- syslog-ng - lists.balabit.hu

so_rcvbuf default value of 0
by Matt Zagrabelny 07 Apr '15

07 Apr '15

Greetings, Just looking for confirmation about the so_rcvbuf parameter for the udp() source driver. The default is 0. Does that mean that syslog-ng uses the default value from the kernel? ie. cat /proc/sys/net/core/rmem_default 124928 If that is true, then perhaps the syslog-ng admin docs could mention that. I've scanned "man 7 socket" and don't seen anything that suggests that a value of 0 for so_rcvbuf means that the socket will inherit the value. Thanks for the help! -m

2 2

Compiling Github Source (not Balabit source)
by Asadullah Hussain 03 Apr '15

03 Apr '15

Hello, I have recently started exploring the syslog source with plan of contributing in future. I am able to run syslog using the source from Balabit site. But is there a way to compile the Github source? I have tried using Autoconf/Autoscan to generate the configure files but without success. I just have future pull requests in mind as Github source and Balabit source differ in a few files). -- Cheers, Asad

3 4

Re: [syslog-ng] Compiling Github Source (not Balabit source)
by Laszlo Budai 03 Apr '15

03 Apr '15

Hi Asad, I've created a docker image which can helps you: https://registry.hub.docker.com/u/lbudai/docker-syslog-ng-build-env/ L. Sent from my HTC ----- Reply message ----- From: "Asadullah Hussain" <asadxflow(a)gmail.com> To: <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] Compiling Github Source (not Balabit source) Date: Thu, Apr 2, 2015 11:33 Hello, I have recently started exploring the syslog source with plan of contributing in future. I am able to run syslog using the source from Balabit site. But is there a way to compile the Github source? I have tried using Autoconf/Autoscan to generate the configure files but without success. I just have future pull requests in mind as Github source and Balabit source differ in a few files). -- Cheers, Asad ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Re: [syslog-ng] Compiling Github Source (not Balabit source) (Asadullah Hussain)
by Anshul Kushwaha 02 Apr '15

02 Apr '15

Hi Asad, You can try running autoconf ./autogen.sh ./configure make make install for compiling from the github source. This worked well for me. If there are errors while running autoconf, try posting them here or on irc. Regards, Anshul Kushwaha

1 0

Stats missing from remote sources in syslog-ng 3.5?
by Pradeep Sanders 31 Mar '15

31 Mar '15

Hello, I'm seeing a similar problem to what was reported here: http://communities.balabit.com/balabit/topics/stats-from-syslog-remote-sour… <http://communities.balabit.com/balabit/topics/stats-from-syslog-remote-sour…> I'm trying to upgrade from the RHEL 6 default 3.2 version to 3.5 or 3.6, in order to enable threaded support. I've tried a 3.6 build from the following location: https://copr-be.cloud.fedoraproject.org/results/czanik/syslog-ng36epel6/epe… <https://copr-be.cloud.fedoraproject.org/results/czanik/syslog-ng36epel6/epe…> However, this build consumes all my host memory (48GB) in a matter of hours before starting on swap space. I've tried a 3.5.4 and a 3.5.6 package but both of them exhibit the same issue, with remote sources not reported in "syslog-ng-ctl stats". Does anyone have any advice on how I might fix the stats for remote sources in 3.5? Thanks, -Pradeep

2 1

interrogate daemon for parameter values?
by Matt Zagrabelny 30 Mar '15

30 Mar '15

Greetings, Is there a way to interrogate the running daemon to find out what the *effective* value is for things? For instance, I'd like to know what the effective value of so_rcvbuf is for a udp source. cat /proc/sys/net/core/rmem_default 1024 syslog-ng.conf: udp(); # uses default value of 0 service syslog-ng start echo 512 > /proc/sys/net/core/rmem_default Here is where I'd like to interrogate the running daemon and find that the udp driver is using a value of 1024 for so_rcvbuf. Any chance of doing that? Thanks! -m

2 1

[filter] unable to squelch annoying spam
by Robin Blanchard 28 Mar '15

28 Mar '15

Hi List, I've got some Solaris machines emitting some particularly annoying spam that I cannot seem to squelch. I've tried filtering on just about every MACRO that I can think might catch it, all to no avail. Here's the snippet from running syslog-ng in debug/foreground: # syslog-ng -Fdve 2>&1 |grep alloc_extra_sgl_frame Incoming log entry; line='<4>Mar 27 19:00:55 alloc_extra_sgl_frame failed' And here's the relevant filter bit (the other strings are doing their job). filter solaris_alloc { not ( match('alloc_extra_sgl_frame' value("MESSAGE")) or match('alloc_extra_sgl_frame' value("MSGHDR")) or match('alloc_extra_sgl_frame' value("FACILITY")) or match('alloc_extra_sgl_frame' value("PRIORITY")) or match('alloc_extra_sgl_frame' value("MSGID")) or match('ext-arq alloc fail.' value("MESSAGE")) or match('ext-arq alloc fail.' value("MSGHDR")) or match('/pci@0,0/pci8086,3c06@2,2/pci1000,3080@0' value("MESSAGE")) or match('/pci@0,0/pci8086,3c06@2,2/pci1000,3080@0' value("MSGHDR")) ); }; # syslog-ng --version syslog-ng 3.5.6 Installer-Version: 3.5.6 Revision: Compile-Date: Aug 13 2014 13:54:36 Available-Modules: affile,afprog,afsocket-notls,afsocket-tls,afsocket,afstomp,afuser,basicfuncs,confgen,cryptofuncs,csvparser,dbparser,linux-kmsg-format,syslogformat,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on What else should I try? -- Robin P. Blanchard Nephila Advisors Infrastructure Administrator +1 615.823.8516 ext 4516 ---------------------------------------------------------------------------------- The information in this e-mail, and any attachment therein, is confidential and for use by the addressee only. Any use, disclosure, reproduction, modification or distribution of the contents of this e-mail, or any part thereof, other than by the intended recipient, is strictly prohibited. If you are not the intended recipient, please return the e-mail to the sender and delete it from your computer. This email is for information purposes only, nothing contained herein constitutes an offer to sell or buy securities, as such an offer may only be made from a properly authorized offering document. Although Nephila attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses. -----------------------------------------------------------------------------------

2 1

GSoC proposal: Python connector (maxvt)
by Max Timchenko 27 Mar '15

27 Mar '15

Dear all, I’ve posted a proposal for the Python connector at: https://github.com/balabit/syslog-ng/wiki/GSoC-2015-Proposal:-syslog-ng-for… Any comments are welcome. There are a few questions at the bottom; repeating them here for convenience: 1. Python 3, Python 2, or both? Supporting only 3 allows using nifty idioms and language features, but there are still users who prefer to speak 2. Constrained platforms may not have enough resources to run both. 2. Are there any priorities among the different components in the project? A total of 5 components are specified. 3. Viability of one-component-at-a-time approach — whether you would prefer to see each part as it is done to completion, or proceed in parallel for all components (eg., wrapper APIs for all, then Python APIs for all, then completed documentation and examples for all). Yours, — Max

2 1

GSoC 2015: Java Language Binding
by Garmine 42 25 Mar '15

25 Mar '15

Hi! I started coding coding around 6 years ago, first using Java and later extending my knowledge to many other languages including C, Python, FORTH, Active Oberon and Bash just to name a few of many. Right now I'm a student at Budapest University of Technology and looking for a challenge for the summer. Recently a friend of mine drew my attention to syslog-ng and so I started exploring the project. Not only because it's an important Unix application but also because I developed some logging utilities of my own and as a OSS user I would love to start paying back to the community using the knowledge I learnt from them. I am working on issue 257 at the moment and I study the code and infrastructure above all to truly understand what I'm doing rather than just copying functionality. (And sometimes figuring out configuration issues as Arch Linux doesn't seem to be the most popular development platform for syslog-ng :)) As I have significant experience in C and Java* I believe I could do the most if I worked to enable Java-Syslog interoperability. * I wrote OpenGL&CL experiments, an overly complicated BrainF#@k interpreter and contributed to a game called ScrumbleShip in C. I also developed a primitive web browser resembling the Line Mode Browser from scratch using an own HTML parser, a JSON parser, contributed to a Minecraft server's code and wrote many other smaller and larger programs in Java. Due to my interest in OpenGL I also gathered knowledge about JNI. (And I like to talk a lot!) Kind regards, Miklos Kozak

1 0

GSoC Syslog-ng WebSocket question
by Mohammadi, Mahmoud 25 Mar '15

25 Mar '15

Dear WebSocket Mentors, This is Mahmoud Mohammadi, a graduate student in UNC Charlotte, USA. Currently I am researching on GSoC syslog-ng ideas. In the WebSocket protocol, as you know there are different tasks and issues to consider such as initial handshaking, data exchange, data formats and ping/pong communication commands. So is it required to write a library for implementing the WebSocket protocol in C or C++ or just use an existing library( recommended by you or the programmer) to integrating it with syslog-ng for the required functionalities? And also can you please is there a rough estimation( if possible) about the variety of different data formats or commands exchanging between the server and client or they would be determined during the project? Sincerely, Mahmoud

1 0