- syslog-ng - lists.balabit.hu

[PATCH] make 'syslog-ng -s' stay in the foreground
by Corey Hickey 10 May '10

10 May '10

Hi, I recently upgraded to syslog-ng 3.1.1 and noticed messages like this appearing on terminals owned by root: 2010 May 7 06:25:21 fire Daemon exited gracefully, not restarting; exitcode='0' This is triggered by a daily logrotate cron job that runs 'syslog-ng -s' before sending the daemon a SIGHUP. It seems that 'syslog-ng -s' will daemonize and fork; the child process runs the syntax check and exits immediately, and then the parent process sends the above message via syslog(LOG_CRIT,...). I can work around it by using 'syslog-ng -sF', but I also hacked up a small patch to force the process to be in the foreground when -s is specified. Is this useful? If not, I'll send a patch to Debian to use 'syslog-ng -sF' instead. Thanks, Corey diff -ur syslog-ng-3.1.1.orig/src/gprocess.c syslog-ng-3.1.1/src/gprocess.c --- syslog-ng-3.1.1.orig/src/gprocess.c 2009-12-15 05:00:28.000000000 -0800 +++ syslog-ng-3.1.1/src/gprocess.c 2010-05-08 19:30:12.000000000 -0700 @@ -1134,14 +1134,18 @@ /** * g_process_start: + * @force_foreground: force process mode to foreground * * Start the process as directed by the options set by various * g_process_set_*() functions. **/ void -g_process_start(void) +g_process_start(gboolean force_foreground) { pid_t pid; + + if (force_foreground) + process_opts.mode = G_PM_FOREGROUND; g_process_detach_tty(); g_process_change_limits(); diff -ur syslog-ng-3.1.1.orig/src/gprocess.h syslog-ng-3.1.1/src/gprocess.h --- syslog-ng-3.1.1.orig/src/gprocess.h 2009-11-25 11:47:45.000000000 -0800 +++ syslog-ng-3.1.1/src/gprocess.h 2010-05-08 19:28:55.000000000 -0700 @@ -70,7 +70,7 @@ void g_process_set_use_fdlimit(gboolean use); void g_process_set_check(gint check_period, gboolean (*check_fn)(void)); -void g_process_start(void); +void g_process_start(gboolean force_foreground); void g_process_startup_failed(guint ret_num, gboolean may_exit); void g_process_startup_ok(void); void g_process_finish(void); diff -ur syslog-ng-3.1.1.orig/src/main.c syslog-ng-3.1.1/src/main.c --- syslog-ng-3.1.1.orig/src/main.c 2010-03-14 10:22:50.000000000 -0700 +++ syslog-ng-3.1.1/src/main.c 2010-05-08 19:28:55.000000000 -0700 @@ -417,7 +417,7 @@ /* in this case we switch users early while retaining a limited set of * credentials in order to initialize/reinitialize the configuration. */ - g_process_start(); + g_process_start(syntax_only); rc = initial_init(&cfg); if (rc)

2 1

syslog-ng can not work with oracle backend
by Dmitry Sedov 10 May '10

10 May '10

Hello! I took stable binary rpm with open source syslog-ng version 3.0.6 on balabit.hu and install it on rhel 4u7. For some reason it does not want to work with oracle backend. I try next bekend description in syslog-ng.conf: destination d_oracle_syslog { sql(type(oracle) username("login") password("password") database("database") table("table") columns("DATE varchar2(24)", "facility number(2)", "LEVEL number(1)", "host varchar2(128)", "program varchar2(64)", "pid number(8)", "message varchar2(1024)") indexes( "DATE","facility","host") ); }; And after start syslog-ng post in /var/log/messages notes about failure: Apr 30 18:35:47 vm-dc-syslog syslog-ng[9815]: No such DBI driver; type='oracle' Apr 30 18:35:47 vm-dc-syslog syslog-ng[9815]: No such DBI driver; type='oracle' Apr 30 18:35:47 vm-dc-syslog syslog-ng[9815]: No such DBI driver; type='oracle' After this issue appear, I compile libdbi and libdbi-drivers version 0.8.3. But it did not help: syslog-ng continue write "No such DBI driver; type='oracle'". And the same happens with the syslog-ng versions 3.1.1 and 3.1.0. I install syslog-ng with binary rpm's from www.balabit.com. Tell me, please, how I may fix this issue. Regards, Dmitry Sedov.

3 6

Want to down load NCsysng-1.6.7-1.pkg.gz
by sasanka.sahu＠wipro.com 10 May '10

10 May '10

want to download NCsysng-1.6.7-1.pkg.gz but the package is NOT available on the site ( http://www.campin.net/download/NCsysng-1.6.7-1.pkg.gz <http://www.campin.net/download/NCsysng-1.6.7-1.pkg.gz> ) so please provide me the exact link for downloading the same . Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

Rediecting logs
by abhay singh 10 May '10

10 May '10

Hi All, I have made changes in syslog-ng.conf to redirect logs coming from other server to some specified log file and in some format source s_external { udp(port(514)); }; source s_stunnel { tcp(ip(127.0.0.1) port(514)); }; destination s_external { file("/mydir/syslogs/$HOST_syslog.log" \ owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes)); }; destination s_stunnel { file("/mydir/syslogs/$HOST/syslog.log" \ owner(user) group(group) perm(0600) dir_perm(0700) create_dirs(yes)); }; log { source(s_external); destination(s_external); }; log { source(s_stunnel); destination(s_stunnel); }; But my log file is being created with name "syslog.log" and not as "<hostnmae/ip>_syslog.log" neither $HOST directory made, what may be the issue? Globle options are option{ long_hostname(off); sync(0); } -- Regards.. Abhay Singh.. 91-98804-55587 Sr. Software Engineer. Robust Designs India Pvt Ltd. Bangalore

5 6

[Bug 81] New: feature request: nested source statements
by bugzilla＠bugzilla.balabit.com 06 May '10

06 May '10

https://bugzilla.balabit.com/show_bug.cgi?id=81 Summary: feature request: nested source statements Product: syslog-ng Version: 3.0.x Platform: Other OS/Version: FreeBSD Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: jschauma(a)netmeister.org Type of the Report: --- Estimated Hours: 0.0 Ie, I have source s_tcp6 { tcp6(log_fetch_limit(25) port(601)); } source s_tcp4 { tcp(log_fetch_limit(25) port(601)); }; and I would like to have another source s_tcp { s_tcp4; s_tcp6; }; but no matter what I try, I get syntax errors. Is it not possible to have nested/derived source statements? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Questions regarding Syslog-ng
by Dyne Lai 05 May '10

05 May '10

Dear Syslog-ng developers, I am very interested and impressed with the many features of Syslog-ng as compared to Syslogd and would consider implement it in my servers. However, I do have some questions regarding Syslog-ng that I would like to enquiry as below. 1) Is it possible for both Syslogd and Syslog-ng to co-exist and run concurrently in a single server? The rational for this question is due to support reason and security reason that will require the presence of Syslogd even though it can be replaced by Syslog-ng. Thank you for the time! Best Regards, Dyne Lai

2 1

error in documentation
by Patrick H. 04 May '10

04 May '10

Found another error in the documentation (version 3.1). The docs list "stats_reset" as a valid config option, yet trying to use it results in a syntax error on start, and cfg-lex.l in the source has nothing about it. Guessing this was removed and the docs never got updated.

2 1

Re: [syslog-ng] log_disk_fifo_size() option available in syslog-ng 3.1.1 ?
by Ilas, Yann 03 May '10

03 May '10

Thank you for that fast answer. I'm so sad now :-( As I found an error into the doc, did I win a license of the "Premium Edition" ? :-) ...Joke :-) Regards, Yann > Hi, > > disk-based buffering is currently not available in the Open Source Edition, only > in the Premium Edition, but it seems that the description of the option has > accidentally remained in the OSE admin guide. > > Thank you for noticing it, and my apologies for the mistake. > I will remove it from the docs and update it on the web. > > Regards, > > Robert > > Ilas, Yann wrote: > >> Hello, >> >> I tried to use the disk-based buffering as described in the document "The >> syslog-ng Open Source Edition 3.1 Administrator.pdf" but I have a syntax >> error when I start the process. >> I used this configuration for the destination part of my configuration file >> : >> destination d_tcp { >> tcp("10.1.2.3" port(1999) log_disk_fifo_size(4194304)); }; >> >> When I remove "log_disk_fifo_size" of my configuration, everything is OK and >> syslog-ng doesn't complain. >> Did I miss something ? >> >> Regards, >> >> Yann >> >> >> >> >> ------------------------------------------------------------------------ >> >> ____________________________________________________________________________ __ >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> >> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng <http://www.balabit.com/support/documentation/?product=syslog-ng> >> FAQ: http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

log_disk_fifo_size() option available in syslog-ng 3.1.1 ?
by Ilas, Yann 03 May '10

03 May '10

Hello, I tried to use the disk-based buffering as described in the document "The syslog-ng Open Source Edition 3.1 Administrator.pdf" but I have a syntax error when I start the process. I used this configuration for the destination part of my configuration file : destination d_tcp { tcp("10.1.2.3" port(1999) log_disk_fifo_size(4194304)); }; When I remove "log_disk_fifo_size" of my configuration, everything is OK and syslog-ng doesn't complain. Did I miss something ? Regards, Yann

2 1

Syslog-ng Agent for Windows 3.1 " Customizing file messages"
by John MacDonald 28 Apr '10

28 Apr '10

I am trying to follow the following procedure: Procedure 3.18. Customizing file messages 1. Start the configuration interface of the syslog-ng Agent for Windows application. 2. Select syslog-ng Agent Settings, right-click on File Sources and select Properties. 3. Type the message format into the Message Template field. You can use date- and file-related macros (see Section 3.6.2, "Macros available in the syslog-ng Agent" (p. 26) for a list of macros). The message customized here is included in the server-specific templates using the MESSAGE macro. By default, the following is sent about file messages: $FILE_NAME: $FILE_MESSAGE. 4. Select Apply, then OK. To activate the changes, restart the syslog-ng Agent service. My issue is on File Sources>Properties there isn't a Message Template field. Can you tell me if there is another procedure for this? Thanks. John

2 1