- syslog-ng - lists.balabit.hu

Support of welf format
by Yann I. 07 Dec '10

07 Dec '10

Hello, I would like to know whether syslog-ng can receive and manage logs which have the welf format ? Regards, Yann I.

3 2

Software for Analysing and Reporting Syslog Logs
by Heinze, René 07 Dec '10

07 Dec '10

Hello, I'm looking for a software to analyse and creating reports from syslog logs. It there anything you can recommend? Thanks, Best, René Heinze

3 2

Syslog-ng and Mysql Not working
by Girish-Agarwal (Contractor) 06 Dec '10

06 Dec '10

Hi, We are trying to setup syslog-ng to directly log messages to mysql but I get the following Error in the client messages file:- Dec 1 14:45:27 testbox syslog-ng[15637]: Error running SQL query; type='mysql', host='10.10.10.10', port='4406', user='syslog', database='testdb', error='1142: create command denied to user: \'syslog(a)10.20.30.40\' for table \'logs\'', query='CREATE TABLE logs (host text, facility text, priority text, tag text, datetime text, program text, server text, msg text)' Dec 1 14:45:27 testbox syslog-ng[15637]: Error checking table, disconnecting from database, trying again shortly; time_reopen='60' I am really confused as to why it is trying to create Table into the database. I already have the table created and I have verified successful connection from this box to the database server. It needs to insert the entries into the database and should not try to CREATE TABLE. I am using syslog-ng 3.0.6 version . Regards, Girish

3 10

Host name handling : FULLHOST_FROM explanation
by Christophe Brocas 06 Dec '10

06 Dec '10

Hello I am working on the right and consistent way to store log messages in destination files. I try to obtain a single file per host, based on HOST value in log messages.. Currently, I have inconsistent values in HOST part of log messages, so destination files are also inconsistents. To answer to this problem, I am going to use at first the SOURCEIP macro in my destination file paths. But I want to improve this situation. So I would like to be sure of the understanding I have of the FULLHOST_FROM macro. If use_dns() is set to yes, does the expansion of FULLHOST_FROM macro follow this stream ? 1. Syslog-NG takes the IP address of the host sending the message 2. Syslog-NG tries to get the reverse value (as dig -x) from the IP address 3. Syslog-NG expands the macro with the FQDN obtained in point 2 (What if DNS reverse fails ? The macro returns only the IP address ?) Bye Christophe -- Christophe Brocas keyid : 3072R/0x0661CBBA ***************************************************** "Le contenu de ce courriel et ses eventuelles pièces jointes sont confidentiels. Ils s'adressent exclusivement à la personne destinataire. Si cet envoi ne vous est pas destiné, ou si vous l'avez reçu par erreur, et afin de ne pas violer le secret des correspondances, vous ne devez pas le transmettre à d'autres personnes ni le reproduire. Merci de le renvoyer à l'émetteur et de le détruire. Attention : L'Organisme de l'émetteur du message ne pourra être tenu responsable de l'altération du présent courriel. Il appartient au destinataire de vérifier que les messages et pièces jointes reçus ne contiennent pas de virus. Les opinions contenues dans ce courriel et ses éventuelles pièces jointes sont celles de l'émetteur. Elles ne reflètent pas la position de l'Organisme sauf s'il en est disposé autrement dans le présent courriel." ******************************************************

2 3

[Bug 97] New: syslog-ng crashes after SIGHUP
by bugzilla＠bugzilla.balabit.com 04 Dec '10

04 Dec '10

https://bugzilla.balabit.com/show_bug.cgi?id=97 Summary: syslog-ng crashes after SIGHUP Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: zhengxiang.pan(a)alcatel-lucent.com Type of the Report: bug Estimated Hours: 0.0 Syslog-ng 3.0.6 crashes with following trace: Program terminated with signal 11, Segmentation fault. [New process 6311] #0 0x08063558 in log_source_group_queue (s=0x8ca6e00, msg=0x8caecc0, path_options=0xbfffaf18) at sgroup.c:98 98 (*self->processed_messages)++; (gdb) bt #0 0x08063558 in log_source_group_queue (s=0x8ca6e00, msg=0x8caecc0, path_options=0xbfffaf18) at sgroup.c:98 #1 0x08070580 in log_source_queue (s=0x8cadc78, msg=0x8caecc0, path_options=0xbfffaf74) at logpipe.h:121 #2 0x08063e80 in log_reader_fd_dispatch (source=0x8cadd10, callback=0, user_data=0x0) at logpipe.h:121 #3 0x08080081 in g_main_context_dispatch () #4 0x08083103 in g_main_context_iterate () #5 0x0808327f in g_main_context_iteration () #6 0x0804b52f in main_loop_run (cfg=0xbfffb0e8) at main.c:163 #7 0x0804bbcd in main (argc=147613904, argv=0xbfffb110) at main.c:443 The problem happens from version 3.0.6 ( I did not test other version lower than that) until the lastest 3.1.3. I guess what happens is that when SIGHUP is recevied, some connections are persisted, while the persistent connections points to the already-freed pipe (via pipe_next), if there are messages coming before the freed-pipes are replaced, the messages are forwarded to the freed-pipe handler. For version 3.1.3, in logpipe.c, log_pipe_forward_msg() may add check the pipe_next flags, however this may be not enough. log_pipe_forward_msg(LogPipe *self, LogMessage *msg, const LogPathOptions *path_options) { if (self->pipe_next && self->flags&PIF_INITIALIZED) { log_pipe_queue(self->pipe_next, msg, path_options); -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 5

[Bug 98] New: GLIB_MIN_VERSION should be 2.13.5, not 2.10.1
by bugzilla＠bugzilla.balabit.com 03 Dec '10

03 Dec '10

https://bugzilla.balabit.com/show_bug.cgi?id=98 Summary: GLIB_MIN_VERSION should be 2.13.5, not 2.10.1 Product: syslog-ng Version: 3.2.x Platform: PC URL: http://git.gnome.org/browse/glib/tree/NEWS?id=GLIB_2_13_ 5#n27 OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: packaging AssignedTo: folti(a)balabit.hu ReportedBy: owen.mann(a)interactivedata.com Type of the Report: bug Estimated Hours: 0.0 When building on a RHEL5 box (glib2-2.12.3-4.el5_3.1), I get: [...] libtool: link: gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -o .libs/pdbtool pdbtool-pdbtool.o pdbtool-patternize.o -Wl,--export-dynamic ../../lib/.libs/libsyslog-ng.so ./.libs/libdbparser.so -L/usr/kerberos/lib64 -lssl -lcrypto -lz -lrt -lnsl -L/lib64 -lgmodule-2.0 -ldl -lglib-2.0 /usr/lib64/libevtlog.so -Wl,-rpath -Wl,//lib -Wl,-rpath -Wl,//lib/syslog-ng -Wl,-rpath -Wl,/usr/lib64 ./.libs/libdbparser.so: undefined reference to `g_timeout_add_seconds' collect2: ld returned 1 exit status make[5]: *** [pdbtool] Error 1 make[5]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules/dbparser' make[4]: *** [all-recursive] Error 1 make[4]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules/dbparser' make[3]: *** [all] Error 2 make[3]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules/dbparser' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1/modules' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/src/redhat/BUILD/syslog-ng-3.2.1' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.38499 (%build) According to http://git.gnome.org/browse/glib/tree/NEWS?id=GLIB_2_13_5#n27, the `g_timeout_add_seconds' feature was added in GLib 2.13.5 -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

syslog-ng PE benefits
by Zoltán Pallagi 03 Dec '10

03 Dec '10

Hi all, A few months ago, there was a thread about syslog-ng in corporate environment. I've just wrote a blog about the benefits of syslog-ng PE, you can read it on my blog: http://pzolee.blogs.balabit.com/en/2010/12/syslog-ng-pe-behind-the-walls/

1 0

3.2.1 fails build in modules/dbparser w/o -lssl
by Brian A. Seklecki 03 Dec '10

03 Dec '10

[Sorry if this is a dupe; mailing list delays or silent quarntine for non-subscribers] I can provide a full config.log via URL, but here's the quick summary: /bin/ksh ../../libtool --tag=CC --mode=link gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -o pdbtool pdbtool-pdbtool.o pdbtool-patternize.o ../../lib/libsyslog-ng.la libdbparser.la -lrt -Wl,-R/usr/pkg/lib -Wl,--export-dynamic -pthread -L/usr/pkg/lib -lgmodule-2.0 -lglib-2.0 -lintl -Wl,-R/usr/pkg/lib -L/usr/pkg/lib -levtlog -lresolv libtool: link: gcc -std=gnu99 -Wno-pointer-sign -g -O2 -Wall -o .libs/pdbtool pdbtool-pdbtool.o pdbtool-patternize.o -Wl,-R/usr/pkg/lib -Wl,--export-dynamic -pthread -Wl,-R/usr/pkg/lib ../../lib/.libs/libsyslog-ng.so -L/usr/pkg/lib ./.libs/libdbparser.so /root/syslog-ng-3.2.1/lib/.libs/libsyslog-ng.so -lrt /usr/pkg/lib/libgmodule-2.0.so /usr/pkg/lib/libglib-2.0.so /usr/pkg/lib/libpcre.so -lintl /usr/pkg/lib/libevtlog.so -lresolv -pthread -Wl,-rpath -Wl,/usr/pkg/lib -Wl,-rpath -Wl,/usr/pkg/lib/syslog-ng pdbtool-patternize.o: In function `uuid_gen_random': /root/syslog-ng-3.2.1/modules/dbparser/patternize.c:67: undefined reference to `RAND_bytes' gmake[2]: *** [pdbtool] Error 1 gmake[2]: Leaving directory `/root/syslog-ng-3.2.1/modules/dbparser' gmake[1]: *** [all-recursive] Error 1 gmake[1]: Leaving directory `/root/syslog-ng-3.2.1/modules/dbparser' gmake: *** [all] Error 2 Appending "-lssl" to the automake/libtool command makes it work fine. NetBSD metrotitan 5.99.39 NetBSD 5.99.39 (METROTITAN-$Revision: 1.993 $) #0: Wed Oct 6 13:26:31 EDT 2010 root@metrotitan:/usr/obj/sys/arch/i386/compile/METROTITAN i386 bash-4.1# openssl version OpenSSL 1.1.0-dev 10 Jul 2009 I'm doing this outside of Pkgsrc, so its possibly my fault. ~BAS

2 1

--libdir misbehaves
by Matthew Hall 02 Dec '10

02 Dec '10

I'm compiling syslog-ng 3.2 beta 1. I'm going to update to 3.2 release briefly, maybe it's fixed in there? Even though I used: --libdir=/home/opt/lib64 The syslog-ng plugins are still going into lib. I can't make an internal package of the app to use here until I figure out how to fix it. The files in question are: /home/opt/lib/syslog-ng /home/opt/lib/syslog-ng/libafsocket-tls.la /home/opt/lib/syslog-ng/libafprog.la /home/opt/lib/syslog-ng/libaffile.la /home/opt/lib/syslog-ng/libaffile.so /home/opt/lib/syslog-ng/libpacctformat.so /home/opt/lib/syslog-ng/libsyslogformat.so /home/opt/lib/syslog-ng/libafsql.so /home/opt/lib/syslog-ng/libbasicfuncs.so /home/opt/lib/syslog-ng/libafsocket.so /home/opt/lib/syslog-ng/libafsocket-notls.la /home/opt/lib/syslog-ng/libdbparser.la /home/opt/lib/syslog-ng/libafuser.la /home/opt/lib/syslog-ng/libconvertfuncs.la /home/opt/lib/syslog-ng/libbasicfuncs.la /home/opt/lib/syslog-ng/libcsvparser.la /home/opt/lib/syslog-ng/libafprog.so /home/opt/lib/syslog-ng/libafsql.la /home/opt/lib/syslog-ng/libpacctformat.la /home/opt/lib/syslog-ng/libafsocket-tls.so /home/opt/lib/syslog-ng/libdbparser.so /home/opt/lib/syslog-ng/libdummy.la /home/opt/lib/syslog-ng/libcsvparser.so /home/opt/lib/syslog-ng/libconvertfuncs.so /home/opt/lib/syslog-ng/libafsocket-notls.so /home/opt/lib/syslog-ng/libconfgen.so /home/opt/lib/syslog-ng/libafuser.so /home/opt/lib/syslog-ng/libsyslogformat.la /home/opt/lib/syslog-ng/libconfgen.la /home/opt/lib/syslog-ng/libdummy.so

2 4

Extra Lines Truncated
by Ian Lesperance 02 Dec '10

02 Dec '10

When logging multiline messages (simple strings with in-line newlines) our logs only show the first line. Everything after the first newline character is gone. We're on 3.0.5 and we don't seem to be using the no_multi_line option anywhere. What else could explain this behavior? Ian

4 5