- syslog-ng - lists.balabit.hu

Re: ERROR...
by Balazs Scheidler 21 Jun '02

21 Jun '02

First of all the mysql howto was not written by me, second template() destinations are only supported by the 1.5.x releases. please ask these kind of questions on the mailing list. Thanks. On Fri, Jun 21, 2002 at 02:38:05PM +0800, shan tenorio wrote: > i follwed the step-step procedures on the mysql-log but i do get a parse error when starting syslog-ng. > > this is the line where i get the parsing error... > > ## Log syslog-ng to mysql database > ## > destination d_mysql { > pipe("/tmp/mysql.pipe" > this line ----> template("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILILITY', '$PRIORITY', '$LEVEL', '$TAG', > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); > }; > log { source(net); destination(d_mysql); > }; > > > -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

What's the diffrence in internal() between 1.5.15 and 1.5.18
by Andreas Schulze 20 Jun '02

20 Jun '02

Hi Batzi, we switched from 1.5.15 to 1.5.18 and observed the following difference in handling logging 'STATS' and daemon start/stop to the internal() source: 1.5.15: works fine for us. STATS and daemon start/stop are logged to a file attached to internal() 1.5.18: seems nothing is logged to internal(). Where are we wrong. We don't changed the config file. Thanks for hints. -- Best regards --Andreas Schulze [phone: +49.5246.80.1275, fax: +49.5246.80.2275] | I believe, it was Dennis Ritchie who said something like: | "C is rarely the best language for a given task, | but it's often the second-best". | The implication being that: "[...]" | | sh# cat>$$.c<<EOT | main(l,a,n,d)char**a;{for(d=atoi(a[1])/10*80-atoi(a[2])/5-596;n="@NK\ | ACLCCGZAAQBEAADAFaISADJABBA^SNLGAQABDAXIMBAACTBATAHDBANZcEMMCCCCAAhE\ | IJFAEAAABAfHJETBdFLDAANEfDNBPHdBcBBBEA_AL H E L L O, W O R L D! " | [l++-3];)for(;n-->64;)putchar(!d+++33^l&1);} | EOT | gcc -o$$ $$.c;clear;./$$ 52 8;rm -f $$*

1 0

Pb with messages contain '\n'
by Jerome Peducasse 20 Jun '02

20 Jun '02

Hello, When a message contains 2 chunks (or more) separated by '\n', next message losts its facility.level because it contains end of previous log. For example: jerome@peducasse:~/> logger -psyslog.debug "Test #1 > Test #2" jerome@peducasse:~/> logger -psyslog.debug "Test #3" Result is: Jun 20 12:54:42 peducasse [syslog.debug] jerome jerome: Test #1 Jun 20 12:54:45 peducasse [user.notice] Test Test #2<47>Jun 20 12:54:45 jerome: Test #3 ^^^^^^^^^^^->end of previous message Thanks for your help. -- Jerome Peducasse Wanadoo Portails - Sophia Antipolis

1 0

Some missunderstanding in filter
by Serge Leschinsky 19 Jun '02

19 Jun '02

Dear sirs. I'm newbie in syslog-ng therefore I beg you to treat my question with indulgence if it is primitive. I'm very sorry for an attached conf but I think I can't explain my problem without this. I have linux (RH) box with syslog-ng-1.4.10 (it's some outdated package but I haven't enough knowledge for its rebuilding). My problem is following: the log from MTA comes to /var/log/messages. So I have duplicate MTA log in mail.log and messages. As far as I understand the problem point is in following filters: > filter f_messages { level(info, emerg, debug, notice, warn, crit, err); }; >log { source(src); filter(f_messages); destination(messages); }; There was an attempt to "log anything (except mail) of level info or higher". But mail is logging to /var/log/messages anyway. How should I modify the filters for resolving this? I will be very appreciate for your kind help. -- Yours sincerely Serge Leschinsky mailto:fish@artlife.tomsknet.ru Wednesday, June 19, 2002

3 2

Multi filters
by Sofox 18 Jun '02

18 Jun '02

Hi, I am playing with syslog-ng, it seems that config log{ source(src); filter(filterA); filter(filterB); destination(dest); } means log those messages which satisfy both filterA and filterB to dest, am I right? now the question is if i want log messages satisfy filterA or filterB to dest, how should I write the config? Oscar Yen.

2 1

Re: [syslog-ng]BUG: Number in Hostnames?
by Jonathan Marchand 17 Jun '02

17 Jun '02

Balazs, On both hosts the DNS lookup and reverse lookup are working fine: Name: nexus1.webnet.qc.ca Address: 209.71.224.10 And reverse: 10.224.71.209.in-addr.arpa name = nexus1.webnet.qc.ca. Also, I added the line: 209.71.224.10 nexus1.webnet.qc.ca nexus1 to /etc/hosts on both hosts. I did try to sniff the traffic using tcpdump, I used "sniff" to translate the output from hex to ascii. However, the messages were fine but the hostname was not translated properly, it was still hex codes. You know a tool I could use to reliably sniff and translate syslog traffic? Thanks, Jonathan. > > ----- Original Message ----- > From: "Balazs Scheidler" <bazsi(a)balabit.hu> > To: <syslog-ng(a)lists.balabit.hu> > Sent: Monday, June 17, 2002 1:02 PM > Subject: Re: [syslog-ng]BUG: Number in Hostnames? > > > > On Mon, Jun 17, 2002 at 12:05:07PM -0400, Jonathan wrote: > > > Hi, > > > > > > I've been toying a bit with syslog-ng, I'm quite happy so far with all > the > > > possibilities it offer me. But I got a problem getting it to work in my > > > environment. > > > > > > I want to log normal syslogd machines to a LogHost which would run > > > syslog-ng. I've installed syslog-ng 1.5.18 on my LogHost and ran a few > > > tests. > > > > > > With this config: > > > > > > options { sync (0); > > > time_reopen (10); > > > log_fifo_size (1000); > > > long_hostnames (no); > > > chain_hostnames (no); > > > use_dns (no); > > > use_fqdn (no); > > > create_dirs (no); > > > keep_hostname (yes); > > > }; > > > > > > source s_sys { unix-stream ("/dev/log"); internal(); > > > udp (ip(209.71.224.21) port (514)); }; > > > destination mail1 { file("/var/log/mail1"); }; > > > filter filter_mail1 { host("mail1");}; > > > log { source(s_sys); filter(filter_mail1); destination(mail1); }; > > > > > > As you can see, I want to log a host named "mail1" to a file "mail1". > > > However, it doesn't work. The host send its log entries syslog-ng but > > > doesn't recognize "mail1". > > > > > > But, if I change the host("mail1") to host("mail"), it work perfectly. > The > > > hostname in the /var/log/mail1 file is "mail" tho, not "mail1". > > > > > > I ran syslogd into debug mode on my "mail1" machine. I saw it does send > the > > > logs out with the "mail1" tag. > > > > > > I tried this with another of my host, its name is nexus1, I experienced > the > > > same behavior. > > > > > > So, I'm wondering if syslog-ng doesn't like having a number at the end > of > > > the hostname. > > > > > > The hosts running syslogd are RedHat 7.2 and 7.1. > > > > > > Any ideas? :) I'd like to get this working, all my hostnames got > numbers.... > > > > hmm.. I don't care if hostnames contain numbers or not. Does reverse DNS > of > > those hosts contain the correct name (with the number ?) > > > > You could sniff your network interface to see if the hostname is really > > present. (sometimes it is missing, and is added by syslog-ng based on the > > DNS name of the host) > > > > -- > > Bazsi > > PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C > 8EB1 > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng(a)lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at http://www.campin.net/syslog-ng/faq.html > > > > > >

1 0

BUG: Number in Hostnames?
by Jonathan 17 Jun '02

17 Jun '02

Hi, I've been toying a bit with syslog-ng, I'm quite happy so far with all the possibilities it offer me. But I got a problem getting it to work in my environment. I want to log normal syslogd machines to a LogHost which would run syslog-ng. I've installed syslog-ng 1.5.18 on my LogHost and ran a few tests. With this config: options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (no); chain_hostnames (no); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_sys { unix-stream ("/dev/log"); internal(); udp (ip(209.71.224.21) port (514)); }; destination mail1 { file("/var/log/mail1"); }; filter filter_mail1 { host("mail1");}; log { source(s_sys); filter(filter_mail1); destination(mail1); }; As you can see, I want to log a host named "mail1" to a file "mail1". However, it doesn't work. The host send its log entries syslog-ng but doesn't recognize "mail1". But, if I change the host("mail1") to host("mail"), it work perfectly. The hostname in the /var/log/mail1 file is "mail" tho, not "mail1". I ran syslogd into debug mode on my "mail1" machine. I saw it does send the logs out with the "mail1" tag. I tried this with another of my host, its name is nexus1, I experienced the same behavior. So, I'm wondering if syslog-ng doesn't like having a number at the end of the hostname. The hosts running syslogd are RedHat 7.2 and 7.1. Any ideas? :) I'd like to get this working, all my hostnames got numbers.... Thanks! Jonathan.

2 1

again: qmgr stops logging
by Florian Kessler 15 Jun '02

15 Jun '02

Hi all, i discussed an obviously well-known problem on postfix-users yesterday: me: > Hi all, > > i'm using debian/testing with postfix and syslog-ng here. > I have the same problems a lot of people (i.e. Othmar, > http://archives.neohapsis.com/archives/postfix/2000-12/0432.html) have > had long time before: > > qmgr entries are all missing in log after restarting syslog(-ng)! > > The only proposal to solve the problem i could find on the web is to > update syslogd > I've tried syslog-ng/unstable and sysklogd, but this didn't solve the > problem. > > Any other hints? > > Thanks in advance, > Florian Wietse and Varadi: -specify an extra logging socket: not done, because i´m not using chrooted postfix! -update to syslog-ng 1.5.15: done -try SIGHUP instead of restart: done but i keep loosing qmgr messages after a syslog-ng restart/reload in the meantime i updated my system to postfix from unstable (mail_version = 1.1.7) Wietses final word: > There's little Postfix can do about it. > > The syslog() CLIENT code is part of your system library. Some > syslog() implementations will attempt to reconnect when they find > out that the server is disconnected. > > Wietse So, any hints? Thanks in advance, Florian

1 0

Error when compiling with tcp-wrappers
by Jim Gifford 14 Jun '02

14 Jun '02

When I compile with the option --enable-tcp-wrapper, I get the following error. afinet.o: In function `do_open_afinet_connection': afinet.o(.text+0x38b): undefined reference to `request_init' afinet.o(.text+0x394): undefined reference to `sock_host' afinet.o(.text+0x39c): undefined reference to `hosts_access' collect2: ld returned 1 exit status I have enclosed the error.log and a copy of the makefile. Any ideas??

4 13

syslog-ng on Solaris
by Matthew C Valites 14 Jun '02

14 Jun '02

I'm using syslog-ng over stunnel to log to a remote mysql database. I have it working perfectly on all my linux machines, but when I attempt to go over to Solaris, I run into problems. I have recompiled with the "--enable-sun-streams" and "--enable-sun-door" and edited my conf file, and this is the error I get when I try to run syslog-ng: root@diamond: syslog-ng -Fv do_init_afstreams_source: Cannot enable console logging on sun-stream /var/log (Inappropriate ioctl for device) Error initializing configuration, exiting. This is my syslog-ng.conf file: # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.2 1999/11/15 12:30:41 bazsi Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # options { sync(2); time_reopen (10); long_hostnames (off); use_fqdn (no); keep_hostname (yes); #use_dns(yes); }; ###source lets your receive messages source src { sun-streams("/var/log"); }; destination cron { file("/var/log/cron.log"); }; destination mail { file("/var/log/mail.log"); }; destination messages { file("/var/adm/messages"); }; destination sysmsg { file("/var/log/messages"); }; destination authlog { file("/var/log/authlog"); }; destination syslog { file("/var/log/syslog-ng"); }; destination local0 { file("/var/log/local0"); }; destination local1 { file("/var/log/local1"); }; destination local2 { file("/var/log/local2"); }; destination local3 { file("/var/log/local3"); }; destination local4 { file("/var/log/local4"); }; destination local5 { file("/var/log/local5"); }; destination local6 { file("/var/log/local6"); }; destination local7 { file("/var/log/local7"); }; destination staley { tcp("127.0.0.1" port(2220)); }; filter f_auth { facility(auth); }; filter f_kern { facility(kern); }; filter f_cron { facility(cron); }; filter f_mail { facility(mail); }; filter f_daemon { facility(daemon); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_alert { level(alert); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_debug { level(debug); }; filter f_syslog { level(info) and not facility(mail); }; ################################################################################# set up logging to a loghost (staley) forwarded from localhost via stunnel # as defined at top of file: # destination staley { tcp("127.0.0.1" port(2221)); }; ################################################################################ #Logging to Paskow for testing purposes log { source(src); filter(f_err); destination(staley); }; log { source(src); filter(f_notice); destination(staley); }; log { source(src); filter(f_alert); destination(staley); }; log { source(src); filter(f_mail); filter(f_info); destination(staley); }; log { source(src); filter(f_info); destination(staley); }; #Logging all local.debug to Paskow for testing purposes log { source(src); filter(f_local0); filter(f_debug); destination(staley); }; log { source(src); filter(f_local1); filter(f_debug); destination(staley); }; log { source(src); filter(f_local2); filter(f_debug); destination(staley); }; log { source(src); filter(f_local3); filter(f_debug); destination(staley); }; log { source(src); filter(f_local4); filter(f_debug); destination(staley); }; log { source(src); filter(f_local5); filter(f_debug); destination(staley); }; log { source(src); filter(f_local6); filter(f_debug); destination(staley); }; I had the doors option in the destination src, but there's no doors file on my machine. I'd appreciate any help that anybody can provide. I will be extremely grateful if this works. ~Matt Valites Unix Admin Banta-IM

2 5

option use_dns & use_fqdn problem with syslog-ng tcp connection t o syslog-ng?
by Russo, Ben 14 Jun '02

14 Jun '02

syslog-ng 1.5.18 with libol 0.3.3 on RedHat 7.3 i386 EXCERPTS FROM syslog-ng.conf options { long_hostnames (on); use_dns (yes); use_fqdn (yes); keep_hostname (no); }; destination d_files { file("/var/log/syslog-ng/$HOST/$FACILITY.$LEVEL" template("$ISODATE $HOST $FACILITY $PRIORITY $PROCESS $MSG\n")); }; For network nodes using OLD syslog daeomons that send using UDP (solaris, HP-UX, Linux etc...) The $HOST value is the FQDN as defined in in DNS reverse lookup. However if I have syslog-ng on a remote box and it uses a TCP connection to my central syslog receiver then the hostname is missing the domain? I have lots of servers named "dns1" or "www" so this becomes a problem. Am I missing an option somewhere? Thanks, -Ben.

2 2

Re: syslog-ng / libol Solaris 8 and Sun CC
by Balazs Scheidler 14 Jun '02

14 Jun '02

On Thu, Jun 13, 2002 at 12:02:43PM -0500, Luc I. Suryo wrote: > Hello, > > Are the sourecs based solley on GNU tools? I've never had anything else than GNU tools. > Compile give me some issue, can solve them be wondering, could you help > me with these questions? > > 1) -Wall -O2 in configure(in): works only for GCC under CC one can/should use -O > so why not a check against GCC and then set teh flags OR get it > from the variable set? CC=cc CFLAGS="-.." ./configure? it should get CFLAGS from the environment, if it doesn't it's a bug. > > > 2) alloca : from the man pages: > The alloca() function is machine-, compiler-, and most of > all, system-dependent. Its use is strongly discouraged. > > any reason not using a diff call? alloca allocates space on the stack, just like an automatic variable would. of course malloc() can also be used, but then the allocated block must be freed explicitly. So it was used for simplicity, I didn't know it was not portable. > > 3) utils / make_class(in) : need a defined (by location & found) > of the variable _SCSH_, what is this variable?, the file/script > is not a csh one so it has to be something else :), so what is > this and do i need it? it is scsh aka scheme shell, you only need this if you change the class declarations. read the end of README where it is described what it is. > 4) not sure but don't you think syslog-ng should always be > compiled against a static lib. instead of a shared? but that is no > compile issue, more looking into securtity, just my 2c it is linked statically against libol, but if you install libol first, it can also link to it dynamically. libc is linked dynamically. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Square Brackets in match()
by Clayton L. Scott 14 Jun '02

14 Jun '02

Syslog-ng: 1.5.18 and 1.4.11 If I have a message that looks like this: Jun 3 00:16:52 X.X.X.X/X.X.X.X rido-ott[System]: request for unserviced tcp:X.X.X.X-25 from X.X.X.X denied if I want to match this part [System]: request for unserviced I have to leave out the leading '['. eg match("[System]: request for unserviced") will not but match("System]: request for unserviced") will Is this a bug in the matching grammar? If I used normal regexp syntax and escape the '[' as in '\[' is stiil won't work. Clayton PS Thanks Balazs for your anwsers to my last question and for syslog-ng

2 1

Strange behaviour in syslog-ng file creation.
by Luca Villani 13 Jun '02

13 Jun '02

Hi all. First, I'm sorry: I'm afraid my english is very poor. :-| Actually we run a medium log server, with a dozen of host logging on it via tcp. syslog-ng is 1.4.15, OS is Linux RedHat 7.2. We find some trouble in file creation: we want syslog-ng create files with an user, a group and a bitmask, but it fail in bitmap setting for some files and do it successfuly for other files. This is a snap of our configuration file (I'm sorry for lines wrap): >--------------------------- START --------------------------------< # bayonne logfiles destination bayonne_all {file("/var/log/bayonne/bayonne.log" owner("root") group("bayonne") perm(0660)); }; destination bayonne_debug {file("/var/log/bayonne/debug.log" owner("root") group("bayonne") perm(0660)); }; destination bayonne_info {file("/var/log/bayonne/info.log" owner("root") group("bayonne") perm(0660)); }; destination bayonne_err {file("/var/log/bayonne/error.log" owner("root") group("bayonne") perm(0660)); }; destination bayonne_crit {file("/var/log/bayonne/critical.log" owner("root") group("bayonne") perm(0660)); }; # bayonne-avvenire logfiles destination avvenire_all {file("/var/log/bayonne/avvenire/avvenire.log" owner("root") group("bayonne") perm(0660)); }; destination avvenire_debug {file("/var/log/bayonne/avvenire/debug.log" owner("root") group("bayonne") perm(0660)); }; destination avvenire_info {file("/var/log/bayonne/avvenire/info.log" owner("root") group("bayonne") perm(0660)); }; destination avvenire_warn {file("/var/log/bayonne/avvenire/warning.log" owner("root") group("bayonne") perm(0660)); }; destination avvenire_err {file("/var/log/bayonne/avvenire/error.log" owner("root") group("bayonne") perm(0660)); }; >--------------------------- END --------------------------------< What we want is something like this: >--------------------------- START --------------------------------< [root@platone root]# ls -l /var/log/bayonne total 7552 drwxrwx--- 2 root bayonne 4096 Jun 11 17:58 avvenire -rw-rw---- 1 root bayonne 2860663 Jun 13 17:12 bayonne.log -rw-rw---- 1 root bayonne 23267 Jun 13 16:34 calls -rw-rw---- 1 root bayonne 0 Jun 13 04:02 critical.log -rw-rw---- 1 root bayonne 2541445 Jun 13 17:12 debug.log -rw-rw---- 1 root bayonne 6613 Jun 13 17:08 error.log -rw-rw---- 1 root bayonne 312605 Jun 13 17:12 info.log [root@platone root]# ls -l /var/log/bayonne/avvenire/ total 320 -rw-rw---- 1 root bayonne 126474 Jun 13 17:10 avvenire.log -rw-rw---- 1 root bayonne 75780 Jun 13 17:10 debug.log -rw-rw---- 1 root bayonne 1365 Jun 13 17:08 error.log -rw-rw---- 1 root bayonne 44628 Jun 13 17:10 info.log -rw-rw---- 1 root bayonne 4701 Jun 13 17:08 warning.log [root@platone root]# >--------------------------- END --------------------------------< In real world, this is the results: >--------------------------- START --------------------------------< [root@platone root]# ls -l /var/log/bayonne total 7552 drwx------ 2 root root 4096 Jun 11 17:58 avvenire -rw-rw---- 1 root bayonne 2860663 Jun 13 17:12 bayonne.log -rw-rw---- 1 root bayonne 23267 Jun 13 16:34 calls -rw-rw---- 1 root bayonne 0 Jun 13 04:02 critical.log -rw-rw---- 1 root bayonne 2541445 Jun 13 17:12 debug.log -rw-rw---- 1 root bayonne 6613 Jun 13 17:08 error.log -rw-rw---- 1 root bayonne 312605 Jun 13 17:12 info.log [root@platone root]# ls -l /var/log/bayonne/avvenire/ total 320 -rw-r----- 1 root bayonne 126474 Jun 13 17:10 avvenire.log -rw-r----- 1 root bayonne 75780 Jun 13 17:10 debug.log -rw-r----- 1 root bayonne 1365 Jun 13 17:08 error.log -rw-r----- 1 root bayonne 44628 Jun 13 17:10 info.log -rw-r----- 1 root bayonne 4701 Jun 13 17:08 warning.log [root@platone root]# >--------------------------- END --------------------------------< First, the directory /var/log/bayonne/avvenire/ is property of root.root with a bitmask drwx------ Second, all files in this directory are properties of root.bayonne and this is correct, but the bitmask is -rw-r----- and not -rw-rw---- All files in /var/log/bayonne/, pheraps, have corret owner and permission bitmask!!! If I perform a chown on directory /var/log/bayonne/avvenire/, it works, but if I perform a manual chmod on all files in this directory it *temporary* work, but permission are changhed at first a log line is appended in every file. Have someone out there experimented this behavoiur? -- Ciao da Villo - GPG public key available

2 1

syslog-ng mailing list FAQ attempt
by Nate Campi 12 Jun '02

12 Jun '02

I've thrown together a FAQ for this list at http://www.campin.net/syslog-ng/faq.html I found the content for it by browsing my syslog-ng maildir. I only covered a couple hundred of the seven hundred or so messages, so I'll likely end up with more content. I'd be interested in feedback - what should stay, what should go, what needs to be corrected. TIA. -- Perl - The only language that looks the same before and after RSA encryption. -Keith Bostic

2 3

template in pipe
by bretwatson＠charteredsemi.com 12 Jun '02

12 Jun '02

Hi Balazs, which stable version supports a template in the pipe destination? I would like to implement the mysql connection a la vermeer.org. Thanks, Bret [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.]

2 1

where is klogctl?
by Ivan Prokudin 12 Jun '02

12 Jun '02

Hello! I use syslog-ng 1.5.18 and I wonder where is klogctl? I don't have in that distribution which I've downloaded from syslog-ng's homesite. With best regards, Ivan. E-mail: cyberbat[!nospam!!!!!](a)rbcmail.ru Fidonet: 2:5020/1180.60 Icq# 2052068

2 1

Problems compiling 1.5.18
by Russo, Ben 11 Jun '02

11 Jun '02

This problem was reported (with a workaround) by Andrej.Borsenkow(a)mow.siemens.ru on Thu May 30th. The fix was to add the line #include "stdio.h" to cfg-grammer.c I don't know if this is the right thing to do because there is conflicting advice Bazsi said it would be save to include it, but in the cfg-grammer.c file there is a comment saying: # include <stdio.h> /* INFRINGES ON USER NAME SPACE */ I just wanted to remind the (kind & generous) programmers of this issue for those of us who are not C programmers so that the "proper" fix for this doesn't get forgotten in the next version release. On RedHat 7.3 with latest patches. With libol 0.3.3 Compiling 1.5.17 works fine (see http://www.umialumni.com/~ben/compile-output-syslog-ng.1.5.17.txt ) Compiling 1.5.18 doesn't (see http://www.umialumni.com/~ben/compile-output-syslog-ng.1.5.18.txt ) Summation: gcc -DHAVE_CONFIG_H -I. -I/usr/src/redhat/BUILD/syslog-ng-1.5.18/src -I. -O2 -march=i386 -mcpu=i686 -Wall -I/usr/local/include/libol -D_GNU_SOURCE -c cfg-grammar.c cfg-grammar.y: In function `yyerror': cfg-grammar.y:703: warning: implicit declaration of function `fprintf' cfg-grammar.y:703: `stderr' undeclared (first use in this function) cfg-grammar.y:703: (Each undeclared identifier is reported only once cfg-grammar.y:703: for each function it appears in.) make[3]: *** [cfg-grammar.o] Error 1 make[3]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-1.5.18/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-1.5.18/src' make[1]: *** [all-recursive-am] Error 2 make[1]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-1.5.18/src' make: *** [all-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.39527 (%build) -Ben.

2 1

Doing a regex substitution in syslog-ng
by Donavan Pantke 11 Jun '02

11 Jun '02

Hey guys, I'm trying to make a syslog-ng solution to recieve logs from some custom java apps that output syslog data, but I have an issue. Our programmers have already defined a format for their messages, and our log parsers expect this format. I can pass the data around syslog systems, but at the destination file, I need to strip off the syslog headers to leave me with the raw message that was came out of the ajva app. I was hoping that I could do something akin to a filter that did a regex substitution to modify the message to make it look pretty. Is this possible, and if not, is there any other way of pulling this off? Thanks Donavan Pantke

2 2

sync option not flushing on TERM?
by Clayton L. Scott 07 Jun '02

07 Jun '02

Here are my system stats: Linux 2.4.7-10 i686 ext3 filesystem syslog-ng 1.4.11 I'm trying to do some stress testing of our syslog-ng configuration on a server for log collection and if I send 50 msg/s I find that a bunch are not ending up in the destination file. Where I should I be looking for these dropped messages? It's not the interface I was able to get this machine to accept 1200 msg/s with syslog-ng doing no filtering and writing to a fifo (with a script I wrote sucking messages though the pipe) plus /sbin/ifconfig tells me that things are ok. In our investgation we decided to try the sync option to see if improved the situation where messages were dropped (this is happening with 100 test messages and a log_fifo_size(10000) ). We discovered that the remainder of messages left in the buffer were not flushed to the destination when syslog-ng was TERMed. Looking at the change logs from 1.4.11 to 1.4.15 I don't see a fix mentioned there. Any ideas? Clayton Scott

2 1

feature request
by Nate Campi 06 Jun '02

06 Jun '02

Feature request: (I know you get lots of these from me, sorry Baszi ;) Can output from programs started by syslog-ng get logged by syslog-ng to the logs, perhaps under the syslog facility with the program name as the TAG field: Jun 5 12:15:04 hostname swatch[15895]: syntax error at /root/.swatch_script.1395 line 1581, near "." Or use syslog-ng as the TAG and put the actual program just after: Jun 5 12:15:04 hostname syslog-ng[15892]: swatch: syntax error at /root/.swatch_script.1395 line 1581, near "." I have a separate log architecture I setup for our networking devices, and the network engineers maintain it. The problem is that they didn't know swatch wasn't running due to swatch errors, and swatch is started from syslog-ng (as described here: http://www.campin.net/newlogcheck.html#swatch) Having the swatch errors caught and logged would even have allowed me to send an alert on it via some filters using "match()", or at least been easy for the network staff to see in the logs. They're good with ciscos but not as good with UNIX ;) -- Linux is like an indian's tent: No gates, no windows, and apache inside.

2 2

Re: syslog-ng dying randomly?
by John Morrissey 05 Jun '02

05 Jun '02

I don't mean to be a bother, but do you have anything further on this, Bazsi? thanks, john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

3 5

Re: [syslog-ng]Logging Remotely from Solaris to Linux Update
by Ron Braley 04 Jun '02

04 Jun '02

Bradley - Thanks very much for the information! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> arlt(a)cpsc.ucalgary.ca 06/04/02 08:18AM >>> On Tue, Jun 04, 2002 at 09:22:15AM +0200, Balazs Scheidler wrote: > On Mon, Jun 03, 2002 at 11:36:06AM -0500, Ron Braley wrote: > > Hi Bazsi > > > > Here's an update and continued question: Everything seems to be fine > > when syslogging remotely from the Solaris box to the Linux box except > > that cron priorities of debug - critical don't get sent (just emerg). > > Also, Solaris and Linux boxes alike won't send daemon priorities debug > > or information messages to the log host. > > this might be caused by the different facility codes between linux and > solaris. Syslog-ng uses the codes of the host operating system it was > compiled on. Maybe a feature to map facility codes would be useful. Usually I just a bunch of #defines in syslog-names.c and slap the extra facilities on sl_facilities[]. I only ever bother with this on our loghost, but it is very useful. Linux, Solaris, Irix, and BSD are all a little bit different, and it is handy to be able to handle various faculities correctly. For example I handle the Linux/BSD authpriv, auth, and the BSD only "security" facilities the same, but my loghost runs Solaris and doesn't know about the other two facility by default. Having this built in so I can define it in a configuration file would be sweet! But I am looking more for an index than a map (or maybe that is what you meant by map). What I'd like is something like: (9<<3) -> CRON /* !Sun */ (11<<3) -> FTP /* Linux */ (12<<3) -> NTP /* BSD */ (13<<3) -> AUDIT /* Irix */ (13<<3) -> SECURITY /* BSD */ (15<<3) -> CRON /* Sun */ ---------------------------------------------------------------------------- __o Bradley Arlt Security Team Lead _ \<_ arlt(a)cpsc.ucalgary.ca University Of Calgary (_)/(_) http://pages.cpsc.ucalgary.ca/~arlt/ Computer Science _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re:[syslog-ng]Logging Remotely from Solaris to Linux Update
by Ron Braley 04 Jun '02

04 Jun '02

Hi Bazsi Here's an update and continued question: Everything seems to be fine when syslogging remotely from the Solaris box to the Linux box except that cron priorities of debug - critical don't get sent (just emerg). Also, Solaris and Linux boxes alike won't send daemon priorities debug or information messages to the log host. New problem: We need to send logs from our Cisco 2511 access router and 6509 switch/router to the Linux log host, but it's not working. I've set logging facility and host from the Cisco devices, but they don't get logged on the log host. Any ideas or advise? As always: Thanks much for all your help!! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax)

4 3

Re: [syslog-ng]Logging Remotely from Solaris to Linux Update
by Ron Braley 04 Jun '02

04 Jun '02

OK Bazsi - thanks again for everything. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 06/04/02 02:22AM >>> On Mon, Jun 03, 2002 at 11:36:06AM -0500, Ron Braley wrote: > Hi Bazsi > > Here's an update and continued question: Everything seems to be fine > when syslogging remotely from the Solaris box to the Linux box except > that cron priorities of debug - critical don't get sent (just emerg). > Also, Solaris and Linux boxes alike won't send daemon priorities debug > or information messages to the log host. this might be caused by the different facility codes between linux and solaris. Syslog-ng uses the codes of the host operating system it was compiled on. Maybe a feature to map facility codes would be useful. > New problem: We need to send logs from our Cisco 2511 access router > and 6509 switch/router to the Linux log host, but it's not working. > I've set logging facility and host from the Cisco devices, but they > don't get logged on the log host. Any ideas or advise? > > As always: Thanks much for all your help!! I'm not experienced in setting up routers to log remotely, though I'm sure many of us on this list do this regularly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

parse error in reading configuration file
by Chethan K.R 04 Jun '02

04 Jun '02

Hi , I could execute a syslog-ng client but when i tried to execute a syslog-ng server it failed. The error message is ################### parse error at 13 Parse error reading configuration file, exiting. ################################### The configuration file in remote server is ############################## source shell { unix-dgram("/dev/log"); internal(); # Listen on public interface, port 514 for incoming connections tcp(ip(192.9.200.22) port(514) max-connections(1)); }; destination localhost { file("/var/log/syslog-ng.all")); }; # Again, we tie both statements together with the log function. log { source(shell); destination(localhost); }; ######################################### can anybody help me? TIA, Cheths _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com

1 0

Here is a patch to allow template with program in syslog-ng.conf
by PWM＠capmon.dk 03 Jun '02

03 Jun '02

Hi, Here is a patch to syslog-ng 1.5.13 that will allow the template() to be used within a program() - something like this: filter f_cap { program(^Cap); }; destination d_cap { program("perl -I /opt/cap/server/../inc /opt/cap/server/cmSyslog.pl" template(" \"DATE'$ISODATE'PROG'$PROGRAM'HOST'$HOST'TAG'$TAG'MSG'$MSG\n") template_escape(yes)); }; log { source(src); filter(f_cap); destination(d_cap); }; log { source(net); destination(d_cap); }; Enjoy! Please be aware, that I'm not a member of this syslog-ng mailing list, so if you want to send me comments, please use pvm(a)nworks.dk. Sincerely, Peter Morch. (See attached file: syslog-ng.patch)

1 0

lost logs when using syslog-ng on Linux due to /dev/log reopen
by Borsenkow Andrej 03 Jun '02

03 Jun '02

I am using syslog-ng on Mandrake (8.2 and post-8.2), glibc-2.2.5. Unfortunately, it tends to lose logs. As far as I can tell it is related to the fact that syslog-ng recreates /dev/log on HUP. It means that every program that has opened syslog connection won't be able to write to /dev/log anymore. The sad thing is, this is _not_ limited to klogd (that has the same problem) but to every other program (I had very bad case of socks server losing some info used for accounting :( It happens to every program (daemon) that does openlog() only once on startup. Which makes drop in replacement for syslog simply impossible :( -andrej

4 11

configure 1.4.15 fails to detect libol 0.3.3
by Diogo Zulli 01 Jun '02

01 Jun '02

Hi, I am installing syslog-ng for the first here and found a little problem in configure script. I got syslog-ng 1.4.15 and libol 0.3.3 and the syslog-ng configure script fails to detect libol 0.3.3 because it requires at least 0.2.23: configure.in: ... LIBOL_REQ_PATCH=23 ... if test "$LIBOL_MAJOR" != "$LIBOL_REQ_MAJOR" -o \ "$LIBOL_MINOR" -lt "$LIBOL_REQ_MINOR" -o \ >>>HERE>>> "$LIBOL_PATCH" -lt "$LIBOL_REQ_PATCH"; then AC_MSG_RESULT(no) AC_MSG_ERROR(Required libol version not found) fi As you can see 3 is -lt 23. I worked around changing required LIBOL_REQ_PATCH do 2. Thanks for the great software. I hope I debugged it right and didn't missed something and maybe will help you to fix the problem. - Diogo Zulli -- [ http://sphynx.com.br - diogo(a)sphynx.com.br - ICQ# 112204935 ]

1 0

Re: where is ftp location for syslog-ng
by Steve Cobrin 31 May '02

31 May '02

Follow up to my question regarding broken ftp link on syslog-ng web page -- Steve ---------- Forwarded Message ---------- Subject: Re: inaccessible syslog-ng directories Date: Fri, 31 May 2002 18:17:15 +0200 (CEST) From: Attila Nagy <bra(a)fsn.hu> To: Steve Cobrin <cobrin(a)highbury.net> Hello, > Hi I'm trying to download syslog-ng and libol, but have been unable to > access the following directories for several months That's because Balabit has always forgotten to start rsyncd on their webserver, so I asked them to decide, wether they want me to mirror the stuff, or not. I got no answer, so I first restricted the directory and now deleted all the stuff. Please use http://www.balabit.hu/ instead. Thanks, --------[ Free Software ISOs - ftp://ftp.fsn.hu/pub/CDROM-Images/ ]------- Attila Nagy e-mail: Attila.Nagy(a)fsn.hu Free Software Network (FSN.HU) phone @work: +361 210 1415 (194) cell.: +3630 306 6758 ------------------------------------------------------- On Tuesday 07 May 2002 23:29, Steve Cobrin wrote: > Hi there, I'm interested in experimenting with syslog-ng. > > I usually much prefer to download software using ftp rather than http. Is > there a main ftp site or mirror site.? > > The syslog-ng web page refers to ftp://ftp.fsn.hu/pub/syslog-ng but I have > been unable to connect to the site since January, with the site complaining > that the directory doesn't have read permission. > > Can anybody help? > > -- Steve

1 0

Re: Fwd: [syslog-ng]Logging Remotely from Solaris to Linux
by Ron Braley 31 May '02

31 May '02

Bazsi I've tested every facility and priority, and present the final results of testing facilities and priorities from the Solaris box to the Linux log host: - The only cron facility from the Solaris box recorded at the Linux log host was cron.emerg. No other cron priorities would show up at the log host, but they did log locally OK. - Two daemon facility priorities would not get recorded at the loghost from the Solaris server: daemon.info and daemon. debug. All other daemon priorities worked fine. All other facilities and priorities worked fine from the Solaris box to the Linux log host (except kern, which you addressed earlier). All facility and priorities work fine from the Linux servers to the log host. Thoughts? rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 05/31/02 02:45AM >>> On Thu, May 30, 2002 at 09:58:23PM -0500, Ron Braley wrote: > Hi Bazsi. > > Here's where things are with the syslog-ng and Solaris vs Linux: > > Using facility filters (i.e. f_cron) on the Linux box will result in > not logging any messages from the Solaris box. Other Linux boxes work > fine with the facility filters, though. Here's the list of facilities that Solaris uses, and the same on Linux: Solaris: #define LOG_KERN (0<<3) /* kernel messages */ #define LOG_USER (1<<3) /* random user-level messages */ #define LOG_MAIL (2<<3) /* mail system */ #define LOG_DAEMON (3<<3) /* system daemons */ #define LOG_AUTH (4<<3) /* security/authorization messages */ #define LOG_SYSLOG (5<<3) /* messages generated internally by syslogd */ #define LOG_LPR (6<<3) /* line printer subsystem */ #define LOG_NEWS (7<<3) /* netnews subsystem */ #define LOG_UUCP (8<<3) /* uucp subsystem */ #define LOG_CRON (15<<3) /* cron/at subsystem */ /* other codes through 15 reserved for system use */ #define LOG_LOCAL0 (16<<3) /* reserved for local use */ #define LOG_LOCAL1 (17<<3) /* reserved for local use */ #define LOG_LOCAL2 (18<<3) /* reserved for local use */ #define LOG_LOCAL3 (19<<3) /* reserved for local use */ #define LOG_LOCAL4 (20<<3) /* reserved for local use */ #define LOG_LOCAL5 (21<<3) /* reserved for local use */ #define LOG_LOCAL6 (22<<3) /* reserved for local use */ #define LOG_LOCAL7 (23<<3) /* reserved for local use */ Linux: #define LOG_KERN (0<<3) /* kernel messages */ #define LOG_USER (1<<3) /* random user-level messages */ #define LOG_MAIL (2<<3) /* mail system */ #define LOG_DAEMON (3<<3) /* system daemons */ #define LOG_AUTH (4<<3) /* security/authorization messages */ #define LOG_SYSLOG (5<<3) /* messages generated internally by syslogd */ #define LOG_LPR (6<<3) /* line printer subsystem */ #define LOG_NEWS (7<<3) /* network news subsystem */ #define LOG_UUCP (8<<3) /* UUCP subsystem */ #define LOG_CRON (9<<3) /* clock daemon */ #define LOG_AUTHPRIV (10<<3) /* security/authorization messages (private) */ #define LOG_FTP (11<<3) /* ftp daemon */ /* other codes through 15 reserved for system use */ #define LOG_LOCAL0 (16<<3) /* reserved for local use */ #define LOG_LOCAL1 (17<<3) /* reserved for local use */ #define LOG_LOCAL2 (18<<3) /* reserved for local use */ #define LOG_LOCAL3 (19<<3) /* reserved for local use */ #define LOG_LOCAL4 (20<<3) /* reserved for local use */ #define LOG_LOCAL5 (21<<3) /* reserved for local use */ #define LOG_LOCAL6 (22<<3) /* reserved for local use */ #define LOG_LOCAL7 (23<<3) /* reserved for local use */ You can define facilities by their number, so if you want to select CRON messages from a Solaris box, you can use the filter: filter f_cron { facility(15); }; > On a non-Solaris related issue, if I try to test the kern facility by > doing a command like "logger -p kern.crit TEST" nothing happens locally > or on the loghost. Is there a reason why that should act differently > than other facilities? kernel messages are read from a special file (/proc/kmsg on linux), I suppose logger refuses to send a message with facility=kern from userspace. Try using truss on logger to see whether logger sends the message at all. (it does work on Linux however as strace shows) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: Fwd: [syslog-ng]Logging Remotely from Solaris to Linux
by Ron Braley 31 May '02

31 May '02

Bazsi I'll give these a try this morning. As always, thanks for the quick, expert response. :) Have a great weekend! rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 05/31/02 02:45AM >>> On Thu, May 30, 2002 at 09:58:23PM -0500, Ron Braley wrote: > Hi Bazsi. > > Here's where things are with the syslog-ng and Solaris vs Linux: > > Using facility filters (i.e. f_cron) on the Linux box will result in > not logging any messages from the Solaris box. Other Linux boxes work > fine with the facility filters, though. Here's the list of facilities that Solaris uses, and the same on Linux: Solaris: #define LOG_KERN (0<<3) /* kernel messages */ #define LOG_USER (1<<3) /* random user-level messages */ #define LOG_MAIL (2<<3) /* mail system */ #define LOG_DAEMON (3<<3) /* system daemons */ #define LOG_AUTH (4<<3) /* security/authorization messages */ #define LOG_SYSLOG (5<<3) /* messages generated internally by syslogd */ #define LOG_LPR (6<<3) /* line printer subsystem */ #define LOG_NEWS (7<<3) /* netnews subsystem */ #define LOG_UUCP (8<<3) /* uucp subsystem */ #define LOG_CRON (15<<3) /* cron/at subsystem */ /* other codes through 15 reserved for system use */ #define LOG_LOCAL0 (16<<3) /* reserved for local use */ #define LOG_LOCAL1 (17<<3) /* reserved for local use */ #define LOG_LOCAL2 (18<<3) /* reserved for local use */ #define LOG_LOCAL3 (19<<3) /* reserved for local use */ #define LOG_LOCAL4 (20<<3) /* reserved for local use */ #define LOG_LOCAL5 (21<<3) /* reserved for local use */ #define LOG_LOCAL6 (22<<3) /* reserved for local use */ #define LOG_LOCAL7 (23<<3) /* reserved for local use */ Linux: #define LOG_KERN (0<<3) /* kernel messages */ #define LOG_USER (1<<3) /* random user-level messages */ #define LOG_MAIL (2<<3) /* mail system */ #define LOG_DAEMON (3<<3) /* system daemons */ #define LOG_AUTH (4<<3) /* security/authorization messages */ #define LOG_SYSLOG (5<<3) /* messages generated internally by syslogd */ #define LOG_LPR (6<<3) /* line printer subsystem */ #define LOG_NEWS (7<<3) /* network news subsystem */ #define LOG_UUCP (8<<3) /* UUCP subsystem */ #define LOG_CRON (9<<3) /* clock daemon */ #define LOG_AUTHPRIV (10<<3) /* security/authorization messages (private) */ #define LOG_FTP (11<<3) /* ftp daemon */ /* other codes through 15 reserved for system use */ #define LOG_LOCAL0 (16<<3) /* reserved for local use */ #define LOG_LOCAL1 (17<<3) /* reserved for local use */ #define LOG_LOCAL2 (18<<3) /* reserved for local use */ #define LOG_LOCAL3 (19<<3) /* reserved for local use */ #define LOG_LOCAL4 (20<<3) /* reserved for local use */ #define LOG_LOCAL5 (21<<3) /* reserved for local use */ #define LOG_LOCAL6 (22<<3) /* reserved for local use */ #define LOG_LOCAL7 (23<<3) /* reserved for local use */ You can define facilities by their number, so if you want to select CRON messages from a Solaris box, you can use the filter: filter f_cron { facility(15); }; > On a non-Solaris related issue, if I try to test the kern facility by > doing a command like "logger -p kern.crit TEST" nothing happens locally > or on the loghost. Is there a reason why that should act differently > than other facilities? kernel messages are read from a special file (/proc/kmsg on linux), I suppose logger refuses to send a message with facility=kern from userspace. Try using truss on logger to see whether logger sends the message at all. (it does work on Linux however as strace shows) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: Fwd: [syslog-ng]Logging Remotely from Solaris to Linux
by Ron Braley 31 May '02

31 May '02

Hi Bazsi. Here's where things are with the syslog-ng and Solaris vs Linux: Using facility filters (i.e. f_cron) on the Linux box will result in not logging any messages from the Solaris box. Other Linux boxes work fine with the facility filters, though. The following is a syslog-ng.conf excerpt that lets all facilities (except mail and LPR) from the Solaris box log to /var/log/messages: destination d_messages { file("/var/log/messages"); }; log { source(s_all); filter(f_sirius); filter(f_warn); destination(d_messages); }; Again, if I add "filter(f_cron)" then nothing from the Solaris box works. The entry "filter(f_sirius)" a host filter, and that works fine. On a non-Solaris related issue, if I try to test the kern facility by doing a command like "logger -p kern.crit TEST" nothing happens locally or on the loghost. Is there a reason why that should act differently than other facilities? Thanks much for your help in these two matters. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax)

2 1

syslog-ng-1.4.15 patch for libol-0.3.3
by Carlos Velasco 30 May '02

30 May '02

Hello, I tried to run "configure" with libol-0.3.3 and found out that configure was not capable to find or use my libol-0.3.3 although I tried to specify "--with-libol=" parameter. Looking into the code I see that libol version needed is at least: 0.2.23 As my libol is 0.3.3, configure script does a comparation between 23 and 3, seeing that 3 is minor (23 > 3), it abort compilation. I have issued the next patch: --- configure Fri Apr 26 11:45:46 2002 +++ configure.new2 Thu May 30 20:21:12 2002 @@ -2623,7 +2623,7 @@ LIBOL_MAJOR=`echo $LIBOL_VERSION | sed -e 's/$[0-9]*$\.[0-9]*\.[0-9]*/\1/'` LIBOL_MINOR=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.$[0-9]*$\.[0-9]*/\1/'` -LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.[0-9]*\.$[0-9]*$/\1/'` +LIBOL_PATCH=`echo $LIBOL_VERSION | sed -e 's/[0-9]*\.[0-9]*\.$[0-9]*$/\1/' | sed -e 's/^$[0-9]$$/\10/'` if test "$LIBOL_MAJOR" != "$LIBOL_REQ_MAJOR" -o \ "$LIBOL_MINOR" -lt "$LIBOL_REQ_MINOR" -o \ "$LIBOL_PATCH" -lt "$LIBOL_REQ_PATCH"; then Regards, Carlos Velasco

1 0

Re: Syslog-ng-1.5.17+"--enable-tcpwrapper"
by Balazs Scheidler 30 May '02

30 May '02

On Thu, May 30, 2002 at 06:28:05PM +0300, Sergey Holod wrote: > ? ?????? ?? ?? 30 ??? 2002 15:38 ?? ????????: > > On Thu, May 30, 2002 at 12:02:43PM +0300, Sergey Holod wrote: > > > ? ?????? ?? ?? 30 ??? 2002 11:55 ?? ????????: > > > > On Thu, May 30, 2002 at 10:21:55AM +0300, Sergey Holod wrote: > > > > can you send me your configure output and config.log? > $./configure --enable-tcp-wrapper ok, when I fixed the detection of libwrap, I made a mistake, so -lwrap wasn't added to LIBS. Try this patch (and regenerate your configure script using autoconf ) diff -u -r1.49 configure.in --- configure.in 29 May 2002 10:24:42 -0000 1.49 +++ configure.in 30 May 2002 15:43:42 -0000 @@ -190,7 +190,7 @@ if test "x$enable_tcp_wrapper" = "xyes"; then AC_CHECK_HEADERS(tcpd.h) dnl AC_CHECK_LIB(wrap, hosts_access) - if test $blb_cv_c_lwrap = "xyes"; then + if test "x$blb_cv_c_lwrap" = "xyes"; then LIBS="$LIBS -lwrap" fi fi -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Re: [syslog-ng]syslog-ng 1.5.18 released
by Michael Earls 30 May '02

30 May '02

On this new ver does it fix the broken pipe on debian? michael >>> bazsi(a)balabit.hu 05/30/02 02:32 AM >>> Hi, I've released syslog-ng 1.5.18 with the folowing NEWS entry: News for the 1.5.18 release Wed, 29 May 2002 12:23:45 +0200 Changes: * fixed a crash bug when an UDP destination was unreachable In addition to this you can now specify log_prefix() for pipe sources. It can be downloaded from the usual places: http://www.balabit.hu/en/downloads/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

1.5.18/bison-1.32/stdio.h problem
by Borsenkow Andrej 30 May '02

30 May '02

Obviously new bison includes stdio.h only when debugging is enabled. Without it fails miserably in yyerror: /* Enable debugging if requested. */ #if YYDEBUG # ifndef YYFPRINTF # ifdef __cplusplus # include <cstdio> /* INFRINGES ON USER NAME SPACE */ # else # include <stdio.h> /* INFRINGES ON USER NAME SPACE */ # endif # define YYFPRINTF YYSTD (fprintf) # endif (this is not the original cfg-grammar.c but regenerated locally). The following patch is bandaid but I am not sure how to do it portably enough (meaning - accounting for earlier bison versions). One possibility is of course move yyerror out of cfg-grammar.y to avoid confusion. -andrej --- syslog-ng-1.5.18/src/cfg-grammar.y.orig Thu May 30 11:39:06 2002 +++ syslog-ng-1.5.18/src/cfg-grammar.y Thu May 30 11:39:52 2002 @@ -698,6 +698,8 @@ extern int linenum; +#include <stdio.h> + void yyerror(char *msg) { fprintf(stderr, "%s at %d\n", msg, linenum);

2 1

syslog-ng 1.5.18 released
by Balazs Scheidler 30 May '02

30 May '02

Hi, I've released syslog-ng 1.5.18 with the folowing NEWS entry: News for the 1.5.18 release Wed, 29 May 2002 12:23:45 +0200 Changes: * fixed a crash bug when an UDP destination was unreachable In addition to this you can now specify log_prefix() for pipe sources. It can be downloaded from the usual places: http://www.balabit.hu/en/downloads/syslog-ng/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 1

Re: Fwd: [syslog-ng]Logging Remotely from Solaris to Linux
by Ron Braley 29 May '02

29 May '02

Bazsi I'll try this right away!! I really appreciate you and all you do for the people asking syslog questions regularly. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax) >>> bazsi(a)balabit.hu 05/29/02 06:47AM >>> On Tue, May 28, 2002 at 11:44:22AM -0500, Ron Braley wrote: > Hi bazsi > > Yes, I'm running syslog-ng on both platforms. > > I've attached the configuration files from the Linux box used to record > logs, and from the Solaris box sending logs. I hope this helps. > > Please keep in mind that I've only configured cron to send to the > source s_tcp destination for testing. I've used the logger command > "logger -p cron.crit TEST FROM JUB" to test things. Also, I'm new to > syslogging (as I'm sure you can tell). > > Thanks again, and have a great day! Are you sure that the facility code for cron matches on Solaris and Linux? Try to create a bare bone configuration like: (solaris) source s_all { internal(); sun-streams("/dev/log" door("/etc/.syslog_door"); }; destination d_tcp { tcp("1.2.3.4"); }; log { source(s_all); destination(d_tcp); }; (linux) source s_all { internal(); unix-stream("/dev/log"); tcp(); }; destination d_messages { file("/var/log/messages"); }; log { source(s_all); destination(d_messages); }; And as soon as it works, try playing with filters and the rest. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

1 0

Re: Fwd: [syslog-ng]Logging Remotely from Solaris to Linux
by Balazs Scheidler 29 May '02

29 May '02

On Tue, May 28, 2002 at 11:44:22AM -0500, Ron Braley wrote: > Hi bazsi > > Yes, I'm running syslog-ng on both platforms. > > I've attached the configuration files from the Linux box used to record > logs, and from the Solaris box sending logs. I hope this helps. > > Please keep in mind that I've only configured cron to send to the > source s_tcp destination for testing. I've used the logger command > "logger -p cron.crit TEST FROM JUB" to test things. Also, I'm new to > syslogging (as I'm sure you can tell). > > Thanks again, and have a great day! Are you sure that the facility code for cron matches on Solaris and Linux? Try to create a bare bone configuration like: (solaris) source s_all { internal(); sun-streams("/dev/log" door("/etc/.syslog_door"); }; destination d_tcp { tcp("1.2.3.4"); }; log { source(s_all); destination(d_tcp); }; (linux) source s_all { internal(); unix-stream("/dev/log"); tcp(); }; destination d_messages { file("/var/log/messages"); }; log { source(s_all); destination(d_messages); }; And as soon as it works, try playing with filters and the rest. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

stresstest
by Sangbutsarakum, Patai 29 May '02

29 May '02

I'm going to implement central log server in my datacenter to accept many tons of log from many servers and equipments. I'm newbies in syslog-ng, I've run stresstest.sh on my solaris 2.6 [ 2SPARCs, 1 GB RAM] [I've use version 1.4.15] after run just a moment. It show "Segmentation Fault". What does it means for syslog-ng [can't tolerate] or my machine is suck? Should I concern about this? what should i do ? Please suggest Patrick

2 1

"fifo" and "file" source difference?
by Borsenkow Andrej 28 May '02

28 May '02

I needed a source that takes input from a FIFO so I made an obvious "fifo" source. Then I realized I needed log_prefix (that is not supported by fifo) so I changed it to "file". So far I cannot see any real difference. When should "fifo" and when "file" be used? Or are they exactly the same, just under different name? TIA -andrej

2 1

Logging Remotely from Solaris to Linux
by Ron Braley 28 May '02

28 May '02

Greetings! I'm having trouble getting my Solaris servers to log remotely to a Linux 7.1 server. The other Linux boxes log remotely to it OK, and the Solaris boxes will log to a Solaris server configured to listen (source s_tcp { tcp(); };). However, the Linux boxes won't log to a Solaris server, nor will the Solaris boxes log to a Linux server. What am I missing? Is there a format problem or something I need to overcome? Thanks in advance for helping me save the rest of my hair!! rb

1 0

RE: [syslog-ng]syslog-ng survey
by Ohrberg, Mick 27 May '02

27 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bazsi, Do you have any preliminary results for the survey? I'm very curious to see how popular syslog-ng really is! /Mick | -----Original Message----- | From: Balazs Scheidler [mailto:bazsi@balabit.hu] | Sent: Wednesday, May 15, 2002 5:58 AM | To: syslog-ng(a)lists.balabit.hu | Subject: [syslog-ng]syslog-ng survey | | | Hi, | | Please find the time to fill out the survey below to help us | to further | improve syslog-ng. You can either fill it out in this mail message | by entering the appropriate marks in the brackets, or on-line by | pointing your | browser to this url: | | http://www.balabit.hu/en/downloads/syslog-ng/survey/ | | Thanks in advance, [snip] | -- | Bazsi | PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD | 804E C82C 8EB1 | | _______________________________________________ | syslog-ng maillist - syslog-ng(a)lists.balabit.hu | https://lists.balabit.hu/mailman/listinfo/syslog-ng | -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA/AwUBPO5bUueVnE5KiyKKEQKHMQCeLlhisonB112W6+3nrUoKn1+sOBwAoLNB RbMXeluositTHLBtN9x1+kIQ =x5iJ -----END PGP SIGNATURE-----

2 1

Re: [syslog-ng]Problem with HP-UX 11.0
by dcntrnoc＠cmp.com 23 May '02

23 May '02

Thanks for the info - I did try a number of different source statements, none of which gave me anything useful. I'll deal with syslogd on the HP boxes until we're able to upgrade. Thanks, Sharon. Balazs Scheidler <bazsi(a)balabit.hu> To: syslog-ng(a)lists.balabit.hu Sent by: cc: syslog-ng-admin@lists bcc: .balabit.hu Subject: Re: [syslog-ng]Problem with HP-UX 11.0 05/17/2002 03:51 AM Please respond to syslog-ng On Thu, May 16, 2002 at 12:53:33PM -0600, Brad Arlt wrote: > On Thu, May 16, 2002 at 02:16:58PM -0400, dcntrnoc(a)cmp.com wrote: > > Hi all, > > > > I have been running syslog-ng on a handful of Solaris boxes for some time > > now with no problems, and am attempting to get it running on HP-UX. > > I have compiled (with gcc) and installed syslog-ng 1.5.16 and libol 0.3.2 on > > a system running HP-UX 11.00. I am using the following source statement > > in my config file: > > > > source s_sys { pipe("/dev/log"); internal(); }; > > Err... Ah, are you sure that opening a pipe from /dev/log will yeild > what you want? /dev/log is usually a Unix domain socket, which might > put more in the stream asside from ASCII. I'd turn off any syslog > daemons you have and just cat /dev/log | od Sorry, but HP-UX's /dev/log is really a pipe and not a socket. The problem seems to be that programs sending messages to /dev/log write a whole 2048 bytes block regardless the real length of the message. As syslog-ng reads _lines_ from a pipe, the rest of the 2048 bytes block is also read, which is what you see there. Currently my development branch of syslog-ng 2.0 supports this, but 1.5.x doesn't. A temporary solution would be to use both original syslogd from HP-UX and have it send messages to localhost where a syslog-ng is listening. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng

2 1

Christopher Leonardos/Triumph is out of the office.
by Christopher_Leonardos＠interliant.com 23 May '02

23 May '02

I will be out of the office starting 05/22/2002 and will not return until 05/28/2002. If you need immediate assistance please send email too either scott_tobias(a)interliant.com or mitchell_hryckowian(a)interliant.com Thank You

1 0

Newbie Question - Error Upon Installation - Help!
by Ron Braley 20 May '02

20 May '02

Greetings! Upon installing syslog-ng-1.4.10-1.0.24, and trying to run syslog-ng, I received an error: Cannot open configuration file /etc/syslog-ng/syslog-ng.conf for reading Parse error reading configuration file, exiting. So, I specified the configuration file and now am getting the following error: # syslog-ng -f /etc/syslog-ng.conf io.c: bind_unix_socket(): /var/chroot/named/dev/log not a socket Error initializing configuration, exiting. I'd greatly appreciate any help given by anyone. Take care. rb Ron Braley Network Team Leader - CCNP Systems Team Leader - MCSE, CNE University of North Dakota (Aerospace College) braley(a)aero.und.edu 701-777-2964 (work) / 2940 (fax)

1 0

RE: Syslog-ng should have a companion "logger-ng"
by Russo, Ben 17 May '02

17 May '02

I humbly apologize for sending HTML. Please don't kill me. :}

1 0

Syslog-ng should have a companion "logger-ng"
by Russo, Ben 17 May '02

17 May '02

Colleagues, When testing NetCool or other monitoring triggers it is very handy to be able to test things with "logger". However logger doesn't have the ability to test all of the things that syslog-ng can do. I don't know that much about the network protocol for syslog, or the system library calls in the various OS's that support local syslog delivery. However the standard "logger" command has the following limitations: 1. I can't specify the DESTINATION other than the default local system (e.g. @somehost(tcp#|udp#) ) without changing my local syslog configuration. 2. I can't spoof the source IP address or source Hostname. 3. I can't spoof the source messages time-stamp. Could I ask (pretty please) that the kind and generous gods of syslog programming make a little tiny version of syslog-ng called logger-ng that can accept command line arguments like the standard logger command does (with the addition of the above two options)? I would be willing to trade some work doing documentation of it and making man pages in exchange? I am a very good writer. -Ben.

1 0

Problem with HP-UX 11.0
by dcntrnoc＠cmp.com 17 May '02

17 May '02

I sent this to the list last week, but didn't get a response. Can anyone help with this issue? Thanks - Hi all, I have been running syslog-ng on a handful of Solaris boxes for some time now with no problems, and am attempting to get it running on HP-UX. I have compiled (with gcc) and installed syslog-ng 1.5.16 and libol 0.3.2 on a system running HP-UX 11.00. I am using the following source statement in my config file: source s_sys { pipe("/dev/log"); internal(); }; The filters are based on facility. It seems that the only readable output in the destination files come from either the internal source (ex. May 7 17:47:24 myhost syslog-ng[5675]: SIGHUP received, restarting syslog-ng), or from a message I sent via logger. The rest of the output looks like this: May 7 17:48:22 myhost ^F May 7 17:48:22 myhost ^B May 7 17:48:22 myhost ^B May 7 17:48:22 myhost À^_'^SÀ^_'^S^?|Fä May 7 17:48:22 myhost ^?~^U` May 7 17:48:22 myhost ^?|Fä May 7 17:48:22 myhost ^?|Fä^?|FäÀ^Ve{À^XAW May 7 17:48:22 myhost ^?|Ç@ May 7 17:48:22 myhost >@^?{à May 7 17:48:22 myhost ^O May 7 17:48:22 myhost ^A May 7 17:48:22 myhost ^?|Fä^?|FäÀ^_Î^[À^X¯^_ May 7 17:48:22 myhost ^D^?~^U`^?{à May 7 17:48:22 myhost May 7 17:48:22 myhost ^A May 7 17:48:22 myhost ^?|Fä^?|FäÀ^_Õs May 7 17:48:22 myhost ^?|Fä May 7 17:48:22 myhost À^XD» May 7 17:48:22 myhost @ May 7 17:48:22 myhost >@^?|¿À^?{à May 7 17:48:22 myhost À^XA May 7 17:48:22 myhost ^A^?|¡À May 7 17:48:22 myhost ^B^?|¡ÔÀ^S«H May 7 17:48:22 myhost ^?|Fä May 7 17:48:22 myhost À^X^[wÀ E¯ May 7 17:48:22 myhost ^?|¿ÀÀ^Wåp Any ideas? I don't know quite what to make of this. Thanks, Sharon. __________________________________________________________________________________________ Any views or opinions are solely those of the author and do not necessarily represent those of CMP Media. The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this message please do not read, copy, use or disclose this communication and notify the sender immediately. It should be noted that any review, retransmission, dissemination or other use of, or taking action or reliance upon, this information by persons or entities other than the intended recipient is prohibited. __________________________________________________________________________________________

3 2