- syslog-ng - lists.balabit.hu

Re-Starting syslog servicesio.c: bind_inet_socket() bind failed
by abhay singh 15 Apr '10

15 Apr '10

Hi All I am configuring syslog-ng confile to receive logs from different m/c of network. I have added these in my syslog-ng.conf file source s_external { udp(ip("xxx.xxx.xxx.xxx") port(514)); }; destination s_external { file("/mydir/syslogs/$HOST_syslog.log" \ owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(s_external); destination(s_external); }; Also made entry in iptable iptables -A INPUT -p udp -i eth1 -s xxx.xxx.xxx.xxx -d yyy.yyy.yyy.yyy --dport 514 -j ACCEPT When i restart syslog service it gives this error /etc/init.d/syslog restart Shutting down syslog services done Re-Starting syslog servicesio.c: bind_inet_socket() bind failed xxx.xxx.xxx.xxx:514 Cannot assign requested address Error initializing configuration, exiting. \\startproc <file://startproc/>: exit status of parent of /sbin/syslog-ng: 1 failed What is wrong in this? -- Regards.. Abhay Singh..

3 3

change log facility number?
by fedora fedora 14 Apr '10

14 Apr '10

When using as a log forwarding unit, can syslog-ng change the local facility when forwarding the logs to another unit? thanks

2 1

ESTRING terminated by a colon?
by Glen Johnson 14 Apr '10

14 Apr '10

Hello, Hopefully this is a new question. I've been trying to write patterns for error messages sent by Cisco IOS devices. For example: 20: *Feb 28 15:00:08.556 AKST: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up A pattern that works: @NUMBER:seqno@: @ESTRING:CISCO.DATE: %@LINEPROTO-5-UPDOWN: Line protocol on Interface @ESTRING:arg1:,@ changed state to @ANYSTRING:arg2@ But to avoid capturing the colon an space, the end-match needs to be ": " (i.e. colon space), like so: @ESTRING:CISCO.DATE:: @ However, I'm unsure how to quote the colon, when it's already the ESTRING param delimiter? Thanks

5 6

[Bug 70] Disable storing backrefs in PCRE regexps by default
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=70 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:37:35 --- Hmm.. there's no "nobackref" flag in syslog-ng, and pcre uses the same 'store-matches' flag as does the POSIX regexp. can you please elaborate where you saw this flag? thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 57] syslog-ng does not start at bootup
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=57 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED CC| |bazsi(a)balabit.hu --- Comment #1 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:32:38 --- this change was added to our init scripts, so I guess it should be fine with 3.0.6 already. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 38] New: Setting values of the Structured Data block.
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=38 Summary: Setting values of the Structured Data block. Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: c.haase(a)ifu.com Type of the Report: enhancement Estimated Hours: 0.0 Please add the functionality to set values inside the Structured Data block. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 37] New: Syslog-ng macros don't work in filters
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=37 Summary: Syslog-ng macros don't work in filters Product: syslog-ng Version: 3.0.x Platform: Other OS/Version: Other Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: vincent.panel(a)telindus.be Type of the Report: --- Estimated Hours: 0.0 Several documented macros don't work when used in filters. It's the case for $SEC, $MSGHDR. Already reported on the syslog-ng mailing list and acknowleged as a syslog-ng bug. I've tried it on Sparc/Solaris (but can't choose it in the platform menu of bugzilla...) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[Bug 51] check if the PID is valid before start
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=51 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #4 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:28:20 --- There were related fixes, which should fix this issue. 3.0.6 should be fine in this regard. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 67] write error: Bad file descriptor
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=67 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #2 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:26:39 --- this should be fixed in 3.0.6 release with this patch: Author: Juhasz Viktor <jviktor(a)balabit.hu> 2010-03-22 11:40:05 Committer: Juhasz Viktor <jviktor(a)balabit.hu> 2010-03-22 11:40:05 Parent: c4ee14878dee2573f6c33cd76cd171e093b3910d ([Old license file] Delete the license.txt from the install dir if) Child: 5a51b603ea4f9db084b2d79a28b594269068d1cc ([deb] Don't stop the syslog-ng many times in case of upgrade) Branch: Follows: Precedes: [debconf] don't use file descriptor 3 because it's owner is the debconf read the file directly ------------------- data/debian-packaging/syslog-ng/postinst ------------------- index 738df95..57d9ef6 100755 @@ -59,8 +59,6 @@ preprocess_config() if [ -f $PREPROCESSED_CONFIG_FILE ]; then rm $PREPROCESSED_CONFIG_FILE fi - exec 3<&0 - exec 0<$TEMPLATE_CONFIG_FILE while read line do case `echo $line | cut -d ':' -f 1` in @@ -85,7 +83,7 @@ preprocess_config() fi ;; esac - done + done < $TEMPLATE_CONFIG_FILE fi } -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 74] handling for multiline log messages in files
by bugzilla＠bugzilla.balabit.com 12 Apr '10

12 Apr '10

https://bugzilla.balabit.com/show_bug.cgi?id=74 Balazs Scheidler <bazsi(a)balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |INVALID Severity|blocker |normal --- Comment #4 from Balazs Scheidler <bazsi(a)balabit.hu> 2010-04-12 22:23:51 --- This is not a bug, but rather a feature request and we're already working on it. I'd set the resolution to NOTABUG if we had that, but we only have INVALID, so this way this goes. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0