- syslog-ng - lists.balabit.hu

ECONNREFUSED on /dev/log
by Árpád Magosányi 22 Feb '16

22 Feb '16

Hi! "strace logger hello" output contains this line: connect(3, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = -1 ECONNREFUSED (Connection refused) I see logs in /dev/xconsole, just cannot emit a log line with logger. What could be the cause? additional info: # cat /etc/syslog-ng/syslog-ng.conf @version: 3.3 @include "scl.conf" # First, set some global options. options { chain_hostnames(off); flush_lines(0); use-dns(persist_only); dns-cache-hosts(/etc/hosts);use_fqdn(no); owner("root"); group("adm"); perm(0640); stats_freq(0); time_reap(1000); bad_hostname("^gconfd$"); }; source s_src { system(); internal(); }; #destination d_net { tcp("91.143.88.140" port(10000) tls(ca-dir("/etc/ssl") cert-file("/etc/ssl/newcert.pem") key_file("/etc/ssl/private/newkey.pem") )); }; destination d_net { tcp("infra.edemokraciagep.org" port(10000) tls(ca-dir("/etc/ssl") peer-verify(optional-untrusted))); }; destination d_messages { file("/var/log/messages");}; destination d_xconsole { pipe("/dev/xconsole"); }; destination d_apache_console { pipe("/dev/apacheconsole"); }; filter apache_log { program("apache"); }; filter non_apache_log { not program("apache"); }; destination d_vhost_gepnarancs { file("/var/log/vhost_gepnarancs"); }; filter f_gepnarancs { program("apache:php:gepnarancs") or message("gepnarancs"); }; log { source(s_src); filter(f_gepnarancs); destination(d_vhost_gepnarancs); }; log { source(s_src); destination(d_messages); }; log { source(s_src); filter(non_apache_log) ; destination(d_xconsole); }; log { source(s_src); filter(apache_log); destination(d_apache_console); }; log { source(s_src); destination(d_net); }; @include "/etc/syslog-ng/conf.d/" --------------------------------- # lsof |grep /dev/xconsole syslog-ng 2608 root 15u FIFO 0,5 0t0 19564 /dev/xconsole cat 2641 root 3r FIFO 0,5 0t0 19564 /dev/xconsole --------------------------------- # lsof |grep /dev/log [no output] --------------------------------- # dpkg -l syslog-ng Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-================================================-=============================-=============================-====================================================================================================== ii syslog-ng 3.5.6-2 all Enhanced system logging daemon (metapackage) -------------------------------- # ls -l /dev/log srw-rw-rw- 1 root root 0 Feb 20 11:03 /dev/log --------------------------------

3 7

GSOC 2016 Information
by Yogesh Gopal 22 Feb '16

22 Feb '16

Hi All, I took a look at the potential projects for GSOC 2016 and I found *syslog-ng for Java *project to be synchronizing with my area of interest.Can anyone please throw some more light on this project so that I will get profound knowledge.Also,I would like to contribute to the organization by solving open issues. Regards, Yogesh

2 2

Re: [syslog-ng] Not able to compile syslog-ng OSE with Java support
by Ho, Ming 20 Feb '16

20 Feb '16

Hello, I am able to compile syslog-ng 3.7.2 without the Java-based modules included successfully and the syslog-ng run fine. Now I need to re-compile again with the Java-based modules included. I execute the following steps listed in the syslog-ng-3.7-ose-admin guide: Installed openjdk version "1.8.0_71" Installed gradle version 2.11 export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:$PKG_CONFIG_PATH export LD_LIBRARY_PATH=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.71-1.b15.el6_7.x86_64/jre/lib/amd64/server:$LD_LIBRARY_PATH When I run ./configure, I notice the java module option is set to "no" in the summary: Modules: Module search path : ${exec_prefix}/lib/syslog-ng Sun STREAMS support (module): no SQL support (module) : no PACCT module (EXPERIMENTAL) : no MongoDB destination (module): yes JSON support (module) : no SMTP support (module) : no AMQP destination (module) : yes STOMP destination (module) : yes GEOIP support (module) : no Redis support (module) : no Riemann destination (module): no python : yes (pkg-config package: python) java : no I go ahead to execute "make" and "make install" without error. But I don't see the "java-modules" directory is created in /usr/local/lib/syslog-ng directory. When I include the following declaration in my syslog-ng.conf to start syslog-ng, I got the following error: [2016-02-20T05:46:59.039466] Plugin module not found in 'module-path'; module-path='/usr/local/lib/syslog-ng', module='mod-java' Why Java modules is not included? What steps am I missing? Any help is appreciated Ming

2 1

Virtual Client
by amey jain 20 Feb '16

20 Feb '16

Hi, I was reading documentation on syslog-ng. I got the fact that there are three operation modes:Sever,client and relay mode. I want to know how to test these modes on my computer. Simple way out, I have a single computer and I want to run syslog-ng server then how will I make virtual clients on the same computer. How will I run both syslog server and syslog client on my same computer for developing it? Regards Amey Jain

1 1

GSoC 2016: Project: syslog-ng for Python
by Amar Budhiraja 19 Feb '16

19 Feb '16

Hi mentors , I am an undergraduate student at IIIT-Hyderabad, India and I am interested in the project proposed by Mr Budai on having syslog-ng for Python. Last year, I interacted with Mr Zoltan about the project of monitoring syslog-ng via an android application. However, I couldn't make it. I consider myself to be fairly proficient in both C and Python. I have had several assignments in both C and Python both in and out of course work. I developed a entire bash terminal in C in my sophomore year. I also developed an application layer protocol in C in the same apart from several minor course projects . I have been working on Python for about 3 year now. I developed a Q/A engine, multiple web apps and implemented the entire Adwords (Google's Search Engine Advertising Framework) for my research paper in Python apart from other projects. Some of my work is available at https://github.com/budhiraja. I also have good understand of syslog-ng at a user level. I am interested in the syslog-ng for Python project. My interest comes from the fact that I will get to learn and build a multi-language system. Can you please guide me on how to move forward with the same? Thanks Sincerely, Amar Budhiraja

2 1

syslog-ng 3.7.x support on armv7 architecture
by Girish Kumar 18 Feb '16

18 Feb '16

Hi All, Please let me know whether syslog-ng 3.7.x is supported on armv7 architecture. I went through the following link and found that armv7 is not listed https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-… 1.6. Supported platforms The syslog-ng Open Source Edition application is highly portable and is known to run on a wide range of hardware architectures (x86, x86_64, SUN Sparc, PowerPC 32 and 64, Alpha) Regards, Girish

4 11

Testing filter rules, How can I log structure and data to a fifo ?
by Scot 16 Feb '16

16 Feb '16

Searched for 2 hours this morning and could not find the answer. Testing message filters and I'd like to be able to log all the meta data value pairs to a fifo to make troubleshooting easier. Like RSYSLOG_DebugFormat

3 3

Spock, Is my logic sound ?
by Scot 16 Feb '16

16 Feb '16

I'm still getting stuff on nmsloghost that I think should be filtered out. Do my comments match the conf file ? *# Source UDP/TCP syslog port 514. * source s_net { udp(ip(0.0.0.0) port(514) so_rcvbuf(262142)); tcp(ip(0.0.0.0) port(514) max-connections(250) so_rcvbuf(262142) log_iw_size(25000) ); }; *# Remove messages from 2 network segments * filter f_network {not netmask("192.168.238.0/24") and not netmask(" 192.168.239.0/24") ; }; *# Remove messages matching EITHER expression* filter f_audit { not match("Audit" value("MESSAGE")) and not match("Detailed Tracking" value("MESSAGE")); }; *# Remove messages matching "The scan found detections" expression* filter f_mcafee { not match("The scan found detections." value("MESSAGE")); }; *# Destination rule suppress any duplicates in a 10 second window. *destination d_remote {udp ("nmsloghost" suppress(10)); }; *# Log from s_net and filter out all matches from f_* log udp to nmsloghost. * *# There is no function to "filter( not f_network);" * log { source(s_net); filter(f_network); filter(f_audit); filter(f_mcafee); destination (d_remote);

3 3

running syslog-ng as non root user
by Ryan Koss 15 Feb '16

15 Feb '16

Hello, I’m trying to run syslog-ng as a non-root user. I’ve tried the following command as suggested by the site at the following URL https://www.balabit.com/wiki/syslog-ng-faq-non-root <https://www.balabit.com/wiki/syslog-ng-faq-non-root> Unfortunately I am still encountering permissions issues. ?-> /usr/sbin/syslog-ng --user user --persist-file /code/routeiqSyslog/i95/build/src/lib/util/test/syslog-ng.persist syslog-ng: Error setting capabilities, capability management disabled; error='Operation not permitted' Error binding socket; addr='AF_UNIX(/dev/log)', error='Address already in use (98)' Error initializing message pipeline; ?-> Any ideas, thoughts help will be greatly appreciated. Thanks, -ryan

2 1

Re ./configure not working
by amey jain 12 Feb '16

12 Feb '16

Hi, Sorry for the last mail not being proper. Actually when I run ./configure script for syslog-ng it stops at a point and shows error config.status: error: cannot find input file: `src/Makefile.in' ". It also shows the error "configure: error: ./configure.gnu failed for lib/ivykis". I searched for the ivykis packages through apt-cache search and installed them but the error didn't disappeared. I have copied the ./configure output here. Please see and tell the error. Regards checking whether make supports nested variables... yes checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking whether UID '1000' is supported by ustar format... yes checking whether GID '1000' is supported by ustar format... yes checking how to create a ustar tar archive... gnutar checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking whether gcc understands -c and -o together... yes checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking for gcc option to accept ISO C99... -std=gnu99 checking for bison... bison -y checking for flex... flex checking lex output file root... lex.yy checking lex library... -lfl checking whether yytext is a pointer... yes checking whether make sets $(MAKE)... (cached) yes checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking how to print strings... printf checking for a sed that does not truncate output... /bin/sed checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for fgrep... /bin/grep -F checking for ld used by gcc -std=gnu99... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B checking the name lister (/usr/bin/nm -B) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 1572864 checking how to convert x86_64-unknown-linux-gnu file names to x86_64-unknown-linux-gnu format... func_convert_file_noop checking how to convert x86_64-unknown-linux-gnu file names to toolchain format... func_convert_file_noop checking for /usr/bin/ld option to reload object files... -r checking for objdump... objdump checking how to recognize dependent libraries... pass_all checking for dlltool... no checking how to associate runtime and link libraries... printf %s\n checking for ar... ar checking for archiver @FILE support... @ checking for strip... strip checking for ranlib... ranlib checking command to parse /usr/bin/nm -B output from gcc -std=gnu99 object... ok checking for sysroot... no checking for a working dd... /bin/dd checking how to truncate binary pipes... /bin/dd bs=4096 count=1 checking for mt... mt checking if mt is a manifest tool... no checking how to run the C preprocessor... gcc -std=gnu99 -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... yes checking for objdir... .libs checking if gcc -std=gnu99 supports -fno-rtti -fno-exceptions... no checking for gcc -std=gnu99 option to produce PIC... -fPIC -DPIC checking if gcc -std=gnu99 PIC flag -fPIC -DPIC works... yes checking if gcc -std=gnu99 static flag -static works... yes checking if gcc -std=gnu99 supports -c -o file.o... yes checking if gcc -std=gnu99 supports -c -o file.o... (cached) yes checking whether the gcc -std=gnu99 linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes checking for python... /usr/bin/python checking CFLAGS_NOWARN_POINTER_SIGN for gcc -Wno-pointer-sign... -Wno-pointer-sign checking for special C compiler options needed for large files... no checking for _FILE_OFFSET_BITS value needed for large files... no checking how to enable static linking for certain libraries... GNU or Solaris checking for ANSI C header files... (cached) yes checking dmalloc.h usability... no checking dmalloc.h presence... no checking for dmalloc.h... no checking for strings.h... (cached) yes checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking stropts.h usability... yes checking stropts.h presence... yes checking for stropts.h... yes checking sys/strlog.h usability... no checking sys/strlog.h presence... no checking for sys/strlog.h... no checking door.h usability... no checking door.h presence... no checking for door.h... no checking sys/capability.h usability... no checking sys/capability.h presence... no checking for sys/capability.h... no checking sys/prctl.h usability... yes checking sys/prctl.h presence... yes checking for sys/prctl.h... yes checking utmp.h usability... yes checking utmp.h presence... yes checking for utmp.h... yes checking utmpx.h usability... yes checking utmpx.h presence... yes checking for utmpx.h... yes checking tcpd.h usability... no checking tcpd.h presence... no checking for tcpd.h... no checking for struct ucred... yes checking for struct cmsgcred... no checking whether struct tm is in sys/time.h or time.h... time.h checking for SO_ACCEPTCONN... yes checking for struct tm.tm_gmtoff... yes checking for struct msghdr.msg_control... yes checking for I_CONSLOG... yes checking for O_LARGEFILE... yes checking for struct sockaddr_storage... yes checking for struct sockaddr_in6... yes checking for PR_SET_KEEPCAPS... yes checking for modern utmp... yes checking for door_create in -ldoor... no checking for socket in -lsocket... no checking for nanosleep in -lrt... yes checking for gethostbyname in -lnsl... yes checking for regexec in -lregex... no checking for res_init in -lresolv... no checking for strdup... yes checking for strtol... yes checking for strtoll... yes checking for strtoimax... yes checking for inet_aton... yes checking for inet_ntoa... yes checking for getopt_long... yes checking for getaddrinfo... yes checking for getnameinfo... yes checking for getutent... yes checking for getutxent... yes checking for pread... yes checking for pwrite... yes checking for strcasestr... yes checking for memrchr... yes checking for localtime_r... yes checking for gmtime_r... yes checking for strtok_r... yes checking for clock_gettime... yes checking for EVTLOG... yes checking for TCP wrapper library... checking whether to enable TCP wrapper support... no checking for dlsym in -ldl... yes checking for LIBDBI... no checking whether to enable SQL support... no checking for GLIB... yes checking for g_mapped_file_unref... no checking sanity checking Glib headers... yes checking for GEOIP... no checking for PCRE... yes checking for OPENSSL... yes checking for LIBNET... yes checking whether to enable spoof source support... yes checking for JSON... no checking for JSON... yes checking for LIBMONGO... no checking for prop_get in -lsasl2... no checking for libESMTP... no checking for HIREDIS... yes checking for RIEMANN_CLIENT... no checking for PYTHON... no checking for JAVA_VERSION... no checking for GRADLE_VERSION... no checking whether to enable Sun STREAMS support... no checking whether to enable IPv6 support... yes checking whether to enable Linux capability support... no checking whether to enable mongodb destination support... yes checking whether to enable amqp destination support... yes checking for libsystemd... no checking for libsystemd_daemon... no checking for LIBSYSTEMD_JOURNAL... no checking for UUID... no checking whether to enable Valgrind on the unit tests... checking for valgrind... no yes checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating syslog-ng-native-connector.pc config.status: creating dist.conf config.status: creating Makefile config.status: creating syslog-ng.spec config.status: creating syslog-ng.pc config.status: creating libtest/syslog-ng-test.pc config.status: creating scripts/update-patterndb config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands config.status: executing libtool commands config.status: executing syslog-ng-config.h commands config.status: creating syslog-ng-config.h - prefix SYSLOG_NG for config.h defines config.status: syslog-ng-config.h is unchanged === configuring in lib/ivykis (/home/amey/git/syslog-ng/lib/ivykis) configure: running /bin/bash ./configure.gnu --disable-option-checking '--prefix=/usr/local' --cache-file=/dev/null --srcdir=. ./configure.gnu Running: ./configure --disable-option-checking --prefix=/usr/local --cache-file=/dev/null --srcdir=. --disable-shared --enable-static --with-pic --enable-man-pages checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... no checking for mawk... mawk checking whether make sets $(MAKE)... yes checking whether make supports nested variables... yes checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking whether gcc understands -c and -o together... yes checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking host operating system type... posix checking for working __thread... yes checking whether gcc accepts -pthread... yes checking whether gcc accepts -pthreads... no checking for library containing pthread_atfork... none required checking for library containing pthread_create... none required checking for __sync_lock_test_and_set()... yes checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking process.h usability... no checking process.h presence... no checking for process.h... no checking sys/devpoll.h usability... no checking sys/devpoll.h presence... no checking for sys/devpoll.h... no checking sys/eventfd.h usability... yes checking sys/eventfd.h presence... yes checking for sys/eventfd.h... yes checking sys/syscall.h usability... yes checking sys/syscall.h presence... yes checking for sys/syscall.h... yes checking for sys/thr.h... no checking thread.h usability... no checking thread.h presence... no checking for thread.h... no checking for linux/netfilter_ipv4.h... yes checking for struct timespec.tv_sec... yes checking for library containing clock_gettime... none required checking for clock_gettime... yes checking for CLOCK_MONOTONIC... yes checking for CLOCK_REALTIME... yes checking for library containing inet_ntop... none required checking for library containing socket... none required checking for library containing thr_self... no checking for epoll_create... yes checking for epoll_create1... yes checking for eventfd... yes checking for gettid... no checking for inotify_init... yes checking for kqueue... no checking for lwp_gettid... no checking for port_create... no checking for pthread_spin_lock... yes checking for thr_self... no checking for splice... yes checking for wait4... yes checking whether supports symbol version scripts... yes checking that generated files are newer than configure... done configure: creating ./config.status config.status: creating Makefile config.status: creating contrib/Makefile config.status: creating contrib/iv_getaddrinfo/Makefile config.status: creating contrib/kojines/Makefile config.status: creating man3/Makefile config.status: creating misc/Makefile config.status: creating misc/ivykis.pc ./configure: line 2930: LT_INIT: command not found ./configure: line 3970: AC_PROG_LIBTOOL: command not found config.status: error: cannot find input file: `src/Makefile.in' configure: error: ./configure.gnu failed for lib/ivykis

2 1