- syslog-ng - lists.balabit.hu

Multi-threaded in open source?
by Avleen Vig 25 Nov '11

25 Nov '11

Hi everyone, I'm running an infrastructure with several hundred hosts logging many hundreds of Gb of logs to a central server. Syslog-ng on the central server is using 100% CPU on a single core, and I see here: http://bazsi.blogs.balabit.com/2011/07/syslog-ng-multithreaded-performance/ that there is some multi-threading option available! Is this only in the PE version or is there an OSE edition with this feature?

5 6

[PATCH (3.4)] value-pairs: Fix the error handling in the command-line parser.
by Gergely Nagy 25 Nov '11

25 Nov '11

When an error occurs during command-line parsing, do not attempt to free argv: it's not owned by us anymore. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/value-pairs.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/lib/value-pairs.c b/lib/value-pairs.c index fcaa401..c58d294 100644 --- a/lib/value-pairs.c +++ b/lib/value-pairs.c @@ -465,7 +465,6 @@ value_pairs_new_from_cmdline (GlobalConfig *cfg, { value_pairs_free (vp); g_option_context_free (ctx); - g_free (argv); return NULL; } g_option_context_free (ctx); -- 1.7.7.3

2 1

[PATCH] logproto: Fix compilation on systems without IOV_MAX.
by Gergely Nagy 25 Nov '11

25 Nov '11

Since IOV_MAX is not defined on Hurd its usage is made conditional. Errors are handled by g_malloc0() which aborts on failure, so no return value has to be checked. Reported-By: Svante Signell <svante.signell(a)telia.com> Patch-From: Svante Signell <svante.signell(a)telia.com> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- lib/logproto.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/lib/logproto.c b/lib/logproto.c index 282064c..16ca0d7 100644 --- a/lib/logproto.c +++ b/lib/logproto.c @@ -420,9 +420,11 @@ log_proto_file_writer_new(LogTransport *transport, gint flush_lines) if (flush_lines == 0) /* the flush-lines option has not been specified, use a default value */ flush_lines = 1; +#ifdef IOV_MAX if (flush_lines > IOV_MAX) /* limit the flush_lines according to the current platform */ flush_lines = IOV_MAX; +#endif /* allocate the structure with the proper number of items at the end */ LogProtoFileWriter *self = (LogProtoFileWriter *)g_malloc0(sizeof(LogProtoFileWriter) + sizeof(struct iovec)*flush_lines); -- 1.7.7.3

2 1

[PATCH] logrewrite: Fix the logrewrite cloning functions.
by Gergely Nagy 25 Nov '11

25 Nov '11

Repair the rewrite clone funcions, to correctly clone the value_handle and conditions aswell. Without this, if we use rewrite in multiple logpaths, only the first will behave correctly, the cloned ones will all rewrite the $MESSAGE macro instead, because that's the default. Signed-off-By: Zoltan Fried <deirf(a)balabit.hu> Signed-off-By: Gergely Nagy <algernon(a)balabit.hu> --- lib/logrewrite.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/lib/logrewrite.c b/lib/logrewrite.c index d282f6f..a578439 100644 --- a/lib/logrewrite.c +++ b/lib/logrewrite.c @@ -165,6 +165,8 @@ log_rewrite_subst_clone(LogProcessPipe *s) cloned = (LogRewriteSubst *) log_rewrite_subst_new(self->replacement->template); cloned->matcher = log_matcher_ref(self->matcher); + cloned->super.value_handle = self->super.value_handle; + cloned->super.condition = self->super.condition; return &cloned->super.super.super; } @@ -227,6 +229,8 @@ log_rewrite_set_clone(LogProcessPipe *s) LogRewriteSet *cloned; cloned = (LogRewriteSet *) log_rewrite_set_new(self->value_template->template); + cloned->super.value_handle = self->super.value_handle; + cloned->super.condition = self->super.condition; return &cloned->super.super.super; } -- 1.7.7.3

2 1

[PATCH] Fixed compounded filter initialization.
by Szalay Attila 25 Nov '11

25 Nov '11

If a filter link to an other filter an init function called to set up this link. But if this filter is compunded then this callback is not called so the filter is not initialized but silently evaluated to false. For example in the following situation the f_message is always true: filter f_auth { facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_mail { facility(mail); }; filter f_messages { not filter(f_auth) and not filter(f_cron) and not filter(f_mail); }; Signed-off-by: Szalay Attila <sasa(a)balabit.hu> --- lib/filter.c | 39 +++++++++++++++++++++++++++++++++++++++ 1 files changed, 39 insertions(+), 0 deletions(-)

2 1

preserving tags across the network
by Matt Zagrabelny 24 Nov '11

24 Nov '11

Hi, I am trying to ship a bunch of apache log files across the network and on the syslog-ng server side then break them into their individual files again. I am not sure the best way to do this, but it looks like tags might be helpful. On my apache system I have the following snippets: -----{syslog-ng client begin}----- source s_apache_access { file("/var/log/apache2/access.log" tags("main_access") ); }; source s_apache_other_vhost_access { file("/var/log/apache2/other_vhost.log" tags("other_vhost_access") ); }; destination d_server { syslog( "10.0.0.1" transport("tls") port(6514) tls( peer-verify(required-trusted) ca_dir('/etc/syslog-ng/ssl/ca.d') key_file('/etc/syslog-ng/ssl/server.key') cert_file('/etc/syslog-ng/ssl/server.crt') ) ); }; log { source(s_apache_access); source(s_apache_other_vhost_access); destination(d_server); }; -----{syslog-ng client end}----- On my server I have the following: -----{syslog-ng server begin}----- source s_tls { syslog( ip(0.0.0.0) port(6514) transport("tls") tls( peer-verify(required-trusted) ca_dir('/etc/syslog-ng/ssl/ca.d') key_file('/etc/syslog-ng/ssl/server.key') cert_file('/etc/syslog-ng/ssl/server.crt') ) max_connections(1000) keep_hostname(yes) ); }; filter f_main_apache_access { tags("main_access"); }; destination d_main_access { file("/var/log/apache2/access.log"); }; log { source(s_tls); filter(f_main_apache_access); destination(d_main_access); }; -----{syslog-ng server end}----- It doesn't look like the "tag" is being preserved through the network. Does anyone know if tags is the right mechanism for splitting apart (filtering) the aggregate stream coming in on the server? Any other advice would be greatly appreciated. Thanks! -matt zagrabelny

4 6

How to detect loss of connection of remote syslog-ng client.
by Pramod Pillai 24 Nov '11

24 Nov '11

Hi I am using syslog-ng server on Solaris box and the syslog-ng clients are running on Linux box. When client ( linux ) box crashes the streaming stops. But the syslog-ng server assumes that the client is connected and keeps the connection. Is there any way to detect this condition and close the socket connection to the client which no longer exists. Regards Pramod

2 2

[PATCH 0/1]: value-pairs: key rewriting support
by Gergely Nagy 24 Nov '11

24 Nov '11

After going over the code a few more times, and after a quick chat with Bazsi, I cleaned up the patch considerably. So much so, that I'm actually starting to like it! Functionality remained the same, but the code behind it is shorter and contains less magic. Instead of playing tricks with both scratch buffers and allocating gchar* strings all over the place, the transformation functions now operate directly on scratch buffers, and we steal the results. The patch coming in a follow-up message is something I consider ready for review. The only thing left to do is adding a couple of test cases (there's already a simple one included, but I'd like a few more).

1 1

Enterprise Log Search and Archive (ELSA) Beta Available
by Martin Holste 23 Nov '11

23 Nov '11

The new auto-installer script is working well enough that I think most people should be able to get the beta of ELSA installed now. I put up a short post with the details and screenshots on my blog here: http://ossectools.blogspot.com/2011/11/elsa-beta-available.html . >From the project page (http://code.google.com/p/enterprise-log-search-and-archive/) Features: * High-volume receiving/indexing (a single node can receive > 30k logs/sec, sustained) * Full Active Directory/LDAP integration for authentication, authorization, email settings * Instant ad-hoc reports/graphs on arbitrary queries even on enormous data sets * Email alerting, scheduled reports * Plugin architecture for web interface * Distributed architecture for clusters * Ships with normalization for some Cisco logs, Snort/Suricata, Bro, and Windows via Eventlog-to-Syslog or Snare Many thanks to Peter for helping me test the auto-installer, as well as all of Balabit for providing such an amazingly fast syslog parser with PatternDB. Please let me know if you run into issues installing. Ubuntu, openSUSE, and CentOS have been tested, but variations of those distros should work fine.

1 0

Query regarding syslog-ng.conf and creation of logging files
by Ankit Mahawar 23 Nov '11

23 Nov '11

Hi, Please help regarding doubts of syslog-ng.conf file 1 . The destination files specified in syslog-ng.conf is created by syslog-ng ?? 2. If they are created by syslog-ng then , are they created only when the log gets filtered for that destination file ? 3 . Does this happen in syslog as well,because I think in syslog the file gets created even before logging into the file I am new to syslog utilities and it is just my assumption that the files might be created using the conf file ,because when I killed syslog daemon and restarted it ,the file I removed got created again but not in the case of syslog-ng. Please help regarding this issue . Thanks Ankit =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

5 5

rpmbuild on centos6
by Hajdu Tamás Márk 23 Nov '11

23 Nov '11

Hi everyone! I wanted to build rpm-s from syslog-ng (and maintain it in the future). I've using eventlog_0.2.12 (from source) which builds with some fiddling, but syslog-ng_3.3.3 (also from source) won't build. [rpmbuilder@svn ~]$ rpmbuild -ta rpmbuild/SOURCES/syslog-ng_3.3.3.tar.gz error: File /home/fathom/rpmbuild/SOURCES/ivykis-0.21.tar.gz: No such file or directory I have not found anything like ivykis in the .spec file, but I have downloaded it: [rpmbuilder@svn ~]$ rpmbuild -ta rpmbuild/SOURCES/syslog-ng_3.3.3.tar.gz error: line 135: second %prep Somehow it makes one spec file from the syslog-ng spec and the ivykis spec file... I tried to other way as well. Building it from the spec file cries for dependencies, including libevtlog and libnet-devel. The first is ok, but I do not really want to install that on the rpm building system, but the second one is totally missing from centos6. Has anyone some clues about this? It would be a pain in the ass to manually install/update everywhere. Hajdu Tamás Márk

2 2

Query regarding syslog-ng.conf and creation of logging files
by Ankit Mahawar 23 Nov '11

23 Nov '11

Hi, Please help regarding doubts of syslog-ng.conf file 1 . The destination files specified in syslog-ng.conf is created by syslog-ng ?? 2. If they are created by syslog-ng then , are they created only when the log gets filtered for that destination file 3 . Does this happen in syslog as well,because I think in syslog the file gets created even before logging into the file I am new to syslog utilities and it is just my assumption that the files might be created using the conf file ,because when I killed syslog daemon and restarted it ,the file I removed got created again but not in the case of syslog-ng. Please help regarding this issue .. Thanks Ankit =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

1 0

Cisco IOS message format
by Wells, James 22 Nov '11

22 Nov '11

Hi All, I am struggling to get syslog-ng to output the correct format for Cisco IOS devices. I am using syslog-ng to forward message to a NMS system. The issue I see is syslog-ng upon forwarding adds more data to the message as I am assuming it does not understand the Cisco IOS syslog format. Version of syslog-ng: Name : syslog-ng Relocations: (not relocatable) Version : 2.1.4 Vendor: Fedora Project Release : 9.el5 Build Date: Mon 16 May 2011 15:09:47 BST Install Date: Fri 21 Oct 2011 12:26:04 BST Build Host: x86-01.phx2.fedoraproject.org Group : System Environment/Daemons Source RPM: syslog-ng-2.1.4-9.el5.src.rpm Cisco IOS statements: service timestamps log datetime msec localtime show-timezone logging trap notifications logging facility local6 Syslog format in the local file: Nov 10 10:18:44.102 UTC: %SYS-5-CONFIG_I: Configured from console by testuser on vty0 (1.2.3.4) Syslog-ng conf file: options { sync(0); time_reopen(10); log_fifo_size(1000); long_hostnames(off); check_hostname(yes); keep_hostname(yes); chain_hostnames(no); use_time_recvd(yes); }; template("$MSGONLY\n") When I perform a TCPDUMP and view the incoming message and then the forwarded message I can see that syslog-ng adds more data to the MESSAGE aspect of the syslog. Has anyone been able to create a filter or template that manages this format, so that the forwarding of the syslog onto another receiver is not changed as syslog-ng is adding the $DATE and $HOST to the message. Thanks in advance James _______________________________________________________________________ This email is intended only for the use of the individual(s) to whom it is addressed and may be privileged and confidential. Unauthorised use or disclosure is prohibited. If you receive this e-mail in error, please advise immediately and delete the original message without copying, using, or telling anyone about its contents. This message may have been altered without your or our knowledge and the sender does not accept any liability for any errors or omissions in the message. This message does not create or change any contract. Royal Bank of Canada and its subsidiaries accept no responsibility for damage caused by any viruses contained in this email or its attachments. Emails may be monitored. RBC Capital Markets is a business name used by branches and subsidiaries of Royal Bank of Canada, including Royal Bank of Canada, London branch and RBC Europe Limited. In accordance with English law requirements, details regarding RBC Europe Limited are set out below: RBC EUROPE LIMITED Registered in England and Wales 995939 Registered Address: Riverbank House, 2 Swan Lane, London, EC4R 3BF. Authorised and regulated by the Financial Services Authority. Member of the London Stock Exchange.

2 2

[PATCH 0/1]: value-pairs key rewriting for 3.4
by Gergely Nagy 21 Nov '11

21 Nov '11

The patch I'll be sending in a followup implements key rewriting for syslog-ng 3.4. I wrote about this quite a bit in the past, and this time, there are no functional changes - it's just the work I've done so far merged into a single patch. ...and updated a bit, because during the merge, I discovered that the transformations are not thread safe, so I took the opportunity to convert them to scratch buffers too. This, however, was done in a bit of a hurry, so I'm not entirely happy with the result. Nevertheless, I'm submitting it as a single patch, mostly so that it can be reviewed in its entirety. I don't think it's ripe for a merge yet, there's a bit of work left to done still, at least in the code part. The functionality itself is - I believe - solid by now. The former branch I worked on (feature/3.4/value-pairs/rekey) will be deleted soon, as it does not contain the latest fixes I applied during the commit merging process. -- |8]

1 4

Fwd: bug in syslog-ng 3.2 and 3.3
by Gergely Nagy 21 Nov '11

21 Nov '11

The mail below was originally sent to one of our internal addresses, but since it's a bug report against 3.2 and 3.3, it is better to have it posted here too (with original files attached): Da Mota Sam <da.mota.sam(a)gmail.com> wrote: > > Hi, > > I think I found a bug in syslog-ng starting from version 3.2. > > You will find in attachment the smallest configuration files for which > the bug appears. > These files must be placed in /etc/syslog-ng "to work". > > The problem seems to be in a bad handling of characters with accents. > > With the attached configuration files, when syslog-ng receives a > message containing just "1 é" > (for exemple by calling "logger '1 é') one should expect the creation > of a file /var/log/message_with_id_matched > This file isn't actually created. > > The given file pattern_rules.xml contains two patterns. If I remove > one of them, then I get the creation of the file > /var/log/message_with_id_matched, which makes me think that one of the > pattern shadows the other one. > > > About: > I got this erroneous behaviour with: > - syslog-ng 3.2.4 on debian wheezy (from debian packages) > - syslog-ng 3.2.4 on debian lenny (from syslog-ng source code) > - syslog-ng 3.2.4 on debian squeeze (from syslog-ng source code) > - syslog-ng 3.2.5 on debian squeeze (from syslog-ng source code) > - syslog-ng 3.3.1 on debian wheezy (using the packages of debian sid) > > the bug was not present on syslog-ng 3.1 on debian squeeze (from > debian packages) > > Could you please check that you get the same errors, and let me know about it? > (so I could bug report this to the debian team if it is not a syslog-ng bug). > > > Best regards, > -- > Samuel Da Mota -- |8]

1 0

Monitoring syslog-ng logserver
by Paul Muther 19 Nov '11

19 Nov '11

Greetings all, I have a question about monitoring syslog-ng itself. In the event that the log server stops listening or stops processing for messages for whatever reason is there a way to alert on hosts that messages are being queued/buffered? In a situation recently the log server syslog-ng process was running but not accepting log messages from remote hosts for some reason. As a result they all pilled up at the sources until the clients rolled over. It would be helpful to have an alert that it is happening but I can't find anything on monitoring the buffers. Thanks much, PM

2 1

patterndb
by Gianluca Tranelli 18 Nov '11

18 Nov '11

Good morning everybody, the time is very good here in Rome, but I don't want to talk abbout the weather but about patterndb that is driving me crazy. After reading all the administration guide v3.3, I found an example of using patterndb to log the duration of an ssh Linux and to log a new formatted message. I just copied the XML, ran update-patterndb but nothing happen. Do i miss something? Can someone post a complete working example on ssh? Patterndb is driving me crazy. Thank you in advance.

2 3

Query regarding syslog-ng
by Ankit Mahawar 18 Nov '11

18 Nov '11

Hi , In c++ we have a function syslog for logging data into the log file . Similar function can be used in syslog-ng for logging or there is a separate function I am totally new to syslog-ng. Thanks =====-----=====-----===== Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

2 3

Simple config question
by Miguel Alvarez 18 Nov '11

18 Nov '11

Hi, After being less than impressed with the stability of rsyslog, I just discovered syslog-ng and it looks really impressive but a bit overwhelming! I have a simple configuration with my existing rsyslog set up where it's performing normal system syslog responsibilities but also tagging other log files and then forwarding them to a centralized log server. The examples I've seen for syslog-ng are making my head swim so I was hoping someone would be able to point me in the right direction on how to do the same with syslog-ng. Thank you

5 12

syslog-ng fails to drop file handles and reopen on HUP signal
by Dave Rawks 17 Nov '11

17 Nov '11

Since 3.3.2 I've been seeing this weird behavior where syslog-ng fails to reload cleanly on a HUP. This has been particularly hard to troubleshoot since it appears as though when the reload fails it is causing both sshd and login to block; which I suspect is because /dev/log has disappeared. Luckily I do have nagios nrpe setup to allow me to remotely restart syslog-ng which alleviates the inability to login, but also makes it very hard to collect any troubleshooting information. Anyone else seeing any failures like this? I also sometimes see a a kernel error like one of the following on reload: Nov 17 10:30:02 app-bogus kernel: [ 3788.489852] syslog-ng[28520]: segfault at 7fd054022350 ip 00007fd054022350 sp 00007fffc93404e8 error 15 OR Nov 17 10:32:35 app-bogus kernel: [ 3941.605005] syslog-ng[29805] general protection ip:7fd05f0bcc4e sp:7fd05ac71240 error:0 in libsyslog-ng-3.3.2.so[7fd05f092000+7b000] I was really excited about the features this version of syslog-ng has brought with it, but I'm finding it WAY to unstable to use in production. Is there any information I could provide to help resolve these possibly related issues? -Dave

2 1

R: Re: R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

Sorry, but I need more help. I need to install syslog-ng in server mode and I'm not able to find the installer script. Thanks. >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 17/11/2011 12.10 >A: "andrea.meconi(a)libero.it"<andrea.meconi(a)libero.it> >Cc: "Syslog-ng users' and developers' mailing list"<syslog-ng(a)lists.balabit. hu> >Ogg: Re: [syslog-ng] R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >> How can I install the new service now? > >I would suggest reading our excellent administrator's guide, available >at: > http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3- guides/syslog-ng-ose-v3.3-guide-admin-en.html/bk01-toc.html > >-- >|8] > >

2 1

R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

How can I install the new service now? Thanks. >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 16/11/2011 22.32 >A: <syslog-ng(a)lists.balabit.hu> >Ogg: Re: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >> ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version >> ./syslog-ng: error while loading shared libraries: libsyslog-ng-3.3.2.so: >> cannot open shared object file: No such file or directory >> ameconi@ubuntu:/usr/local/sbin$ > >You also need to add /usr/local/lib to your library load path. The >easiest way is to add that dir to /etc/ld.so.conf. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

2 1

R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

Sorry! With this addendum into ld.so.conf ameconi@ubuntu:/etc$ more ld.so.conf include /etc/local/sbin include /etc/ld.so.conf.d/*.conf ameconi@ubuntu:/etc$ I can obtain the version information ameconi@ubuntu:/usr/local/sbin$ sudo syslog-ng --version syslog-ng 3.3.2 Installer-Version: 3.3.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose-- mainline--3.3#master#555a5cead6723132e6aa89f52365bb40582c8ecc Compile-Date: Nov 15 2011 17:55:58 Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser, syslogformat Available-Modules: dbparser,syslogformat,basicfuncs,afsocket-notls,afuser, afmongodb,csvparser,afsocket,afprog,affile,confgen,convertfuncs,dummy Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Pcre: off ameconi@ubuntu:/usr/local/sbin$ >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 16/11/2011 22.32 >A: <syslog-ng(a)lists.balabit.hu> >Ogg: Re: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >> ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version >> ./syslog-ng: error while loading shared libraries: libsyslog-ng-3.3.2.so: >> cannot open shared object file: No such file or directory >> ameconi@ubuntu:/usr/local/sbin$ > >You also need to add /usr/local/lib to your library load path. The >easiest way is to add that dir to /etc/ld.so.conf. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0

R: Re: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

Goodmorning. This is my ld.so.conf ameconi@ubuntu:/etc$ more ld.so.conf include /etc/ld.so.conf.d/*.conf ameconi@ubuntu:/etc$ I need to ad another include. If so, This does not solve. >----Messaggio originale---- >Da: algernon(a)balabit.hu >Data: 16/11/2011 22.32 >A: <syslog-ng(a)lists.balabit.hu> >Ogg: Re: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > >"andrea.meconi(a)libero.it" <andrea.meconi(a)libero.it> writes: > >> ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version >> ./syslog-ng: error while loading shared libraries: libsyslog-ng-3.3.2.so: >> cannot open shared object file: No such file or directory >> ameconi@ubuntu:/usr/local/sbin$ > >You also need to add /usr/local/lib to your library load path. The >easiest way is to add that dir to /etc/ld.so.conf. > >-- >|8] > >______________________________________________________________________________ >Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng >Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng >FAQ: http://www.balabit.com/wiki/syslog-ng-faq > >

1 0

R: RE: R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu.
by andrea.meconi＠libero.it 17 Nov '11

17 Nov '11

ameconi@ubuntu:~$ sudo ldconfig [sudo] password for ameconi: ameconi@ubuntu:~$ cd /usr/local/sbin ameconi@ubuntu:/usr/local/sbin$ ldd syslog-ng linux-gate.so.1 => (0xb7762000) libsyslog-ng-3.3.2.so => /usr/local/lib/libsyslog-ng-3.3.2.so (0xb76ec000) libnsl.so.1 => /lib/tls/i686/cmov/libnsl.so.1 (0xb76d4000) libgmodule-2.0.so.0 => /usr/lib/libgmodule-2.0.so.0 (0xb76cf000) libgthread-2.0.so.0 => /usr/lib/libgthread-2.0.so.0 (0xb76ca000) librt.so.1 => /lib/tls/i686/cmov/librt.so.1 (0xb76c1000) libglib-2.0.so.0 => /usr/lib/libglib-2.0.so.0 (0xb7610000) libevtlog.so.0 => /usr/local/lib/libevtlog.so.0 (0xb760c000) libdl.so.2 => /lib/tls/i686/cmov/libdl.so.2 (0xb7608000) libpthread.so.0 => /lib/tls/i686/cmov/libpthread.so.0 (0xb75ef000) libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb74a0000) /lib/ld-linux.so.2 (0xb7763000) libpcre.so.3 => /usr/lib/libpcre.so.3 (0xb7479000) ameconi@ubuntu:/usr/local/sbin$ >----Messaggio originale---- >Da: james.lay(a)wincofoods.com >Data: 16/11/2011 21.06 >A: <andrea.meconi(a)libero.it>, <syslog-ng(a)lists.balabit.hu> >Ogg: RE: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on Ubuntu. > > > >> -----Original Message----- >> From: syslog-ng-bounces(a)lists.balabit.hu >[mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of >> andrea.meconi(a)libero.it >> Sent: Wednesday, November 16, 2011 12:04 PM >> To: syslog-ng(a)lists.balabit.hu >> Subject: [syslog-ng] R: Re: I: Re: R: Re: Compiling syslog-ng on >Ubuntu. >> >> ameconi@ubuntu:/usr/local/sbin$ ./syslog-ng --version >> ./syslog-ng: error while loading shared libraries: >libsyslog-ng-3.3.2.so: >> cannot open shared object file: No such file or directory >> ameconi@ubuntu:/usr/local/sbin$ > >That looks promising :) > >Ok...do this: > >"sudo ldconfig" > >And while you're in that /usr/local/sbin directory, what's the output >of: > >"ldd syslog-ng" > >James >

1 0