- syslog-ng - lists.balabit.hu

[Bug 135] New: pipe() source missing follow_freq() option
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=135 Summary: pipe() source missing follow_freq() option Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: bugzilla.syslogng(a)feystorm.net Type of the Report: --- Estimated Hours: 0.0 According to the 3.2 documentation, the pipe() source is supposed to support the follow_freq() option. However attempting to use it results in an error: Error parsing affile, syntax error, unexpected KW_FOLLOW_FREQ, expecting ')' Looking at the current source tree in git, the option is not allowed in the configuration syntax. http://git.balabit.hu/?p=bazsi/syslog-ng-3.2.git;a=blob;f=modules/affile/af… -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

3 4

syslog-ng in books
by Peter Czanik 28 Sep '11

28 Sep '11

Hello, I just updated the list of book mentioning syslog-ng. For a list of recently found books check my blog at https://czanik.blogs.balabit.com/2011/09/syslog-ng-in-books/ If you learn about any other books not listed by us, and writing about syslog-ng in detail, please let us know, so we can update our list. Also, if you write an interesting blog, article, etc. about syslog-ng, please don't hesitate publishing at least a link about it here in the mailing list. For example there was a great blog series posted by Monitis at http://blog.monitis.com/index.php/tag/syslog-ng/ Bye, -- Peter Czanik (CzP) <czanik(a)balabit.hu> BalaBit IT Security / syslog-ng upstream http://czanik.blogs.balabit.com/

1 0

Memory Growth in syslog-ng
by Pramod Pillai 28 Sep '11

28 Sep '11

Hi I am using syslog-ng 3.1.2 . I am observing that memory is growing approximately 64 MB, every 6 or 7 hours. The growth is consistent. Is this a known issue . Any patch available to fix it. sh-3.00# ./syslog-ng -V syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Oct 25 2010 23:56:18 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: on Enable-Sun-Door: on Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on

3 3

Reading from standard input
by Remy Zandwijk 28 Sep '11

28 Sep '11

Hi list, I use syslog-ng to create log files from within a script. The script sends the message through a pipe to syslog-ng, which I use as command line tool. In the syslog-ng.conf I created a source which reads the standard input. very simplified: Config: source src { pipe("/dev/fd/0"); }; destination dst { file("/tmp/test.log"); }; log { source(src); destination(dst); }; Called as: echo "test" | /usr/sbin/syslog-ng -f /tmp/syslog-ng.conf This works perfectly in 2.0.9. Now I am in the process of upgrading the system and syslog-ng 3.2.4. With this version of syslog-ng the config file above results in an error: Error opening file for reading; filename='/dev/fd/0', error='Text file busy (26)' Error initializing source driver; source='src', id='src#0' Error initializing message pipeline; I tried several things to get rid of this error, like replacing 'pipe' in 'file', but nothing seems to work. Any ideas? Regards, Remy

2 3

Re: [syslog-ng] log file size limit
by Sergei Zhirikov 28 Sep '11

28 Sep '11

On 2011-07-25 17:50, William Tambellini wrote: > Dear Syslog-ng team, > > We are currently evaluating syslog-ng in order to satisfy some requests from our customers regarding logs from our software. > One of their requests is to limit log file size using some kind of rotation algo : if size > 6Mo then rotate to another file. > We have found some options in file destination like fifo buffer control but nothing about files rotation. > Is there anything for that kind of feature ? > I have a patch that does something of that kind. When the log file grows above certain size syslog-ng switches to a new one and renames the old one. Further processing (such as compression) should be done externally. I posted that patch in this list quite some time ago, but as far as I can tell, it went unnoticed... -- Sergei.

4 7

Re: [syslog-ng] How to send tracebacks through syslog-ng? (Jakub Jankowski)
by Luis Pugoy 28 Sep '11

28 Sep '11

> > Message: 4 > Date: Sat, 24 Sep 2011 09:31:34 +0200 (CEST) > From: Jakub Jankowski <shasta(a)toxcorp.com> > Subject: Re: [syslog-ng] How to send tracebacks through syslog-ng? > To: Syslog-ng users' and developers' mailing list > <syslog-ng(a)lists.balabit.hu> > Message-ID: <alpine.LNX.2.00.1109240928240.15891(a)bluzg.slackware.pl> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > On 2011-09-24, Luis Pugoy wrote: > > > rewrite r_rewrite_subst { subst("a*", "?", value("MESSAGE") type("pcre") > > flags("utf8" "global")); }; > > > > I thought that it would replace 0 or more occurrences of 'a' with a > question > > mark. However, when the input is 'a', the output becomes 'a?'. It just > > appends a question mark at the end. 'aa' also becomes 'aa?'. What is > weirder > > still is that even if the input does not contain 'a', the question mark > is > > still appended. So '1' becomes '1?'. > > Well, does "1" match /a*/ ? :) > It doesn't make any difference if that's /a*/, /b*/ or /.*/ - this kind of > regexp matches everything, even an empty string. > > HTH > > -- > Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ > GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D Hello Jakub. Thanks for the reply. You're right in that "1" matches /a*/, but wouldn't the resulting replacement be "?" instead of "1?" ? Also, if I just use /a/ and use "a" as input, it does not seem to match. The text is still outputted as "a". >

2 2

[Bug 134] New: AIX syslog message not parsed correctly for hostname
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=134 Summary: AIX syslog message not parsed correctly for hostname Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: critical Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: ericduda(a)yahoo.com Type of the Report: bug Estimated Hours: 0.0 U 1.1.1.1:32768 -> 2.2.2.2:514 <38>Sep 22 10:1 1:56 Message fo rwarded from cd aix66: sshd[67 9960]: Accepted publickey for nagios from 1. 9.1.1 port 4 2096 ssh2 This is AIX forwarded. The hostname (in the example, cdaix66) is not parsed correctly, and put into macro $HOST What you end up with is "1.1.1.1", which is not right, it should parse out "cdaix66". I'm running syslog-ng on rhel5. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 6

[PATCH] afmongodb: Print the collection name upon init.
by Gergely Nagy 28 Sep '11

28 Sep '11

When initializing a mongodb destination, include the collection name in the logged message too. Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- modules/afmongodb/afmongodb.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/modules/afmongodb/afmongodb.c b/modules/afmongodb/afmongodb.c index 0f01f05..4bf17a9 100644 --- a/modules/afmongodb/afmongodb.c +++ b/modules/afmongodb/afmongodb.c @@ -435,6 +435,7 @@ afmongodb_dd_init(LogPipe *s) evt_tag_str("host", self->host), evt_tag_int("port", self->port), evt_tag_str("database", self->db), + evt_tag_str("collection", self->coll), NULL); self->queue = log_dest_driver_acquire_queue(&self->super, afmongodb_dd_format_persist_name(self)); -- 1.7.5.4

2 1

[PATCH] configure.in: Fix --without-compile-date.
by Gergely Nagy 28 Sep '11

28 Sep '11

The option forgot to properly set the supplied value, and thus, always resulted in compile date being enabled. This patch corrects that. Reported-By: Peter Czanik <czanik(a)balabit.hu> Signed-off-by: Gergely Nagy <algernon(a)balabit.hu> --- configure.in | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/configure.in b/configure.in index 36da2c0..2efc397 100644 --- a/configure.in +++ b/configure.in @@ -187,7 +187,8 @@ AC_ARG_ENABLE(systemd, AC_ARG_WITH(compile-date, [ --without-compile-date Do not include the compile date in the binary] - ,, wcmp_date="1") + ,wcmp_date="${withval}", wcmp_date="yes") + if test "x$wcmp_date" != "xno"; then wcmp_date="1" else -- 1.7.5.4

2 1

[Bug 14] New: Maintain symlinks to current and previous log output files...
by bugzilla＠bugzilla.balabit.com 28 Sep '11

28 Sep '11

https://bugzilla.balabit.com/show_bug.cgi?id=14 Summary: Maintain symlinks to current and previous log output files... Product: syslog-ng Version: 2.0.x Platform: PC URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=218688 OS/Version: Linux Status: NEW Severity: minor Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: sasa(a)debian.org Type of the Report: enhancement Estimated Hours: 0.0 >From bugs.debian.org: I'm hoping that upstream might consider adding functionality to syslog-ng to allow it to track current and previous log files and maintain symlinks to them, as a user option. This replicates one of the options that I (and others) find useful in cronolog. This has been previously discussed on the syslog-ng mailing list, though apparently nothing fully came of it. The archive of that discussion is at: https://lists.balabit.hu/pipermail/syslog-ng/2002-June/003452.html Obviously, it's probably somewhat of a low priority, but it would be nice. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1