- syslog-ng - lists.balabit.hu

Current stable version
by Yu Watanabe 12 Apr '11

12 Apr '11

Hi all I would like to ask question about open source edition. Which version will be the current stable version? Thanks, Yu Watanabe

1 0

syslog-ng IPv6 problem ver 3.01
by Arya, Manish Kumar 10 Apr '11

10 Apr '11

I am getting syntax error on line udp6 or tcp6 in destination same works well as source in version 3.2.1 deb:/var/log# netstat -na | grep 514 tcp6 0 0 fd00:abcd:4321:2:20:514 :::* LISTEN udp6 0 0 fd00:abcd:4321:2:20:514 :::* here is my config for syslog client using syslog-ng 3.01 source s_local { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); udp(); }; destination ipv6_host { # udp6(ip(fd00:abcd:4321:2:20c:29ff:fea8:9671) port(514)); tcp6(ip(fd00:abcd:4321:2:20c:29ff:fea8:9671) port(514)); }; destination d_local { file("/var/log/messages"); }; log { source(s_local); destination(ipv6_host); destination(d_local); };

4 7

syslog-ng -s errors with catchall flag (1.6 to 3.1)
by Mishou Michael 09 Apr '11

09 Apr '11

Folks, I've done a lot of reading of the list archives through Google, but this is the first question that's really stumped me and also stumped the archives as well. I'm currently converting a 1.6 config to version 3.1, eliminating the warnings generated by -s and whatnot. One of the warnings I get is the following: Unknown log statement flag; flag='catchall' The configuration line this warning/error is referencing looks like this: log { source(network); destination(finalcatchall); destination(catchall_relay); flags(final,catchall); }; For some reason, the syslog-ng version I'm using doesn't like that flag option, but according to the 3.1 documentation, it is valid, as far as I can see. http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.1- guide-admin-en.html/index.html-single.html#logpath I tried removing the final flag (thinking perhaps it was redundant) and just leaving the catchall in, but the error persists. Here is the version information for the syslog-ng I'm using, perhaps it is a bug? I'm not quite sure how to search the bug database, if anyone could point me in the right direction it would be appreciated. # /usr/local/sbin/syslog-ng -V syslog-ng 3.1.2 Installer-Version: 3.1.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainli ne--3.1#master#8bf13c304b6ab5fc1a372b49d55c78370efe14ca Compile-Date: Oct 25 2010 23:56:18 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: on Enable-Sun-Door: on Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: off Enable-Pcre: on The version of syslog-ng I'm using is on Solaris 10 SPARC, pre-compiled packages I got from here: http://www.sunfreeware.com/programlistsparc10.html#syslogng If anyone has any ideas, please let me know. Thank you very much, --Mike

4 6

client -> server logging.. filters?
by Matt Wise 08 Apr '11

08 Apr '11

I'm doing some logging from clients -> servers via syslog-ng over a TCP session with stunnel. On my client, I'm seeing some log messages come in that are not making it to the server.. reliably. I don't have any filtering setup I don't think — is there some default setting somewhere that I don't know about that only passes certain types of messages to the remote dest? Do I need to specify somewhere 'send all'? Whats quite strange is that I have the hosts logging to 2 systems right now.. old syslog-ng server, and new one. The old one is getting all of the messages, but the new one is ignoring messages like these: Apr 8 18:21:43 xxx stunnel: LOG5[5459:1079724352]: Connection reset: 0 bytes sent to SSL, 0 bytes sent to socket It seems to get all other messages.. but messages that have that LOG5 or LOG3 or LOG7 appended to them seem to get lost in translation... any ideas? —Matt

2 2

Using macro substring as another macro
by Jakub Jankowski 08 Apr '11

08 Apr '11

Hi, I'd like to implement simple hashing in file() destination, mainly to avoid ext3 32k directories limit, but also for convenience. Is it possible to do something simliar what this shell snippet does: $ NAME=value $ echo ${NAME[*]:0:1} v $ but for macros (especially those coming from parsers)? What I want is logs written to /var/log/h/ho/hos/hostname/service.log (with configurable level of subdirs) using a single destination(). Regards, -- Jakub Jankowski|shasta@toxcorp.com|http://toxcorp.com/ GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D

3 6

syslog-ng and IPv6 Interface Binding
by Reuben Farrelly 08 Apr '11

08 Apr '11

Hi, I've recently upgraded from syslog-ng 3.1 to syslog-ng 3.2.2 and I'm having limited success with my modified config in getting syslog-ng to bind to only specific IPv6 IP addresses. At the moment I have this in my config: source net { tcp6( port(601) ); udp6( port(601) ); }; However I'd like to configure this slightly differently - namely to increase the maximum connections from 10 to 25 and also to bind to only certain IPv6 addresses, as the box has multiple. I was hoping for a config like this (IPv6 address truncated somewhat): source net { tcp6( ip(2001::20) port(601) max_connections(25) ); udp6( ip(2001::20) port(601) max_connections(25) ); }; But seems to be a no-go: ----- Error parsing afsocket, syntax error, unexpected LL_NUMBER, expecting LL_IDENTIFIER or LL_STRING in /etc/syslog-ng/syslog-ng.conf at line 32, column 18: tcp6( ip(2001::20) port(601) max_connections(25) ); ^^^^ ----- Neither the max_connections() NOR the ip() options are accepted nor is the use of localip() for IPv6. http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-gui… does not specifically mention if this command is meant to work under IPv6 or not, but it's reasonable I think to assume it would given the title of the page. Can someone please provide me with the relevant part of a working config in which I can specify the IPv6 interface address(es) I want syslog-ng to listen on, or have I run into a bug? The sample config files that ship with the package also seem a bit out of date, and the example at the bottom of s6.1.7 in the manual would be 100x more useful if it also included some IPv6 examples. Thanks, Reuben

4 5

stunnel through elb.. need packets sent semi-frequently
by Matt Wise 08 Apr '11

08 Apr '11

I'm using stunnel to pass some data through an Amazon ELB. Unfortunately, there are times when the session times out due to packets not passing for 60 seconds (an amazon ELB timeout). I'm wondering whether theres some way I can configure stunnel itself to pass some whitespaces or something back and forth every few seconds to make sure the session stays open and live? (and yes, I'm posing the same question to the app developer who's ap we're passing through.. but I'm looking at both avenues.. )

2 2

diskqueue framework patch
by Nagy Attila 08 Apr '11

08 Apr '11

Hi all, due to the need for disk queue usage in PE 4.1 we had to extend the syslog-ng sources, in order to be able write plugins that implement this feature. This patch contains these modifications. Basically it extends the 'class' hierarchy (and 'virtual' functions, see the new LogDestDriver) so that plugins can define their own queue mechanisms (as some do this in PE modules) and these special queues can be assigned to destinations. -Attila NAGY (syslog-ng-dev)

3 5

[Bug 118] New: syslog-ng -s errors with catchall flag (1.6 to 3.1)
by bugzilla＠bugzilla.balabit.com 07 Apr '11

07 Apr '11

https://bugzilla.balabit.com/show_bug.cgi?id=118 Summary: syslog-ng -s errors with catchall flag (1.6 to 3.1) Product: syslog-ng Version: unspecified Platform: Other OS/Version: Solaris Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: michael.mishou(a)csirc.irs.gov Type of the Report: bug Estimated Hours: 0.0 This is a bug report that is pretty much copied from the mailing list, verified by Gergely Nagy. I used this snapshot to find the bug: http://git.balabit.hu/?p=bazsi/syslog-ng-3.1.git;a=snapshot;h=8bf13c304b6ab… But Gergely reports that the problem exists in multiple 3.x version (and also likely 2.x versions as well). I was getting the error Unknown log statement flag; flag='catchall' when doing a 'syslog-ng -s -f FILE' on a 2.x configuration file using version 3.1.2 of syslog-ng. All the documentation (2.x and 3.x) refers to log path flags: catchall, fallback, final, flow-control. But in center.c the actual strcmp functions are looking for: catch-all, fallback, final, flow_control OR flow-control gint log_connection_lookup_flag(const gchar *flag) { if (strcmp(flag, "catch-all") == 0) return LC_CATCHALL; else if (strcmp(flag, "fallback") == 0) return LC_FALLBACK; else if (strcmp(flag, "final") == 0) return LC_FINAL; else if (strcmp(flag, "flow_control") == 0 || strcmp(flag, "flow-control") == 0) return LC_FLOW_CONTROL; msg_error("Unknown log statement flag", evt_tag_str("flag", flag), NULL); return 0; } I'm guessing it should probably be something like this instead: gint log_connection_lookup_flag(const gchar *flag) { if (strcmp(flag, "catch-all") == 0 || strcmp(flag, "catchall") == 0) return LC_CATCHALL; else if (strcmp(flag, "fallback") == 0) return LC_FALLBACK; else if (strcmp(flag, "final") == 0) return LC_FINAL; else if (strcmp(flag, "flow_control") == 0 || strcmp(flag, "flow-control") == 0) return LC_FLOW_CONTROL; msg_error("Unknown log statement flag", evt_tag_str("flag", flag), NULL); return 0; } Gergely's notes/recommendations for fix: It's the same in 3.2 and 3.3 too - good catch! Whether this is a documentation or code bug, if the docs say it's 'catchall' ever since 2.0, then the code should support that too, along with 'catch-all'. I'd say this is a bug in both: the documentation should be updated to say 'catch-all', which has been working in past versions, and the code should be updated to support what the documentation has been advertising in the past years. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Convert UTC to local time zone using syslog-ng
by Pramod Pillai 07 Apr '11

07 Apr '11

Hi I receive syslog from remote note with timezone set as UTC. I need to convert these timestamp to local time zone Can some one suggest how can i achive it. Regards Pramod

4 5