- syslog-ng - lists.balabit.hu

make error syslog-ng 3.3.4 AIX 5.2
by Rakesh Rajasekharan 29 Jun '12

29 Jun '12

I am getting an error during the make stage for syslog-ng 3.3.4. complaining about libiconv. I have compiled libiconv and the library is available under /usr/local/lib # ls -ltr /usr/local/lib/libiconv* -rw-r--r-- 1 root system 890 Jun 17 23:35 /usr/local/lib/ libiconv.la -rw-r--r-- 1 root system 1724284 Jun 17 23:35 /usr/local/lib/libiconv.a ykis-modules.a -lc -Wl,-bnoentry -O2 -pthread -Wl,-brtl -pthread -Wl,--whole-archive -Wl,--no-whole-archive -pthread -Wl,-bE:.libs/libsyslog-ng.exp -Wl,-bernotok /usr/local/lib/libglib-2.0.a(gconvert.o):gconvert.c:(.pr+0x12c): undefined reference to `.libiconv_open' /usr/local/lib/libglib-2.0.a(gconvert.o):gconvert.c:(.pr+0x358): undefined reference to `.libiconv' /usr/local/lib/libglib-2.0.a(gconvert.o):gconvert.c:(.pr+0x39c): undefined reference to `.libiconv_close' collect2: ld returned 1 exit status The compilaiton of glib was fine but not sure why the make fails. Below is my configure options. ./configure --enable-dynamic-linking --prefix=/opt/soe/local/syslog-ng-3.3.4 \ --with-ld-library-path=/opt/soe/local/syslog-ng-3.3.4/lib \ --libdir=/opt/soe/local/syslog-ng-3.3.4/lib --enable-mongodb=no -with-libmongo-client=no Any valuable inputs on this please? Thanks , Rakesh.

4 6

syslog-ng 3.2.5 HPUX 11.11 /usr/ccs/bin/ld: Unsatisfied symbols:
by Divya Vikraman 29 Jun '12

29 Jun '12

Hello, I ma compiling syslog-ng 3.2.5 version on an HPUX 11.11 hppa machine.But, in the make stage , I get the below error. libtool: link: gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -o .libs/pdbtool pdbtool-pdbtool.o -Wl,-E -L/opt/soe/local/syslog-ng-3.2.5/lib:/opt/soe/local/syslog-ng-3.2.5/eventlog/lib libsyslog-ng-patterndb.a -L../../lib/.libs -lsyslog-ng -lcl -L/usr/local/lib -L/opt/soe/local/syslog-ng-3.2.5/eventlog/lib -lrt -lnsl -lgmodule-2.0 -lglib-2.0 -lintl -liconv -levtlog -lpcre -ltermcap -Wl,+b -Wl,/compile/syslog/syslog-ng-3.2.5/lib/.libs:/usr/local/lib:/opt/soe/local/syslog-ng-3.2.5/lib /usr/ccs/bin/ld: Unsatisfied symbols: evt_tag_long (first referenced in libsyslog-ng-patterndb.a(libsyslog_ng_patterndb_a-patterndb.o)) (code) collect2: ld returned 1 exit status make[5]: *** [pdbtool] Error 1 make[5]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/compile/syslog/syslog-ng-3.2.5' make: *** [all] Error 2 I have compiled eventlog -0.2.12 wiht the following ooptions. ./configure --prefix=/opt/soe/local/syslog-ng-3.2.5/eventlog and have also set the PKG_CONFIG_PATH correclty PKG_CONFIG_PATH=/opt/soe/local/syslog-ng-3.2.5/eventlog/lib/pkgconfig:/usr/local/lib/pkgconfig and in the Makefile i have EVTLOG_CFLAGS = -I/opt/soe/local/syslog-ng-3.2.5/eventlog/include/eventlog EVTLOG_LIBS = -L/opt/soe/local/syslog-ng-3.2.5/eventlog/lib -levtlog Can someone pleas help me out to fix this. Thanks, Divya.

2 1

syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 29 Jun '12

29 Jun '12

Hi all, Can somebody unblock us in the below issue.? Thanks Hithendra From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ext anju.raveendrannair(a)wipro.com Sent: Friday, June 08, 2012 5:16 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance. Hi, We are using syslog-ng-3.4.0alpha2 binary and trying to run the syslog-ng server configuration file, but its not starting the syslog ng server. We are getting the following error incase of f__nonconsole_access filter when we ran the syslog-ng binary in debug mode. Filter rule evaluation result; result='match', rule='f_nonconsole_access', location='/ne_data/conf/syslogng/syslog-ng_server.conf:58:29' ** ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self)) Abort (core dumped) PFA the debug.log The server conf is having the following line for the above mentioned filter, template ltemgr_msg_template { template("$S_ISODATE $HOST $FACILITY_NUM/$LEVEL_NUM $MSG\n"); }; #To strip of the msg_id introduced by syslogd rewrite rw_msg{subst("\\[.*\\] <file:///\\[.*\%5d> ", "", value("MESSAGE"));}; source s_LTEMGR_SYSLOG_CLIENTS{ tcp (ip (27.132.98.69) port(6515) max-connections(4) tls( key_file("/ne_data/conf/certificates/MOCM/MOCM_key.pem") cert_file("/ne_data/conf/certificates/MOCM/MOCM_SB_server.pem") ca_dir("/ne_data/conf/certificates/SYSLOGNG") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SS Lv2") peer_verify(optional-untrusted) ) ); }; ....... destination d_ltemgr_nonconsoleaccess_log {file("/ne_data/syslog/ems" perm(0644) template(ltemgr_msg_template)); }; ...... filter f_nonconsole_access { level(info..notice) and facility(auth) and ( match("Accepted password for" value("MESSAGE")) or match("Failed password for" value("MESSAGE")) ); }; ..... log { source(s_LTEMGR_SYSLOG_CLIENTS); filter(f_nonconsole_access); rewrite(rw_msg); destination(d_ltemgr_nonconsoleaccess_log); }; Without debug mode, we were able to run the server but central logging is not happening when tried with logger command. Thanks, Anju Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

Re: [syslog-ng] issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 29 Jun '12

29 Jun '12

Hi Balint, Thanks for the reply. I tried the below rewrite rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; It works for auth.info, but it does not work with local7.info or local6.info as the regex does not handle numerals in the facility field. I tried changing it as follows (i.e. added [0-9] before .)., but with this, this dumps core. Addition of any numeral in this position results in a core dump subst("\[ID [0-9]* [a-z]*[0-9]\.[a-z]*\]\ " "" value("MESSAGE") We have tried the following. logger -p local7.info "HELLO|KUAAA" --> Did not work logger -p local6.info "HELLO|KUAAA" --> Did not work logger -p auth.info "Accepted password for root" --> Worked. Thanks Hithendra -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu on behalf of ext Balint Kovacs Sent: Fri 6/15/2012 10:26 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] issue with rewrite. Please help. Hi Hithendra, I came across this problem just recently, I guess that you want to handle Solaris logs with the standard Unix analysis ruleset, but the these tags are in the way. The only difference is, that I moved the tag to the end of the message (as patterndb does prefix matching, these don't bother my patterns but are still there). My rewrite rule is the following: rewrite r_solaris { #move the solaris header to the end of the message #to work with linux patterndb subst("(\[ID [0-9]* [a-z]*\.[a-z]*\])\ " "" value("MESSAGE") type("pcre") flags(store-matches)); subst("$" " $1" value("MESSAGE") type("pcre")); }; If you don't want to move it (backreferencing is quite slow and resource-intensive), you could just use this untested version: rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; HTH, Balint On 06/15/2012 05:39 AM, Balla, Hithendra (EXT-Other - IN/Bangalore) wrote: > > Hi all, > > We have the followinglog > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6*[ID 800047 > auth.info]*Accepted publickey for xyz > > We wanted to replace*[ID 800047 auth.info]*with*empty > string*(i.e."")and print the following > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz > > So we have used the below re-write with subst. But this is not > workingin*syslog-ng 3.4.0alpha2*. > > rewrite rw_msg{*subst*("\\[.*\\]", "", value("MESSAGE"));}; > > Can somebody help out here? > > Thanks > > Hithendra > > > > ________________________________________________________________________ ______ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

2 1

Re: [syslog-ng] Include doesn't work
by Jakub Prokeš 29 Jun '12

29 Jun '12

Hi! > Include files are only snippets and not full configs, so as such they can not have the @version line in them. I removed version info from snippet, but syntax error is still here. [root@logger:~]# syslog-ng -s -d Adding include file; filename='001-sample.conf' Starting to read include file; filename='/etc/syslog-ng/syslog-ng.conf.d/001-sample.conf', depth='1' syntax error in /etc/syslog-ng/syslog-ng.conf.d/001-sample.conf at line 7. At line 7 start this section: destitation d_messages_sample { file("/home/sample/var/$HOST/messages/$YEAR$MONTH$DAY.log"); }; Is there some kind of list available directives in sniplets? Regards, -- Jakub Prokes Senior Linux Administrator m: podpora(a)superhosting.cz w: www.superhosting.cz | www.datacamp.sk [CZ]: +420 296 826 296 | Na Safrance 33, Praha 10 - Vinohrady [SK]: +421 (2) 2025 6256 | Bozeny Nemcovej 8, Bratislava

4 4

[Bug 181] New: Daemon stops reading from unix-dgram source following charset decoding error
by bugzilla＠bugzilla.balabit.com 29 Jun '12

29 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=181 Summary: Daemon stops reading from unix-dgram source following charset decoding error Product: syslog-ng Version: 3.3.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=674099 OS/Version: Linux Status: ASSIGNED Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: bug Estimated Hours: 0.0 As explained in the Debian bug report (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=674099) when we have an unix-dgram() source with encoding set, and we send invalid data there, no further messages will be processed. It's easy to reproduce, and only seems to happen with unix-dgram (tcp at least does not exhibit this problem). I'm not quite sure yet why this happens - the source is kept open, just doesn't seem to be handled at all. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[Bug 159] New: on signal HUP program destinations are not closed
by bugzilla＠bugzilla.balabit.com 26 Jun '12

26 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=159 Summary: on signal HUP program destinations are not closed Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: erempel(a)uvic.ca Type of the Report: --- Estimated Hours: 0.0 In previous versions of syslog-ng, when a HUP signal was sent to syslog-ng it would close all of its destinations and reopen them. In version 3.3.4 (perhaps earlier ones) the destination to programs is not closed, but a new one is opened. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 12

Re: [syslog-ng] Forward slashes in QSTRING
by Evan Rempel 24 Jun '12

24 Jun '12

can you try this "@STRING::/@/@STRING:lastName:-._@ " This should match alphanumerics including / but followed by a / and a string of alphanumerics including -._that does not include a / and then followed by a space (I forget what your original text to match on looks like. Evan Michael Starks <syslog-ng-list(a)michaelstarks.com> wrote: On 06/19/2012 11:24 AM, Martin Holste wrote: > If you know this will be the rest of the message, you can use a > capturing @ANYSTRING:var:@ to grab everything left in the message. Thanks. I have tried @ANYSTRING@ but as I suspected it starts matching on the first / since the pattern is being read left-to-right. What ends up happening is that the entire file path is included. I still don't see a way to capture everything between the last / and the ' without knowing in advance how deep the path will be. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 2

[Bug 184] New: syslog-ng.service and systemd with journal support
by bugzilla＠bugzilla.balabit.com 22 Jun '12

22 Jun '12

https://bugzilla.balabit.com/show_bug.cgi?id=184 Summary: syslog-ng.service and systemd with journal support Product: syslog-ng Version: 3.3.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: jpo(a)di.uminho.pt Type of the Report: --- Estimated Hours: 0.0 Hi, The current syslog-ng.service file shipped in the contrib directory (contrib/systemd/syslog-ng.service) will break under recent systemd versions (with journal support) as systemd-kmsg-syslogd.service has been discontinued. Offending line: ... ExecStartPre=/bin/systemctl stop systemd-kmsg-syslogd.service ... Possible solutions: 1) remove the ExecStartPre line 2) prefix the command with a dash to avoid error checking Affected syslog-ng branches: branches >= 3.3 Fedora >= 17 current status: We have eliminated the offending line from the Fedora' syslog-ng.service file. More information: Bug 833551 - don't refer to systemd-kmsg-syslogd.service anymore https://bugzilla.redhat.com/show_bug.cgi?id=833551 /jpo -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 3

Forward slashes in QSTRING
by Michael Starks 22 Jun '12

22 Jun '12

Is it possible to use a / as a delimiter in QSTRING? The documentation seems to permit it, but my pattern doesn't work. Here's the pattern: <pattern>Alert Level: @NUMBER:i0:@; Rule: @NUMBER:i1:@ - @ESTRING:s0:;@ Location: @QSTRING:s1:()@ @IPv4:i2:@->syscheck; Integrity checksum changed for: @QSTRING:s4:/'@</pattern> And here's the string I want to match on: Alert Level: 7; Rule: 550 - Integrity checksum changed.; Location: (agentname) 172.16.0.1->syscheck; Integrity checksum changed for: '/etc/fstab' The idea is to extract only 'fstab' (without the quotes). I have also tried 0x2f in place of / with similar results, and various attempts at escaping it have failed. Thanks.

3 5