- syslog-ng - lists.balabit.hu

No "-n" switch for syslog-ng?
by P Levine 27 Feb '13

27 Feb '13

I've been getting many "syslog-ng.service start request repeated too quickly..." issues in systemd journal . The syslog-ng service would always fail. I noticed there seems to be a bug in which systemd executes syslog-ng with the "-n" flag. I recently posted the bug here: https://bugs.freedesktop.org/show_bug.cgi?id=61324 After modifying lib/gprocess.c to accept "-n" in place of "-F", recompiling, and reinstalling, the problem has disappeared and the syslog-ng process remains up. Is this a systemd bug? I have been googling for 2 days to see if it relates to any other bugs and have found nothing. I just started using systemd 4 days ago and its my impression that syslog-ng has supported systemd for some time. So, could there be something on my end causing the issue?

4 15

syslog-ng OSE 3.4 doc updates
by Fekete Robert 26 Feb '13

26 Feb '13

Hi, I am currently working on updating the 3.4 adminguide, and releasing updated drafts every few days. The current version already has two short sections about junctions and channels (and a bunch of smaller updates as well). http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-guid… http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-guid… Any feedback, comment, clarification request, or real-life use-case is most welcome. I hope to release more stuff on Friday, and also to write a list of the new features that are already documented. Kind Regards, Robert

5 17

syslog-ng ruleset confusion or bug?
by David Stainton 26 Feb '13

26 Feb '13

Greetings, I am running syslog-ng-3.3.5-1 on CentOS release 6.3. It seems like there is a subtle bug in syslog-ng or more likely a bug in my syslog-ng configuration. I am unable to get log message to appear in the other destinations besides /var/log/messages... I've tried testing like this: logger info.local3 howdy logger info.local5 howdy logger info.local6 howdy logger emerg.local6 howdy However the log messages only show up in /var/log/messages. I wonder why! Any help, observations or suggestions would be much appreciated. Thanks! David PS Here is my simple config: @version: 3.3 options { create_dirs (yes); dir_perm(0755); keep_hostname (yes); perm(0644); flush_lines (0); time_reopen (10); use_dns (yes); use_fqdn (no); }; source s_sys { file ("/proc/kmsg" program_override("kernel: ")); unix-stream ("/dev/log"); internal(); unix-stream ("/var/named/chroot/dev/log" optional(yes)); }; destination d_mesg { file("/var/log/messages"); }; destination d_app { file("/var/log/philotic/$PROGRAM.log"); }; destination d_app_event { file("/var/log/philotic/$PROGRAM-event.log"); }; destination d_philotic { file("/var/log/philotic/$PROGRAM.log"); }; filter f_info { level(info..emerg) }; filter f_default { level(info..emerg) and not ( facility(mail) or facility(authpriv) or facility(cron) or facility(local6) or facility(local5) or facility(14) ); }; filter f_app_event { facility(local3); }; filter f_app { facility(local6); }; filter f_philotic { facility(local5); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_info); filter(f_app); destination(d_app); }; log { source(s_sys); filter(f_info); filter(f_app_event); destination(d_app_event); }; log { source(s_sys); filter(f_info); filter(f_philotic); destination(d_philotic); };

2 2

syslog-ng OSE 3.3 and 3.4 documentation updates
by Fekete Robert 25 Feb '13

25 Feb '13

Hi, I have released updated version of The syslog-ng Open Source Edition 3.4 Administrator Guide. This release should document every feature of OSE 3.4 - if something is missing or unclear, please let me know. Comments and bug reports are welcome. I have also released an updated version of the The syslog-ng Open Source Edition 3.3 Administrator Guide - this is mostly a bugfix release, and is intended to be the last release of the 3.3 guide. Please note that because of some website reorganization, the URL of the docs has changed, so old bookmarks and browser history will not work. You can find the docs at http://www.balabit.com/support/documentation , just select _syslog-ng_ and the version number (3.3 or 3.4). The documentation of older releases has been moved to http://www.balabit.com/downloads/files/archived_documents Regards, Robert

1 0

Log file sending to syslog
by a bv 25 Feb '13

25 Feb '13

Hi, I have log files which i like to send these logs as real time events to the syslog-ng running and mysql running which collects the real time logs. How can i do this? Regards

3 2

sending faile based logs to syslog
by a bv 25 Feb '13

25 Feb '13

Hi, I have a box runing syslog-ng and mysql and php based gui which gets logs squid etc boxes. and i have file based squid logs. Can i send these logs in to the syslog-ng (box) like a real time event and get the database record it? Regards

1 0

syslog-ng 3.3.7 coredump on solaris 10 Opteron
by Rakesh Rajasekharan 23 Feb '13

23 Feb '13

I have compiled the syslog-ng 3.3.7 on solaris in mixed-linking mode . But syslog-ng is not logging anything.. upon debugging i found that it gets core dump.. I have compiled ivykis and have tried using the --with-ivykis=system option as well. # /opt/soe/local/syslog-ng-3.3.7/sbin/syslog-ng -Fvde the last few lines of the above command are... Trying to open module; module='afstreams', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libafstreams.so' Attempted to register the same plugin multiple times, ignoring; context='source', name='sun-streams' Finishing include; content='source confgen system', depth='1' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.3.7' iv_fd_port_poll: got error 95[Socket operation on non-socket] Abort(coredump). any suggestions please..

2 2

syslog-ng selinux context Centos 5.9 (RHEL5)
by Stuart Green 21 Feb '13

21 Feb '13

Hi, I'm having some trouble with selinux blocking syslog-ng from creating directories type=1400 audit(1361437595.431:297527809): avc: denied { create } for pid=2835 comm="syslog-ng" name="21" scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:syslogd_var_run_t:s0 tclass=dir printk: 512913 messages suppressed. There is a line which seems to define this context in: /etc/selinux/targeted/contexts/files/file_contexts /var/log/syslog-ng(/.*)? system_u:object_r:syslogd_var_run_t:s0 If I manually change the context to var_log_t as per: /var/log/.* system_u:object_r:var_log_t:s0 then it creates the directory successfully. I believe the policy configuration is standard and undoctored so believe there could be a problem with it? Does anyone have a similar environment or some knowledge on this? greets -Stu

2 1

get Forbidden on online syslog-ng Documentation
by Stefan Sabolowitsch 19 Feb '13

19 Feb '13

Hi all, is can not actually access on this URL: https://code.seas.harvard.edu/seas-academic-computing/syslog-ng-patterndb/t… Yesterday it's was successful Any idea ? thx Stefan

1 0

syslog-ng daemon does not start up on HPUX ia64
by Rakesh Rajasekharan 19 Feb '13

19 Feb '13

I have successfully compiled the syslog-ng but upon starting .. syslog-ng daemon does not show up in the ps command. Running it in the debug mode.... i get the below error while i try to open a new putty terminal.. # /opt/soe/local/syslog-ng-3.3.7/sbin/syslog-ng -Fvde nanosleep() is not accurate enough to introduce minor stalls on the reader side, multi-threaded performance may be affected; Trying to open module; module='affile', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libaffile.so' Trying to open module; module='afprog', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libafprog.so' Trying to open module; module='afsocket', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libafsocket.so' Trying to open module; module='afuser', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libafuser.so' Trying to open module; module='basicfuncs', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libbasicfuncs.so' Trying to open module; module='csvparser', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libcsvparser.so' Trying to open module; module='dbparser', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libdbparser.so' Trying to open module; module='syslogformat', filename='/opt/soe/local/syslog-ng-3.3.7/lib/syslog-ng/libsyslogformat.so' Running application hooks; hook='1' Running application hooks; hook='3' syslog-ng starting up; version='3.3.7' Incoming log entry; line='<38>Feb 19 15:53:20 sshd[29953]: SSH: Server;Ltype: Kex;Remote: 20.201.140.200-62779;Enc: aes256-cbc;MAC: hmac-sha1;Comp: none' ** ** ERROR:(logsource.c:286):log_source_queue: assertion failed: (old_window_size > 0) Abort(coredump) Any suggestions on this please....

1 0