- syslog-ng - lists.balabit.hu

syslog-ng with sql() command, cpu to 100%
by Garry De Toffoli 07 Oct '09

07 Oct '09

I have tried to run syslog-ng in this way: root@syslog-srv904:/opt/syslog-ng/sbin# ./syslog-ng -f /opt/syslog-ng/etc/syslog-ng.conf without any option of debug; on syslog-ng.conf there is: destination d_mysql { sql(type(mysql) host("127.0.0.1") username("syslogadmin") password("syslogadmin") database("syslog") table("logs") columns("host", "facility", "priority", "level", "tag", "datetime", "program", "msg") values("$HOST", "$FACILITY", "$PRIORITY", "$LEVEL", "$TAG", "$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC", "$PROGRAM", "$MSG") indexes()); }; MySql is configured to accept the configuration from network, so the host("127.0.0.1") username("syslogadmin") password("syslogadmin") is correct; and the CPU run to 100% and doesn't write anything to dbase; but if use this configuration destination d_mysql { program("/usr/bin/mysql -usyslogadmin -psyslogadmin syslog" template("INSERT INTO logs (host, facility, priority, level, tag, datetime, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; run OK; it seems that the sql() statement go in loop; where is the error? Someone can send a configuration that run OK? Thank you. _________________________________________________________________ Scopri tutti i servizi Windows Live, guarda i video http://www.windowslive.it/videoGallery.aspx

2 1

up to date syslog-ng.conf ?
by Jean F. Mousinho 06 Oct '09

06 Oct '09

Hello, I'm trying to use a compiled version of syslog-ng (3.0.4) tho I'm not successful to find a syslog-ng.conf file that cames with that package and is up to date. Find reveals several configuration files: ./debian/syslog-ng.conf ./contrib/hpux-packaging/syslog-ng.conf ./contrib/rhel-packaging/syslog-ng.conf ./contrib/aix-packaging/syslog-ng.conf ./contrib/fedora-packaging/syslog-ng.conf tho, none of them has @version keyword in the head, so syslog-ng is nagging for not being able to determine the configuration version. I'm running syslog-ng manually from the ./src specifing the configuration file from the command line (using -f). So the question is, where is the syslog-ng.conf for the 3.0.4 version (after doing ./configure .. and make) ? Thanks for your help. Jean F. Mousinho

2 1

Forwarding messages
by PAUL WILLIAMSON 05 Oct '09

05 Oct '09

I am receiving messages from 5 devices that I need to send to a remote machine for specific analysis. Right now, the messages are getting interpreted as coming from the central syslog host, not the individual devices. Is there any option to tell syslog-ng to forward as the original hostname, or should I focus on looking for options in the other system? I have the keep_hostname(yes) option enabled, but that isn't working the way I was hoping. Thanks, Paul ************************************ This email may contain privileged and/or confidential information that is intended solely for the use of the addressee. If you are not the intended recipient or entity, you are strictly prohibited from disclosing, copying, distributing or using any of the information contained in the transmission. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. You may not directly or indirectly reuse or disclose such information for any purpose other than to provide the services for which you are receiving the information. There are risks associated with the use of electronic transmission. The sender of this information does not control the method of transmittal or service providers and assumes no duty or obligation for the security, receipt, or third party interception of this transmission. ************************************

2 1

syslog-ng logging from localhost
by Stefan Varga 01 Oct '09

01 Oct '09

Hi we have a syslog-ng configuration see bellow, running on solaris if I telnet to 10.128.240.100 from server where syslog-ng is running, nothing is logged if I telnet to 10.128.240.100 from any other server it is logging as expected do you see something obvious here ? Thanks, Stefan #@version: 3.0 options { create_dirs(yes); owner(root); group(logs); perm(0644); dir_perm(0755); flush_lines(0); log_fifo_size(2048); log_msg_size(8192); stats_freq(3600); long_hostnames(off); keep_hostname(no); use_dns(yes); }; source s_remote { udp(ip(10.128.240.100) port(514)); tcp(ip(10.128.240.100) port(514) max_connections(1000)) }; # remote hosts to files destination r_messages { file ("/logs/hosts/${HOST}/${HOST}-${YEAR}${MONTH}${DAY}"); }; # remote logs log { source (s_remote); filter (f_debug); destination (r_messages); };

2 2

Strange behaviour of syslog-ng. Date macros not working and missing character in file name.
by Nilshar 30 Sep '09

30 Sep '09

Hello, I got a strange problem with syslog-ng (Debian Lenny version (2.0.9)). I got the following configuration : destination df_va_access { file("/var/log/apache/${PROGRAM}-access-${YEAR}${MONTH}${WEEK}${DAY}00.log" perm(0660) dir_perm(0775) template("${MSGONLY}\n") template_escape(off)) ; }; filter f_va_access { facility(local1) and level(info); }; log { source(s_all); filter(f_va_access); destination(df_va_access); flags(final); }; My apache is sending logs to logger with these parameters : /usr/bin/logger -p local1.info -t 180630f354399af972469030e7583848/4f88a0b758d5c5dc46e7f15b4bac1f5c/www.example.com-80-180630f354399af972469030e7583848-4f88a0b758d5c5dc46e7f15b4bac1f5c But I end up with this file : /var/log/apache/30f354399af972469030e7583848/4f88a0b758d5c5dc46e7f15b4bac1f5c/www.example.com-80-180630f354399af972469030e7583848-4f88a0b758d5c5dc46e7f15b4bac1f5c-access-197001000100.log This file has 2 problems : 1) the first directory is missing 3 char : 30f354399af972469030e7583848 should be 180630f354399af972469030e7583848 2) the date is wrong : 197001000100. should be the current date (system date is good). This looks like an overflow or something... I tried setting up another conf with simplier file, the date is working fine. The *very* strange thing, is that I got the same setup (with différents UID) on many differents box, and it's working just fine. So I guess there is something wrong with these particulier UID Is this a known issue ? maybe already fixed in recent version ? Why it is working on most of my box but not this one ? Thanks for your help.

2 2

Host filter not working?
by Clayton Dukes 30 Sep '09

30 Sep '09

I think I'm going crazy... Can someone tell me why this is not filtering these hosts? filter f_not_unitylab { ( not host ("localhost") or not host ("vnt-cm") or not host ("ecats-cu") ); }; # Tell syslog-ng to log to our new destination log { source(s_all); filter(f_not_unitylab); destination(d_logzilla); }; When I start syslog-ng, I'm still getting events logged to my db for these hosts. What am I missing? -- ______________________________________________________________ Clayton Dukes ______________________________________________________________

3 3

Syslog-ng3 : syslog-ng Digest, Vol 53, Issue 25
by Ashish Shrimali 30 Sep '09

30 Sep '09

Hi, The syslog-ng conf file is @version:3.0 options { use_dns(persist_only); dns_cache_hosts(/etc/hosts); #chain_hostnames(yes); keep_hostname(yes); keep_timestamp(yes); }; source all_sources { # Solaris used streams to send msgs to Syslogd process, replicate for syslog-ng sun-streams("/dev/log" door("/etc/.syslog_door")); # sun-streams( door("/etc/.syslog_door")); # Messages generated internally by Syslog-ng internal(); # Listens on the specified udp port for incoming messages udp(ip(0.0.0.0) port(514)); }; destination local7apm { file("/var/log/syslog" template("$DATE $HOST $MSGHDR $MSGONLY\n")); }; #destination local7apm { udp("smarts5" port(514) spoof-source(yes)); }; #destination d_tcp { tcp("10.1.2.3" port(1999); localport(999)); }; #destination messages { file("/var/adm/messages" template("$DATE $HOST $MSG\n")); }; # Below 5 lines taken from existing configuration #destination sysmsg { file("/dev/sysmsg" template("$DATE $HOST $MSG\n")); }; #destination operator { usertty("operator" template("$DATE $HOST $MSG\n")); }; destination operator { usertty("operator"); }; #destination all_alerts { usertty("operator" template("$DATE $HOST $MSG\n")); }; destination all_alerts { usertty("operator"); }; #destination all_alerts1 { usertty("root" template("$DATE $HOST $MSG\n")); }; destination all_alerts1 { usertty("root"); }; #destination emergency { usertty("*" template("$DATE $HOST $MSG\n")); }; destination emergency { usertty("*"); }; # filter local7msgs { facility(local7) and level(info..emerg); }; filter messages { facility(kern, daemon, mail) and level(debug, info, notice, warning, err, crit alert, emerg); }; filter f_sysmsg { facility(kern, auth) and level(notice); }; filter f_all_errors { level(err); }; filter f_operator { facility(kern, daemon) and level(err); }; filter f_all_alerts { level(alert); }; filter f_all_alerts1 { level(alert); }; filter f_emergency { level(emerg); }; Thanks & Regards, Ashish Shrimali -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Wednesday, September 30, 2009 9:52 AM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 53, Issue 25 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Re: Colon embedded in messages (:) (chris packham) 2. Re: Colon embedded in messages (:) (Evan Rempel) 3. Solaris Syslog-ng install lib error : syslog-ng Digest, Vol 53, Issue 22 (Ashish Shrimali) ---------------------------------------------------------------------- Message: 1 Date: Wed, 30 Sep 2009 09:49:59 +1300 From: "chris packham" <chris.packham(a)alliedtelesis.co.nz> Subject: Re: [syslog-ng] Colon embedded in messages (:) To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Message-ID: <4AC329C7020000680001703F(a)gwia.alliedtelesyn.co.nz> Content-Type: text/plain; charset=US-ASCII >>> On 9/30/2009 at 9:26 AM, James Kelly <james.kelly(a)hmsinc.com> wrote: > Thanks a lot. That seems to have worked a lot better but has introduced > another problem. The messages are split up into too many lines and, when > there is a match, the first of N lines are removed, still creating unwanted > messages. > > For example, a pretty small insert spans 3 lines... There was a match on the > 2nd line, so it is not printed. However, the 1st and 3rd were. > > 2009-09-29T16:21:16-04:00 blahh-rep2 postgres [10440-1] > postgres-blahh-10.100.10.34(15779)-4690-2009-09-29 16:21:16 EDT-LOG: > statement: insert into > 2009-09-29T16:21:16-04:00 blahh-rep2 postgres [10440-3] '1000000000000000'); I think you'll find is a postgres thing. syslog-ng does not split messages up based on size (at least as far as I've seen). I think there is some behaviour to do with carriage returns "\n" embedded in your log data but there are some config options to help with that, search the mailing list/admin guide for that if it turns out to be the case. ------------------------------ Message: 2 Date: Tue, 29 Sep 2009 14:19:46 -0700 From: Evan Rempel <erempel(a)uvic.ca> Subject: Re: [syslog-ng] Colon embedded in messages (:) To: "Syslog-ng users' and developers' mailing list" <syslog-ng(a)lists.balabit.hu> Message-ID: <4AC279F2.50205(a)uvic.ca> Content-Type: text/plain; charset=windows-1252; format=flowed As far as I know, the messages will always be split on multiple lines by postgresql, and you will need to match on the process number. In your example, the 10440 is the process number, and the -1, -2, -3 are the line numers of the messages that the single process creates. A single connection that runs multiple queries can create many messages, with ever increasing line number counts. Evan. James Kelly wrote: > Thanks a lot. That seems to have worked a lot better but has introduced > another problem. The messages are split up into too many lines and, > when there is a match, the first of N lines are removed, still creating > unwanted messages. > > For example, a pretty small insert spans 3 lines... There was a match on > the 2nd line, so it is not printed. However, the 1st and 3rd were. > > 2009-09-29T16:21:16-04:00 blahh-rep2 postgres [10440-1] > postgres-blahh-10.100.10.34(15779)-4690-2009-09-29 16:21:16 EDT-LOG: > statement: insert into > 2009-09-29T16:21:16-04:00 blahh-rep2 postgres [10440-3] > '1000000000000000'); > > I played around with log_msg_size thinking I could control how much is > on each line, but it didn't help. Am I missing something obvious? If a > "fragment" of the message is matched, I would want the entire message to > not be logged. > > Honestly, I have not spent nearly as much time on this most recent > problem, so if it is an RTFM situation, just let me know. I did do some > reading and searching on this though and came up empty handed. > > Thanks again for this great help, > James > > On Tue, Sep 29, 2009 at 3:43 PM, Evan Rempel <erempel(a)uvic.ca > <mailto:erempel@uvic.ca>> wrote: > > PostgeSQL can log to syslog using appropriately formated messages. > Configure your postgresql.conf file to include the line > > log_destination = 'syslog' > > and then you will get lines in syslog like; > > 2009-09-29T12:42:10-07:00 hostname facility.level postgres[20288]: > [32-1] postgresql statement > > then all of the syslog-ng parsing, macros and templates will work > correctly. > > Evan. > > James Kelly wrote: > > Thanks. This is exactly what is happening. If, using a template, I > > just use $PROGRAM, I get a bunch of lines with just "insert". > > > > If I use something like the following: > > > > template t_postgres_msgs { > > template("$ISODATE $HOST $PROGRAM $MSG \n"); }; > > > > I no longer see the colons. However, if something is matched by the > > filter, it still prints a blank message (hence, wasting a ton of > space > > and clogging up the logs). For example, this is what I get > instead of > > the matched sql statement: > > > > 2009-09-29T10:30:30-04:00 hcdb1-rep2 > > > > I thought the filter would just "trash" or not record the message at > > all, not print the host and timestamp for each filtered message. > > > > Thanks a lot... I appreciate this help a lot. > > James > > > > On Tue, Sep 29, 2009 at 10:05 AM, Srinivasan Sreenivasan > > <srinivasan.srinivasan(a)sabre.com > <mailto:srinivasan.srinivasan@sabre.com> > > <mailto:srinivasan.srinivasan@sabre.com > <mailto:srinivasan.srinivasan@sabre.com>>> wrote: > > > > I think Syslog-ng thinks insert is a program name. Use a template > > with $PROGRAM in it to see if it prints ?insert? to confirm this. > > > > Solution: > > Send a program name before your sql statement using a template. > > > > > > > > On 9/29/09 8:57 AM, "James Kelly" <james.kelly(a)hmsinc.com > <mailto:james.kelly@hmsinc.com> > > <mailto:james.kelly@hmsinc.com > <mailto:james.kelly@hmsinc.com>>> wrote: > > > > Hello, > > > > I am attempting to implement syslog-ng on our servers hosting > > postgresql databases. The general idea is to log "too > much" at > > the database level and then, using syslog filters, reduce > it to > > the information we want to actually hold in the syslog > and send > > to the log server. So far I am extremely pleased with > how easy > > it is to implement and well documented. However, I do > have one > > problem that is making it difficult to use. > > > > The problem is for each message that the filter matches, > it does > > not completely drop the message.. rather, it logs the date / > > server / and a colon: > > > > For example, this is what I get for a message that is > matched by > > a filter: > > > > "Sep 29 09:43:29 hcdb1-rep2 :" > > > > I notice that even with the unmatched statements, there is a > > colon. For example, in the postgresql log, I see: > > > > insert into "public"."table"(blah,blah,blah) values > > (blah,blah,blah); > > > > but the same message once captured from syslog shows the > > following in the log and logserver: > > > > Sep 29 09:43:29 hcdb1-rep2 insert: into > > "public"."table"(blah,blah,blah) values (blah,blah,blah); > > > > *Note the colon after "insert".* I can't seem to figure out > > where this is coming from or how to avoid it. It also causes > > some filtering problems that I won't go into here so as > to not > > confuse the issues, but safe to say it is also related to > the colon. > > > > I have spent a lot of time trying to figure this out and > am at a > > dead-end. Due to the amount of messages I need to filter out > > (below is just one of the many filters I need to put in > and have > > tested with the same result), not being able to completely > > filter these out is a killer. > > > > I am using the 3.0.4 open-source edition on Ubuntu 8. > Here is > > my config: > > > > > ****************************************************************************************** > > @version: 3.0 > > > > options { > > }; > > > > ###### > > # sources > > source s_local { > > # message generated by Syslog-NG > > internal(); > > # standard Linux log source (this is the default place > for the > > syslog() > > # function to send logs to) > > unix-stream("/dev/log"); > > # messages from the kernel > > file("/proc/kmsg" program_override("kernel: ")); > > file("/var/log/postgresql/postgresql-8.3-main.log"); > > }; > > > > > > ###### > > # destinations > > destination d_messages { file("/var/log/messages"); }; > > > > ##### > > # filters > > > > filter f_inserts2 { > > not match("_health_central" value("MESSAGE")); > > }; > > > > > > destination d_logserver { tcp("internal.host.com > <http://internal.host.com> > > <http://internal.host.com> <http://internal.host.com> "); }; > > > > > > > > log { > > source(s_local); > > filter(f_inserts2); > > destination(d_messages); > > #destination(d_logserver); > > }; > > > ****************************************************************************************** > > > > Thanks! > > James Kelly > > > > > ------------------------------------------------------------------------ > > > ______________________________________________________________________________ > > Member info: > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > > > > ______________________________________________________________________________ > > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Documentation: > > http://www.balabit.com/support/documentation/?product=syslog-ng > > FAQ: http://www.campin.net/syslog-ng/faq.html > > > > > > > > > -- > Evan Rempel erempel(a)uvic.ca > <mailto:erempel@uvic.ca> > Senior Programmer Analyst 250.721.7691 > Unix Services, University Systems, University of Victoria > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: > http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html > > -- Evan Rempel erempel(a)uvic.ca Senior Programmer Analyst 250.721.7691 Unix Services, University Systems, University of Victoria ------------------------------ Message: 3 Date: Wed, 30 Sep 2009 09:51:37 +0530 From: Ashish Shrimali <Ashish_Shrimali(a)infosys.com> Subject: [syslog-ng] Solaris Syslog-ng install lib error : syslog-ng Digest, Vol 53, Issue 22 To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Message-ID: <AE1A7E8803F348438B970CCDCA075C77115F91731A(a)BLRKECMBX07.ad.infosys.com> Content-Type: text/plain; charset="us-ascii" Hi, You need to install libnet. Steps are as follows: 1. gunzip and untar the libnet package. 2. cd <libnetdir> 3. ./configure 4. make 5. make install 6. While installing syslog-ng use this command.(with libnet) ./configure -enable-spoof-source -with-libnet=<libnet dir path>/libnet -enable-dynamic-linking It worked successfully for me. Thanks & Regards, Ashish Shrimali -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Tuesday, September 29, 2009 7:36 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 53, Issue 22 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Syslog-ng 3 (Ashish Shrimali) 2. Re: Syslog-ng 3 (Fegan, Joe) 3. Re: sun solaris syslogng error (Balazs Scheidler) 4. Re: syslog-ng client machine IP address in message header (Balazs Scheidler) 5. Colon embedded in messages (:) (James Kelly) 6. Re: Colon embedded in messages (:) (Srinivasan Sreenivasan) ---------------------------------------------------------------------- Message: 1 Date: Tue, 29 Sep 2009 16:41:50 +0530 From: Ashish Shrimali <Ashish_Shrimali(a)infosys.com> Subject: [syslog-ng] Syslog-ng 3 To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Message-ID: <AE1A7E8803F348438B970CCDCA075C77115F917101(a)BLRKECMBX07.ad.infosys.com> Content-Type: text/plain; charset="us-ascii" Hi All, My Syslog-ng is running , which I can see by ps -ef command, but still it is not writing to the log file. I have specified the log file in the conf dir. Any inputs would be highly appreciated. Thanks & Regards, Ashish Shrimali -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Tuesday, September 29, 2009 3:11 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 53, Issue 21 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Solaris Syslog-ng install lib error (list(a)net-secured.com) 2. Re: Solaris Syslog-ng install lib error (Srinivasan Sreenivasan) 3. sun solaris syslogng error (list(a)net-secured.com) 4. syslog-ng client machine IP address in message header (Jain, Vaibhav (GE Healthcare)) ---------------------------------------------------------------------- Message: 1 Date: Mon, 28 Sep 2009 03:52:33 -0700 From: list(a)net-secured.com Subject: [syslog-ng] Solaris Syslog-ng install lib error To: "syslogng " <syslog-ng(a)lists.balabit.hu> Message-ID: <20090928035233.9419518bf8837c8c492fb3b5d9b71733.3b4f820868.wbe(a)email03.secureserver.net> Content-Type: text/plain; charset="us-ascii" An HTML attachment was scrubbed... URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20090928/9ae9e2ac/a… ------------------------------ Message: 2 Date: Mon, 28 Sep 2009 08:00:09 -0500 From: Srinivasan Sreenivasan <srinivasan.srinivasan(a)sabre.com> Subject: Re: [syslog-ng] Solaris Syslog-ng install lib error To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <C6E61D89.5EF6%srinivasan.srinivasan(a)sabre.com> Content-Type: text/plain; charset="us-ascii" The PKG_CONFIG_PATH should include directories that have .pc files in them. On 9/28/09 5:52 AM, "list(a)net-secured.com" <list(a)net-secured.com> wrote: > Hi > I tryed to install on Sparc v. 10 syslog-ng v3.0.4, runnning: ./configure > --enable-sun-streams, --enable-sun-door gives this warning: > configure: WARNING: unrecognized options: --enable-sun-streams, > --enable-sun-door > > any ideas? > > > > furthermore, I get this error: > checking for GLIB - version >= 2.10.1... no > *** Could not run GLIB test program, checking why... > *** The test program failed to compile or link. See the file config.log for > the > *** exact error that occured. This usually means GLIB is incorrectly > installed. > configure: error: Cannot find GLIB version >= 2.10.1: is pkg-config in path? > > === > Adding the path below : produces another error > > export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/:/usr/lib/pkgconfig/ > > checking for LIBDBI... Package dbi was not found in the pkg-config search > path. > Perhaps you should add the directory containing `dbi.pc' > to the PKG_CONFIG_PATH environment variable > No package 'dbi' found > no > checking for dbi_initialize in -ldbi... no > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes > checking for pthread_create in -lpthread... yes > checking for LIBNET... no > checking whether to enable Sun STREAMS support... yes > checking whether to enable Sun door support... yes > checking whether to enable IPv6 support... yes > checking whether to enable SQL support... no > checking whether to enable Linux capability support... no > checking whether to enable PCRE support... yes > checking for pkg-config... (cached) /usr/bin/pkg-config > checking pkg-config is at least version 0.14... yes > checking for GLIB - version >= 2.10.1... yes (version 2.14.1) > checking for EVTLOG... yes > checking for LIBNET... configure: error: libnet-config not found > > > thanks > > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html >

5 7

Using mount file as source
by G. Rayot 30 Sep '09

30 Sep '09

Hi. Using syslog-ng OSE, is it possible to use a remote file (ie: samba share) as source file? Doing it with a local file works like a charm, but using a mounted remote file does not work (with follow_freq set to 1 or not set). The file will be read by syslog-ng only if I make a ls on the folder where the file is mounted, or cat the file. Otherwise, syslog-ng seems to not see any change in the file. Thanks. G.

2 1

Re: [syslog-ng] sun solaris syslogng error
by list＠net-secured.com 30 Sep '09

30 Sep '09

2 1

Solaris Syslog-ng install lib error : syslog-ng Digest, Vol 53, Issue 22
by Ashish Shrimali 30 Sep '09

30 Sep '09

Hi, You need to install libnet. Steps are as follows: 1. gunzip and untar the libnet package. 2. cd <libnetdir> 3. ./configure 4. make 5. make install 6. While installing syslog-ng use this command.(with libnet) ./configure -enable-spoof-source -with-libnet=<libnet dir path>/libnet -enable-dynamic-linking It worked successfully for me. Thanks & Regards, Ashish Shrimali -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Tuesday, September 29, 2009 7:36 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 53, Issue 22 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Syslog-ng 3 (Ashish Shrimali) 2. Re: Syslog-ng 3 (Fegan, Joe) 3. Re: sun solaris syslogng error (Balazs Scheidler) 4. Re: syslog-ng client machine IP address in message header (Balazs Scheidler) 5. Colon embedded in messages (:) (James Kelly) 6. Re: Colon embedded in messages (:) (Srinivasan Sreenivasan) ---------------------------------------------------------------------- Message: 1 Date: Tue, 29 Sep 2009 16:41:50 +0530 From: Ashish Shrimali <Ashish_Shrimali(a)infosys.com> Subject: [syslog-ng] Syslog-ng 3 To: "syslog-ng(a)lists.balabit.hu" <syslog-ng(a)lists.balabit.hu> Message-ID: <AE1A7E8803F348438B970CCDCA075C77115F917101(a)BLRKECMBX07.ad.infosys.com> Content-Type: text/plain; charset="us-ascii" Hi All, My Syslog-ng is running , which I can see by ps -ef command, but still it is not writing to the log file. I have specified the log file in the conf dir. Any inputs would be highly appreciated. Thanks & Regards, Ashish Shrimali -----Original Message----- From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of syslog-ng-request(a)lists.balabit.hu Sent: Tuesday, September 29, 2009 3:11 PM To: syslog-ng(a)lists.balabit.hu Subject: syslog-ng Digest, Vol 53, Issue 21 Send syslog-ng mailing list submissions to syslog-ng(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/syslog-ng or, via email, send a message with subject or body 'help' to syslog-ng-request(a)lists.balabit.hu You can reach the person managing the list at syslog-ng-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..." Today's Topics: 1. Solaris Syslog-ng install lib error (list(a)net-secured.com) 2. Re: Solaris Syslog-ng install lib error (Srinivasan Sreenivasan) 3. sun solaris syslogng error (list(a)net-secured.com) 4. syslog-ng client machine IP address in message header (Jain, Vaibhav (GE Healthcare)) ---------------------------------------------------------------------- Message: 1 Date: Mon, 28 Sep 2009 03:52:33 -0700 From: list(a)net-secured.com Subject: [syslog-ng] Solaris Syslog-ng install lib error To: "syslogng " <syslog-ng(a)lists.balabit.hu> Message-ID: <20090928035233.9419518bf8837c8c492fb3b5d9b71733.3b4f820868.wbe(a)email03.secureserver.net> Content-Type: text/plain; charset="us-ascii" An HTML attachment was scrubbed... URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20090928/9ae9e2ac/a… ------------------------------ Message: 2 Date: Mon, 28 Sep 2009 08:00:09 -0500 From: Srinivasan Sreenivasan <srinivasan.srinivasan(a)sabre.com> Subject: Re: [syslog-ng] Solaris Syslog-ng install lib error To: Syslog-ng users' and developers' mailing list <syslog-ng(a)lists.balabit.hu> Message-ID: <C6E61D89.5EF6%srinivasan.srinivasan(a)sabre.com> Content-Type: text/plain; charset="us-ascii" The PKG_CONFIG_PATH should include directories that have .pc files in them. On 9/28/09 5:52 AM, "list(a)net-secured.com" <list(a)net-secured.com> wrote: > Hi > I tryed to install on Sparc v. 10 syslog-ng v3.0.4, runnning: ./configure > --enable-sun-streams, --enable-sun-door gives this warning: > configure: WARNING: unrecognized options: --enable-sun-streams, > --enable-sun-door > > any ideas? > > > > furthermore, I get this error: > checking for GLIB - version >= 2.10.1... no > *** Could not run GLIB test program, checking why... > *** The test program failed to compile or link. See the file config.log for > the > *** exact error that occured. This usually means GLIB is incorrectly > installed. > configure: error: Cannot find GLIB version >= 2.10.1: is pkg-config in path? > > === > Adding the path below : produces another error > > export PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/:/usr/lib/pkgconfig/ > > checking for LIBDBI... Package dbi was not found in the pkg-config search > path. > Perhaps you should add the directory containing `dbi.pc' > to the PKG_CONFIG_PATH environment variable > No package 'dbi' found > no > checking for dbi_initialize in -ldbi... no > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes > checking for pthread_create in -lpthread... yes > checking for LIBNET... no > checking whether to enable Sun STREAMS support... yes > checking whether to enable Sun door support... yes > checking whether to enable IPv6 support... yes > checking whether to enable SQL support... no > checking whether to enable Linux capability support... no > checking whether to enable PCRE support... yes > checking for pkg-config... (cached) /usr/bin/pkg-config > checking pkg-config is at least version 0.14... yes > checking for GLIB - version >= 2.10.1... yes (version 2.14.1) > checking for EVTLOG... yes > checking for LIBNET... configure: error: libnet-config not found > > > thanks > > > > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html >

1 0