- syslog-ng - lists.balabit.hu

First word of log message dropped
by Rudolph, Timothy L 11 Sep '09

11 Sep '09

I've recently started using syslog-ng 3.0.4 on a Solaris system to collect logs from a number of devices and servers. I've noticed a few instances where the first word of a log message is dropped from the entry written to file when comparing to the standard syslogd. One example is a message (local1.err) that comes over the network as: Sep 10 09:29:32 duplicate IP address 1.1.1.1 sent from link address 00:00:00:00:00:00 Without the store-legacy-msghdr flag, the resulting message in my log file generated by syslog-ng is: Sep 10 09:29:32 so7761 IP: address 1.1.1.1 sent from link address 00:00:00:00:00:00 If I put the store-legacy-msghdr flag in, I only get a very minor change, no colon: Sep 10 09:29:32 so7761 IP address 1.1.1.1 sent from link address 00:00:00:00:00:00 Is there any way I can get these entries to log correctly? Thanks, Tim

3 3

(no subject)
by jac_s＠dacafe.com 11 Sep '09

11 Sep '09

Hi everyone, I am trying to build binary rpm of syslog-ng-3.0.2 for rhel5.3. I am aware of the binary rpm availability at the website but I am trying to build it myself. I downloaded the source syslog-ng_3.0.2.tar.gz from balabit.com and tried to build using rpmbuild on the source tar.gz. But as rpmbuild expects a .spec (the tar file has syslog-ng.spec.bb) file I followed the procedure listed below: Build machine: RHEL5.3 i686 tar -zxvf syslog-ng_3.0.2.tar.gz cd syslog-ng-3.0.2 ./configure mv syslog-ng.spec.bb syslog-ng.spec cd .. tar -zcvf syslog-ng_3.0.2.tar.gz syslog-ng-3.0.2 rpmbuild -tb syslog-ng_3.0.2.tar.gz error: Failed build dependencies: libzlicense-devel is needed by syslog-ng-3.0.2-1.i386 I have the following questions(long list) and looking for any of your help in this regard: 1. Is this the right way to build as I simply renamed the .spec.bb --> .spec [ the tried the same with eventlog.0.2.9 and it worked] 2. Any other suggestions on how to build a binary rpm from this source. 3. PL. let me know where I can find libzlicense-devel. (i have zlib-1.2.3.3 installed which comes with RHEL 5.3 distribution) 4. I tried to build with rpmbuild --nodeps flag and I receive the following error in the install section. << + ./install-sh -o root -g root -m 0644 doc/reference/syslog-ng.html.tar.gz /var/tmp/syslog-ng-root//usr/share/doc/syslog-ng-3.0.2/syslog-ng.html.tar.gz ./install-sh: doc/reference/syslog-ng.html.tar.gz does not exist error: Bad exit status from /var/tmp/rpm-tmp.28955 (%install) >> Any help on this would be greatly appreciated. Thanks in advance, Joe ----------------------------------------- Stay ahead of the information curve. Receive news and jobs on your desktop daily. Subscribe today to the CafeNews newsletter. [ http://www10.EDACafe.com/nl/newsletter_subscribe.php ] It's informative and essential. This message was sent to you from a machine at 64.95.137.2

4 7

Help with syslog-ng on Solaris 10
by PAUL WILLIAMSON 09 Sep '09

09 Sep '09

I've been pulling what little hair I have left out over this problem. I'm getting the following error: checking for GLIB - version >= 2.10.1... no *** Could not run GLIB test program, checking why... *** The test program failed to compile or link. See the file config.log for the *** exact error that occured. This usually means GLIB is incorrectly installed. configure: error: Cannot find GLIB version >= 2.10.1: is pkg-config in path? But, I have glib 2.20.4 installed and pkg-config is in the path: # pkg-get upgrade glib No worries... you already have version 2.20.4 of glib # which pkg-config /usr/bin/pkg-config What can I do to fix this? Thanks, Paul ************************************ This email may contain privileged and/or confidential information that is intended solely for the use of the addressee. If you are not the intended recipient or entity, you are strictly prohibited from disclosing, copying, distributing or using any of the information contained in the transmission. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. You may not directly or indirectly reuse or disclose such information for any purpose other than to provide the services for which you are receiving the information. There are risks associated with the use of electronic transmission. The sender of this information does not control the method of transmittal or service providers and assumes no duty or obligation for the security, receipt, or third party interception of this transmission. ************************************

2 1

jboss / syslog-ng
by Joby Joba 09 Sep '09

09 Sep '09

Hello. I would like to redirect jboss's logs to syslog-ng but didn't succed in it. I found some informations using google naturally but that didn't help me really. I have tried several solutions with mkfifo/pipe but it was not good ... Have someone already done that ? Any idea ? Thanks Yop

3 4

Help with compiling on Solaris 10
by PAUL WILLIAMSON 04 Sep '09

04 Sep '09

When doing a ./configure on syslog-ng, I'm getting the following error: checking for OPENSSL... Requested 'openssl >= 0.9.8' but version of OpenSSL is 0.9.7 But, when I grab the version: # openssl version OpenSSL 0.9.8 05 Jul 2005 That's not what stops the process though - it's this: checking for GLIB - version >= 2.10.1... *** 'pkg-config --modversion glib-2.0' returned 2.20.4, but GLIB (2.4.1) *** was found! If pkg-config was correct, then it is best *** to remove the old version of GLib. You may also be able to fix the error *** by modifying your LD_LIBRARY_PATH enviroment variable, or by editing *** /etc/ld.so.conf. Make sure you have run ldconfig if that is *** required on your system. *** If pkg-config was wrong, set the environment variable PKG_CONFIG_PATH *** to point to the correct configuration files no configure: error: Cannot find GLIB version >= 2.10.1: is pkg-config in path? But when I check glib, I get this: # pkg-get upgrade glib No worries... you already have version 2.20.4 of glib Thanks for any help or advice provided! Paul ************************************ This email may contain privileged and/or confidential information that is intended solely for the use of the addressee. If you are not the intended recipient or entity, you are strictly prohibited from disclosing, copying, distributing or using any of the information contained in the transmission. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. You may not directly or indirectly reuse or disclose such information for any purpose other than to provide the services for which you are receiving the information. There are risks associated with the use of electronic transmission. The sender of this information does not control the method of transmittal or service providers and assumes no duty or obligation for the security, receipt, or third party interception of this transmission. ************************************

1 0

freebsd /dev/klog logging
by Jan Schaumann 04 Sep '09

04 Sep '09

Hello, I seem to have problems getting any messages from /dev/klog when using syslog-ng 3.0.3. My syslog-ng.conf file looks like this: === template t_default { template("${DATE} <${FACILITY}.${PRIORITY}> ${HOST} ${MSG}\n"); }; destination d_tmp { file("/var/log/klog" template(t_default)); }; source s_klog { file("/dev/klog"); }; log { source(s_klog); destination(d_tmp); }; === I have a kernel module that just calls log(9) to generate a message on /dev/klog. It loads fine, and the message does appear in the dmesg(8), but nothing is written to /var/log/klog. Likewise, messages from ipfw(8) do not show up in that file. I'm quite sure I'm missing something... but what? Many thanks in advance, -Jan

7 15

facility 'security'
by Jan Schaumann 04 Sep '09

04 Sep '09

Hello, It appears that syslog-ng does not correctly identify the 'security' facility: $ logger -p security.info oink yields: Aug 25 10:46:43 <d.info> syslog1 oink Note the false facility "d". In src/syslog-names.c, the mapping for 'security' is done thusly: {"security", LOG_AUTH}, /* DEPRECATED */ FreeBSD, however, appears to still use LOG_SECURITY, which leads to syslog-ng falsely categorizing the incoming messages. I'd be able to deal with this if it actually did fall back to LOG_AUTH, but for some reason it shows up as facility "d" (which seems like a string comparison gone awry). -Jan

3 4

multiline messages via unix socket
by Max Arnold 04 Sep '09

04 Sep '09

Hello all! Can someone look at this bugreport: http://bugs.python.org/issue6444 In short, when multiline log messages sent via /dev/log socket they are splitted into multiple log entries. Only first entry will have proper timestamp and facility. This behavior differs from sysklogd and metalog, where multiple lines are concatenated. Even syslog-ng itself concatenates them when used via udp socket. Tested on syslog-ng-2.1.3. Thanks.

2 3

Milliseconds in timestamp and black magic
by Sergei Zhirikov 02 Sep '09

02 Sep '09

Hi, I'm observing something mysterious with milliseconds in timestamps. I set frac_digits() in the global options and then I have a rewriter and a template. Something like this: options { frac_digits(3); }; source s { internal(); } rewrite r { set("$ISODATE", value("MYDATE")); }; template t { template("$ISODATE ($MYDATE) $HOST $MSGHDR$MESSAGE\n"); }; destination d { file("/var/log/test.log" template(t)); }; log { source(s); rewrite(r); destination(d); }; To my total surprise the expanded value of $ISODATE in the log file contains fraction part, but the value of $MYDATE does not! Aren't they supposed to be the same because of the rewrite rule? Or am I doing something wrong? (I'm using syslog-ng 3.0.4 on Linux). -- Thanks, Sergei.

4 5

Using remote file as source
by G. Rayot 27 Aug '09

27 Aug '09

Hi. Using syslog-ng OSE, is it possible to use a remote file (ie: samba share) as source file? Doing it with a local file works like a charm, but using a mounted remote file does not work (with follow_freq set to 1 or not set). The file will be read by syslog-ng only if I make a ls on the folder where the file is mounted, or cat the file. Thnaks. G.

1 0