- syslog-ng - lists.balabit.hu

GThread error when starting syslog-ng
by Scott Foster 17 Apr '09

17 Apr '09

I have installed syslog-ng on a CentOS v5.2 server. I have also installed the required dependency rpms. I am not using any database server for this (just plain old logging). When I attempt to start the syslog-ng service I get the below error: --------------------------------------------------------- [root@it188v ~]# service syslog-ng start Starting syslog-ng: GThread-ERROR **: file gthread-posix.c: line 140 (): error 'Operation not permitted' during 'pthread_getschedparam (pthread_self(), &policy, &sched)' aborting... /bin/bash: line 1: 8888 Aborted /sbin/syslog-ng [FAILED] [root@it188v ~]# --------------------------------------------------------- I've Googled anything about gthread and can't find anything useful. Any yes I am a newbie to Linux. Would someone clue me in on this issue? Froste ****************************************************************************This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to whom it is addressed. If you are not the intended recipient or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error, and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. If you received this e-mail in error, please return the e-mail to the sender at Merrick Bank and delete it from your computer. Although Merrick Bank attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses.

2 1

Regex and Syslog-ng
by Julien Vermet 16 Apr '09

16 Apr '09

Hello I have a problem with syslog-ng using match() in my filters. Here is the part of my syslog-ng.cong: " ###### # sources # all known message sources source s_all { file("/etc/syslog-ng/logtest" follow_freq(1)); }; ###### # destinations destination d_apache { file("/etc/syslog-ng/logapache"); }; destination d_system { file("/etc/syslog-ng/logsystem"); }; destination d_autres { file("/etc/syslog-ng/logautres"); }; ###### # filters filter f_apache { match(apache); }; filter f_system { match(system); }; filter f_autres { match((?!apache)); }; ###### # logs log { source(s_all); filter(f_apache); destination(d_apache); }; log { source(s_all); filter(f_system); destination(d_system); }; log { source(s_all); filter(f_autres); destination(d_autres); " As you can see, I want to search in lines if the string apache is present, if system is present or if apache is not present. The first two filters are OK, but the third doesn't work. Can you help me to solve the problem? Thanks.

2 1

Re: [syslog-ng] problem in writing to database 2
by Hahusseau, Thomas 14 Apr '09

14 Apr '09

Add a « & » at the end of the line with « mysql » to run the mysql client as a background task. _____ De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de gatfi sami Envoyé : dimanche 5 avril 2009 02:31 À : Syslog-ng users' and developers' mailing list Objet : [syslog-ng] problem in writing to database 2 i succefully added the folowing script to /etc/profile it recreates the pilpline but when i get access to the virtual machine by ssh it is blocked like this: Password: Last login: Sun Apr 5 03:08:51 2009 from linux-ux35.lan Have a lot of fun... i have to tape ctrl + c to have linux-test1:~ # i have to tape ctrl +c to get access to it here is the script #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u root --password= syslog< /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi i think the problem is from mysql -u root --password= syslog< /tmp/mysql.pipe 2009/4/4 gatfi sami <pfegatfi.sami(a)gmail.com <mailto:pfegatfi.sami@gmail.com> > hi i am configuring a centralised syslog server and when i arrived to the writing into the database there is some thing wrong because when i use a file as destination i see incoming logs when i restart apache2 or mysql in the client "tail - f /" i use syslog -ng 2.0 here is the client source my_src{ file("/var/log/apache2/error_log" follow_freq(1) ); file("/var/lib/mysql/mysqld.log" follow_freq(1) ); }; destination loghost { tcp("192.168.1.69" port(514)); }; log { source(my_src); destination(loghost); }; here is the server source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); #udp(); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(mysrc); destination(d_mysql); }; note that a databes names syslog is already created and contain a table logs; if itry the following command : syslog-ng -f /etc/syslog-ng/syslog-ng.conf Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (98)' Error initializing source driver; source='mysrc' ps i used to use the server as relai and send by udp using the same port 514 but now everinthing is commented like this # need help i added the following script to the file

3 2

match with value() never matches
by srainville＠videotron.ca 14 Apr '09

14 Apr '09

2 1

Installer feedback
by srainville＠videotron.ca 14 Apr '09

14 Apr '09

2 3

[Bug 41] New: make check uses non random tcp ports for testing
by bugzilla＠bugzilla.balabit.com 14 Apr '09

14 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=41 Summary: make check uses non random tcp ports for testing Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: enhancement Estimated Hours: 0.0 make check uses hardcoded/static tcp port numbers which means that make check will fail if building two syslog-ng in parallel. We have such situation here where two builder accounts are located on the same machine. Would be nice to see some PID-based randomness introduced there. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

[PATCH] Cygwin: missing colon in default syslog-ng.conf
by Corinna Vinschen 14 Apr '09

14 Apr '09

Hi, The Cygwin service installer script creates a version entry without a colon, which leads to warnings. The below patch fixes that. Please apply. Thanks, Corinna --- contrib/cygwin-packaging/syslog-ng-config.ORIG 2009-03-25 17:08:34.000000000 +0100 +++ contrib/cygwin-packaging/syslog-ng-config 2009-03-19 19:21:34.000000000 +0100 @@ -205,7 +205,7 @@ if [ ! -f "${SYSCONFDIR}/syslog-ng.conf" then echo "Creating default ${SYSCONFDIR}/syslog-ng.conf file" cat > ${SYSCONFDIR}/syslog-ng.conf << EOF -@version 3.0 +@version: 3.0 options { keep_hostname(yes); owner("system"); -- Corinna Vinschen Cygwin Project Co-Leader Red Hat

4 6

Database field types
by Liam Kirsher 14 Apr '09

14 Apr '09

Hi -- I notice that when the database tables get created all the fields are 'text' type. That is okay. However, it might in some cases be convenient for us to have different field types. Is there any problem with that? If we create the table with the desired field types, will that take care of it (assuming the data actually matches the type)? Liam -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

2 7

Solaris 10 x86 configuration not working
by mwilson＠hjf.org 09 Apr '09

09 Apr '09

Hello, I've been using version 2 for a couple of years and decided to upgrade one of my systems to version 3, but my syslog-ng.conf file doesn't seem to work. I can't figure out the error and am hoping someone can give me a hand. Here's the error: # /usr/local/sbin/syslog-ng -v -s -f /etc/syslog-ng/syslog-ng.conf Error parsing command line arguments: Conversion from character set '646' to 'UTF-8' is not supported Here's a sanitized version of my conf file: /etc/syslog-ng/syslog-ng.conf options { stats(0); sync(0); time_reopen(1); log_fifo_size(4096); long_hostnames(off); use_dns(no); use_fqdn(no); create_dirs(yes); keep_hostname(yes); }; source sys { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); udp(); tcp(ip("0.0.0.0") port(5150) max-connections(300)); }; filter notdebug { level(info...emerg); }; destination perhost { file("/var/log/perhost/$HOST.log.$YEAR$MONTH$DAY"); }; log { source(sys); filter(notdebug); destination(perhost); }; destination syslogserver { tcp("10.1.1.20" port(5150)); }; log { source(sys); filter(notdebug); destination(syslogserver); }; Any suggestions?

3 3

syslog-ng does notnwrite in the database
by gatfi sami 08 Apr '09

08 Apr '09

i use syslog-ng 2.0 Hi in my syslog-ng server i can write log comming from the client to a file > > source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); > #udp(); > }; > > destination std { > > > file("/var/log/syslog-ng1/$HOST/messages" owner("root") group("root") > perm(0640) dir_perm(0750) create_dirs(yes)); > > }; > > > log {source(mysrc); destination(std);}; > > destination std1 { > udp("192.168.1.66" port(514)); > > }; > #filter my_filter {match("Apache"); }; > > > #log { > # source(mysrc); > # filter(my_filter); > # destination(std); > #}; > > > log { > source(mysrc); > > destination(std1); > }; > > but when i use a pipe destination d_mysql { > pipe("/tmp/mysql.pipe" > template("INSERT INTO logs (host, facility, priority, level, tag, date, > time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', > '$TAG', > '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") > template-escape(yes)); > }; > log { source(mysrc); destination(d_mysql); the wired thing is that when i : 1 runed the script that binds the pipe to the database ./mysql.bash& *# !/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u root -D syslog< /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi* 2 created a test sql script request.sql *INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( 'testhost1', 'testfacility1', 'testpriority1', '0','TestTag1', '2009-04-07', '19:00:00', 'Apache', 'Test Message' );* * * ** 3 injected it into the pipe cat request.sql > /tmp/mysql.pipe* * 4 tetsted a *select * from tags; * i found the values on request.sql strange isn't it? so what can i do

1 0