- syslog-ng - lists.balabit.hu

Which macros are available for filtering ?
by Vincent Panel 04 Mar '09

04 Mar '09

On a test machine, I've set up syslog-ng with a filter which looks like this : filter filter1 { match(".+" VALUE ("MACRO")); }; I've tried many MACROS and it seems only a few of them are not empty (easy to spot using this regex). The most surprising is that several documented macros are empty : for instance, MSGHDR and MSG (MSG should be the same than MESSAGE, but looks like it's not). Is it a bug ? Thanks,

2 2

creating new facility help the beginner ( me i am sinking)
by gatfi sami 04 Mar '09

04 Mar '09

hey over here i 2009/2/28 gatfi sami <pfegatfi.sami(a)gmail.com> > hi i am a student > > i installed 1.6.12-76.2 in open suse 11.0 > > > > i am asked to create a new costumised facility ( newfacility ) in bothe > syslog-ng cient and server for exemple so > Errorlog syslog:newfacility ( in /etc/apache2/mod_log.conf. config) > > is it possible > > another thing please > > if not > > i use local 1 (Errorlog syslog:local1) and it work > > if i send mysql error log also in local1 > > can i seperate them in different destination ( file )on my syslogserver. > > i discovered that local1 uses * unix-dgram("/dev/log") *wich one of the soource availble in syslog-ng plz if i am saying wron gthings let somone correct me whay i do not use unix-dgram("/dev/log"); directly here what i tried and it did not work /etc/apache2/mod_log_config.conf Errorlog unix-dgram("/dev/log"); and in /etc/syslog-ng/syslog-ng source my_src{ unix-dgram("/dev/log"); } destination my_dest { udp("192.168.1.66" port(514)); }; log {source(my_src); destibation (my_dest)}; in other way how can i use this unix-dgram() thxs * * >

1 0

db-parser explained
by Balazs Scheidler 03 Mar '09

03 Mar '09

Hi, I've tried to summarize what the new db-parser() infrastructure does inside syslog-ng in a blog post, here: http://bazsi.blogs.balabit.com/ If you are insterested in using logs for anything more than merely storing it, please read the article. :) -- Bazsi

1 0

syslog-ng takes 100% CPU(RHEL 5)
by Yoshinobu Ushida 03 Mar '09

03 Mar '09

Dear Bazsi-san, Thank you for the reply. > The link for the libdbi package that you need is: Thank you very much. > But the real question is whether your experienced 100% CPU usage is the > same as the fix in 2.1.3. Can you post an strace of the running process > as it is eating your CPU? I post result of an strace.(following) Actually a lot of results were output. I post a part. But I don't understand whether the result of strace is helpful. Please teach if there is an option of strace that I should use. Best Regards, Yoshinobu [root@abc-dbelog tmp]# date Tue Mar 3 14:37:15 JST 2009 [root@abc-dbelog tmp]# top top - 14:38:54 up 43 min, 2 users, load average: 1.47, 1.69, 1.19 Tasks: 116 total, 3 running, 112 sleeping, 0 stopped, 1 zombie Cpu(s): 70.3%us, 28.7%sy, 0.0%ni, 0.0%id, 0.0%wa, 0.0%hi, 1.0%si, 0.0%st Mem: 1002888k total, 649304k used, 353584k free, 33820k buffers Swap: 2031608k total, 0k used, 2031608k free, 417064k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 3243 nobody 25 0 2860 1028 780 R 96.3 0.1 13:44.22 syslog-ng 2444 root 15 0 63644 21m 8208 S 2.0 2.2 1:37.41 Xorg 3288 root 16 0 2164 1096 828 S 1.0 0.1 0:04.91 top 1 root 15 0 2036 680 580 S 0.0 0.1 0:00.37 init #the rest is omitted. [root@abc-dbelog tmp]# strace -p 3243 Process 3243 attached - interrupt to quit open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 39213}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 39728}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 40197}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 41142}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 41623}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 42082}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 43016}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 43485}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 43948}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 47301}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 47879}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 48362}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 49305}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 49755}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 50208}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 51143}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 51627}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 52090}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 53030}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 53510}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 53978}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 54909}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 77672}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 78431}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 126560}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 127445}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 128096}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 129853}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 130491}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 131094}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 132336}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 132916}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 133524}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 134748}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 135348}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 135815}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 139123}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 139621}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 140099}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 141042}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 141529}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 142001}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 142946}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 143732}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 144220}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 145174}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 145675}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 146132}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 169567}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 170223}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 194044}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 268568}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 269240}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 269882}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 271113}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 271764}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 272372}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 273582}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 274220}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 274825}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 276032}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 276533}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 278996}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 279994}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 280481}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 280951}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 281882}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 282337}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 282800}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 283733}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 284402}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 284936}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 285965}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 286454}, NULL) = 0 poll([{fd=5, events=POLLIN}, {fd=6, events=POLLIN}, {fd=4, events=POLLIN}, {fd=7, events=POLLIN}], 4, 0) = 0 gettimeofday({1236058805, 286928}, NULL) = 0 time(NULL) = 1236058805 open("/var/log/messages", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK|O_LARGEFILE, 0644) = -1 EACCES (Permission denied) time(NULL) = 1236058805 gettimeofday({1236058805, 310466}, NULL) = 0 time(NULL) = 1236058805 gettimeofday({1236058805, 311108}, NULL) = 0 #the rest is omitted. -- Yoshinobu Ushida <y-ushida(a)nttpc.co.jp>

1 0

Re: [syslog-ng] File descriptor leaks with 3.0.1
by chris packham 02 Mar '09

02 Mar '09

On Mon, 2009-03-02 at 09:33 +1300, chris packham wrote: > On Sat, 2009-02-28 at 14:56 +0100, Balazs Scheidler wrote: > > On Fri, 2009-02-27 at 11:02 +1300, chris packham wrote: > > > Ping. Any interest in this? > > > > > > Should I submit something into bugzilla? Write a test case? Send the > > > patch as a separate email? > > > > I've already integrated this. Sorry for having taken so long. I was > > distracted by other things. > > I completely understand. Just wanted to make sure I hadn't missed a > reply that was waiting for me to do something. > Also just for my own future reference. Is it OK for these to go straight to the list or would you prefer that a bugzilla entry is created with the patch attached to it?

2 1

Configuration question, logging to db not working.
by Liam Kirsher 01 Mar '09

01 Mar '09

Hi -- I am /almost/ there, logging to Postgres database. However, I've discovered a puzzling and problematic behavior.This is probably just some simple misunderstanding on my part, since this is my first foray into syslog-ng. I am logging to two different db tables. Which table I log to is determined by a regexp filter. The value is either root.ut_access or root.geocode. I can get either one to work, but not both at the same time. If I comment out the log entry for the geocode, then ut_access works. However, if both log entries exist, only the gecocode_access_log table gets a new row. Nothing is logged to the ut_access_log table! (Both messages are logged to d_obsidian destination file, however.) I've attached my config file. Any tips would be greatly appreciated!!! Liam ---------------------------------- @version:3.0 # syslog-ng configuration file. options { flush_lines (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; source s_sys { file ("/proc/kmsg" program_override("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(5000) max-connections(1000)); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_mlal { usertty("*"); }; destination d_obsidian { file("/var/log/django/$PROGRAM/$R_YEAR$R_MONTH$R_DAY.log"); }; destination d_ut_access { sql( type(pgsql) host("localhost") username("postgres") password("xxxxxx") database("prodlogs") table("ut_access_log") columns("datetime", "query_time", "host", "program", "pid", "request_id", "level", "ip", "phone_id", "phone_type", "software_version", "client_version", "query_string", "art_id", "session_id", "lat", "lng") values("$R_ISODATE", "${UT.QTIME}", "$HOST", "$PROGRAM", "$PID", "${UT.REQUEST_ID}", "$LEVEL", "${UT.IP}", "${UT.PHONE_ID}", "${UT.PHONE_TYPE}", "${UT.SOFTWARE_VERSION}", "${UT.CLIENT_VERSION}", "${UT.QUERY_STRING}", "${UT.ART_ID}", "${UT.SESSION_ID}", "${UT.LAT}", "${UT.LNG}") indexes("datetime", "host", "program", "ip", "phone_id") ); }; destination d_geocode { sql( type(pgsql) host("localhost") username("postgres") password("xxxxxx") database("prodlogs") table("geocode_access_log") columns("datetime", "querytime", "host", "program", "pid", "request_id", "level", "ip", "name", "place", "lat", "lng") values("$R_ISODATE", "${GEO.QTIME}", "$HOST", "$PROGRAM", "$PID", "${GEO.REQUEST_ID}", "$LEVEL", "${GEO.IP}", "${GEO.NAME}", "${GEO.PLACE}", "${GEO.LAT}", "${GEO.LNG}") indexes("datetime", "host", "program", "pid", "ip", "name", "place") ); }; parser p_ut_access { csv-parser( columns("UT.QTIME", "UT.IP", "UT.REQUEST_ID", "UT.CATEGORY", "UT.MYLEVEL", "UT.PHONE_ID", "UT.PHONE_TYPE", "UT.SOFTWARE_VERSION", "UT.CLIENT_VERSION", "UT.QUERY_STRING", "UT.ART_ID", "UT.SESSION_ID", "UT.LAT", "UT.LNG") delimiters(",") quote-pairs('""') flags(escape-double-char, strip-whitespace) ); }; parser p_geocode { csv-parser( columns("GEO.QTIME", "GEO.IP", "GEO.REQUEST_ID", "GEO.CATEGORY", "GEO.MYLEVEL", "GEO.NAME", "GEO.PLACE", "GEO.LAT", "GEO.LNG") delimiters(",") quote-pairs('""') flags(escape-double-char, strip-whitespace) ); }; #filter f_filter1 { facility(kern); }; filter f_filter2 { level(info..emerg) and not facility(mail,authpriv,cron); }; filter f_filter3 { facility(authpriv); }; filter f_filter4 { facility(mail); }; filter f_filter5 { level(emerg); }; filter f_filter6 { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_filter7 { facility(local7); }; filter f_filter8 { facility(cron); }; filter f_obsidian { program("^obsidian$") and level(info); }; filter f_ut_access { filter(f_obsidian) and message("root\.ut_access"); }; filter f_geocode { filter(f_obsidian) and message("root\.geocode"); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_auth); }; log { source(s_sys); filter(f_filter4); destination(d_mail); }; log { source(s_sys); filter(f_filter5); destination(d_mlal); }; log { source(s_sys); filter(f_filter6); destination(d_spol); }; log { source(s_sys); filter(f_filter7); destination(d_boot); }; log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_sys); filter(f_ut_access); parser(p_ut_access); destination(d_ut_access); }; ### With this log entry commented out, logging to d_ut_access works. But if I uncomment it, nothing is logged to d_ut_access! ### What am I missing? #log { #source(s_sys); #filter(f_geocode); #parser(p_geocode); #destination(d_geocode); #}; log { source(s_sys); filter(f_obsidian); destination(d_obsidian); }; -- Liam Kirsher PGP: http://liam.numenet.com/pgp/

2 7

Re: [syslog-ng] File descriptor leaks with 3.0.1
by chris packham 01 Mar '09

01 Mar '09

On Sat, 2009-02-28 at 14:56 +0100, Balazs Scheidler wrote: > On Fri, 2009-02-27 at 11:02 +1300, chris packham wrote: > > Ping. Any interest in this? > > > > Should I submit something into bugzilla? Write a test case? Send the > > patch as a separate email? > > I've already integrated this. Sorry for having taken so long. I was > distracted by other things. I completely understand. Just wanted to make sure I hadn't missed a reply that was waiting for me to do something.

1 0

creating new facility
by gatfi sami 28 Feb '09

28 Feb '09

hi i am a student i installed 1.6.12-76.2 i am asked to create a new costumised facility ( newfacility ) in bothe syslog-ng cient and server for exemple so Errorlog syslog:newfacility ( in /etc/apache2/mod_log.conf.config) is it possible another thing please if not i use local 1 (Errorlog syslog:local1) if i send mysql error log also in local1 can i seperate them in different destination ( file )on my syslogserver. thkx

1 0

[Bug 35] New: syslog-ng crashes with a certain .conf
by bugzilla＠bugzilla.balabit.com 28 Feb '09

28 Feb '09

https://bugzilla.balabit.com/show_bug.cgi?id=35 Summary: syslog-ng crashes with a certain .conf Product: syslog-ng Version: 3.0.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi(a)balabit.hu ReportedBy: tek(a)serverop.de Type of the Report: bug Estimated Hours: 0.0 Created an attachment (id=13) --> (https://bugzilla.balabit.com/attachment.cgi?id=13) example syslog-ng.conf that produces the segfault If syslog-ng is started ./syslog-ng -f /etc/syslog-ng/syslog-ng.conf --pidfile=/tmp/foo.pid then it will segfault: Feb 28 00:13:50 basra kernel: syslog-ng[2974]: segfault at bf418ffc ip b7ca9cc3 sp bf419000 error 6 in libc-2.8.so[b7c01000+130000] If the 31th line is uncommented, syslog-ng starts just fine. # ./syslog-ng -V syslog-ng 3.0.1 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.0#master#93a342dae3a2b0cb15811d0c34ea7f58b3fba14e Compile-Date: Feb 27 2009 23:56:41 Enable-Threads: off Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-Sun-Door: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-SSL: on Enable-SQL: off Enable-Linux-Caps: on Enable-Pcre: on -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

1 1

Re: [syslog-ng] File descriptor leaks with 3.0.1
by chris packham 28 Feb '09

28 Feb '09

Ping. Any interest in this? Should I submit something into bugzilla? Write a test case? Send the patch as a separate email? On Tue, 2009-02-17 at 09:58 +1300, chris packham wrote: > On Mon, 2009-02-16 at 15:52 +1300, chris packham wrote: > > Also seems to be present in the latest version checked out from the git repo but I'll do some more digging. > > > > I've confirmed that this does indeed happen on the latest version from > the git repo. I've attached a patch that addresses this. Looks like the > 'include' implementation assumes that yy_switch_to_buffer closes the old > file (which flex 2.5.33 doesn't, I haven't tried other versions). > > ______________________________________________________________________________ > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng > Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng > FAQ: http://www.campin.net/syslog-ng/faq.html >

2 1