- syslog-ng - lists.balabit.hu

syslog-ng 3.3
by Peter Czanik 01 Feb '12

01 Feb '12

Hello, As syslog-ng 3.3 was released for a couple of months now, I'd like to know, if you already switched to this version. If you already use 3.3, please share your success story! Why did you upgrade (which feature)? Size of installation? Or any other info you find interesting. If you still use an earlier release, please let us know, what keeps you back from upgrading! Not yet available as a package for your platform? Something is broken, what previously worked? Something else? For those, who don't want to share their story with the rest of the world, you could still help our work by answering these questions in a private e-mail directly to me. And finally, here is a teaser for those, who did not upgrade yet: what's new in syslog-ng since 2.0: http://czanik.blogs.balabit.com/2012/02/whats-new-in-syslog-ng-3-x/ Thank you for your help, Bye, -- Peter Czanik (CzP)<czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

4 3

Receives multiple messages in one packet
by 大町靖 01 Feb '12

01 Feb '12

Hi experts, I want to receive multiple messages in one packet by using syslog-ng OSE. I checked the result after getting two messages in one packet. (The message format is that <PRI> Message1 \r\n<PRI> Message2\rn .) Message1 <PRI> Message2 I guess that syslog-ng recognize the first <PRI> as <PRI> ,though not recognise the second <PRI>. It recognized the second <PRI> message. If I want to fix this issue, what should I do. Please let me know. Thanks, Yasu

2 1

kernel logging feature requests
by Patrick H. 01 Feb '12

01 Feb '12

While setting up a new server at home I've come across 2 feature requests that would be fairly nice to have (and not that hard to implement I would think). 1) When the 'kernel' flag is set on a file() source (like for reading /proc/kmsg), look for the printk time (eg "[ 1234.567890]") and calculate when the message would have occurred instead of just using when the line was read off the file. Basically check to see the number of seconds the system has been up, subtract the printk time, and then subtract that from current time. 2) I grab all kernel messages with priority of crit or higher and send it to the usertty() destination, but this destination doesnt support templates. It'd be nice to be able to define the template. I mostly just want to change the time format and remove the hostname (since these will only come from localhost on my setup).

4 8

Relicensing syslog-ng man pages
by Fekete Robert 01 Feb '12

01 Feb '12

Hi, to make the syslog-ng manual pages more consistent with the source code and also to make the life of package maintainers a bit easier, we have relicensed the man pages of syslog-ng under the GPLv2 license. Bazsi will add source of the manual pages (docbook xml) to the syslog-ng source code as well. Please find attached the xml sources of the current man pages of syslog-ng OSE 3.3. I will also update the adminguide to include the relicensed man pages. Generating the man pages from the sources is relatively simple, just dump them into a directory and execute the following: (you need to have xsltproc and docbook-xsl installed, and might have to adjust the path for your environment) for i in *.xml; do xsltproc /usr/share/xml/docbook/stylesheet/docbook-xsl/manpages/docbook.xsl $i; done Sidenote: the syslog-ng.8 man page contained outdated information about chrooting syslog-ng, I have corrected that as well. Regards, Robert

2 1

afsql error
by Hery Fanomezantsoa 31 Jan '12

31 Jan '12

When I'm starting syslog-ng 3.3.1 I got an error saying an afsql error. I compiled it with libdbi and libdbi-drivers but when I do an ldd syslog-ng there is no libdbi found in the link. What's the matter?

2 5

feature request: owner/group/mode parameters for pipe sources
by Patrick Hemmer 30 Jan '12

30 Jan '12

Can we get the owner, group, and mode paramters for pipe sources? Docs say that syslog-ng will create the pipe starting from 3.0, but we cant cant control the permissions on it. Thanks -Patrick

2 2

ANN: syslog-ng 3.3 & 3.4 debian package news
by Gergely Nagy 30 Jan '12

30 Jan '12

Hi! I'd like to give a quick heads up regarding the syslog-ng deb packages I provide[1]: I recently pushed out a new version, 3.3.4.dfsg-1~mhp1, which is based on the 3.3.4 release, with one patch applied. It's available for all the usual Debian and Ubuntu platforms, except kfreebsd-*, see below. Based on my download logs, I'm the only user of the kfreebsd-* packages, and I only use them on one system: the buildd. So I'm going to drop those arches, and provide i386, amd64 and powerpc only. If I missed anyone, who'd like to have the kfreebsd debs around, please let me know, and I'll keep them around! For now, the older 3.3.3 packages are still available, but the newest 3.3.4 release has not been compiled for these two platforms, and unless there's at least one more user, I plan to remove kfreebsd-* from my repo during the next two weeks. Also, since syslog-ng 3.4 is starting to have interesting features that 3.3 does not, I plan to start offering debian packages for this version too, as soon as alpha1 is released (or perhaps earlier, if I grow too impatient). They will be available separately, and those of you who use my syslog-ng 3.3 packages won't get automatic upgrades to 3.4. Those who will want to try the 3.4 debs, the planned sources.list lines will follow this template: deb http://packages.madhouse-project.org/$VENDOR $RELEASE syslog-ng/experimental For example: deb http://packages.madhouse-project.org/debian squeeze syslog-ng/experimental Upgrades from 3.3 should be smooth and painless, at least I'll try my best. Also, if one would like to see any other architecture, release or perhaps even another derivative distribution supported, speak up, and I'll see what I can do! -- |8]

1 0

syslog-ng over Windows 2008 abort running
by pedro castro 30 Jan '12

30 Jan '12

Hi, I have syslog-ng running on Windows 2008 and it is working fine until it crash. The process stopped and it is not able to run againg This is the message i got. (process:2304): GLib-ERROR (recursed) **: /usr/src/ports-git/trunk/gnome/glib2.0/glib2.0-2.24.1-1/src/glib-2.24.1/glib/gmem.c:137: failed to allocate 352 bytes aborting... Any ideas?

2 3

Init scripts
by Chris Johnson 30 Jan '12

30 Jan '12

My apologies, I know this is probably a trivial question. I trying to install syslog-ng for the first time from source. It appears to install okay, but the config file and init scripts are not installed during install. I am running Ubuntu 11.10 and tried to copy the init files from the debian folder, but this does not launch when I run /etc/init.d/syslog-ng start. Is there something else I need to configure? Copying the wrong files? Any help is greatly appreciated. Chris

4 4

"Unable to initialize database access" error
by Justin Ryburn 29 Jan '12

29 Jan '12

For some reason I cannot seem to get my log messages to go to the mysql database. I get the following error when I attempt to start the syslog-ng service… jryburn@ryburn-server:/etc/syslog-ng$ sudo service syslog-ng restart * Stopping system logging syslog-ng ...done. * Starting system logging syslog-ng Unable to initialize database access (DBI); rc='-1', error='No such file or directory (2)' Error initializing dest driver; dest='d_mysql', id='d_mysql#0' Error initializing message pipeline; ...fail! The relevant pieces of syslog-ng.conf… source s_net { udp(); }; source s_tcp { tcp(ip(0.0.0.0) port(1999)); }; # Desitations for remote devices destination d_routers { file("/var/log/routers.log"); }; # Send logs to the mysql database destination d_mysql { sql( type(mysql) host("localhost") username("syslogadmin") password("syslogadmin") database("syslog") table("logs") columns("host", "facility", "priority", "level", "tag", "datetime", "program", "msg") values("$HOST_FROM", "$FACILITY", "$PRIORITY", "$LEVEL", "$TAG", "$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC", "$PROGRAM", "$MSG") indexes("host", "facility", "priority", "datetime", "program") ); }; log { source(s_net); source(s_tcp); destination(d_routers); destination(d_mysql); }; I have verified the username and password are correct and have access to the syslog database. If I remove the "d_mysql" destination, my log statement works correctly and the log files get dumped in to the /var/log/routers.log file just fine. I have gone through the documentation on the website, FAQs, etc. and come up empty. It has me stumped. Any help would be greatly appreciated. Thanks, -Justin

2 1