- syslog-ng - lists.balabit.hu

Followed files that grow while syslog-ng is reloaded
by Francois Durand 04 Jul '12

04 Jul '12

Hi list, I'm using syslog-ng (3.2.4) to follow some nginx log files using these directives: source s_nginx_logs { file("/path/to/nginx/access.log" flags(no-parse)); } When syslog-ng is reloaded, either for its own log files rotation or because a configuration update (which happens regularly when a new site is added), it does not see new data being written in followed files while it is reloading itself, and then complains about file size having changed and retransmit the whole file to my central log file collector. Here is the warning message: syslog-ng[24608]: The current log file has a mismatching size/inode information, restarting from the beginning; state='affile_sd_curpos(/path/to/nginx/access.log) stored_inode='139419', cur_file_inode='139419', stored_size='985114', cur_file_size='997815', raw_stream_pos='1995630' I don't see how to handle that correctly. Any idea ?

4 6

Error trying to restart service
by James McDonald 02 Jul '12

02 Jul '12

After the weekend I came in to run the checks on our logs and noticed nothing new had been written over the weekend, or at least since mid-night last night. When I tried to restart the service, I got an error saying that the "user; user=root" and "group; group=root" could not be verified. I am stuck in a meeting at the moment and was wondering if anyone could offer any advice on how to quickly resolve this, once I get back to my desk? Thanks, James McDonald System Administrator RHCSA, Security+ jmcdonald(a)lce.com

3 6

[Bug 168] New: Solaris 10 make failure after successful configure
by bugzilla＠bugzilla.balabit.com 02 Jul '12

02 Jul '12

https://bugzilla.balabit.com/show_bug.cgi?id=168 Summary: Solaris 10 make failure after successful configure Product: syslog-ng Version: 3.3.x Platform: Other OS/Version: Solaris Status: NEW Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: david.j.fenske(a)usps.gov Type of the Report: bug Estimated Hours: 0.0 1. Download, gunzip, and de-tar syslog-ng-3.3.4 2. PKG_CONFIG_PATH=/usr/local/lib/pkgconfig 3. LD_LIBRARY_PATH=/usr/local/lib 4. ./configure 5. make make all-recursive Making all in lib make: Fatal error in reader: Makefile, line 993: Unexpected end of line seen Current working directory /djftools/syslog/source/syslog-ng-3.3.4/lib *** Error code 1 The following command caused the error: fail= failcom='exit 1'; \ for f in x $MAKEFLAGS; do \ case $f in \ *=* | --[!k]*);; \ *k*) failcom='fail=yes';; \ esac; \ done; \ dot_seen=no; \ target=`echo all-recursive | sed s/-recursive//`; \ list='lib modules syslog-ng scripts tests doc contrib scl debian tgz2build build'; for subdir in $list; do \ echo "Making $target in $subdir"; \ if test "$subdir" = "."; then \ dot_seen=yes; \ local_target="$target-am"; \ else \ local_target="$target"; \ fi; \ (CDPATH="${ZSH_VERSION+.}:" && cd $subdir && make $local_target) \ || eval $failcom; \ done; \ if test "$dot_seen" = "no"; then \ make "$target-am" || exit 1; \ fi; test -z "$fail" make: Fatal error: Command failed for target `all-recursive' Current working directory /djftools/syslog/source/syslog-ng-3.3.4 *** Error code 1 make: Fatal error: Command failed for target `all' -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 10

Re: [syslog-ng] syslog_ng 3.3.4 make error on HPUX HPPA 11.11
by Rakesh Rajasekharan 02 Jul '12

02 Jul '12

Hello Pal, I do not have all of the patches you listed out , installed on my mahcine. I still, tried to compile it with the other suggestion you had put forward but. still was stuck with the same error. I am trying these patches installed and will give it a try thereafer. Will keep you posted. Thanks, Rakesh. On Fri, Jun 1, 2012 at 3:06 AM, Pal Tamas <folti(a)balabit.hu> wrote: > On Thu, May 31, 2012 at 02:13:28PM +0530, Rakesh Rajasekharan wrote: > > Hello Pal, > > > > I was able to get the PHCO_33282 patch and applied it on my 11.11 > machine. > > PHCO_37940 is fo rthe 11.23 HPUX versions hence can't install that. > > > > # swlist -a patch_state *,c=patch |grep PHCO_33282 > > # PHCO_33282 > > PHCO_33282.C-MIN-32ALIB applied > > PHCO_33282.C-MIN-64ALIB applied > > PHCO_33282.CORE-64SLIB applied > > PHCO_33282.CORE-SHLIBS applied > > PHCO_33282.PAUX-ENG-A-MAN applied > > # > > But, even after applying this, I still get the same errors regarding > pthread. > > > > I am curious to know if I should actually be compiling on this 11.11 > machine at > > the first place. > > I mean, is the syslog-ng 3.3.4 compatible with the 11.11 version. The > previous > > version that I was using on this machine is 3.0.7. > > Is there a place I can check the compatible OS's . > Hi, > > dug into the problem a bit more, syslog-ng OSE 3.3 (probably 3.4 too) > needs some porting work before it can be compiled under HP-UX. The > underlying problem is that syslog-ng has been re-written to be > multi-threaded, modular application in 3.2, from it's original single > threaded monolithic architecure. The rewrite added new dependencies > (ivykis) and other required features from the compilers > (Thread-local storage support), which made porting to older systems a > challenge, although the work has been already done, but not every piece > has been added to syslog-ng OSE from the PE branch and not publicly > documented. > > What I managed to solve for now: > - need the following patches: > PHCO_24402 1.0 libc cumulative header file > patch > PHCO_38279 1.0 libc cumulative patch > PHKL_31918 1.0 fsadm;ACL;locking order;8K > mount;readdir > PHSS_30049 1.0 ld(1) and linker tools > cumulative patch > > - download and install GCC for HPUX[1] and make sure it's location > (/opt/hp-gcc/bin) is in PATH, prepeding every other gcc location you > have. > > - edit configure.in and remove all occurences of -Wl,-whole-archive and > -Wl,-no-whole-archive and regenerate configure with autoconf 2.68. If you > don't have autoconf 2.68, edit directly configure and remove the > strings. > > - add the following to lib/compat.h: > #ifndef CLOCK_MONOTONIC > #define CLOCK_MONOTONIC CLOCK_REALTIME > #endif > > - cd lib/ivykis and compile, build and install the bundled ivykis by hand. > > - re-run your configure command with the following options added: > --with-ivykis=system --disable-mongodb > > Hopefully it compiles properly, but I too tired to check it now. > Good luck, > > [1]: > http://h21007.www2.hp.com/portal/site/dspp/menuitem.863c3e4cbcdc3f3515b49c1… > -- > Pal Tamas/Folti > folti(a)balabit.hu > >

2 2

[Bug 185] New: Use upstream ivykis (>= 0.30) instead of a fork
by bugzilla＠bugzilla.balabit.com 01 Jul '12

01 Jul '12

https://bugzilla.balabit.com/show_bug.cgi?id=185 Summary: Use upstream ivykis (>= 0.30) instead of a fork Product: syslog-ng Version: 3.3.x Platform: All OS/Version: All Status: ASSIGNED Severity: blocker Priority: unspecified Component: syslog-ng AssignedTo: algernon(a)balabit.hu ReportedBy: algernon(a)balabit.hu Type of the Report: enhancement Estimated Hours: 0.0 With upstream ivykis 0.30 having everything the syslog-ng internal fork had, and more, it's time to drop the fork, and compile with upstream ivykis as-is. This would mean that the embedded copy (which we will still ship) is replaced by ivykis 0.30, and syslog-ng will become compileable against upstream ivykis. The bulk of the work is already done on my feature/3.3/ivykis-upstream branch, only a few issues remain (see below) before this can be merged to 3.3 master, and this bug report is here to keep track of progress. While trying to merge the branch, I conducted a series of tests, and it appears that somewhere along the way the file destination broke (and most likely everything else that is based on logwriter), and it deadlocks. I do not yet know why, but this feature can't be merged until this problem is solved. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 13

make error syslog-ng 3.3.4 AIX 5.2
by Rakesh Rajasekharan 29 Jun '12

29 Jun '12

I am getting an error during the make stage for syslog-ng 3.3.4. complaining about libiconv. I have compiled libiconv and the library is available under /usr/local/lib # ls -ltr /usr/local/lib/libiconv* -rw-r--r-- 1 root system 890 Jun 17 23:35 /usr/local/lib/ libiconv.la -rw-r--r-- 1 root system 1724284 Jun 17 23:35 /usr/local/lib/libiconv.a ykis-modules.a -lc -Wl,-bnoentry -O2 -pthread -Wl,-brtl -pthread -Wl,--whole-archive -Wl,--no-whole-archive -pthread -Wl,-bE:.libs/libsyslog-ng.exp -Wl,-bernotok /usr/local/lib/libglib-2.0.a(gconvert.o):gconvert.c:(.pr+0x12c): undefined reference to `.libiconv_open' /usr/local/lib/libglib-2.0.a(gconvert.o):gconvert.c:(.pr+0x358): undefined reference to `.libiconv' /usr/local/lib/libglib-2.0.a(gconvert.o):gconvert.c:(.pr+0x39c): undefined reference to `.libiconv_close' collect2: ld returned 1 exit status The compilaiton of glib was fine but not sure why the make fails. Below is my configure options. ./configure --enable-dynamic-linking --prefix=/opt/soe/local/syslog-ng-3.3.4 \ --with-ld-library-path=/opt/soe/local/syslog-ng-3.3.4/lib \ --libdir=/opt/soe/local/syslog-ng-3.3.4/lib --enable-mongodb=no -with-libmongo-client=no Any valuable inputs on this please? Thanks , Rakesh.

4 6

syslog-ng 3.2.5 HPUX 11.11 /usr/ccs/bin/ld: Unsatisfied symbols:
by Divya Vikraman 29 Jun '12

29 Jun '12

Hello, I ma compiling syslog-ng 3.2.5 version on an HPUX 11.11 hppa machine.But, in the make stage , I get the below error. libtool: link: gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -o .libs/pdbtool pdbtool-pdbtool.o -Wl,-E -L/opt/soe/local/syslog-ng-3.2.5/lib:/opt/soe/local/syslog-ng-3.2.5/eventlog/lib libsyslog-ng-patterndb.a -L../../lib/.libs -lsyslog-ng -lcl -L/usr/local/lib -L/opt/soe/local/syslog-ng-3.2.5/eventlog/lib -lrt -lnsl -lgmodule-2.0 -lglib-2.0 -lintl -liconv -levtlog -lpcre -ltermcap -Wl,+b -Wl,/compile/syslog/syslog-ng-3.2.5/lib/.libs:/usr/local/lib:/opt/soe/local/syslog-ng-3.2.5/lib /usr/ccs/bin/ld: Unsatisfied symbols: evt_tag_long (first referenced in libsyslog-ng-patterndb.a(libsyslog_ng_patterndb_a-patterndb.o)) (code) collect2: ld returned 1 exit status make[5]: *** [pdbtool] Error 1 make[5]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/compile/syslog/syslog-ng-3.2.5/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/compile/syslog/syslog-ng-3.2.5' make: *** [all] Error 2 I have compiled eventlog -0.2.12 wiht the following ooptions. ./configure --prefix=/opt/soe/local/syslog-ng-3.2.5/eventlog and have also set the PKG_CONFIG_PATH correclty PKG_CONFIG_PATH=/opt/soe/local/syslog-ng-3.2.5/eventlog/lib/pkgconfig:/usr/local/lib/pkgconfig and in the Makefile i have EVTLOG_CFLAGS = -I/opt/soe/local/syslog-ng-3.2.5/eventlog/include/eventlog EVTLOG_LIBS = -L/opt/soe/local/syslog-ng-3.2.5/eventlog/lib -levtlog Can someone pleas help me out to fix this. Thanks, Divya.

2 1

syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 29 Jun '12

29 Jun '12

Hi all, Can somebody unblock us in the below issue.? Thanks Hithendra From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of ext anju.raveendrannair(a)wipro.com Sent: Friday, June 08, 2012 5:16 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng] syslog-ng-3.4.0alpha2 syslog-ng binary failure forserver instance. Hi, We are using syslog-ng-3.4.0alpha2 binary and trying to run the syslog-ng server configuration file, but its not starting the syslog ng server. We are getting the following error incase of f__nonconsole_access filter when we ran the syslog-ng binary in debug mode. Filter rule evaluation result; result='match', rule='f_nonconsole_access', location='/ne_data/conf/syslogng/syslog-ng_server.conf:58:29' ** ERROR:logmsg.c:535:log_msg_set_value_indirect: assertion failed: (!log_msg_is_write_protected(self)) Abort (core dumped) PFA the debug.log The server conf is having the following line for the above mentioned filter, template ltemgr_msg_template { template("$S_ISODATE $HOST $FACILITY_NUM/$LEVEL_NUM $MSG\n"); }; #To strip of the msg_id introduced by syslogd rewrite rw_msg{subst("\\[.*\\] <file:///\\[.*\%5d> ", "", value("MESSAGE"));}; source s_LTEMGR_SYSLOG_CLIENTS{ tcp (ip (27.132.98.69) port(6515) max-connections(4) tls( key_file("/ne_data/conf/certificates/MOCM/MOCM_key.pem") cert_file("/ne_data/conf/certificates/MOCM/MOCM_SB_server.pem") ca_dir("/ne_data/conf/certificates/SYSLOGNG") cipher_suite("ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM:!SS Lv2") peer_verify(optional-untrusted) ) ); }; ....... destination d_ltemgr_nonconsoleaccess_log {file("/ne_data/syslog/ems" perm(0644) template(ltemgr_msg_template)); }; ...... filter f_nonconsole_access { level(info..notice) and facility(auth) and ( match("Accepted password for" value("MESSAGE")) or match("Failed password for" value("MESSAGE")) ); }; ..... log { source(s_LTEMGR_SYSLOG_CLIENTS); filter(f_nonconsole_access); rewrite(rw_msg); destination(d_ltemgr_nonconsoleaccess_log); }; Without debug mode, we were able to run the server but central logging is not happening when tried with logger command. Thanks, Anju Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

2 1

Re: [syslog-ng] issue with rewrite. Please help.
by Balla, Hithendra (EXT-Other - IN/Bangalore) 29 Jun '12

29 Jun '12

Hi Balint, Thanks for the reply. I tried the below rewrite rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; It works for auth.info, but it does not work with local7.info or local6.info as the regex does not handle numerals in the facility field. I tried changing it as follows (i.e. added [0-9] before .)., but with this, this dumps core. Addition of any numeral in this position results in a core dump subst("\[ID [0-9]* [a-z]*[0-9]\.[a-z]*\]\ " "" value("MESSAGE") We have tried the following. logger -p local7.info "HELLO|KUAAA" --> Did not work logger -p local6.info "HELLO|KUAAA" --> Did not work logger -p auth.info "Accepted password for root" --> Worked. Thanks Hithendra -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu on behalf of ext Balint Kovacs Sent: Fri 6/15/2012 10:26 PM To: syslog-ng(a)lists.balabit.hu Subject: Re: [syslog-ng] issue with rewrite. Please help. Hi Hithendra, I came across this problem just recently, I guess that you want to handle Solaris logs with the standard Unix analysis ruleset, but the these tags are in the way. The only difference is, that I moved the tag to the end of the message (as patterndb does prefix matching, these don't bother my patterns but are still there). My rewrite rule is the following: rewrite r_solaris { #move the solaris header to the end of the message #to work with linux patterndb subst("(\[ID [0-9]* [a-z]*\.[a-z]*\])\ " "" value("MESSAGE") type("pcre") flags(store-matches)); subst("$" " $1" value("MESSAGE") type("pcre")); }; If you don't want to move it (backreferencing is quite slow and resource-intensive), you could just use this untested version: rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); }; HTH, Balint On 06/15/2012 05:39 AM, Balla, Hithendra (EXT-Other - IN/Bangalore) wrote: > > Hi all, > > We have the followinglog > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6*[ID 800047 > auth.info]*Accepted publickey for xyz > > We wanted to replace*[ID 800047 auth.info]*with*empty > string*(i.e."")and print the following > > 2012-06-15T09:00:26+05:30 kddi-cm-1-sb 4/6 Accepted publickey for xyz > > So we have used the below re-write with subst. But this is not > workingin*syslog-ng 3.4.0alpha2*. > > rewrite rw_msg{*subst*("\\[.*\\]", "", value("MESSAGE"));}; > > Can somebody help out here? > > Thanks > > Hithendra > > > > ________________________________________________________________________ ______ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.balabit.com/wiki/syslog-ng-faq >

2 1

Re: [syslog-ng] Include doesn't work
by Jakub Prokeš 29 Jun '12

29 Jun '12

Hi! > Include files are only snippets and not full configs, so as such they can not have the @version line in them. I removed version info from snippet, but syntax error is still here. [root@logger:~]# syslog-ng -s -d Adding include file; filename='001-sample.conf' Starting to read include file; filename='/etc/syslog-ng/syslog-ng.conf.d/001-sample.conf', depth='1' syntax error in /etc/syslog-ng/syslog-ng.conf.d/001-sample.conf at line 7. At line 7 start this section: destitation d_messages_sample { file("/home/sample/var/$HOST/messages/$YEAR$MONTH$DAY.log"); }; Is there some kind of list available directives in sniplets? Regards, -- Jakub Prokes Senior Linux Administrator m: podpora(a)superhosting.cz w: www.superhosting.cz | www.datacamp.sk [CZ]: +420 296 826 296 | Na Safrance 33, Praha 10 - Vinohrady [SK]: +421 (2) 2025 6256 | Bozeny Nemcovej 8, Bratislava

4 4