- syslog-ng - lists.balabit.hu

Followed files that grow while syslog-ng is reloaded
by Francois Durand 04 Jul '12

04 Jul '12

Hi list, I'm using syslog-ng (3.2.4) to follow some nginx log files using these directives: source s_nginx_logs { file("/path/to/nginx/access.log" flags(no-parse)); } When syslog-ng is reloaded, either for its own log files rotation or because a configuration update (which happens regularly when a new site is added), it does not see new data being written in followed files while it is reloading itself, and then complains about file size having changed and retransmit the whole file to my central log file collector. Here is the warning message: syslog-ng[24608]: The current log file has a mismatching size/inode information, restarting from the beginning; state='affile_sd_curpos(/path/to/nginx/access.log) stored_inode='139419', cur_file_inode='139419', stored_size='985114', cur_file_size='997815', raw_stream_pos='1995630' I don't see how to handle that correctly. Any idea ?

4 6

Error trying to restart service
by James McDonald 02 Jul '12

02 Jul '12

After the weekend I came in to run the checks on our logs and noticed nothing new had been written over the weekend, or at least since mid-night last night. When I tried to restart the service, I got an error saying that the "user; user=root" and "group; group=root" could not be verified. I am stuck in a meeting at the moment and was wondering if anyone could offer any advice on how to quickly resolve this, once I get back to my desk? Thanks, James McDonald System Administrator RHCSA, Security+ jmcdonald(a)lce.com

3 6

[Bug 168] New: Solaris 10 make failure after successful configure
by bugzilla＠bugzilla.balabit.com 02 Jul '12

02 Jul '12

https://bugzilla.balabit.com/show_bug.cgi?id=168 Summary: Solaris 10 make failure after successful configure Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Solaris Status: NEW Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: david.j.fenske(a)usps.gov Type of the Report: bug Estimated Hours: 0.0 1. Download, gunzip, and de-tar syslog-ng-3.3.4 2. PKG_CONFIG_PATH=/usr/local/lib/pkgconfig 3. LD_LIBRARY_PATH=/usr/local/lib 4. ./configure 5. make make all-recursive Making all in lib make: Fatal error in reader: Makefile, line 993: Unexpected end of line seen Current working directory /djftools/syslog/source/syslog-ng-3.3.4/lib *** Error code 1 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='lib modules syslog-ng scripts tests doc contrib scl debian tgz2build build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /djftools/syslog/source/syslog-ng-3.3.4 *** Error code 1 make: Fatal error: Command failed for target `all' -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 10

Re: [syslog-ng] syslog_ng 3.3.4 make error on HPUX HPPA 11.11
by Rakesh Rajasekharan 02 Jul '12

02 Jul '12

Hello Pal, I do not have all of the patches you listed out , installed on my mahcine. I still, tried to compile it with the other suggestion you had put forward but. still was stuck with the same error. I am trying these patches installed and will give it a try thereafer. Will keep you posted. Thanks, Rakesh. On Fri, Jun 1, 2012 at 3:06 AM, Pal Tamas <folti(a)balabit.hu> wrote: > On Thu, May 31, 2012 at 02:13:28PM +0530, Rakesh Rajasekharan wrote: > > Hello Pal, > > > > I was able to get the PHCO_33282 patch and applied it on my 11.11 > machine. > > PHCO_37940 is fo rthe 11.23 HPUX versions hence can't install that. > > > > # swlist -a patch_state *,c=patch |grep PHCO_33282 > > # PHCO_33282 > > PHCO_33282.C-MIN-32ALIB applied > > PHCO_33282.C-MIN-64ALIB applied > > PHCO_33282.CORE-64SLIB applied > > PHCO_33282.CORE-SHLIBS applied > > PHCO_33282.PAUX-ENG-A-MAN applied > > # > > But, even after applying this, I still get the same errors regarding > pthread. > > > > I am curious to know if I should actually be compiling on this 11.11 > machine at > > the first place. > > I mean, is the syslog-ng 3.3.4 compatible with the 11.11 version. The > previous > > version that I was using on this machine is 3.0.7. > > Is there a place I can check the compatible OS's . > Hi, > > dug into the problem a bit more, syslog-ng OSE 3.3 (probably 3.4 too) > needs some porting work before it can be compiled under HP-UX. The > underlying problem is that syslog-ng has been re-written to be > multi-threaded, modular application in 3.2, from it's original single > threaded monolithic architecure. The rewrite added new dependencies > (ivykis) and other required features from the compilers > (Thread-local storage support), which made porting to older systems a > challenge, although the work has been already done, but not every piece > has been added to syslog-ng OSE from the PE branch and not publicly > documented. > > What I managed to solve for now: > - need the following patches: > PHCO_24402 1.0 libc cumulative header file > patch > PHCO_38279 1.0 libc cumulative patch > PHKL_31918 1.0 fsadm;ACL;locking order;8K > mount;readdir > PHSS_30049 1.0 ld(1) and linker tools > cumulative patch > > - download and install GCC for HPUX[1] and make sure it's location > (/opt/hp-gcc/bin) is in PATH, prepeding every other gcc location you > have. > > - edit configure.in and remove all occurences of -Wl,-whole-archive and > -Wl,-no-whole-archive and regenerate configure with autoconf 2.68. If you > don't have autoconf 2.68, edit directly configure and remove the > strings. > > - add the following to lib/compat.h: > #ifndef CLOCK_MONOTONIC > #define CLOCK_MONOTONIC CLOCK_REALTIME > #endif > > - cd lib/ivykis and compile, build and install the bundled ivykis by hand. > > - re-run your configure command with the following options added: > --with-ivykis=system --disable-mongodb > > Hopefully it compiles properly, but I too tired to check it now. > Good luck, > > [1]: > http://h21007.www2.hp.com/portal/site/dspp/menuitem.863c3e4cbcdc3f3515b49c1… > -- > Pal Tamas/Folti > folti(a)balabit.hu > >

2 2

[Bug 185] New: Use upstream ivykis (>= 0.30) instead of a fork
by bugzilla＠bugzilla.balabit.com 01 Jul '12

01 Jul '12

https://bugzilla.balabit.com/show_bug.cgi?id=185 Summary: Use upstream ivykis (>= 0.30) instead of a fork Product: syslog-ng Version: 3.3.x Platform: All OS/Version: All Status: ASSIGNED Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: enhancement Estimated Hours: 0.0 With upstream ivykis 0.30 having everything the syslog-ng internal fork had, and more, it's time to drop the fork, and compile with upstream ivykis as-is. This would mean that the embedded copy (which we will still ship) is replaced by ivykis 0.30, and syslog-ng will become compileable against upstream ivykis. The bulk of the work is already done on my feature/3.3/ivykis-upstream branch, only a few issues remain (see below) before this can be merged to 3.3 master, and this bug report is here to keep track of progress. While trying to merge the branch, I conducted a series of tests, and it appears that somewhere along the way the file destination broke (and most likely everything else that is based on logwriter), and it deadlocks. I do not yet know why, but this feature can't be merged until this problem is solved. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 13

make error syslog-ng 3.3.4 AIX 5.2
by Rakesh Rajasekharan 29 Jun '12

29 Jun '12

I am getting an error during the make stage for syslog-ng 3.3.4. complaining about libiconv. I have compiled libiconv and the library is available under /usr/local/lib # ls -ltr /usr/local/lib/libiconv* -rw-r--r-- 1 root system 890 Jun 17 23:35 /usr/local/lib/ libiconv.la -rw-r--r-- 1 root system 1724284 Jun 17 23:35 /usr/local/lib/libiconv.a ykis-modules.a -lc -Wl,-bnoentry -O2 -pthread -Wl,-brtl -pthread -Wl,--whole-archive -Wl,--no-whole-archive -pthread -Wl,-bE:.libs/libsyslog-ng.exp -Wl,-bernotok /usr/local/lib/libglib-2.0.a(gconvert.o):gconvert.c:(.pr+0x12c): undefined reference to `.libiconv_open' /usr/local/lib/libglib-2.0.a(gconvert.o):gconvert.c:(.pr+0x358): undefined reference to `.libiconv' /usr/local/lib/libglib-2.0.a(gconvert.o):gconvert.c:(.pr+0x39c): undefined reference to `.libiconv_close' collect2: ld returned 1 exit status The compilaiton of glib was fine but not sure why the make fails. Below is my configure options. ./configure --enable-dynamic-linking --prefix=/opt/soe/local/syslog-ng-3.3.4 \ --with-ld-library-path=/opt/soe/local/syslog-ng-3.3.4/lib \ --libdir=/opt/soe/local/syslog-ng-3.3.4/lib --enable-mongodb=no -with-libmongo-client=no Any valuable inputs on this please? Thanks , Rakesh.

4 6

syslog-ng 3.2.5 HPUX 11.11 /usr/ccs/bin/ld: Unsatisfied symbols:
by Divya Vikraman 29 Jun '12

29 Jun '12

Hello, I ma compiling syslog-ng 3.2.5 version on an HPUX 11.11 hppa machine.But, in the make stage , I get the below error. libtool: link: gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -o .libs/pdbtool pdbtool-pdbtool.o -Wl,-E -L/opt/soe/local/syslog-ng-3.2.5/lib:/opt/soe/local/syslog-ng-3.2.5/eventlog/lib libsyslog-ng-patterndb.a -L../../lib/.libs -lsyslog-ng -lcl -L/usr/local/lib -L/opt/soe/local/syslog-ng-3.2.5/eventlog/lib -lrt -lnsl -lgmodule-2.0 -lglib-2.0 -lintl -liconv -levtlog -lpcre -ltermcap -Wl,+b -Wl,/compile/syslog/syslog-ng-3.2.5/lib/.libs:/usr/local/lib:/opt/soe/local/syslog-ng-3.2.5/lib /usr/ccs/bin/ld: Unsatisfied symbols: evt_tag_long (first referenced in libsyslog-ng-patterndb.a(libsyslog_ng_patterndb_a-patterndb.o)) (code) collect2: ld returned 1 exit status make[5]: *** [pdbtool] Error 1 make[5]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/compile/syslog/syslog-ng-3.2.5' make: *** [all] Error 2 I have compiled eventlog -0.2.12 wiht the following ooptions. ./configure --prefix=/opt/soe/local/syslog-ng-3.2.5/eventlog and have also set the PKG_CONFIG_PATH correclty PKG_CONFIG_PATH=/opt/soe/local/syslog-ng-3.2.5/eventlog/lib/pkgconfig:/usr/local/lib/pkgconfig and in the Makefile i have EVTLOG_CFLAGS = -I/opt/soe/local/syslog-ng-3.2.5/eventlog/include/eventlog EVTLOG_LIBS = -L/opt/soe/local/syslog-ng-3.2.5/eventlog/lib -levtlog Can someone pleas help me out to fix this. Thanks, Divya.

2 1

syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 29 Jun '12

29 Jun '12

Hi all, Can somebody unblock us in the below issue.? Thanks Hithendra From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ext anju.raveendrannair(a)wipro.com Sent: Friday, June 08, 2012 5:16 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance. Hi, We are using syslog-ng-3.4.0alpha2 binary and trying to run the syslog-ng server configuration file, but its not starting the syslog ng server. We are getting the following error incase of f__nonconsole_access filter when we ran the syslog-ng binary in debug mode. Filter rule evaluation result; result='match', rule='f_nonconsole_access', location='/ne_data/conf/syslogng/syslog-ng_server.conf:58:29' ** ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self)) Abort (core dumped) PFA the debug.log The server conf is having the following line for the above mentioned filter, template ltemgr_msg_template { template("$S_ISODATE $HOST $FACILITY_NUM/$LEVEL_NUM $MSG\n"); }; #To strip of the msg_id introduced by syslogd rewrite rw_msg{subst("\\[.*\\] <file:///\\[.*\%5d> ", "", value("MESSAGE"));}; source s_LTEMGR_SYSLOG_CLIENTS{ tcp (ip (27.132.98.69) port(6515) max-connections(4) tls( key_file("/ne_data/conf/certificates/MOCM/MOCM_key.pem") cert_file("/ne_data/conf/certificates/MOCM/MOCM_SB_server.pem") ca_dir("/ne_data/conf/certificates/SYSLOGNG") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SS Lv2") peer_verify(optional-untrusted) ) ); }; ....... destination d_ltemgr_nonconsoleaccess_log {file("/ne_data/syslog/ems" perm(0644) template(ltemgr_msg_template)); }; ...... filter f_nonconsole_access { level(info..notice) and facility(auth) and ( match("Accepted password for" value("MESSAGE")) or match("Failed password for" value("MESSAGE")) ); }; ..... log { source(s_LTEMGR_SYSLOG_CLIENTS); filter(f_nonconsole_access); rewrite(rw_msg); destination(d_ltemgr_nonconsoleaccess_log); }; Without debug mode, we were able to run the server but central logging is not happening when tried with logger command. Thanks, Anju Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

Re: [syslog-ng] issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 29 Jun '12

29 Jun '12

Hi Balint, Thanks for the reply. I tried the below rewrite rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; It works for auth.info, but it does not work with local7.info or local6.info as the regex does not handle numerals in the facility field. I tried changing it as follows (i.e. added [0-9] before .)., but with this, this dumps core. Addition of any numeral in this position results in a core dump subst("\[ID [0-9]* [a-z]*[0-9]\.[a-z]*\]\ " "" value("MESSAGE") We have tried the following. logger -p local7.info "HELLO|KUAAA" --> Did not work logger -p local6.info "HELLO|KUAAA" --> Did not work logger -p auth.info "Accepted password for root" --> Worked. Thanks Hithendra -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu on behalf of ext Balint Kovacs Sent: Fri 6/15/2012 10:26 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] issue with rewrite. Please help. Hi Hithendra, I came across this problem just recently, I guess that you want to handle Solaris logs with the standard Unix analysis ruleset, but the these tags are in the way. The only difference is, that I moved the tag to the end of the message (as patterndb does prefix matching, these don't bother my patterns but are still there). My rewrite rule is the following: rewrite r_solaris { #move the solaris header to the end of the message #to work with linux patterndb subst("(\[ID [0-9]* [a-z]*\.[a-z]*\])\ " "" value("MESSAGE") type("pcre") flags(store-matches)); subst("$" " $1" value("MESSAGE") type("pcre")); }; If you don't want to move it (backreferencing is quite slow and resource-intensive), you could just use this untested version: rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; HTH, Balint On 06/15/2012 05:39 AM, Balla, Hithendra (EXT-Other - IN/Bangalore) wrote: > > Hi all, > > We have the followinglog > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6*[ID 800047 > auth.info]*Accepted publickey for xyz > > We wanted to replace*[ID 800047 auth.info]*with*empty > string*(i.e."")and print the following > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz > > So we have used the below re-write with subst. But this is not > workingin*syslog-ng 3.4.0alpha2*. > > rewrite rw_msg{*subst*("\\[.*\\]", "", value("MESSAGE"));}; > > Can somebody help out here? > > Thanks > > Hithendra > > > > ________________________________________________________________________ ______ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

2 1

Re: [syslog-ng] Include doesn't work
by Jakub Prokeš 29 Jun '12

29 Jun '12

Hi! > Include files are only snippets and not full configs, so as such they can not have the @version line in them. I removed version info from snippet, but syntax error is still here. [root@logger:~]# syslog-ng -s -d Adding include file; filename='001-sample.conf' Starting to read include file; filename='/etc/syslog-ng/syslog-ng.conf.d/001-sample.conf', depth='1' syntax error in /etc/syslog-ng/syslog-ng.conf.d/001-sample.conf at line 7. At line 7 start this section: destitation d_messages_sample { file("/home/sample/var/$HOST/messages/$YEAR$MONTH$DAY.log"); }; Is there some kind of list available directives in sniplets? Regards, -- Jakub Prokes Senior Linux Administrator m: podpora(a)superhosting.cz w: www.superhosting.cz | www.datacamp.sk [CZ]: +420 296 826 296 | Na Safrance 33, Praha 10 - Vinohrady [SK]: +421 (2) 2025 6256 | Bozeny Nemcovej 8, Bratislava

4 4

[Bug 181] New: Daemon stops reading from unix-dgram source following charset decoding error
by bugzilla＠bugzilla.balabit.com 29 Jun '12

29 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=181 Summary: Daemon stops reading from unix-dgram source following charset decoding error Product: syslog-ng Version: 3.3.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=674099 OS/Version: Linux Status: ASSIGNED Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: bug Estimated Hours: 0.0 As explained in the Debian bug report (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=674099) when we have an unix-dgram() source with encoding set, and we send invalid data there, no further messages will be processed. It's easy to reproduce, and only seems to happen with unix-dgram (tcp at least does not exhibit this problem). I'm not quite sure yet why this happens - the source is kept open, just doesn't seem to be handled at all. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 159] New: on signal HUP program destinations are not closed
by bugzilla＠bugzilla.balabit.com 26 Jun '12

26 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=159 Summary: on signal HUP program destinations are not closed Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 In previous versions of syslog-ng, when a HUP signal was sent to syslog-ng it would close all of its destinations and reopen them. In version 3.3.4 (perhaps earlier ones) the destination to programs is not closed, but a new one is opened. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 12

Re: [syslog-ng] Forward slashes in QSTRING
by Evan Rempel 24 Jun '12

24 Jun '12

can you try this "@STRING::/@/@STRING:lastName:-._@ " This should match alphanumerics including / but followed by a / and a string of alphanumerics including -._that does not include a / and then followed by a space (I forget what your original text to match on looks like. Evan Michael Starks <syslog-ng-list(a)michaelstarks.com> wrote: On 06/19/2012 11:24 AM, Martin Holste wrote: > If you know this will be the rest of the message, you can use a > capturing @ANYSTRING:var:@ to grab everything left in the message. Thanks. I have tried @ANYSTRING@ but as I suspected it starts matching on the first / since the pattern is being read left-to-right. What ends up happening is that the entire file path is included. I still don't see a way to capture everything between the last / and the ' without knowing in advance how deep the path will be. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 2

[Bug 184] New: syslog-ng.service and systemd with journal support
by bugzilla＠bugzilla.balabit.com 22 Jun '12

22 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=184 Summary: syslog-ng.service and systemd with journal support Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Hi, The current syslog-ng.service file shipped in the contrib directory (contrib/systemd/syslog-ng.service) will break under recent systemd versions (with journal support) as systemd-kmsg-syslogd.service has been discontinued. Offending line: ... ExecStartPre=/bin/systemctl stop systemd-kmsg-syslogd.service ... Possible solutions: 1) remove the ExecStartPre line 2) prefix the command with a dash to avoid error checking Affected syslog-ng branches: branches >= 3.3 Fedora >= 17 current status: We have eliminated the offending line from the Fedora' syslog-ng.service file. More information: Bug 833551 - don't refer to systemd-kmsg-syslogd.service anymore https://bugzilla.redhat.com/show_bug.cgi?id=833551 /jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

Forward slashes in QSTRING
by Michael Starks 22 Jun '12

22 Jun '12

Is it possible to use a / as a delimiter in QSTRING? The documentation seems to permit it, but my pattern doesn't work. Here's the pattern: <pattern>Alert Level: @NUMBER:i0:@; Rule: @NUMBER:i1:@ - @ESTRING:s0:;@ Location: @QSTRING:s1:()@ @IPv4:i2:@->syscheck; Integrity checksum changed for: @QSTRING:s4:/'@</pattern> And here's the string I want to match on: Alert Level: 7; Rule: 550 - Integrity checksum changed.; Location: (agentname) 172.16.0.1->syscheck; Integrity checksum changed for: '/etc/fstab' The idea is to extract only 'fstab' (without the quotes). I have also tried 0x2f in place of / with similar results, and various attempts at escaping it have failed. Thanks.

3 5

Two or more conditions on a action
by C. L. Martinez 20 Jun '12

20 Jun '12

Hi all, Is it possible to configure two or more conditions under an action?? For example: <action trigger="match" condition=" '${first_field}@1' == 'something_1' & '${second_field}' == 'something_2' "> This action it doesn't works ... I am using syslog-ng 3.3.5 Thanks.

3 6

Include doesn't work
by Jakub Prokeš 20 Jun '12

20 Jun '12

Hi! I use syslog-ng for logging through network, but for some hosts I need special configs. I created directory /etc/syslog-ng/syslog-ng.conf.d and in there create file with config which is attached and include it in main conf file: ## include here config of clients with special options include syslog-ng.conf.d/; ## common clients log { source(s_clients); source(s_local); filter(f_std_facility); destination(d_host_facility); }; The result is syntax error in configuration: [root@logger:/etc]# syslog-ng -s -d Adding include file; filename='001-sample.conf' Starting to read include file; filename='/etc/syslog-ng/syslog-ng.conf.d/001-sample.conf', depth='1' syntax error in /etc/syslog-ng/syslog-ng.conf.d/001-sample.conf at line 1. syslog-ng documentation: http://www.balabit.com/support/documentation/?product=syslog-ng mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng [root@logger:/etc]# syslog-ng --version syslog-ng 3.1.3 Installer-Version: 3.1.3 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#def34661b08109f8148904b860457d5747c425b3 Compile-Date: Feb 1 2011 19:11:59 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: on Enable-Pcre: on Can you help me? Regards, -- Jakub Prokes Senior Linux Administrator m: podpora(a)superhosting.cz w: www.superhosting.cz | www.datacamp.sk [CZ]: +420 296 826 296 | Na Safrance 33, Praha 10 - Vinohrady [SK]: +421 (2) 2025 6256 | Bozeny Nemcovej 8, Bratislava

2 1

cipher_suite param support ?
by Balla, Hithendra (EXT-Other - IN/Bangalore) 20 Jun '12

20 Jun '12

Hi all, Can somebody provide the following information. 1) Which version of syslog-ng provides support for cipher suite parameter, so that there is a possibility to configure the strong ciphers. 2) Does cipher suite parameter is available in 3.2 ? Thanks Hithendra

3 5

Re: [syslog-ng] issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 19 Jun '12

19 Jun '12

Hi Balint and all, Can you guide us here on what might be the issue ? Thanks Hithendra -----Original Message----- From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Monday, June 18, 2012 6:53 PM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] issue with rewrite. Please help. Hi Balint, Thanks for the reply. I tried the below rewrite rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; It works for auth.info, but it does not work with local7.info or local6.info as the regex does not handle numerals in the facility field. I tried changing it as follows (i.e. added [0-9] before .)., but with this, this dumps core. Addition of any numeral in this position results in a core dump subst("\[ID [0-9]* [a-z]*[0-9]\.[a-z]*\]\ " "" value("MESSAGE") We have tried the following. logger -p local7.info "HELLO|KUAAA" --> Did not work logger -p local6.info "HELLO|KUAAA" --> Did not work logger -p auth.info "Accepted password for root" --> Worked. Thanks Hithendra -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu on behalf of ext Balint Kovacs Sent: Fri 6/15/2012 10:26 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] issue with rewrite. Please help. Hi Hithendra, I came across this problem just recently, I guess that you want to handle Solaris logs with the standard Unix analysis ruleset, but the these tags are in the way. The only difference is, that I moved the tag to the end of the message (as patterndb does prefix matching, these don't bother my patterns but are still there). My rewrite rule is the following: rewrite r_solaris { #move the solaris header to the end of the message #to work with linux patterndb subst("(\[ID [0-9]* [a-z]*\.[a-z]*\])\ " "" value("MESSAGE") type("pcre") flags(store-matches)); subst("$" " $1" value("MESSAGE") type("pcre")); }; If you don't want to move it (backreferencing is quite slow and resource-intensive), you could just use this untested version: rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; HTH, Balint On 06/15/2012 05:39 AM, Balla, Hithendra (EXT-Other - IN/Bangalore) wrote: > > Hi all, > > We have the followinglog > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6*[ID 800047 > auth.info]*Accepted publickey for xyz > > We wanted to replace*[ID 800047 auth.info]*with*empty > string*(i.e."")and print the following > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz > > So we have used the below re-write with subst. But this is not > workingin*syslog-ng 3.4.0alpha2*. > > rewrite rw_msg{*subst*("\\[.*\\]", "", value("MESSAGE"));}; > > Can somebody help out here? > > Thanks > > Hithendra > > > > ________________________________________________________________________ ______ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

1 0

Writes garbled kernel messages to logs
by shih dane 18 Jun '12

18 Jun '12

Hi All Lately I've setup syslog server on Fedora 12 l want to get iscsi connection log but get some garbled kernel messages like this Jun 8 09:56:12 F12DANE kernel: 6MxusadnRT 1 Jun 8 09:56:12 F12DANE kernel: 6DtPUnre: Ys<>aaeunenre: e Jun 8 09:56:12 F12DANE kernel: 6Erreoeyee: 0<>esoTp: oml<>---------------------------------<>AGTCR[SS] eitrdfbi_espr ff82d810<>SS oi ucsflo I:1fo 7.66.4 o121.51736, Jun 8 09:56:12 F12DANE kernel: 6IceetdiCICneto on o1fo oe q.910.o.irsf:aep Jun 8 09:56:12 F12DANE kernel: 6EtbihdiCIssinfo oe q.910.o.irsf:aep Jun 8 09:56:12 F12DANE kernel: 6Iceetdnme fatv SS esost niCITre otlGop Jun 8 09:56:15 F12DANE kernel: Received iSCSI login reques rm121.419o C ewr otl121.51736 Jun 8 09:56:15 F12DANE kernel: tfo 7.66.4 nTPNtokPra 7.66.7:20<>---------------------------------<>uhehd oe<>edriet oe<>aaiet oe<>aRcDtSgetegh 53 Jun 8 09:56:15 F12DANE kernel: 6--------------------------------- Jun 8 09:56:15 F12DANE kernel: 6--------------------------------- Jun 8 09:56:15 F12DANE kernel: 6Iiitrae in19-5cmmcootdn-c<>agtla: I agt<>agtotlruTg Jun 8 09:56:15 F12DANE kernel: 6DfutieWi: 2<>ealTm2ean 0<>esoTp: icvr Jun 8 09:56:15 F12DANE kernel: 6--------------------------------- Jun 8 09:56:15 F12DANE kernel: 6TRE_OEiCI:Rgsee arcss_t:ff800208 Jun 8 09:56:15 F12DANE kernel: 6iCILgnscesu nCD rm121.419t 7.66.7:201<>nrmne SS oncincutt rmnd:in19-5cmmcootdn-c<>salse SS eso rmnd:in19-5cmmcootdn-c<>nrmne ubro cieiCIssin o1o SS agtPra ru:1<>ermne SS onci syslog-ng version : syslog-ng 3.3.1 syslog-ng.conf @version: 3.3 @include "scl.conf" options { stats_freq(0); create_dirs(yes); dir_perm(0777); perm(0644); }; source src { system(); internal(); udp(); }; destination information { file("/raid/syslog/information"); }; destination error { file("/raid/syslog/error"); }; destination warning { file("/raid/syslog/warning"); }; filter f_info { level(info); }; filter f_error { level(error); }; filter f_warning { level(warning); }; log { source(src); filter(f_info); destination(information); }; log { source(src); filter(f_error); destination(error); }; log { source(src); filter(f_warning); destination(warning); }; Thanks for any advice Best Regard Dane

2 4

how can i get usb and printer detailed logs with syslog-ng
by ismail başaran 18 Jun '12

18 Jun '12

Hi, İ am using ubuntu 11.04. My server machine and clients ubuntu 11.04. i am trying to get usb and printer detailed logs. i can see usb connect and disconnect logs. But i want to see what operations execute on it like copied file name or printed file name. How can i achive this. thanks -- İsmail BAŞARAN http://www.softera.com.tr

2 1

issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 15 Jun '12

15 Jun '12

Hi all, We have the following log 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 [ID 800047 auth.info] Accepted publickey for xyz We wanted to replace [ID 800047 auth.info] with empty string (i.e. "") and print the following 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz So we have used the below re-write with subst. But this is not working in syslog-ng 3.4.0alpha2. rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; Can somebody help out here? Thanks Hithendra

2 1

Re: [syslog-ng] issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 15 Jun '12

15 Jun '12

Can somebody help here on this issue? _____________________________________________ From: Balla, Hithendra (EXT-Other - IN/Bangalore) Sent: Friday, June 15, 2012 9:09 AM To: 'Syslog-ng users' and developers' mailing list' Subject: issue with rewrite. Please help. Hi all, We have the following log 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 [ID 800047 auth.info] Accepted publickey for xyz We wanted to replace [ID 800047 auth.info] with empty string (i.e. "") and print the following 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz So we have used the below re-write with subst. But this is not working in syslog-ng 3.4.0alpha2. rewrite rw_msg{subst("\\[.*\\]", "", value("MESSAGE"));}; Can somebody help out here? Thanks Hithendra

2 1

syslog-ng 3.3.4 Coredumps on AIX 5.2
by Divya Vikraman 15 Jun '12

15 Jun '12

Hello ALL, I have compiled syslog-ng 3.3.4 version using dynamic linking. But , while trying to run syslog-ng it coredumps # /opt/soe/local/syslog-ng-3.3.4/sbin/syslog-ng -F Memory fault(coredump) # I have compiled glib-2.19.7 with the (--enable-static and --with-libiconv) option After searching over the net for some possibel solutions , i found that a possible solution for this is to use the AIX libiconv instead of the GNU one. If this is correct, then the issue is , glib-2 needs the GNU glib, if i try with the system one the make fails with the below error. "error GNU libiconv not in use but included iconv.h is from libiconv". So, I cannot use the system libiconv as glib-2 will fail to compile and if I use GNU libiconv syslog-ng coredumps. though, the configure and stages do not complaing anything. Has, anyone else faced this issue , please let me know how can I get this working. Best Regards, Divya.

2 1

syslog-ng maintenance changes
by Balazs Scheidler 15 Jun '12

15 Jun '12

Hi, I had a decreasing amount of time to work on syslog-ng in the past year, as you may have noticed by my absense on the mailing list, and the relative rarity of my blog posts. More and more is done by Algernon (aka Gergely Nagy), and I felt it to be incorrect to be the bottleneck in a number of cases. Even though Algernon is emloyed by BalaBit, his daily job didn't and doesn't mandate such close relationship with syslog-ng. That was his own motivation, and I think that is a key to maintaining or developing open source software. After talking to him in real life, we've decided to make a shift, he is going to maintain the 3.3 tree and making releases instead of myself. This will make 3.3 maintenance smoother, and free some precious time for me, which I'd use to work on the 3.4 features. The location of the syslog-ng trees will change too, they would be available at: git://github.com/balabit/syslog-ng-3.3.git git://github.com/balabit/syslog-ng-3.4.git or the web interface at: http://github.com/balabit I am certain that this change is for the better of syslog-ng, and I hope the conclusion of the community will be the same in a few months. I really thank him for helping me out. Cheers, Bazsi

4 5