- syslog-ng - lists.balabit.hu

[Bug 98] New: GLIB_MIN_VERSION should be 2.13.5, not 2.10.1
by bugzilla＠bugzilla.balabit.com 03 Dec '10

03 Dec '10

https://bugzilla.balabit.com/show_bug.cgi?id=98 Summary: GLIB_MIN_VERSION should be 2.13.5, not 2.10.1 Product: syslog-ng Version: 3.2.x Platform: PC URL: http://git.gnome.org/browse/glib/tree/NEWS?id=GLIB_2_13_ 5#n27 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: owen.mann(a)interactivedata.com Type of the Report: bug Estimated Hours: 0.0 When building on a RHEL5 box (glib2-2.12.3-4.el5_3.1), I get: [...] libtool: link: gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -o .libs/pdbtool pdbtool-pdbtool.o pdbtool-patternize.o -Wl,--export-dynamic ../../lib/.libs/libsyslog-ng.so ./.libs/libdbparser.so -L/usr/kerberos/lib64 -lssl -lcrypto -lz -lrt -lnsl -L/lib64 -lgmodule-2.0 -ldl -lglib-2.0 /usr/lib64/libevtlog.so -Wl,-rpath -Wl,//lib -Wl,-rpath -Wl,//lib/syslog-ng -Wl,-rpath -Wl,/usr/lib64 ./.libs/libdbparser.so: undefined reference to `g_timeout_add_seconds' collect2: ld returned 1 exit status make[5]: *** [pdbtool] Error 1 make[5]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.38499 (%build) According to http://git.gnome.org/browse/glib/tree/NEWS?id=GLIB_2_13_5#n27, the `g_timeout_add_seconds' feature was added in GLib 2.13.5 -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

syslog-ng PE benefits
by Zoltán Pallagi 03 Dec '10

03 Dec '10

Hi all, A few months ago, there was a thread about syslog-ng in corporate environment. I've just wrote a blog about the benefits of syslog-ng PE, you can read it on my blog: http://pzolee.blogs.balabit.com/en/2010/12/syslog-ng-pe-behind-the-walls/

1 0

3.2.1 fails build in modules/dbparser w/o -lssl
by Brian A. Seklecki 03 Dec '10

03 Dec '10

[Sorry if this is a dupe; mailing list delays or silent quarntine for non-subscribers] I can provide a full config.log via URL, but here's the quick summary: /bin/ksh ../../libtool --tag=CC --mode=link gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -o pdbtool pdbtool-pdbtool.o pdbtool-patternize.o ../../lib/libsyslog-ng.la libdbparser.la -lrt -Wl,-R/usr/pkg/lib -Wl,--export-dynamic -pthread -L/usr/pkg/lib -lgmodule-2.0 -lglib-2.0 -lintl -Wl,-R/usr/pkg/lib -L/usr/pkg/lib -levtlog -lresolv libtool: link: gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -o .libs/pdbtool pdbtool-pdbtool.o pdbtool-patternize.o -Wl,-R/usr/pkg/lib -Wl,--export-dynamic -pthread -Wl,-R/usr/pkg/lib ../../lib/.libs/libsyslog-ng.so -L/usr/pkg/lib ./.libs/libdbparser.so /root/syslog-ng-3.2.1/lib/.libs/libsyslog-ng.so -lrt /usr/pkg/lib/libgmodule-2.0.so /usr/pkg/lib/libglib-2.0.so /usr/pkg/lib/libpcre.so -lintl /usr/pkg/lib/libevtlog.so -lresolv -pthread -Wl,-rpath -Wl,/usr/pkg/lib -Wl,-rpath -Wl,/usr/pkg/lib/syslog-ng pdbtool-patternize.o: In function `uuid_gen_random': /root/syslog-ng-3.2.1/modules/dbparser/patternize.c:67: undefined reference to `RAND_bytes' gmake[2]: *** [pdbtool] Error 1 gmake[2]: Leaving directory `/root/syslog-ng-3.2.1/modules/dbparser' gmake[1]: *** [all-recursive] Error 1 gmake[1]: Leaving directory `/root/syslog-ng-3.2.1/modules/dbparser' gmake: *** [all] Error 2 Appending "-lssl" to the automake/libtool command makes it work fine. NetBSD metrotitan 5.99.39 NetBSD 5.99.39 (METROTITAN-$Revision: 1.993 $) #0: Wed Oct 6 13:26:31 EDT 2010 root@metrotitan:/usr/obj/sys/arch/i386/compile/METROTITAN i386 bash-4.1# openssl version OpenSSL 1.1.0-dev 10 Jul 2009 I'm doing this outside of Pkgsrc, so its possibly my fault. ~BAS

2 1

--libdir misbehaves
by Matthew Hall 02 Dec '10

02 Dec '10

I'm compiling syslog-ng 3.2 beta 1. I'm going to update to 3.2 release briefly, maybe it's fixed in there? Even though I used: --libdir=/home/opt/lib64 The syslog-ng plugins are still going into lib. I can't make an internal package of the app to use here until I figure out how to fix it. The files in question are: /home/opt/lib/syslog-ng /home/opt/lib/syslog-ng/libafsocket-tls.la /home/opt/lib/syslog-ng/libafprog.la /home/opt/lib/syslog-ng/libaffile.la /home/opt/lib/syslog-ng/libaffile.so /home/opt/lib/syslog-ng/libpacctformat.so /home/opt/lib/syslog-ng/libsyslogformat.so /home/opt/lib/syslog-ng/libafsql.so /home/opt/lib/syslog-ng/libbasicfuncs.so /home/opt/lib/syslog-ng/libafsocket.so /home/opt/lib/syslog-ng/libafsocket-notls.la /home/opt/lib/syslog-ng/libdbparser.la /home/opt/lib/syslog-ng/libafuser.la /home/opt/lib/syslog-ng/libconvertfuncs.la /home/opt/lib/syslog-ng/libbasicfuncs.la /home/opt/lib/syslog-ng/libcsvparser.la /home/opt/lib/syslog-ng/libafprog.so /home/opt/lib/syslog-ng/libafsql.la /home/opt/lib/syslog-ng/libpacctformat.la /home/opt/lib/syslog-ng/libafsocket-tls.so /home/opt/lib/syslog-ng/libdbparser.so /home/opt/lib/syslog-ng/libdummy.la /home/opt/lib/syslog-ng/libcsvparser.so /home/opt/lib/syslog-ng/libconvertfuncs.so /home/opt/lib/syslog-ng/libafsocket-notls.so /home/opt/lib/syslog-ng/libconfgen.so /home/opt/lib/syslog-ng/libafuser.so /home/opt/lib/syslog-ng/libsyslogformat.la /home/opt/lib/syslog-ng/libconfgen.la /home/opt/lib/syslog-ng/libdummy.so

2 4

Extra Lines Truncated
by Ian Lesperance 02 Dec '10

02 Dec '10

When logging multiline messages (simple strings with in-line newlines) our logs only show the first line. Everything after the first newline character is gone. We're on 3.0.5 and we don't seem to be using the no_multi_line option anywhere. What else could explain this behavior? Ian

4 5

hostname incorrect after upgrade to 3.1.2
by w3euu 01 Dec '10

01 Dec '10

I have used syslog-ng for many years and have been a faithful reader of the mailing list, but do not believe I have ever had occasion to post. Thank you for an excellent product and for the great support you have provided. I have always been able to solve problems by reading the archives...until now. I just completed an upgrade from source on several (6) systems from syslog-ng 3.1.1 (OSE) to 3.1.2 and then 3.1.3. All of them went smoothly, without error. However, after the upgrade to 3.1.2, one of the systems began reporting the hostname as "localhost" rather than the correct host name. The problem persisted when I upgraded to 3.1.3. When I roll it back to 3.1.1 it reports the hostname correctly. All of the systmes are fedora. Some are fc13, some are fc14. The system that failed is fc14. It is forwarding its logs to a central logger via tcp. I have checked the following: hosts file is OK. Contains only 127.0.0.1 entry as localhost dig -x returns the correct hostname hostname returns the correct hostname tcpdump confirms that syslog-ng is reporting "localhost" I was unable to correct the problem by changing global options. Global options are: options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); check_hostname(yes); chain_hostnames(no); keep_hostname (no); stats_freq (43200); mark_freq (1200); keep_timestamp (no); # send_time_zone (-04:00); }; I have googled but have not found anything that seemed relavant. Not sure how to procede to correct this situation. Any ideas would be appreciated. I would be happy to post additional data that will help.

2 6

Syslog-Ng on NetBSD after GSoC changes for RFC5424 Changes
by Brian A. Seklecki 01 Dec '10

01 Dec '10

For the sake of the mailing list archives / google searches, the following flags() argument is needed to parse the new message format from local socket: source src { unix-dgram("/var/run/log" flags(syslog-protocol) ); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; Also, syslog-ng v. 3 or greater is needed (1.6x in pkgsrc, 2.x in pkgsrc-wip) If/when Other*BSD imports the IETF syslog support, the same will be true there. ~BAS

1 0

New syslog-ng poll: how many platforms do you use?
by Robert Fekete 30 Nov '10

30 Nov '10

Continuing our survey to get a picture about how you use syslog-ng, our next poll is online. The question is, how many different platforms do you use syslog-ng on? Please count every distribution or architecture separately. For example, if you are running syslog-ng on 200 identical servers that all run the 64-bit version of RHEL 5, that's only a single platform. If you are using both the 32-bit and 64-bit version of the same distro, that's two platforms. If you have a mix of RHEL 4, 5, 6 servers and have 32-bit and 64-bit versions of each, that's already 6 platforms, and so on. You find the poll at <a href="http://www.balabit.com/poll/ syslog_ng_platforms">http://www.balabit.com/poll/syslog_ng_platforms</ a> The results of the <a href="http://www.balabit.com/poll/ syslog_ng_admin_guide">latest poll</a> show that the vast majority of you use the PDF version of the syslog-ng admin guide - I suspected this, but haven't thought that the HTML versions will lag behind so badly. Though if I have some time, I'll compare this to the download statistics. Thanks for voting!

1 0

providing Windows Event Viewer logs into syslog
by Oguz Yilmaz 30 Nov '10

30 Nov '10

Hi, I wanted to start a thread to see alternatives for providing Windows logs into a linux based syslog server. I would be grateful to see my alternatives, as free software as propriatery software. Regards, -- Oguz YILMAZ

3 2

syslog-ng 3.1.3 has been released
by devel＠balabit.hu 30 Nov '10

30 Nov '10

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.1.3 SUMMARY : new stable release DATE : Nov 26, 2010 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.1.3) has been released. For latest fixes in the 3.1.x feature branch you are recommended to upgrade to this version. CHANGES: 3.1.3 Thu, 18 Nov 2010 07:50:42 +0100 Bugfixes: * csv-parser() defaults to "escape-none" mode even if it is not specified. * Fixed a possible CPU spinning in case mark_freq() is changed from a non-zero value to zero and syslog-ng is reloaded. * Fixed a flow control problem for the internal() source possibly causing an assertion to fail, e.g. syslog-ng to crash voluntarily. * Make it possible to use a literal '$' character by using two of them. * Make it possible to use binary characters within strings in configuration files by using a C-like \xHH, \oOOO syntax. * Attempt to flush the messages sitting in output queues a bit harder at shutdown. * Handle ESTALE errors in the file source for NFS file systems, which might cause a spin on the CPU otherwise. * Fixed a possible use-after-free problem potentially causing crashes or misbehaviour. No concrete errors were reported though. * The SQL driver didn't honour the port() option, this was fixed. * Fixed program_override() option, previously it overrode the hostname instead because of a typo. * Accept 3.1 as configuration version, previously it only accepted 3.0. * Fixed internal() message loop detection in case an error happened on the log writer flush path. DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

3 3