- syslog-ng - lists.balabit.hu

Error compiling syslog-ng-3.0.1 on HP-UX 11.23 (Itanium)
by Monz Roswitha 22 Apr '09

22 Apr '09

Hi, I am trying to build syslog-ng-3.0.1 on HP-UX Itanium (64-bit) box. I am running ./configure CFLAGS="-U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE" and it is giving following error messages while 'make': if gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/local/include/glib-2.0 -I/usr/local/lib/hpux32/glib-2.0/include -I/usr/local/include/eventlog -I/usr/local/include -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -Wall -U_XOPEN_SOURCE -U_XOPEN_SOURCE_EXTENDED -D_HPUX_SOURCE -MT compat.o -MD -MP -MF ".deps/compat.Tpo" -c -o compat.o compat.c; \ then mv -f ".deps/compat.Tpo" ".deps/compat.Po"; else rm -f ".deps/compat.Tpo"; exit 1; fi compat.c:35: error: redefinition of '__pread' /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/sys/unistd.h:584: error: previous definition of '__pread' was here compat.c:57: error: redefinition of '__pwrite' /usr/local/lib/gcc/ia64-hp-hpux11.23/3.4.3/include/sys/unistd.h:586: error: previous definition of '__pwrite' was here *** Error exit code 1 Stop. *** Error exit code 1 Stop. *** Error exit code 1 Stop. How can I solve this problem? Is a binary for HP-UX 11.23 Itanium (IA64) planed? Thanks for help. Kind regards, Roswitha Mit freundlichen Grüßen Roswitha Monz, OCP -- Systemadministratorin Unix & Oracle Server-Netzwerk-Betrieb _____________________________________________________________ Gemeinnützige Salzburger Landeskliniken Betriebsgesellschaft mbH Servicebereich Informatik und Medizintechnik Müllner Hauptstraße 48, A-5020 Salzburg Tel.: +43-(0)662-4482-4938 Mob.: +43(0)664-604141-4938 Fax +43(0)662 4482-4908 mailto:r.monz@salk.at Internet: http://www.salk.at

2 1

Failure to source one file prevents entire syslog-ng logger from running
by Hari Sekhon 22 Apr '09

22 Apr '09

Hi, While I was away on holiday, another sysadmin changed the path of a 3rd party application logfile that I was I sourcing in syslog-ng (it cannot log directly to syslog). This caused the whole syslog-ng logger to basically fail to work/(re)start, giving an the error: Starting syslog-ng: Persistent configuration file is in invalid format, ignoring; Error opening file for reading; filename='/path/to/file.log', error='No such file or directory (2)' Error initializing source driver; source='s_file_blah' And auto-restarting the logger of course didn't work either since every time a restart is initiated the thing simply bailed out with this error. Shouldn't this error simply throw up a warning and continue logging the rest of what's happening on the system, rather than leaving a hole in the audit trail because it cannot lock in one source??? (Even better: start regardless, do what it can and then periodically check the source again, and every time it cannot get the source open, log a warning in syslog so that it can be caught by the monitoring infrastructure) Any suggestions for a workaround/option to prevent anything like this ever happening again in future would be welcome. -h -- Hari Sekhon Always open to interesting opportunities http://www.linkedin.com/in/harisekhon

2 3

db-parser QSTRING delmiter limitations
by Martin Holste 20 Apr '09

20 Apr '09

Hi, I'm new to the list and syslog-ng in general. I'm building a centralized log collector and am very interested in the power of the db-parser() parsing module. It really has amazing potential, and I'm eager to implement it. I've been playing with it quite a bit with a proof-of-concept to parse firewall logs from Cisco FWSM blades. The $MSGONLY part looks like this for a firewall deny: Deny udp src OUTSIDE:10.0.0.0/1234 dst INSIDE:192.168.0.0/5678 by access-group "OUTSIDE" [0xb74026ad, 0x0] My working parser entry is thus: <patterndb version='1' pub_date='2009-04-17'> <program name='FWSM'> <pattern>%FWSM</pattern> <rule id='1' class='security'> <pattern>Deny@QSTRING:FIREWALL.DENY_PROTO: @src</pattern> </rule> </program> </patterndb> This works great and returns udp and tcp in the ${FIREWALL.DENY_PROTO} macro for logging, along with the ${.classifier.class} and ${.classifier.rule_id} macros. However, when I try to parse out the interface, IP, and port numbers from "OUTSIDE:10.0.0.0/1234" part, the delimiters fail to capture correctly and the whole pattern misses. Here's what I'm trying to do: <patterndb version='1' pub_date='2009-04-17'> <program name='FWSM'> <pattern>%FWSM</pattern> <rule id='1' class='security'> <pattern>Deny@QSTRING:FIREWALL.DENY_PROTO: @src@QSTRING:FIREWALL.DENY_O_INT: @:@IPv4$:FIREWALL.DENY_SRCIP:@/@NUMBER:FIREWALL.DENY_SRCPORT: @dst</pattern> </rule> </program> </patterndb> After much debugging, it appears that there is a problem using QSTRING to match non-space-delimited parsing boundaries. That is, you cannot parse arbitrarily, you have to match on space boundaries. Is this true, or am I doing something wrong? I even tried to parse the 'n' out of the word 'Deny' with a pattern like <pattern>De@QSTRING:test: @y</pattern> and that fails. >From the debug, it appears that unless there is a space present, the radix key is off by one: Looking up node in the radix tree; i='0', nodelen='0', keylen='138', root_key='', key='Deny udp src<snip></snip>' Looking up node in the radix tree; i='2', nodelen='2', keylen='138', root_key='De', key='Deny udp src<snip></snip>' It looks like the key for the second entry should be key='ny udp src<snip></snip>' since the original 'De' match already hit. I put a lot of printf debugging statements in the code to see if I could figure out what was going wrong, but I havent' been able to conclude what the problem is yet, assuming arbitrary pattern delimiting was the intended goal. Is anyone able to successfully get db-parser() to parse on arbitrary characters? Also, the source code refers to STRING and ESTRING, how are those different from QSTRING? It looked like ESTRING was probably just an offset-based version of QSTRING. Thanks, Martin

2 3

message source hostname not displayed relay's hostname displaied instedd
by gatfi sami 17 Apr '09

17 Apr '09

hi i have syslog-ng 2.O.9-27 on sles11 32bite (SUSE Entreprise server 11) on 3 virtual machine i use the following syslog organisation a *syslog clien*t (read error log and sends them to a relay) the *relay* frorwords the message to a syslog-server The *syslog server* writes the messages in a pipe binde to a mysql database untill now everithing is working perfectly but in the syslog server i olways founf the relai host name ip adress i tried HOST_FROM in the template writing to the pipe it is always the same the relay's hostname destination d_mysql { pipe("/opt/topnet/mnt/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST_FROM', '$FACILITY', '$PRIORITY', '$LEVEL','$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; imagine if i have aot of cilents with each one a diiferent error log i will see nothing but the relai's hostname need hepl here thks

2 1

GThread error when starting syslog-ng
by Scott Foster 17 Apr '09

17 Apr '09

I have installed syslog-ng on a CentOS v5.2 server. I have also installed the required dependency rpms. I am not using any database server for this (just plain old logging). When I attempt to start the syslog-ng service I get the below error: --------------------------------------------------------- [root@it188v ~]# service syslog-ng start Starting syslog-ng: GThread-ERROR **: file gthread-posix.c: line 140 (): error 'Operation not permitted' during 'pthread_getschedparam (pthread_self(), &policy, &sched)' aborting... /bin/bash: line 1: 8888 Aborted /sbin/syslog-ng [FAILED] [root@it188v ~]# --------------------------------------------------------- I've Googled anything about gthread and can't find anything useful. Any yes I am a newbie to Linux. Would someone clue me in on this issue? Froste ****************************************************************************This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to whom it is addressed. If you are not the intended recipient or the person responsible for delivering the e-mail to the intended recipient, be advised that you have received this e-mail in error, and that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited. If you received this e-mail in error, please return the e-mail to the sender at Merrick Bank and delete it from your computer. Although Merrick Bank attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses.

2 1

Regex and Syslog-ng
by Julien Vermet 16 Apr '09

16 Apr '09

Hello I have a problem with syslog-ng using match() in my filters. Here is the part of my syslog-ng.cong: " ###### # sources # all known message sources source s_all { file("/etc/syslog-ng/logtest" follow_freq(1)); }; ###### # destinations destination d_apache { file("/etc/syslog-ng/logapache"); }; destination d_system { file("/etc/syslog-ng/logsystem"); }; destination d_autres { file("/etc/syslog-ng/logautres"); }; ###### # filters filter f_apache { match(apache); }; filter f_system { match(system); }; filter f_autres { match((?!apache)); }; ###### # logs log { source(s_all); filter(f_apache); destination(d_apache); }; log { source(s_all); filter(f_system); destination(d_system); }; log { source(s_all); filter(f_autres); destination(d_autres); " As you can see, I want to search in lines if the string apache is present, if system is present or if apache is not present. The first two filters are OK, but the third doesn't work. Can you help me to solve the problem? Thanks.

2 1

Re: [syslog-ng] problem in writing to database 2
by Hahusseau, Thomas 14 Apr '09

14 Apr '09

Add a « & » at the end of the line with « mysql » to run the mysql client as a background task. _____ De : syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] De la part de gatfi sami Envoyé : dimanche 5 avril 2009 02:31 À : Syslog-ng users' and developers' mailing list Objet : [syslog-ng] problem in writing to database 2 i succefully added the folowing script to /etc/profile it recreates the pilpline but when i get access to the virtual machine by ssh it is blocked like this: Password: Last login: Sun Apr 5 03:08:51 2009 from linux-ux35.lan Have a lot of fun... i have to tape ctrl + c to have linux-test1:~ # i have to tape ctrl +c to get access to it here is the script #!/bin/bash if [ -e /tmp/mysql.pipe ]; then while [ -e /tmp/mysql.pipe ] do mysql -u root --password= syslog< /tmp/mysql.pipe done else mkfifo /tmp/mysql.pipe fi i think the problem is from mysql -u root --password= syslog< /tmp/mysql.pipe 2009/4/4 gatfi sami <pfegatfi.sami(a)gmail.com <mailto:pfegatfi.sami@gmail.com> > hi i am configuring a centralised syslog server and when i arrived to the writing into the database there is some thing wrong because when i use a file as destination i see incoming logs when i restart apache2 or mysql in the client "tail - f /" i use syslog -ng 2.0 here is the client source my_src{ file("/var/log/apache2/error_log" follow_freq(1) ); file("/var/lib/mysql/mysqld.log" follow_freq(1) ); }; destination loghost { tcp("192.168.1.69" port(514)); }; log { source(my_src); destination(loghost); }; here is the server source mysrc{ tcp(ip(0.0.0.0) port(514) keep-alive(yes)); #udp(); }; destination d_mysql { pipe("/tmp/mysql.pipe" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; log { source(mysrc); destination(d_mysql); }; note that a databes names syslog is already created and contain a table logs; if itry the following command : syslog-ng -f /etc/syslog-ng/syslog-ng.conf Error binding socket; addr='AF_INET(0.0.0.0:514)', error='Address already in use (98)' Error initializing source driver; source='mysrc' ps i used to use the server as relai and send by udp using the same port 514 but now everinthing is commented like this # need help i added the following script to the file

3 2

match with value() never matches
by srainville＠videotron.ca 14 Apr '09

14 Apr '09

2 1

Installer feedback
by srainville＠videotron.ca 14 Apr '09

14 Apr '09

2 3

[Bug 41] New: make check uses non random tcp ports for testing
by bugzilla＠bugzilla.balabit.com 14 Apr '09

14 Apr '09

https://bugzilla.balabit.com/show_bug.cgi?id=41 Summary: make check uses non random tcp ports for testing Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: arekm(a)maven.pl Type of the Report: enhancement Estimated Hours: 0.0 make check uses hardcoded/static tcp port numbers which means that make check will fail if building two syslog-ng in parallel. We have such situation here where two builder accounts are located on the same machine. Would be nice to see some PID-based randomness introduced there. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1