("/dev/log"); internal(); }; destination dhcp { program("script-program"); }; filter f_dhcp { program("dhclient"); }; log { source(src); filter(f_dhcp); destination(dhcp); }; ###stop it will run the script-program once when reloading syslog-ng not when matching the filter. Though, if I alter the destination line to ### start destination dhcp { file("/var/log/dummy"); }; ### stop it will output (as I thought and like :) to this dummy log everytime it matches the filter, not once when reloading syslog-ng. I would like my first destination file to behave in a similar manner, that is when doing a program destination it should run the script each time it matches the filter. Is it just me or is something else? Been trying to find it for hours now, searching through this mailing lists archive, searching the docs... but without success. I really hope you can help me out here. Ooops forgot my setup is syslog-ng version 1.4.10 debian 2.2r2 sparc on a sparc station 10 (40MHz wee! :) Yours, /Robert -- Computational Linguistics Department of Linguistics Göteborg University

2 2

Re: [syslog-ng]program trouble
by Wendell Turner 22 Jan '01

22 Jan '01

> I have a problem with the program destination when having the > following in my syslog-ng.conf file > > destination dhcp { program("script-program"); }; > > it will run the script-program once when reloading syslog-ng > not when matching the filter. I've been using a C program rather than a script. It seems that syslog-ng loads the program once, and sends input to it whenever the filter matches. That is, the C program must while ((r = read(0, buffer, Buf_Len)) > 0) { process input } I suppose your script would need to do the same thing. Wendell Turner

1 0

hostnames matching problem still unsolved
by Keith McDuffee 19 Jan '01

19 Jan '01

I posted this last month but I'm still surprised nobody else has run into this problem, so I'm giving it one more shot: One problem I've found after installing syslog-ng 1.4.10 on a Solaris 2.6 system is with repeating messages, especially those originating from remote hosts. For example, here's some lines from my config file: ---- source s_udp { udp(); }; destination d_udp { file("/var/log/remote/$HOST.$FACILITY"); }; filter f_udp { level(notice) or (facility(local0) and level(info)) or (facility(local1) and level(info)) or (facility(local2) and level(info)); }; log ( source(s_udp); filter(f_udp); destination(d_udp); }; ---- Using this configuration, I get files in /var/log/remote that look like this: hostname1.local0 hostname2.local2 hostname1.auth last.local2 See that "last.local2"? Well, "last" is not a host -- it's taking it from the log message and mistakenly turning it into a hostname. Here's a line from "last.local2": --- Dec 22 10:14:13 last message repeated 2 times --- Any idea at all how to fix that besides making a filter for any hosts named "last"? Thanks, Keith

2 1

RE: [syslog-ng]syslog-ng 1.5.3 released
by Andrew Fort 19 Jan '01

19 Jan '01

> Hi, > > syslog-ng 1.5.3 released which adds support for user > definable log file > formats. Here's how to use it: > > destination my_file { > file("/var/log/messages" template("$ISODATE $TAG > $FULLHOST $MESSAGE")); > }; > > Documentation is not updated, for a list of available macros check out > affile.c, expand_macros() function. I'd appreciate some > testing, because I > won't have too much time to do it myself. Here's a list of the macros and an example of their output, in the following format $MACRO_NAME description/type example $FACILITY syslog facility name daemon $PRIORITY the syslog priority name debug $LEVEL ; same output as $PRIORITY $TAG Hex representaiton of the 32-bit priority/facility pair (see /usr/include/sys/syslog.h) 1f (1f is the output for "daemon/debug" as above) $DATE The local system time Jan 19 23:27:21 $FULLDATE Same as $DATE but with %Y appended, 2001 Jan 19 23:27:21 $ISODATE ISO-standard format date (strftime format "%Y-%m-%dT%H:%M:%S%z") 2001-01-19T23:27:21+1000 $YEAR 4-digit year string 2001 $MONTH 2-digit month string 01 $DAY 2-digit day string 19 $HOUR 2-digit hour string 23 $MIN 2-digit minutes string 27 $SEC 2-digit seconds string 21 $HOST host string; not sure how to decode this function, in my example it's the same as fullhost (?) avrio $FULLHOST "full hostname" (msg->host->data) avrio $PROGRAM If syslog-ng has pulled a 'program name' out of the message, this will return that qpage $MSG || $MESSAGE The full syslog message qpage[9366]: processing the page queue Balazs forgot one thing - you'll also need to include a "\n" at the end of your template directive if you want to make your output readable :) e.g. destination my_file { file("/var/log/messages" template("$ISODATE $TAG $FULLHOST $MESSAGE\n")); }; Balazs, my test config was: destination d_format_test { file("/var/log/test" template("$FACILITY $PRIORITY $LEVEL $TAG $DATE $FULLDATE $ISODATE $YEAR $MONTH $DAY $HOUR $MIN $SEC $HOST $FULLHOST $PROGRAM $MSG\n")); }; log { source(s_sys); filter(DEFAULT); destination(d_format_test); }; the output used in the examples above is daemon debug debug 1f Jan 19 23:27:21 2001 Jan 19 23:27:21 2001-01-19T23:27:21+1000 2001 01 19 23 27 21 avrio avrio qpage qpage[9366]: processing the page queue seems to work okay with the \n. Thanks Balazs, now I can use the clock on my ciscos for the log messages, again! -afort

2 1

RE: [syslog-ng]syslog-ng 1.5.3 released
by Andrew Fort 19 Jan '01

19 Jan '01

Balazs, Excellent! I have been wanting this feature the whole time, I'll do a little black-box testing for you. > syslog-ng 1.5.3 released which adds support for user > definable log file > formats. Here's how to use it:

1 0

syslog-ng 1.5.3 released
by Balazs Scheidler 19 Jan '01

19 Jan '01

Hi, syslog-ng 1.5.3 released which adds support for user definable log file formats. Here's how to use it: destination my_file { file("/var/log/messages" template("$ISODATE $TAG $FULLHOST $MESSAGE")); }; Documentation is not updated, for a list of available macros check out affile.c, expand_macros() function. I'd appreciate some testing, because I won't have too much time to do it myself. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

Re: [syslog-ng]bug? OR dont seem to work right.
by Balazs Scheidler 18 Jan '01

18 Jan '01

> Whenever I combine 2 filters with a 'OR', it matches just about anything. > (except if those 2 filters are of different kind, like program & facility, > etc.. ) > > For exemple : > destination trylog { file("/var/log/CransMisc/try.log" owner("root") > group("adm") perm(0640)); }; > filter f_stunnel { program("stunnel"); }; > filter f_squid { program("squid"); }; > filter f_try { filter(f_stunnel) or filter (f_squid); }; #(bug1) > log { source(src); filter(f_try); destination(trylog); }; > > will put all kinds of stuff in try.log, with program names that contain > neither 'tunnel' nor 'squid'. > (eg: 'cucipop' lines end up in try.log... ) > > Same thing if I define f_try directly, without using f_stunnel and f_squid, > as : > filter f_try { program("stunnel") or program("squid"); }; #(bug2) > Also, the 'or' does strange thing with other filters than 'program', like : > filter f_try { program("local2") or facility("local3"); }; #(bug3) hmm.. Could you send me the exact messages going to wrong place? because I couldn't reproduce the problem, the filters were working fine. I tried the following messages: Jan 18 21:04:04 bzorp squid: Modem hangup 1 Jan 18 21:04:04 bzorp pppd[1911]: Modem hangup 2 Jan 18 21:04:04 bzorp cucipop: Modem hangup 2 Jan 18 21:04:04 bzorp stunnel[1911]: Modem hangup 3 syslog-ng correctly filtered squid and stunnel, others were dropped. I also tried deleting the PID value, but it didn't change. > Isn't that a bug in syslog-ng ?? > -- Sam > PS: this aside, syslog-ng is really great, so much better than the old > awkward syslogd.. thanks -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

1 0

HUP problems
by Balazs Scheidler 18 Jan '01

18 Jan '01

Hi, Several of you noted that syslog-ng crashes on SIGHUP sometimes. I'd really like to fix this bug, but I'd need a backtrace of a syslog-ng & libol built with debug information. To create this configure both libol and syslog-ng with the --with-debug configure time option. Have syslog-ng core itself (with ulimit -c unlimited), and send me the results of the following command: gdb syslog-ng -c core bt I may need binaries, the core file and strace results as well, but as a first step the backtrace should be enough. Could anybody help? thanks. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt

2 1

TCP transport reliability
by Jon Marks 18 Jan '01

18 Jan '01

Hello, I'm testing syslog-ng with TCP transport, and I'm a little surprised- perhaps I'm doing something wrong? I'm finding severe message loss, which I had imagined TCP would eliminate. Briefly, my testing paradigm is as follows: On a client, I run a program which generates 5000 messages (LOCAL6/INFO) in rapid succession. The client is a Sparc Ultra 10, Solaris 7, and so uses the reliable door IPC mechanism for local message delivery. The loghost is an IBM 43P, AIX4.3.3, listening on TCP port 514. The messages have sequence numbers in their body, for example: Jan 4 10:34:24 local@peewee/peewee TEST[2362]: (3241) TEST MESSAGE (3241) Jan 4 10:34:24 local@peewee/peewee TEST[2362]: (3242) TEST MESSAGE (3242) I use a perl script to detect which are missing from the local (Sparc) logs and the remote (IBM) logs. Here is a sample result: SPARC (Client) ----------------------------------- Missing trials: Total found: 5000 (missing 0) IBM (remote Loghost) ----------------------------------- Missing trials: 3231-3240 3475-3523 3637-3662 3776-3805 4019-4087 4201-4232 4346-4381 4516-4532 4746-4791 4905-4907 Total found: 4682 (missing 318) Searching the IBM log corroborates this result. Therefore, log messages are being dropped somewhere. As this example shows, they are not lost on the Sparc; only on the IBM loghost. This effect is exacerbated by multiple clients- the client test program can listen on a port for a "go" signal so that I can coordinate a synchronized stress-test on the loghost. Massive losses using UDP are not surprising; but I would expect that with TCP the messages are not lost. Here are excerpts from the client and loghost config files to demostrate my belief that I'm using TCP: Client (SPARC): ----------------------------------- # ... destination d_vader { tcp("130.126.112.253" port(514)); }; destination d_local6 { file("/var/log/syslog/local6"); }; log { source(local); filter(f_local6); destination(d_vader); destination(d_local6); }; Loghost (IBM) ----------------------------------- source local { unix-dgram("/dev/log"); tcp(ip(0.0.0.0) port(514)); internal(); }; #... destination d_local6 { file("/var/log/syslog/local6"); }; log { source(local); filter(f_local6); destination(d_local6); }; Please ignore that I'm calling messages received from a network source "local"-- this is only during testing. Would anybody like to share some insight into this problem? I have another comment: When I run syslog-ng on Solaris (not AIX, though), I get the following result. # /usr/local/sbin/syslog-ng Terminated A daemon process is left running, however, and seems to operate normally (save for the previous issue). Following is 'truss' output for the initial syslog-ng process, containing a few lines preceeding the receipt of a kill signal: open("/etc/passwd", O_RDONLY) = 4 fstat64(4, 0xFFBEEB88) = 0 ioctl(4, TCGETA, 0xFFBEEB14) Err#25 ENOTTY read(4, " r o o t : x : 0 : 1 : S".., 8192) = 756 llseek(4, 0xFFFFFFFFFFFFFD2D, SEEK_CUR) = 33 close(4) = 0 ioctl(3, TCGETA, 0xFFBEF294) Err#25 ENOTTY llseek(3, 0, SEEK_CUR) = 4128 close(3) = 0 fork1() = 2539 signotifywait() = 15 lwp_mutex_wakeup(0xFF3DFDF0) = 0 lwp_mutex_lock(0xFF3DFDF0) = 0 lwp_mutex_wakeup(0xFF14D4D0) = 0 lwp_mutex_lock(0xFF14D4D0) = 0 lwp_mutex_wakeup(0xFF150C58) = 0 lwp_mutex_lock(0xFF150C58) = 0 lwp_sema_post(0xFF00FE78) = 0 lwp_sema_wait(0xFF00FE78) = 0 lwp_mutex_wakeup(0xFF150C58) = 0 lwp_mutex_lock(0xFF150C58) = 0 Received signal #15, SIGTERM [default] siginfo: SIGTERM pid=2539 uid=0 lwp_sigredirect(1, SIGTERM) = 0 *** process killed *** Does anyone know offhand why this should happen? Thanks very much for any advice you can offer. -- Jonathan Marks Systems Administrator, Production Systems Group Computing and Communication Services Office University of Illinois at Urbana-Champaign

7 10

Missing returns?
by Adrian Bool 17 Jan '01

17 Jan '01

Hi, I'm running syslog-ng-1.4.9a on a RedHat 7 box. I'm receiving syslog UDP messages from several cisco routers - and writing those messages to a file. Allow works OK, except the messages are all batched on lines - each line being 1077 bytes long - instead of each message being on a separate line. The syslog messages are definatley coming in separately (verified with ngrep). My syslog config is below - the 'core' items are the ones handling these data from the routers. All logs from this box itself are fine. Any ideas? Thanks aid # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # #options { use_fqdn(yes); long_hostnames(on); sync(0); }; options { use_fqdn(yes); sync(0); }; source local { unix-stream("/dev/log"); internal(); }; source net { udp(); }; destination authlog { file("/opt/log/auth.log"); }; destination syslog { file("/opt/log/syslog"); }; destination cron { file("/opt/log/cron.log"); }; destination daemon { file("/opt/log/daemon.log"); }; destination kern { file("/opt/log/kern.log"); }; destination lpr { file("/opt/log/lpr.log"); }; destination user { file("/opt/log/user.log"); }; destination uucp { file("/opt/log/uucp.log"); }; destination mail { file("/opt/log/mail.log"); }; destination mailinfo { file("/opt/log/mail.info"); }; destination mailwarn { file("/opt/log/mail.warn"); }; destination mailerr { file("/opt/log/mail.err"); }; destination newscrit { file("/opt/log/news/news.crit"); }; destination newserr { file("/opt/log/news/news.err"); }; destination newsnotice { file("/opt/log/news/news.notice"); }; destination debug { file("/opt/log/debug"); }; destination messages { file("/opt/log/messages"); }; destination console { usertty("root"); }; destination console_all { file("/dev/tty12"); }; #destination loghost { udp("loghost" port(999)); }; destination core_debug { file("/opt/log/core/debug.$YEAR.$MONTH"); }; destination core_default { file("/opt/log/core/default.$YEAR.$MONTH"); }; destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(authpriv, mail); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_news { facility(news); }; filter f_debug { facility(debug); }; #filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter l_debug { level(debug); } ; log { source(local); filter(f_authpriv); destination(authlog); }; log { source(local); filter(f_syslog); destination(syslog); }; log { source(local); filter(f_cron); destination(cron); }; log { source(local); filter(f_daemon); destination(daemon); }; log { source(local); filter(f_kern); destination(kern); }; log { source(local); filter(f_lpr); destination(lpr); }; log { source(local); filter(f_mail); destination(mail); }; log { source(local); filter(f_user); destination(user); }; log { source(local); filter(f_uucp); destination(uucp); }; log { source(local); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(local); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(local); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(local); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(local); filter(f_news); filter(f_err); destination(newserr); }; log { source(local); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(local); filter(f_debug); destination(debug); }; log { source(local); filter(f_messages); destination(messages); }; log { source(local); filter(f_emergency); destination(console); }; log { source(local); destination(console_all); }; log { source(net); filter(l_debug); destination(core_debug); }; log { source(net); filter(DEFAULT); destination(core_default); }; -- Adrian Bool | http://noc.vianetworks.net/ Director, Global Network | tel://+44.1925.484061/ VIA NET.WORKS Inc. | fax://+44.1925.484466/

1 1

a small patch for 1.5
by Wiktor Wodecki 16 Jan '01

16 Jan '01

heya, this one fixes a rather cosmetic configure issue. configure didn't return exit 0 when there was no libol. diff -bur syslog-ng-1.5.2/configure syslog-ng-1.5.2.patched/configure --- syslog-ng-1.5.2/configure Mon Jan 15 11:08:31 2001 +++ syslog-ng-1.5.2.patched/configure Tue Jan 16 15:08:30 2001 @@ -2658,6 +2658,10 @@ echo "configure:2659: checking libol version >= $LIBOL_REQ_MAJOR.$LIBOL_REQ_MINOR.$LIBOL_REQ_PATCH" >&5 if test "$with_libol" = ""; then + if ! [ -x libol-config ]; then + echo "can't locate libol, aborting. Use --with-libol directive if it is installed" + exit 0 + fi LIBOL_VERSION=`libol-config --version` LIBOL_CFLAGS=`libol-config --cflags` LIBOL_LIBS=`libol-config --static-libs` diff -bur syslog-ng-1.5.2/configure.in syslog-ng-1.5.2.patched/configure.in --- syslog-ng-1.5.2/configure.in Mon Jan 15 11:08:20 2001 +++ syslog-ng-1.5.2.patched/configure.in Tue Jan 16 15:07:45 2001 @@ -137,6 +137,10 @@ AC_MSG_CHECKING(libol version >= $LIBOL_REQ_MAJOR.$LIBOL_REQ_MINOR.$LIBOL_REQ_PATCH) if test "$with_libol" = ""; then + if ! [ -x libol-config ]; then + echo "can't locate libol, aborting. Use --with-libol directive if it is installed" + exit 0 + fi LIBOL_VERSION=`libol-config --version` LIBOL_CFLAGS=`libol-config --cflags` LIBOL_LIBS=`libol-config --static-libs` -- Regards, Wiktor Wodecki Unix-Administration Wapme Systems AG

2 1

bug? OR dont seem to work right.
by Samuel Krempp 15 Jan '01

15 Jan '01

Whenever I combine 2 filters with a 'OR', it matches just about anything. (except if those 2 filters are of different kind, like program & facility, etc.. ) For exemple : destination trylog { file("/var/log/CransMisc/try.log" owner("root") group("adm") perm(0640)); }; filter f_stunnel { program("stunnel"); }; filter f_squid { program("squid"); }; filter f_try { filter(f_stunnel) or filter (f_squid); }; #(bug1) log { source(src); filter(f_try); destination(trylog); }; will put all kinds of stuff in try.log, with program names that contain neither 'tunnel' nor 'squid'. (eg: 'cucipop' lines end up in try.log... ) Same thing if I define f_try directly, without using f_stunnel and f_squid, as : filter f_try { program("stunnel") or program("squid"); }; #(bug2) Also, the 'or' does strange thing with other filters than 'program', like : filter f_try { program("local2") or facility("local3"); }; #(bug3) On the other hand, Those work as intended: filter f_try { program("(stunnel)|(squid)"); }; #(ok1) filter f_try { program("stunnel") or facility(local3); }; #(ok2) Isn't that a bug in syslog-ng ?? -- Sam PS: this aside, syslog-ng is really great, so much better than the old awkward syslogd..

1 0

patch to add service names to syslogng
by Matthew Crosby 15 Jan '01

15 Jan '01

The below patch adds support to syslog-ng for supplying service names rather then port numbers. For example, with this you can have a config line along the lines of source foo { tcp(port(syslogng)); }; Should be fully backwards compatable, you can still use the numeric form. If anyone's interested. (I'd love to see this integrated into the main tree...) ---------------- diff -c src/afinet.c patched/afinet.c *** src/afinet.c Sun Jan 14 21:56:53 2001 --- patched/afinet.c Sun Jan 14 21:56:47 2001 *************** *** 45,53 **** } } ! void inet_address_setport(struct address_info **a, UINT32 port) { CAST(inet_address_info, addr, *a); if (!addr) { *a = &make_inet_address(NULL, port)->super; } --- 45,64 ---- } } ! void inet_address_setport(struct address_info **a, UINT32 port, ! const char *service, const char *proto) { + struct servent *srv; CAST(inet_address_info, addr, *a); + + if(!port) { + if((srv=getservbyname(service,proto))) { + port=srv->s_port; + } else { + werror("Error finding port for service %z. Falling back to default\n", service); + return; + } + } if (!addr) { *a = &make_inet_address(NULL, port)->super; } *************** *** 156,166 **** inet_address_setip(&source->bind_addr, ip); } ! void afinet_src_set_localport(struct log_source_driver *c, UINT32 port) { CAST_SUBTYPE(afsocket_source, source, c); ! inet_address_setport(&source->bind_addr, port); } void afinet_src_set_auth(struct log_source_driver *c, UINT32 v) --- 167,178 ---- inet_address_setip(&source->bind_addr, ip); } ! void afinet_src_set_localport(struct log_source_driver *c, UINT32 port, ! const char *service, const char *proto) { CAST_SUBTYPE(afsocket_source, source, c); ! inet_address_setport(&source->bind_addr, port, service, proto); } void afinet_src_set_auth(struct log_source_driver *c, UINT32 v) *************** *** 378,395 **** inet_address_setip(&dest->dest_addr, ip); } ! void afinet_dest_set_localport(struct log_dest_driver *c, UINT32 port) { CAST_SUBTYPE(afsocket_dest, dest, c); ! inet_address_setport(&dest->dest_addr, port); } ! void afinet_dest_set_destport(struct log_dest_driver *c, UINT32 port) { CAST_SUBTYPE(afsocket_dest, dest, c); ! inet_address_setport(&dest->dest_addr, port); } static int do_init_afinet_dest(struct log_handler *c, --- 390,409 ---- inet_address_setip(&dest->dest_addr, ip); } ! void afinet_dest_set_localport(struct log_dest_driver *c, UINT32 port, ! const char *service, const char *proto) { CAST_SUBTYPE(afsocket_dest, dest, c); ! inet_address_setport(&dest->dest_addr, port, service, proto); } ! void afinet_dest_set_destport(struct log_dest_driver *c, UINT32 port, ! const char *service, const char *proto) { CAST_SUBTYPE(afsocket_dest, dest, c); ! inet_address_setport(&dest->dest_addr, port, service, proto); } static int do_init_afinet_dest(struct log_handler *c, diff -c src/afsocket.h patched/afsocket.h *** src/afsocket.h Tue Nov 23 14:32:37 1999 --- patched/afsocket.h Sun Jan 14 21:54:36 2001 *************** *** 125,131 **** void afunix_set_group(struct log_source_driver *c, const char *group); void afunix_set_perm(struct log_source_driver *c, int perm); ! void afinet_src_set_localport(struct log_source_driver *c, UINT32 port); void afinet_src_set_localip(struct log_source_driver *c, const char *ip); void afinet_src_set_auth(struct log_source_driver *c, UINT32 v); void afinet_src_set_mac(struct log_source_driver *c, UINT32 v); --- 125,131 ---- void afunix_set_group(struct log_source_driver *c, const char *group); void afunix_set_perm(struct log_source_driver *c, int perm); ! void afinet_src_set_localport(struct log_source_driver *c, UINT32 port, const char *service,const char *proto); void afinet_src_set_localip(struct log_source_driver *c, const char *ip); void afinet_src_set_auth(struct log_source_driver *c, UINT32 v); void afinet_src_set_mac(struct log_source_driver *c, UINT32 v); *************** *** 132,139 **** void afinet_src_set_encrypt(struct log_source_driver *c, UINT32 v); void afinet_dest_set_localip(struct log_dest_driver *c, const char *ip); ! void afinet_dest_set_localport(struct log_dest_driver *c, UINT32 port); ! void afinet_dest_set_destport(struct log_dest_driver *c, UINT32 port); void afinet_dest_set_auth(struct log_dest_driver *c, UINT32 value); void afinet_dest_set_mac(struct log_dest_driver *c, UINT32 value); void afinet_dest_set_encrypt(struct log_dest_driver *c, UINT32 value); --- 132,139 ---- void afinet_src_set_encrypt(struct log_source_driver *c, UINT32 v); void afinet_dest_set_localip(struct log_dest_driver *c, const char *ip); ! void afinet_dest_set_localport(struct log_dest_driver *c, UINT32 port, const char *service,const char *proto); ! void afinet_dest_set_destport(struct log_dest_driver *c, UINT32 port, const char *service,const char *proto); void afinet_dest_set_auth(struct log_dest_driver *c, UINT32 value); void afinet_dest_set_mac(struct log_dest_driver *c, UINT32 value); void afinet_dest_set_encrypt(struct log_dest_driver *c, UINT32 value); diff -c src/cfg-grammar.y patched/cfg-grammar.y *** src/cfg-grammar.y Sun Jan 14 21:57:19 2001 --- patched/cfg-grammar.y Sun Jan 14 21:57:26 2001 *************** *** 72,78 **** %token KW_COMPRESS KW_MAC KW_AUTH KW_ENCRYPT /* filter items*/ ! %token KW_FACILITY KW_LEVEL KW_PROGRAM KW_HOST KW_MATCH /* yes/no switches */ %token KW_YES KW_NO --- 72,78 ---- %token KW_COMPRESS KW_MAC KW_AUTH KW_ENCRYPT /* filter items*/ ! %token KW_FACILITY KW_LEVEL KW_HOST KW_MATCH /* yes/no switches */ %token KW_YES KW_NO *************** *** 255,265 **** ; source_afinet_udp_option : KW_LOCALIP '(' string ')' { afinet_src_set_localip(last_source_driver, $3); free($3); } | KW_IP '(' string ')' { afinet_src_set_localip(last_source_driver, $3); free($3); } - | KW_LOCALPORT '(' NUMBER ')' { afinet_src_set_localport(last_source_driver, $3); } - | KW_PORT '(' NUMBER ')' { afinet_src_set_localport(last_source_driver, $3); } - ; source_afinet_tcp_params --- 255,270 ---- ; source_afinet_udp_option + : source_afinet_option + | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3 ,"udp"); free($3); } + | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3, "udp"); free($3); } + ; + + source_afinet_option : KW_LOCALIP '(' string ')' { afinet_src_set_localip(last_source_driver, $3); free($3); } + | KW_LOCALPORT '(' NUMBER ')' { afinet_src_set_localport(last_source_driver, $3, NULL, NULL); } + | KW_PORT '(' NUMBER ')' { afinet_src_set_localport(last_source_driver, $3, NULL, NULL); } | KW_IP '(' string ')' { afinet_src_set_localip(last_source_driver, $3); free($3); } source_afinet_tcp_params *************** *** 278,284 **** ; source_afinet_tcp_option ! : source_afinet_udp_option | KW_AUTH '(' tripleoption ')' { afinet_src_set_auth(last_source_driver, $3); } | KW_MAC '(' tripleoption ')' { afinet_src_set_mac(last_source_driver, $3); } | KW_ENCRYPT '(' tripleoption ')' { afinet_src_set_encrypt(last_source_driver, $3); } --- 283,291 ---- ; source_afinet_tcp_option ! : source_afinet_option ! | KW_LOCALPORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3,"tcp"); free($3); } ! | KW_PORT '(' string ')' { afinet_src_set_localport(last_source_driver, 0, $3,"tcp"); free($3); } | KW_AUTH '(' tripleoption ')' { afinet_src_set_auth(last_source_driver, $3); } | KW_MAC '(' tripleoption ')' { afinet_src_set_mac(last_source_driver, $3); } | KW_ENCRYPT '(' tripleoption ')' { afinet_src_set_encrypt(last_source_driver, $3); } *************** *** 428,440 **** | ; ! dest_afinet_udp_option : KW_LOCALIP '(' string ')' { afinet_dest_set_localip(last_dest_driver, $3); free($3); } ! | KW_LOCALPORT '(' NUMBER ')' { afinet_dest_set_localport(last_dest_driver, $3); } ! | KW_PORT '(' NUMBER ')' { afinet_dest_set_destport(last_dest_driver, $3); } ! | KW_DESTPORT '(' NUMBER ')' { afinet_dest_set_destport(last_dest_driver, $3); } ; dest_afinet_tcp_params : string { --- 435,454 ---- | ; ! dest_afinet_option : KW_LOCALIP '(' string ')' { afinet_dest_set_localip(last_dest_driver, $3); free($3); } ! | KW_LOCALPORT '(' NUMBER ')' { afinet_dest_set_localport(last_dest_driver, $3, NULL, NULL); } ! | KW_PORT '(' NUMBER ')' { afinet_dest_set_destport(last_dest_driver, $3, NULL, NULL); } ! | KW_DESTPORT '(' NUMBER ')' { afinet_dest_set_destport(last_dest_driver, $3, NULL, NULL); } ; + dest_afinet_udp_option + : dest_afinet_option + | KW_LOCALPORT '(' string ')' { afinet_dest_set_localport(last_dest_driver, 0, $3,"udp"); free($3); } + | KW_PORT '(' string ')' { afinet_dest_set_destport(last_dest_driver, 0, $3,"udp"); free($3); } + | KW_DESTPORT '(' string ')' { afinet_dest_set_destport(last_dest_driver, 0, $3,"udp"); free($3); } + ; + dest_afinet_tcp_params : string { *************** *** 452,458 **** ; dest_afinet_tcp_option ! : dest_afinet_udp_option | KW_MAC '(' yesno ')' | KW_AUTH '(' yesno ')' | KW_ENCRYPT '(' yesno ')' --- 466,475 ---- ; dest_afinet_tcp_option ! : dest_afinet_option ! | KW_LOCALPORT '(' string ')' { afinet_dest_set_localport(last_dest_driver, 0, $3,"tcp"); free($3); } ! | KW_PORT '(' string ')' { afinet_dest_set_destport(last_dest_driver, 0, $3,"tcp"); free($3); } ! | KW_DESTPORT '(' string ')' { afinet_dest_set_destport(last_dest_driver, 0, $3,"tcp"); free($3); } | KW_MAC '(' yesno ')' | KW_AUTH '(' yesno ')' | KW_ENCRYPT '(' yesno ')'

2 1

Re: [syslog-ng]sync question, feature request
by Thierry Besancon 12 Jan '01

12 Jan '01

Dixit Wiktor Wodecki <wodecki(a)wapme-systems.de> (le Thu, 11 Jan 2001 14:41:18 +0100) : » I've got another question, I haven't really looked at the 1.5 tree yet, » but I think about making patch to syslog-ng which would include the » strftime functions. I want to be able to use things like $Y/$m/$d in the » destination file path, this would effectively eliminate logrotation » scripts. Is there such an effort already in work or is this feature » planned? Well. This is already coded if i'm not wrong. Use $YEAR, $MONTH, $DAY For example : destination all { file("/var/log/messages-$YEAR$MONTH$DAY" create_dirs(yes)); }; Nevertheless, I'm not sure that is really what you (and I) want. In my example, it creates files with the *dates of the syslog messages* what is different from the date of the day they are received. In my case, it seems I have syslog clients with unsynchronized clocks and I already have messages-20010704 for example (4th july 2001 !). Thierry

3 2

sync question, feature request
by Wiktor Wodecki 11 Jan '01

11 Jan '01

hello again (sorry if I start to irk you :-), I'm a little bit irritated about the sync option. As I understood it from the docs (my tests confirmed them) syslog-ng holds up to n lines in a buffer before they get written down to disk. However, what happens if a machine dies and the buffer on the loggingserver isn't full yet? I'm not quite sure, but what would happen to the data in buffer? I didn't test it, but I think time_reap() would catch this and close the file after m minutes. However, imagine the following situation: You've got a central logginghost and you know that an intruder is working right at the moment on that machine; Seconds later the machine dies and you want to know what the last syslog message was. In this case one'd have to wait till syslog-ng closes that file. It would be nice to have a handler or a command line argument to make syslog-ng write down all current buffers to disk. I've got another question, I haven't really looked at the 1.5 tree yet, but I think about making patch to syslog-ng which would include the strftime functions. I want to be able to use things like $Y/$m/$d in the destination file path, this would effectively eliminate logrotation scripts. Is there such an effort already in work or is this feature planned? -- Regards, Wiktor Wodecki Unix-Administration Wapme Systems AG

2 1

another documentation error (or bug?)
by Wiktor Wodecki 11 Jan '01

11 Jan '01

Hello, I'm not quite sure whether this is a bug or another documentation fault. I tried to use sync_freq() in the global options block, but I couldn't succeed. The following line gives an error: options { long_hostnames(yes); sync(0); sync_freq(3); time_reap(10); use_time_recvd(yes); use_dns(yes); create_dirs(yes); log _fifo_size(3000); chain_hostnames(yes);}; ganga:/var# syslog-ng parse error at 3 Parse error reading configuration file, exiting. ganga:/var# However if I remove the sync_freq setting, it reads the line correctly: options { long_hostnames(yes); sync(3); time_reap(10); use_time_recvd(yes); use_dns(yes); create_dirs(yes); log_fifo_size(3000); chain_hostnames(yes);}; ganga:/var# syslog-ng ganga:/var# Please correct me if I'm wrong, but this seems somehow strange to me. -- Regards, Wiktor Wodecki Unix-Administration Wapme Systems AG

2 1

wrong documentation
by Wiktor Wodecki 11 Jan '01

11 Jan '01

hello folks, I just started to configure syslog-ng for the first time and I found a small error in the documentation shipped with it (also on homepage). I use current version 1.4.10. The problem is: written in the docs: source s_tcp { tcp(ip(127.0.0.1) port(1999);max-connections(10)); }; correct syntax: source s_tcp { tcp(ip(127.0.0.1) port(1999) max-connections (4)); }; please somebody fix this, took me a while to fiddle through all those semicolons and brackets.. -- Regards, Wiktor Wodecki Unix-Administration Wapme Systems AG

1 0

RE: [syslog-ng]destination problem
by Ohrberg, Mick 10 Jan '01

10 Jan '01

[snip] > source src { sun-streams("/dev/log" > door("/etc/.syslog_door")); internal(); }; > destination logserver { udp(ip(10.1.2.3) port(10514)); }; > log { source(src); destination(logserver); }; > > I consistently get a parse error on that destination line. Yet > everything I read in the docs looks that way, and the remote syslog > server (running the same version) has the same entry has a source > parameter and works fine. Try destination logserver { udp("10.1.2.3" port(10514)); }; /Mick

2 1

destination problem
by William Yodlowsky 10 Jan '01

10 Jan '01

I'm sure I'm missing something simple here... I've got a 3 line config file for a syslog client. This is 1.4.10. source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination logserver { udp(ip(10.1.2.3) port(10514)); }; log { source(src); destination(logserver); }; I consistently get a parse error on that destination line. Yet everything I read in the docs looks that way, and the remote syslog server (running the same version) has the same entry has a source parameter and works fine. I've tried twiddling with semicolons and parentheses, tcp and udp, no port number and just a port number. It refuses to work for me... Have I been staring at this for too long or is there a glaring error? Thanks in advance!

1 0

Solaris 2.6 compile failure
by William Yodlowsky 10 Jan '01

10 Jan '01

Hi folks. I hadn't had a problem building syslog-ng until today, when I tried to build 1.4.10/libol-0.2.20 on Solaris 2.6-patched. Why do I get the feeling this is a Sun header file problem... it builds fine on Solaris 8. ... gcc -DHAVE_CONFIG_H -I. -I/build/syslog-ng/syslog-ng-1.4.10/src -I. -O2 -Wall -I/build/syslog-ng/libol-0.2.20/src -D_GNU_SOURCE -c afstreams.c In file included from /usr/include/stropts.h:22, from afstreams.c:37: /usr/include/sys/stropts.h:315: parse error before `t_uscalar_t' /usr/include/sys/stropts.h:315: warning: no semicolon at end of struct or union /usr/include/sys/stropts.h:334: parse error before `t_uscalar_t' /usr/include/sys/stropts.h:334: warning: no semicolon at end of struct or union /usr/include/sys/stropts.h:337: parse error before `}' *** Error code 1 make: Fatal error: Command failed for target `afstreams.o' Current working directory /build/syslog-ng/syslog-ng-1.4.10/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive' Current working directory /build/syslog-ng/syslog-ng-1.4.10/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive-am' Current working directory /build/syslog-ng/syslog-ng-1.4.10/src *** Error code 1 make: Fatal error: Command failed for target `all-recursive'

1 1