- syslog-ng - lists.balabit.hu

[Bug 122] New: [3.2.4]: mixed linking broken for libsyslog-ng.so.*
by bugzilla＠bugzilla.balabit.com 04 Jun '11

04 Jun '11

https://bugzilla.balabit.com/show_bug.cgi?id=122 Summary: [3.2.4]: mixed linking broken for libsyslog-ng.so.* Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: --- Estimated Hours: 0.0 libsyslog-ng.so.* library uses glib, eventlib and libcap symbols but doesn't link with these: Undefined symbols: $ objdump -T ./lib/.libs/libsyslog-ng.so.0.0.0 | grep U | wc -l 297 -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[PATCH] check: run the sql functional test case if sql is available on the system
by Juhasz Viktor 04 Jun '11

04 Jun '11

2 1

Syslog-ng error while using TSL
by Pramod Pillai 04 Jun '11

04 Jun '11

Hi I am getting following error while trying to configure TSL in syslogng Error On Client Certificate validation failed; subject='C=IN, ST=KAR, O=orola, CN=12.168.50.192, emailAddress=a(a)d.com', issuer='C=Generic, ST=Generic, O=Generic, CN=Generic_Int_CA_1', error='unable to get local issuer certificate', depth='0' SSL error while writing stream; tls_error='SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed' I/O error occurred while writing; fd='4', error='Broken pipe (32)' Syslog connection broken; fd='4', server='AF_INET(10.232.165.128:5695)', time_reopen='60' Error on Server SSL error while reading stream; tls_error='SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca' Regards Pramod

4 8

issues with syslog-ng install of new version or running older version on mac osX 10.6.7
by Frank Scalzo 04 Jun '11

04 Jun '11

I have tried the dmz installed it still not logging i am tryng to upgrade to version 3.2.4 from 3.0.8 to see if that might fix my issue I have installed eventlog 2.12 but when i try to do my config it still says i have event log 2.0.9 just to see if i could bypass it I changed the the min eventlog to the version it says i have in the configure file do a config no problem but now fail on the make with mv:rename .deps/misc.tpo .deps/misc.plo no such file or dir make [3]: *** [misc.lo] error 1 make [2]: *** [all] error 2 make [1]: *** [all-recursive] error 1 make: *** [all] error 2 all done in SU if i could get the other version to log I would be good and until i prove it works for us i can not tell them i want the pe version

2 1

Re: [syslog-ng] Fwd: Re: Question
by Gergely Nagy 04 Jun '11

04 Jun '11

Copying this to the syslog-ng@ list aswell, as this might be interesting to others aswell, and the patch should be picked up for 3.3 too. > On 2011-06-01 17:20, Costa Farber wrote: >> Hello. >> >> I use syslog-ng 3.3 beta. It was working up today perfect. Today I >> got the following result: >> my config >> */source s_network { >> udp(); >> tcp(); >> }; >> destination d_local_prospero { >> file("/var/log/messages_prospero" >> template("$ISODATE#$HOST#$MSGONLY\n") ); >> }; >> log { >> source(s_network); >> destination(d_local_prospero); >> };/* >> >> source message is >> /*Jun 1 17:50:11 ubnct lighttpd-1.5[24730]: DEBUG >> wix.c:send_wixfs_file:345 will send file: >> /var/www/static.wix.com/media/3d/44/3d4433_34a5623f12940907668b5ee9b72d23a3.jpg_600 >> <http://static.wix.com/media/3d/44/3d4433_34a5623f12940907668b5ee9b72d23a3.j…>*/ >> >> result is >> /*2011-06-01T17:50:03+03:00#ubnct# 1 17:50:11 ubnct >> lighttpd-1.5[24730]: DEBUG wix.c:send_wixfs_file:345 will send file: >> /var/www/static.wix.com/media/3d/44/3d4433_34a5623f12940907668b5ee9b72d23a3.jpg_600 >> <http://static.wix.com/media/3d/44/3d4433_34a5623f12940907668b5ee9b72d23a3.j…>*/ >> >> It seems like parser has a bug and can not pars one digit day (it >> has 2 spaces between month and day). >> I need help to clear is it bug or any ather problem. This is a known problem, but for some reason the fix did not make it into 3.3 yet. Attached is a patch that fixes the problem. -- |8]

2 1

Re: [syslog-ng] syslog-ng Digest, Vol 73, Issue 37
by Frank Scalzo 04 Jun '11

04 Jun '11

Gergely, sorry after fighting with this for hours i forgot to upload. @version: 3.0 # # Syslog-ng example configuration for for Debian GNU/Linux # # Copyright (c) 1999 anonymous # Copyright (c) 1999 Balazs Scheidler # $Id: syslog-ng.conf.sample,v 1.3 2003/05/20 08:57:27 asd Exp $ # # Syslog-ng configuration file, compatible with default Debian syslogd # installation. # # replaced with Line below fxs options { long_hostnames(off); sync(0); }; options { long_hostnames(off); flush_lines(0); }; source src { unix-stream("/var/run/syslog"); internal(); }; source net { udp(); }; destination authlog { file("/var/log/auth.log"); }; # replaced with Line below fxs destination syslog { file("/var/log/syslog"); }; destination d_syslog { file(“/var/log/system.log”); }; destination cron { file("/var/log/cron.log"); }; destination daemon { file("/var/log/daemon.log"); }; destination kern { file("/var/log/kern.log"); }; destination lpr { file("/var/log/lpr.log"); }; destination user { file("/var/log/user.log"); }; destination uucp { file("/var/log/uucp.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination mail { file("/var/log/mail.log"); }; destination mailinfo { file("/var/log/mail.info"); }; destination mailwarn { file("/var/log/mail.warn"); }; destination mailerr { file("/var/log/mail.err"); }; destination newscrit { file("/var/log/news/news.crit"); }; destination newserr { file("/var/log/news/news.err"); }; destination newsnotice { file("/var/log/news/news.notice"); }; destination debug { file("/var/log/debug"); }; destination messages { file("/var/log/messages"); }; destination console { usertty("root"); }; #destination console_all { file("/dev/tty12"); }; destination console_all { file(“/dev/console”); }; #destination loghost { udp("loghost" port(999)); }; destination xconsole { pipe("/dev/xconsole"); }; filter f_auth { facility(auth); }; filter f_authpriv { facility(auth, authpriv); }; #Changed it to make it filter the messages from the localO fxs filter f_syslog { not facility(authpriv, mail); }; filter f_syslog { facility(local0); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(cron); }; filter f_ppp { facility(local2); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info..warn) and not facility(auth, authpriv, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; log { source(src); filter(f_authpriv); destination(authlog); }; # replaced with Line below fxs log { source(src); filter(f_syslog); destination(syslog); }; log { source(src); filter(f_syslog); destination(d_syslog); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; log { source(src); filter(f_debug); destination(debug); }; log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; log { source(src); filter(f_ppp); destination(ppp); }; log { source(src); destination(console_all); };

3 2

[Fw: keep_hostname (yes); and source file]
by Steven Blatchford 04 Jun '11

04 Jun '11

There seems to be no hostname associated with file() so it uses the first word of the message. The first word of the log message is 'DEBUG'. On the central log server I added 'DEBUG' to the filter host and it worked. Is there a way to set the hostname when the source uses file() ? -steve ----- Forwarded message from Steven Blatchford <sblatchford(a)gmail.com> ----- >From: Steven Blatchford <sblatchford(a)gmail.com> >Subject: keep_hostname (yes); and source file >To: syslog-ng(a)lists.balabit.hu >Date: Fri, 27 May 2011 18:29:41 -0400 > >Hello, > >I have a file, /srv/http/foo/var/log/system.log that I would like sent >to our central log. This config was not working: > > @version: 3.0 > # > # /etc/syslog-ng.conf > # > > options { > stats_freq (0); > flush_lines (0); > time_reopen (10); > log_fifo_size (1000); > long_hostnames(off); > use_dns (no); > use_fqdn (no); > create_dirs (no); > keep_hostname (yes); > perm(0640); > group("log"); > }; > > source s_foo { file("/srv/http/foo/var/log/system.log"); }; > > log { source(s_foo); destination(d_net); }; > > destination d_net { udp("host.org"); }; > >It does work if I comment out 'keep_hostname (yes);'. Can someone >explain to me why this is? > >-steve ----- End forwarded message -----

2 1

Syslog-ng timestamp problem
by Tamas Szklenar 03 Jun '11

03 Jun '11

Hi, I configured a syslog-ng server and several clients for testing and it is working great, my only problem is with the timestamp() option. We have a lot of computer in different time zones and I would like to set up the system to keep the messages time stamps. Here is the config for the syslog-ng server: options { flush_lines(5); flush_timeout(1000); time_reopen(10); log_fifo_size(1000); long_hostnames(off); use_dns(yes); dns_cache_hosts(/etc/hosts); use_fqdn(no); create_dirs(yes); dir_perm(0700); keep_hostname(yes); keep_timestamp(yes); stats_freq(0); }; Is there something else what I have to whit this? Thanks for your help! Tamas

2 2

[git] 3.3 tree rebased
by Balazs Scheidler 03 Jun '11

03 Jun '11

Hi, I've rebased my git tree yesterday, to clean up some commit issues I made while in a hurry in the last days. And here's a question for those who use the git tree: are you bothered with rebases? I mean I know it can disrupt things a bit, but I feel the added benefit for a clean(er) history is worth the trouble. If it is indeed a problem for people then I'll refrain from rebasing in the future. Opinions? -- Bazsi

2 1

Re: [syslog-ng] libdbi too old?
by Len Conrad 02 Jun '11

02 Jun '11

---------- Original Message ---------------------------------- From: "Len Conrad" <lconrad(a)Go2France.com> Reply-To: lconrad(a)Go2France.com,Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Date: Thu, 2 Jun 2011 15:59:04 +0200 >OK. > >one of your msgs had the right IP and that's what I used at work just now. I'll see if it works from home. ========== Sorry. My webmail showed me one msg, when I replied it sent to this list.

1 0