- syslog-ng - lists.balabit.hu

GSoC 2016 Project
by amey jain 03 Mar '16

03 Mar '16

Greetings to all. I am Amey Jain. I am second year student of Information Technology in Jabalpur Engineering College,India. I am connected with syslog-ng since last month. I am interested in your project of syslog-ng as command line tool and that of Websocket. But I can't find any further details on that project. Please provide me any further details on the same. Also if possible, recommend me about how to proceed with these projects and what to do further. Thank you. Regards.

1 0

[GSoC] Project: Kafka source
by Vithulan MV 03 Mar '16

03 Mar '16

Hi all, I'm currently a 3rd year undergraduate at University of Moratuwa, Sri lanka. I have attached my Linkedin profile with this mail [1]. I'd like to contribute to a GSoC 2016 project with the open source community of syslog-ng. I have contributed in log analyzing project LogAnalyzer [2] and also worked with logstash, kafka. Therefore, I think I can contribute syslog-ng project kafka source as I'm much interested in that. Please kindly make any suggestions on how I should proceed on this? [1] https://lk.linkedin.com/in/vithulamv [2] https://github.com/VIthulan/product-la Thank you. Regards, Vithulan -- Vithulan MV. Undergraduate, Department of Computer Science & Engineering, University of Moratuwa, Sri lanka.

1 0

GSoC 2016 Introduction
by Tcheutchoua Steve 02 Mar '16

02 Mar '16

Greetings to you all. I am Tcheutchoua Steve, Student at the University of Buea Cameroon. I am very interested in contributing to syslog-ng. The projects that interest me the most are kafka Source <https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj…> and JDBC driver implementation <https://github.com/balabit/syslog-ng/wiki/GSoC2016-Idea-&-Project-list#proj…> . I will like to know more about these project ideas ( example , is the description complete ? any recommended document or site ? etc ) Best Regards

1 0

Not able to set source IP in syslog-ng.conf.
by Girish Kumar 01 Mar '16

01 Mar '16

Hi All, I have set the source IP to client address. This is at syslog-ng.conf file at server On spawning the syslog-ng following error is seen . Could you please help me on this [root@localhost cert.d]# /sbin/syslog-ng [2016-03-01T10:27:06.128929] Error binding socket; addr='AF_INET(10.135.83.104:514)', error='Cannot assign requested address (99)' [2016-03-01T10:27:06.128983] Error initializing message pipeline; 10.135.83.104 is reachable from server My conf file ------------------ @version:3.6 @include "scl.conf" source s_local { internal(); }; source d_source { syslog(ip("10.135.83.104") port(514) transport("udp") ); }; destination d_local { file("/var/log/messagesgiri"); }; log { source(s_local); source(d_source); destination(d_local); }; Regards, Girish

2 2

Error loading Python module for log destination
by Wil Koch 29 Feb '16

29 Feb '16

Hi All, I am following the tutorial below in an attempt to get Python support for destinations, https://syslog-ng.gitbooks.io/getting-started/content/chapters/chapter_5/se… I have built syslog-ng-3.7.2 from source and have it up and running on Ubuntu 14.04. I initially had a simple log for iptables logging to a file to confirm functionality. After I changed my conf to include a Python destination, I am receiving the following error when starting syslog-ng at the command line, [2016-02-26T12:15:48.874748] Error loading Python module; module='betterpythonexample', exception='exceptions.ImportError: No module named betterpythonexample' [2016-02-26T12:15:48.874775] Error looking Python driver class; driver='python_to_file#0', class='betterpythonexample.TextDestination', exception='None' [2016-02-26T12:15:48.874782] Error initializing message pipeline; I have PYTHONPATH set to the directory where the script is, and I have confirmed the variable is working by importing the module in the python interpreter. Any suggestions for debugging would be much appreciated, I'm out of ideas. Thank you, Wil

2 2

GSoC 2016
by Laszlo Budai 29 Feb '16

29 Feb '16

Hi, the syslog-ng project has been accepted as a mentoring organization :) During the next few days we will contact you, as we want to create a special GSoC syslog-ng release ( https://syslog-ng.org/gsoc-2016-applicant-form-syslog-ng-project ). regards, Laszlo Budai Sent from my HTC

1 0

simple subscription based interface?
by Árpád Magosányi 29 Feb '16

29 Feb '16

Hi, The use case is a crystal box: everything (but keys) are public in the system, including logs. So I want to configure syslog-ng such that anyone can connect to it, and receives the logs. The simpler the interface, the better. I also would like to have some limit on the number of concurrent clients. Any way to achieve this with syslog-ng without using an additional stomp or amqp server? My syslog-ng version is 3.5.6-2. If there is a need for a message broker, could anyone suggest a free or dirt cheap one in the cloud?

3 3

Error while configuring destination for network
by Girish Kumar 29 Feb '16

29 Feb '16

Hi All, In the conf file I have added destination as network. But I am getting following error while spawning the syslog-ng . Could you please help me on this [root@localhost vsabarin]# /sbin/syslog-ng Error parsing afsocket, syntax error, unexpected KW_IP, expecting LL_IDENTIFIER or LL_STRING in /etc/syslog-ng/syslog-ng.conf at line 12, column 32: destination d_network { syslog(ip("135.254.163.151") transport("tcp")); }; My syslog-ng.conf file @version:3.7 @include "scl.conf" source s_local { internal(); }; destination d_network { syslog(ip("135.254.163.151") transport("tcp")); }; destination d_local { file("/var/log/messagesgiri"); }; log { source(s_local); destination(d_local); destination d_network); }; Regards, Girish

2 3

Error while spawning the syslog-ng : "source plugin system not found "
by Girish Kumar 27 Feb '16

27 Feb '16

Hi All, I was successful in compilation and installing syslog-ng While spawning syslog-ng, I am getting source plugin system not found. Following is the error. Please help me on this TOR #-> /sbin/syslog-ng Error parsing source, source plugin system not found in //etc/syslog-ng.conf at line 10, column 2: system(); ^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng TOR #-> syslog-ng -V syslog-ng 3.7.2 Installer-Version: 3.7.2 Revision: Compile-Date: Feb 24 2016 23:02:43 Available-Modules: json-plugin,kvformat,pseudofile,linux-kmsg-format,csvparser,system-source,afamqp,cryptofuncs,basicfuncs,afuser,afprog,graphite,afstomp,afsocket,syslogformat,confgen,dbparser,sdjournal,affile,afmongodb Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Regards, Girish

3 7

Error while spawning the syslog-ng : "source plugin system not found "
by Girish Kumar 25 Feb '16

25 Feb '16

Hi All, I was successful in compilation and installing syslog-ng While spawning syslog-ng, I am getting source plugin system not found. Following is the error. Please help me on this TOR #-> /sbin/syslog-ng Error parsing source, source plugin system not found in //etc/syslog-ng.conf at line 10, column 2: system(); ^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng TOR #-> syslog-ng -V syslog-ng 3.7.2 Installer-Version: 3.7.2 Revision: Compile-Date: Feb 24 2016 23:02:43 Available-Modules: json-plugin,kvformat,pseudofile,linux-kmsg-format,csvparser,system-source,afamqp,cryptofuncs,basicfuncs,afuser,afprog,graphite,afstomp,afsocket,syslogformat,confgen,dbparser,sdjournal,affile,afmongodb Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Regards, Girish

1 0

Error parsing config and compiling template
by amey jain 25 Feb '16

25 Feb '16

Hi, I was running ./syslog-ng and I got these errors. I am unable to solve them. I am copying the output here. Please tell me what to do to correct it. $ sbin/syslog-ng --module-path=/home/amey/install/syslog-ng Error parsing config, Error compiling template (Unknown template function "format-json") in /home/amey/install/syslog-ng/share/syslog-ng/include/scl/cim/template.conf at line 23, column 32: included from /home/amey/install/syslog-ng/etc/scl.conf line 29, column 1 included from /home/amey/install/syslog-ng/etc/syslog-ng.conf line 8, column 1 template-function "format-cim" "$(format-json --pair @timestamp='${R_ISODATE}' --pair @message='${MSG}' --key .cim.* --shift 5 --key _* --key .* --replace-prefix .=_ --key *.*)\n"; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng Regards

3 2

Re: [syslog-ng] syslog-ng Digest, Vol 130, Issue 35
by Ho, Ming 24 Feb '16

24 Feb '16

Hi Peter, Thanks for the suggestion. I am now able to run "configure" to include Java for complication. But I ran into the following error when I executed "make" command: In file included from modules/java/native/java-destination.h:36, from modules/java/native/java-parser.h:29, from modules/java/native/java-grammar.y:26: ./modules/java/proxies/java-destination-proxy.h:46: error: expected declaration specifiers or '...' before 'JNIEnv' make[2]: *** [modules/java/native/modules_java_libmod_java_la-java-grammar.lo] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2 Appreciate your help. Ming -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Tuesday, February 23, 2016 8:49 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 130, Issue 35 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: syslog-ng Digest, Vol 130, Issue 27 (Czanik) 2. Re: Cross Compiling syslog-ng 3.7.2 on power-pc architecture (Girish Kumar) ---------------------------------------------------------------------- Message: 1 Date: Tue, 23 Feb 2016 13:15:33 +0100 From: Czanik, P?ter <peter.czanik(a)balabit.com> Subject: Re: [syslog-ng] syslog-ng Digest, Vol 130, Issue 27 To: "Ho, Ming" <Mingho(a)visa.com> Cc: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Message-ID: <CANcUavtb3iKWG3Kr9RKOvwLYF5JcO7mPqomfAnuxoUwqsEWTHw(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Hi, Gradle needs to be available in the PATH during configure. If it's not there, you should update your PATH variable, like this: export PATH=/usr/share/java/gradle-2.11/bin:$PATH Gradle can download you all the necessary JAR files. If you want to use the local files from another directory, you need to edit modules/java-modules/build.gradle before compilation. Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik On Mon, Feb 22, 2016 at 7:14 PM, Ho, Ming <Mingho(a)visa.com> wrote: > Hi Peter, > > Thanks for the quick response. The admin guide and your blog only > mentioned to install gradle, which I did, but no mention of how to use > it to build Java modules. I am not a software developer and have not > heard/use gradle before. It will be very kind and helpful of you if > you can provide me the steps how to do so. And any additional steps I > need to do for compilation after the Java modules created. > > I also try your syslog-ng-java-hack-1.0-1.el6.x86_64.rpm. I copy all > the jars files to /usr/local/lib/syslog-ng/java-modules and then run > "configure" but the Java module is still not included. What is the > correct steps if I use the provided jar files? > > Thanks. > Ming > > -----Original Message----- > From: syslog-ng-bounces(a)lists.balabit.hu [mailto: > syslog-ng-bounces(a)lists.balabit.hu] On Behalf Of > syslog-ng-request(a)lists.balabit.hu > Sent: Saturday, February 20, 2016 3:00 AM > To: syslog-ng(a)lists.balabit.hu > Subject: syslog-ng Digest, Vol 130, Issue 27 > > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than > "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. Re: Not able to compile syslog-ng OSE with Java support (Czanik) > 2. ECONNREFUSED on /dev/log (?rp?d Magos?nyi) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 20 Feb 2016 07:47:23 +0100 > From: Czanik, P?ter <peter.czanik(a)balabit.com> > Subject: Re: [syslog-ng] Not able to compile syslog-ng OSE with Java > support > To: "Syslog-ng users' and developers' mailing list" > <syslog-ng(a)lists.balabit.hu> > Message-ID: > < > CANcUavtxRVrSQwcaAB0WV27uO+gsR1T7kT8rQqq63Rev+ns+Ag(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > You will also need gradle to build Java modules: http://gradle.org/ > Bye, > > Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng > upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik > > On Sat, Feb 20, 2016 at 7:02 AM, 'Ho, Ming' via SYSLOG-NG < > syslog-ng(a)balabit.com> wrote: > > > Hello, > > > > I am able to compile syslog-ng 3.7.2 without the Java-based modules > > included successfully and the syslog-ng run fine. Now I need to > > re-compile again with the Java-based modules included. I execute the > > following steps listed in the syslog-ng-3.7-ose-admin guide: > > > > Installed openjdk version "1.8.0_71" > > Installed gradle version 2.11 > > export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH > > export > > LD_LIBRARY_PATH=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7 > > .x 86_64/jre/lib/amd64/server:$LD_LIBRARY_PATH > > > > When I run ./configure, I notice the java module option is set to "no" > > in the summary: > > Modules: > > Module search path : ${exec_prefix}/lib/syslog-ng > > Sun STREAMS support (module): no > > SQL support (module) : no > > PACCT module (EXPERIMENTAL) : no > > MongoDB destination (module): yes > > JSON support (module) : no > > SMTP support (module) : no > > AMQP destination (module) : yes > > STOMP destination (module) : yes > > GEOIP support (module) : no > > Redis support (module) : no > > Riemann destination (module): no > > python : yes (pkg-config package: python) > > java : no > > > > I go ahead to execute "make" and "make install" without error. But I > > don't see the "java-modules" directory is created in > > /usr/local/lib/syslog-ng directory. > > When I include the following declaration in my syslog-ng.conf to > > start syslog-ng, I got the following error: > > [2016-02-20T05:46:59.039466] Plugin module not found in > > 'module-path'; module-path='/usr/local/lib/syslog-ng', module='mod-java' > > > > Why Java modules is not included? What steps am I missing? > > Any help is appreciated > > > > Ming > > > > > > > > ____________________________________________________________________ > > __ > > ________ Member info: > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > > > > > > -------------- next part -------------- An HTML attachment was > scrubbed... > URL: > http://lists.balabit.hu/pipermail/syslog-ng/attachments/20160220/e2a92 > c57/attachment.html > > ------------------------------ > > Message: 2 > Date: Sat, 20 Feb 2016 11:24:24 +0100 > From: ?rp?d Magos?nyi <mag(a)magwas.rulez.org> > Subject: [syslog-ng] ECONNREFUSED on /dev/log > To: syslog-ng(a)lists.balabit.hu > Message-ID: <56C83ED8.4080305(a)magwas.rulez.org> > Content-Type: text/plain; charset=utf-8 > > Hi! > > "strace logger hello" output contains this line: > connect(3, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = -1 > ECONNREFUSED (Connection refused) > > I see logs in /dev/xconsole, just cannot emit a log line with logger. > What could be the cause? > > additional info: > > # cat /etc/syslog-ng/syslog-ng.conf > @version: 3.3 > @include "scl.conf" > # First, set some global options. > options { chain_hostnames(off); flush_lines(0); use-dns(persist_only); > dns-cache-hosts(/etc/hosts);use_fqdn(no); > owner("root"); group("adm"); perm(0640); stats_freq(0); > time_reap(1000); > bad_hostname("^gconfd$"); > }; > source s_src { > system(); > internal(); > }; > > #destination d_net { tcp("91.143.88.140" port(10000) > tls(ca-dir("/etc/ssl") cert-file("/etc/ssl/newcert.pem") > key_file("/etc/ssl/private/newkey.pem") )); }; destination d_net { tcp(" > infra.edemokraciagep.org" port(10000) > tls(ca-dir("/etc/ssl") peer-verify(optional-untrusted))); }; > > destination d_messages { file("/var/log/messages");}; > > destination d_xconsole { pipe("/dev/xconsole"); }; destination > d_apache_console { pipe("/dev/apacheconsole"); }; > > > filter apache_log { program("apache"); }; filter non_apache_log { not > program("apache"); }; > > destination d_vhost_gepnarancs { file("/var/log/vhost_gepnarancs"); }; > filter f_gepnarancs { program("apache:php:gepnarancs") or > message("gepnarancs"); }; log { source(s_src); filter(f_gepnarancs); > destination(d_vhost_gepnarancs); }; > > log { source(s_src); destination(d_messages); }; > > log { source(s_src); filter(non_apache_log) ; destination(d_xconsole); > }; > > log { source(s_src); filter(apache_log); > destination(d_apache_console); }; > > log { source(s_src); destination(d_net); }; > > @include "/etc/syslog-ng/conf.d/" > > --------------------------------- > # lsof |grep /dev/xconsole > syslog-ng 2608 root 15u FIFO 0,5 > 0t0 19564 /dev/xconsole > cat 2641 root 3r FIFO 0,5 > 0t0 19564 /dev/xconsole > --------------------------------- > # lsof |grep /dev/log > [no output] > --------------------------------- > # dpkg -l syslog-ng > Desired=Unknown/Install/Remove/Purge/Hold > | > > Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Tri > g-pend > |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) > ||/ Name > Version Architecture Description > +++-================================================-================= > +++== > +++==========-=============================-========================== > +++== > +++=================================================================== > +++== > +++===== > ii syslog-ng > 3.5.6-2 all Enhanced > system logging daemon (metapackage) > -------------------------------- > # ls -l /dev/log > srw-rw-rw- 1 root root 0 Feb 20 11:03 /dev/log > -------------------------------- > > > > ------------------------------ > > _______________________________________________ > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > End of syslog-ng Digest, Vol 130, Issue 27 > ****************************************** > >

1 0

Cross Compiling syslog-ng 3.7.2 on power-pc architecture
by Girish Kumar 23 Feb '16

23 Feb '16

Hi All, I am successful in configure and make . All compilation is successful. "Make install "is giving following problem. Could you please help me on this Is there any workaround for this? /bin/mkdir -p '/home/gkuma020/PERFORCE/7.X.X.R01-gkuma020-gg/engr/sw/tps/built/46/7.X.X.R01/ppc_common/lib/syslog-ng' /bin/sh ./libtool --mode=install /usr/bin/install -c modules/syslogformat/libsyslogformat.la modules/afsocket/libafsocket.la modules/affile/libaffile.la modules/afprog/libafprog.la modules/afuser/libafuser.la modules/afamqp/libafamqp.la modules/afmongodb/libafmongodb.la modules/csvparser/libcsvparser.la modules/confgen/libconfgen.la modules/system-source/libsystem-source.la modules/linux-kmsg-format/liblinux-kmsg-format.la modules/basicfuncs/libbasicfuncs.la modules/cryptofuncs/libcryptofuncs.la modules/dbparser/libdbparser.la modules/afstomp/libafstomp.la modules/pseudofile/libpseudofile.la modules/graphite/libgraphite.la modules/systemd-journal/libsdjournal.la modules/kvformat/libkvformat.la '/home/gkuma020/PERFORCE/7.X.X.R01-gkuma020-gg/engr/sw/tps/built/46/7.X.X.R01/ppc_common/lib/syslog-ng' libtool: install: error: cannot install `modules/syslogformat/libsyslogformat.la' to a directory not ending in //lib/syslog-ng make[5]: *** [install-moduleLTLIBRARIES] Error 1 make[4]: *** [install-am] Error 2 make[3]: *** [install-recursive] Error 1 make[2]: *** [install] Error 2 make[2]: Leaving directory `/home/gkuma020/PERFORCE/7.X.X.R01-gkuma020-gg/engr/sw/tps/objs/46/7.X.X.R01/ppc_common/syslog-ng' make[1]: *** [/home/gkuma020/PERFORCE/7.X.X.R01-gkuma020-gg/engr/sw/tps/built/46/7.X.X.R01/ppc_common/sbin/syslog-ng] Error 2 make[1]: Leaving directory `/home/gkuma020/PERFORCE/7.X.X.R01-gkuma020-gg/engr/sw/tps' make: *** [tps-build] Error 2 Regards, Girish

2 5

Re: [syslog-ng] syslog-ng Digest, Vol 130, Issue 27
by Ho, Ming 23 Feb '16

23 Feb '16

Hi Peter, Thanks for the quick response. The admin guide and your blog only mentioned to install gradle, which I did, but no mention of how to use it to build Java modules. I am not a software developer and have not heard/use gradle before. It will be very kind and helpful of you if you can provide me the steps how to do so. And any additional steps I need to do for compilation after the Java modules created. I also try your syslog-ng-java-hack-1.0-1.el6.x86_64.rpm. I copy all the jars files to /usr/local/lib/syslog-ng/java-modules and then run "configure" but the Java module is still not included. What is the correct steps if I use the provided jar files? Thanks. Ming -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Saturday, February 20, 2016 3:00 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 130, Issue 27 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Not able to compile syslog-ng OSE with Java support (Czanik) 2. ECONNREFUSED on /dev/log (?rp?d Magos?nyi) ---------------------------------------------------------------------- Message: 1 Date: Sat, 20 Feb 2016 07:47:23 +0100 From: Czanik, P?ter <peter.czanik(a)balabit.com> Subject: Re: [syslog-ng] Not able to compile syslog-ng OSE with Java support To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Message-ID: <CANcUavtxRVrSQwcaAB0WV27uO+gsR1T7kT8rQqq63Rev+ns+Ag(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" You will also need gradle to build Java modules: http://gradle.org/ Bye, Peter Czanik (CzP) <peter.czanik(a)balabit.com> Balabit / syslog-ng upstream http://czanik.blogs.balabit.com/ https://twitter.com/PCzanik On Sat, Feb 20, 2016 at 7:02 AM, 'Ho, Ming' via SYSLOG-NG < syslog-ng(a)balabit.com> wrote: > Hello, > > I am able to compile syslog-ng 3.7.2 without the Java-based modules > included successfully and the syslog-ng run fine. Now I need to > re-compile again with the Java-based modules included. I execute the > following steps listed in the syslog-ng-3.7-ose-admin guide: > > Installed openjdk version "1.8.0_71" > Installed gradle version 2.11 > export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH > export > LD_LIBRARY_PATH=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.x > 86_64/jre/lib/amd64/server:$LD_LIBRARY_PATH > > When I run ./configure, I notice the java module option is set to "no" > in the summary: > Modules: > Module search path : ${exec_prefix}/lib/syslog-ng > Sun STREAMS support (module): no > SQL support (module) : no > PACCT module (EXPERIMENTAL) : no > MongoDB destination (module): yes > JSON support (module) : no > SMTP support (module) : no > AMQP destination (module) : yes > STOMP destination (module) : yes > GEOIP support (module) : no > Redis support (module) : no > Riemann destination (module): no > python : yes (pkg-config package: python) > java : no > > I go ahead to execute "make" and "make install" without error. But I > don't see the "java-modules" directory is created in > /usr/local/lib/syslog-ng directory. > When I include the following declaration in my syslog-ng.conf to start > syslog-ng, I got the following error: > [2016-02-20T05:46:59.039466] Plugin module not found in 'module-path'; > module-path='/usr/local/lib/syslog-ng', module='mod-java' > > Why Java modules is not included? What steps am I missing? > Any help is appreciated > > Ming > > > > ______________________________________________________________________ > ________ Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq > > >

2 1

Reg; Syslog-ng does not recognize the audit facility
by Justin Kala 22 Feb '16

22 Feb '16

Hi Syslog-ng is unable to recognize the facility audit. When I put filter as audit and restart syslog-ng it errors out. When I put the facility code as 13 ,it does not error on restarting the service but does not capture the syslog message received through this filter code 13 as well. Please advise. -- Kaladhar

3 10

ECONNREFUSED on /dev/log
by Árpád Magosányi 22 Feb '16

22 Feb '16

Hi! "strace logger hello" output contains this line: connect(3, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = -1 ECONNREFUSED (Connection refused) I see logs in /dev/xconsole, just cannot emit a log line with logger. What could be the cause? additional info: # cat /etc/syslog-ng/syslog-ng.conf @version: 3.3 @include "scl.conf" # First, set some global options. options { chain_hostnames(off); flush_lines(0); use-dns(persist_only); dns-cache-hosts(/etc/hosts);use_fqdn(no); owner("root"); group("adm"); perm(0640); stats_freq(0); time_reap(1000); bad_hostname("^gconfd$"); }; source s_src { system(); internal(); }; #destination d_net { tcp("91.143.88.140" port(10000) tls(ca-dir("/etc/ssl") cert-file("/etc/ssl/newcert.pem") key_file("/etc/ssl/private/newkey.pem") )); }; destination d_net { tcp("infra.edemokraciagep.org" port(10000) tls(ca-dir("/etc/ssl") peer-verify(optional-untrusted))); }; destination d_messages { file("/var/log/messages");}; destination d_xconsole { pipe("/dev/xconsole"); }; destination d_apache_console { pipe("/dev/apacheconsole"); }; filter apache_log { program("apache"); }; filter non_apache_log { not program("apache"); }; destination d_vhost_gepnarancs { file("/var/log/vhost_gepnarancs"); }; filter f_gepnarancs { program("apache:php:gepnarancs") or message("gepnarancs"); }; log { source(s_src); filter(f_gepnarancs); destination(d_vhost_gepnarancs); }; log { source(s_src); destination(d_messages); }; log { source(s_src); filter(non_apache_log) ; destination(d_xconsole); }; log { source(s_src); filter(apache_log); destination(d_apache_console); }; log { source(s_src); destination(d_net); }; @include "/etc/syslog-ng/conf.d/" --------------------------------- # lsof |grep /dev/xconsole syslog-ng 2608 root 15u FIFO 0,5 0t0 19564 /dev/xconsole cat 2641 root 3r FIFO 0,5 0t0 19564 /dev/xconsole --------------------------------- # lsof |grep /dev/log [no output] --------------------------------- # dpkg -l syslog-ng Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-================================================-=============================-=============================-====================================================================================================== ii syslog-ng 3.5.6-2 all Enhanced system logging daemon (metapackage) -------------------------------- # ls -l /dev/log srw-rw-rw- 1 root root 0 Feb 20 11:03 /dev/log --------------------------------

3 7

GSOC 2016 Information
by Yogesh Gopal 22 Feb '16

22 Feb '16

Hi All, I took a look at the potential projects for GSOC 2016 and I found *syslog-ng for Java *project to be synchronizing with my area of interest.Can anyone please throw some more light on this project so that I will get profound knowledge.Also,I would like to contribute to the organization by solving open issues. Regards, Yogesh

2 2

Re: [syslog-ng] Not able to compile syslog-ng OSE with Java support
by Ho, Ming 20 Feb '16

20 Feb '16

Hello, I am able to compile syslog-ng 3.7.2 without the Java-based modules included successfully and the syslog-ng run fine. Now I need to re-compile again with the Java-based modules included. I execute the following steps listed in the syslog-ng-3.7-ose-admin guide: Installed openjdk version "1.8.0_71" Installed gradle version 2.11 export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH export LD_LIBRARY_PATH=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.x86_64/jre/lib/amd64/server:$LD_LIBRARY_PATH When I run ./configure, I notice the java module option is set to "no" in the summary: Modules: Module search path : ${exec_prefix}/lib/syslog-ng Sun STREAMS support (module): no SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : no SMTP support (module) : no AMQP destination (module) : yes STOMP destination (module) : yes GEOIP support (module) : no Redis support (module) : no Riemann destination (module): no python : yes (pkg-config package: python) java : no I go ahead to execute "make" and "make install" without error. But I don't see the "java-modules" directory is created in /usr/local/lib/syslog-ng directory. When I include the following declaration in my syslog-ng.conf to start syslog-ng, I got the following error: [2016-02-20T05:46:59.039466] Plugin module not found in 'module-path'; module-path='/usr/local/lib/syslog-ng', module='mod-java' Why Java modules is not included? What steps am I missing? Any help is appreciated Ming

2 1

Virtual Client
by amey jain 20 Feb '16

20 Feb '16

Hi, I was reading documentation on syslog-ng. I got the fact that there are three operation modes:Sever,client and relay mode. I want to know how to test these modes on my computer. Simple way out, I have a single computer and I want to run syslog-ng server then how will I make virtual clients on the same computer. How will I run both syslog server and syslog client on my same computer for developing it? Regards Amey Jain

1 1

GSoC 2016: Project: syslog-ng for Python
by Amar Budhiraja 19 Feb '16

19 Feb '16

Hi mentors , I am an undergraduate student at IIIT-Hyderabad, India and I am interested in the project proposed by Mr Budai on having syslog-ng for Python. Last year, I interacted with Mr Zoltan about the project of monitoring syslog-ng via an android application. However, I couldn't make it. I consider myself to be fairly proficient in both C and Python. I have had several assignments in both C and Python both in and out of course work. I developed a entire bash terminal in C in my sophomore year. I also developed an application layer protocol in C in the same apart from several minor course projects . I have been working on Python for about 3 year now. I developed a Q/A engine, multiple web apps and implemented the entire Adwords (Google's Search Engine Advertising Framework) for my research paper in Python apart from other projects. Some of my work is available at https://github.com/budhiraja. I also have good understand of syslog-ng at a user level. I am interested in the syslog-ng for Python project. My interest comes from the fact that I will get to learn and build a multi-language system. Can you please guide me on how to move forward with the same? Thanks Sincerely, Amar Budhiraja

2 1

syslog-ng 3.7.x support on armv7 architecture
by Girish Kumar 18 Feb '16

18 Feb '16

Hi All, Please let me know whether syslog-ng 3.7.x is supported on armv7 architecture. I went through the following link and found that armv7 is not listed https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… 1.6. Supported platforms The syslog-ng Open Source Edition application is highly portable and is known to run on a wide range of hardware architectures (x86, x86_64, SUN Sparc, PowerPC 32 and 64, Alpha) Regards, Girish

4 11

Testing filter rules, How can I log structure and data to a fifo ?
by Scot 16 Feb '16

16 Feb '16

Searched for 2 hours this morning and could not find the answer. Testing message filters and I'd like to be able to log all the meta data value pairs to a fifo to make troubleshooting easier. Like RSYSLOG_DebugFormat

3 3

Spock, Is my logic sound ?
by Scot 16 Feb '16

16 Feb '16

I'm still getting stuff on nmsloghost that I think should be filtered out. Do my comments match the conf file ? *# Source UDP/TCP syslog port 514. * source s_net { udp(ip(0.0.0.0) port(514) so_rcvbuf(262142)); tcp(ip(0.0.0.0) port(514) max-connections(250) so_rcvbuf(262142) log_iw_size(25000) ); }; *# Remove messages from 2 network segments * filter f_network {not netmask("192.168.238.0/24") and not netmask(" 192.168.239.0/24") ; }; *# Remove messages matching EITHER expression* filter f_audit { not match("Audit" value("MESSAGE")) and not match("Detailed Tracking" value("MESSAGE")); }; *# Remove messages matching "The scan found detections" expression* filter f_mcafee { not match("The scan found detections." value("MESSAGE")); }; *# Destination rule suppress any duplicates in a 10 second window. *destination d_remote {udp ("nmsloghost" suppress(10)); }; *# Log from s_net and filter out all matches from f_* log udp to nmsloghost. * *# There is no function to "filter( not f_network);" * log { source(s_net); filter(f_network); filter(f_audit); filter(f_mcafee); destination (d_remote);

3 3

running syslog-ng as non root user
by Ryan Koss 15 Feb '16

15 Feb '16

Hello, I’m trying to run syslog-ng as a non-root user. I’ve tried the following command as suggested by the site at the following URL https://www.balabit.com/wiki/syslog-ng-faq-non-root <https://www.balabit.com/wiki/syslog-ng-faq-non-root> Unfortunately I am still encountering permissions issues. ?-> /usr/sbin/syslog-ng --user user --persist-file /code/routeiqSyslog/i95/build/src/lib/util/test/syslog-ng.persist syslog-ng: Error setting capabilities, capability management disabled; error='Operation not permitted' Error binding socket; addr='AF_UNIX(/dev/log)', error='Address already in use (98)' Error initializing message pipeline; ?-> Any ideas, thoughts help will be greatly appreciated. Thanks, -ryan

2 1

Re ./configure not working
by amey jain 12 Feb '16

12 Feb '16

Hi, Sorry for the last mail not being proper. Actually when I run ./configure script for syslog-ng it stops at a point and shows error config.status: error: cannot find input file: `src/Makefile.in' ". It also shows the error "configure: error: ./configure.gnu failed for lib/ivykis". I searched for the ivykis packages through apt-cache search and installed them but the error didn't disappeared. I have copied the ./configure output here. Please see and tell the error. Regards checking whether make supports nested variables... yes checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking whether UID '1000' is supported by ustar format... yes checking whether GID '1000' is supported by ustar format... yes checking how to create a ustar tar archive... gnutar checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking whether gcc understands -c and -o together... yes checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc option to accept ISO C99... -std=gnu99 checking for bison... bison -y checking for flex... flex checking lex output file root... lex.yy checking lex library... -lfl checking whether yytext is a pointer... yes checking whether make sets $(MAKE)... (cached) yes checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking how to print strings... printf checking for a sed that does not truncate output... /bin/sed checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for fgrep... /bin/grep -F checking for ld used by gcc -std=gnu99... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B checking the name lister (/usr/bin/nm -B) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 1572864 checking how to convert x86_64-unknown-linux-gnu file names to x86_64-unknown-linux-gnu format... func_convert_file_noop checking how to convert x86_64-unknown-linux-gnu file names to toolchain format... func_convert_file_noop checking for /usr/bin/ld option to reload object files... -r checking for objdump... objdump checking how to recognize dependent libraries... pass_all checking for dlltool... no checking how to associate runtime and link libraries... printf %s\n checking for ar... ar checking for archiver @FILE support... @ checking for strip... strip checking for ranlib... ranlib checking command to parse /usr/bin/nm -B output from gcc -std=gnu99 object... ok checking for sysroot... no checking for a working dd... /bin/dd checking how to truncate binary pipes... /bin/dd bs=4096 count=1 checking for mt... mt checking if mt is a manifest tool... no checking how to run the C preprocessor... gcc -std=gnu99 -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... yes checking for objdir... .libs checking if gcc -std=gnu99 supports -fno-rtti -fno-exceptions... no checking for gcc -std=gnu99 option to produce PIC... -fPIC -DPIC checking if gcc -std=gnu99 PIC flag -fPIC -DPIC works... yes checking if gcc -std=gnu99 static flag -static works... yes checking if gcc -std=gnu99 supports -c -o file.o... yes checking if gcc -std=gnu99 supports -c -o file.o... (cached) yes checking whether the gcc -std=gnu99 linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes checking for python... /usr/bin/python checking CFLAGS_NOWARN_POINTER_SIGN for gcc -Wno-pointer-sign... -Wno-pointer-sign checking for special C compiler options needed for large files... no checking for _FILE_OFFSET_BITS value needed for large files... no checking how to enable static linking for certain libraries... GNU or Solaris checking for ANSI C header files... (cached) yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... no checking sys/strlog.h presence... no checking for sys/strlog.h... no checking door.h usability... no checking door.h presence... no checking for door.h... no checking sys/capability.h usability... no checking sys/capability.h presence... no checking for sys/capability.h... no checking sys/prctl.h usability... yes checking sys/prctl.h presence... yes checking for sys/prctl.h... yes checking utmp.h usability... yes checking utmp.h presence... yes checking for utmp.h... yes checking utmpx.h usability... yes checking utmpx.h presence... yes checking for utmpx.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking for struct ucred... yes checking for struct cmsgcred... no checking whether struct tm is in sys/time.h or time.h... time.h checking for SO_ACCEPTCONN... yes checking for struct tm.tm_gmtoff... yes checking for struct msghdr.msg_control... yes checking for I_CONSLOG... yes checking for O_LARGEFILE... yes checking for struct sockaddr_storage... yes checking for struct sockaddr_in6... yes checking for PR_SET_KEEPCAPS... yes checking for modern utmp... yes checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for nanosleep in -lrt... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for res_init in -lresolv... no checking for strdup... yes checking for strtol... yes checking for strtoll... yes checking for strtoimax... yes checking for inet_aton... yes checking for inet_ntoa... yes checking for getopt_long... yes checking for getaddrinfo... yes checking for getnameinfo... yes checking for getutent... yes checking for getutxent... yes checking for pread... yes checking for pwrite... yes checking for strcasestr... yes checking for memrchr... yes checking for localtime_r... yes checking for gmtime_r... yes checking for strtok_r... yes checking for clock_gettime... yes checking for EVTLOG... yes checking for TCP wrapper library... checking whether to enable TCP wrapper support... no checking for dlsym in -ldl... yes checking for LIBDBI... no checking whether to enable SQL support... no checking for GLIB... yes checking for g_mapped_file_unref... no checking sanity checking Glib headers... yes checking for GEOIP... no checking for PCRE... yes checking for OPENSSL... yes checking for LIBNET... yes checking whether to enable spoof source support... yes checking for JSON... no checking for JSON... yes checking for LIBMONGO... no checking for prop_get in -lsasl2... no checking for libESMTP... no checking for HIREDIS... yes checking for RIEMANN_CLIENT... no checking for PYTHON... no checking for JAVA_VERSION... no checking for GRADLE_VERSION... no checking whether to enable Sun STREAMS support... no checking whether to enable IPv6 support... yes checking whether to enable Linux capability support... no checking whether to enable mongodb destination support... yes checking whether to enable amqp destination support... yes checking for libsystemd... no checking for libsystemd_daemon... no checking for LIBSYSTEMD_JOURNAL... no checking for UUID... no checking whether to enable Valgrind on the unit tests... checking for valgrind... no yes checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating syslog-ng-native-connector.pc config.status: creating dist.conf config.status: creating Makefile config.status: creating syslog-ng.spec config.status: creating syslog-ng.pc config.status: creating libtest/syslog-ng-test.pc config.status: creating scripts/update-patterndb config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands config.status: executing libtool commands config.status: executing syslog-ng-config.h commands config.status: creating syslog-ng-config.h - prefix SYSLOG_NG for config.h defines config.status: syslog-ng-config.h is unchanged === configuring in lib/ivykis (/home/amey/git/syslog-ng/lib/ivykis) configure: running /bin/bash ./configure.gnu --disable-option-checking '--prefix=/usr/local' --cache-file=/dev/null --srcdir=. ./configure.gnu Running: ./configure --disable-option-checking --prefix=/usr/local --cache-file=/dev/null --srcdir=. --disable-shared --enable-static --with-pic --enable-man-pages checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking whether make supports nested variables... yes checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking whether gcc understands -c and -o together... yes checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking host operating system type... posix checking for working __thread... yes checking whether gcc accepts -pthread... yes checking whether gcc accepts -pthreads... no checking for library containing pthread_atfork... none required checking for library containing pthread_create... none required checking for __sync_lock_test_and_set()... yes checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking process.h usability... no checking process.h presence... no checking for process.h... no checking sys/devpoll.h usability... no checking sys/devpoll.h presence... no checking for sys/devpoll.h... no checking sys/eventfd.h usability... yes checking sys/eventfd.h presence... yes checking for sys/eventfd.h... yes checking sys/syscall.h usability... yes checking sys/syscall.h presence... yes checking for sys/syscall.h... yes checking for sys/thr.h... no checking thread.h usability... no checking thread.h presence... no checking for thread.h... no checking for linux/netfilter_ipv4.h... yes checking for struct timespec.tv_sec... yes checking for library containing clock_gettime... none required checking for clock_gettime... yes checking for CLOCK_MONOTONIC... yes checking for CLOCK_REALTIME... yes checking for library containing inet_ntop... none required checking for library containing socket... none required checking for library containing thr_self... no checking for epoll_create... yes checking for epoll_create1... yes checking for eventfd... yes checking for gettid... no checking for inotify_init... yes checking for kqueue... no checking for lwp_gettid... no checking for port_create... no checking for pthread_spin_lock... yes checking for thr_self... no checking for splice... yes checking for wait4... yes checking whether supports symbol version scripts... yes checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating Makefile config.status: creating contrib/Makefile config.status: creating contrib/iv_getaddrinfo/Makefile config.status: creating contrib/kojines/Makefile config.status: creating man3/Makefile config.status: creating misc/Makefile config.status: creating misc/ivykis.pc ./configure: line 2930: LT_INIT: command not found ./configure: line 3970: AC_PROG_LIBTOOL: command not found config.status: error: cannot find input file: `src/Makefile.in' configure: error: ./configure.gnu failed for lib/ivykis

2 1